WO2019119860A1 - 暴力破解攻击的检测方法和相关装置 - Google Patents
暴力破解攻击的检测方法和相关装置 Download PDFInfo
- Publication number
- WO2019119860A1 WO2019119860A1 PCT/CN2018/102881 CN2018102881W WO2019119860A1 WO 2019119860 A1 WO2019119860 A1 WO 2019119860A1 CN 2018102881 W CN2018102881 W CN 2018102881W WO 2019119860 A1 WO2019119860 A1 WO 2019119860A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- session information
- probability value
- markov chain
- chain
- historical
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/29—Graphical models, e.g. Bayesian networks
- G06F18/295—Markov models or related models, e.g. semi-Markov models; Markov random fields; Networks embedding Markov models
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1433—Vulnerability analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
Definitions
- the present application relates to the field of computers and, more particularly, to methods of detecting brute force attacks, network devices, and computer readable storage media.
- cloud servers exposed to the public network environment face a large number of attacks every day.
- password brute force attacks against application services deployed on cloud servers are the most common.
- the so-called brute force attack means that the attacker performs an exhaustive scan of the passwords of these application services. If the password configured by the user is not strong enough, it is easily hit by the attacker's password dictionary. In other words, the passwords of these application services are easily cracked.
- the password of the application service is cracked, and the attacker can illegally access the application service, which will cause the user's data to leak, and even the application server is controlled by the attacker. Therefore, detecting brute force attacks is very necessary for the security of cloud servers.
- the present application provides a detection method and related device for a brute force attack, which is helpful for detecting a brute force attack.
- the present application provides a method for detecting a brute force attack.
- the detecting method includes: the network device acquiring the mirrored traffic to be detected between the client and the server; the network device acquiring the first session information sequence according to the mirrored traffic to be detected, where the first session information sequence includes multiple sessions Information, the plurality of session information is in one-to-one correspondence with the multiple login session initiated by the client to the server by using the to-be-detected mirrored traffic, where the multiple session information is in the first session information sequence.
- the network device uses the first session information sequence as a first Markov chain, and acquires a state chain of the first Markov chain a probability value, wherein each session information in the first session information sequence is a state in the first Markov chain; and the network device is based on a state chain probability value of the first Markov chain And determining, by the first reference probability value, whether the multiple login session is a brute force attack, and the first reference probability value is used to identify a brute force attack.
- the plurality of session information of the multiple login session is regarded as a Markov chain, and the state chain probability value of the Markov chain is calculated, and according to the state chain probability value, whether the multiple login session is violent is determined. Crack the attack. That is to say, in the detection method, the judgment problem of the brute force attack is converted into a probability problem, and whether the login session is a brute force attack according to the probability is helpful to detect the brute force attack.
- each session information is a sum of a length of a message carrying a username and a password in a corresponding login session and a length of a message carrying the authentication result.
- the determining, according to the attack probability threshold and the first state chain probability, whether the multiple login session to be detected is a brute force attack comprises: if the first state chain probability is greater than Or equal to the attack probability threshold, determining that the multiple login session to be detected is a brute force attack.
- the network device determines, according to the state chain probability value of the first Markov chain and the first reference probability value, whether the multiple login session is a brute force attack, including: If the state chain probability value of the first Markov chain is less than or equal to the first reference probability value, the network device determines that the multiple login session is a brute force attack; or if the first Markov chain The network device determines that the multiple login session is a brute force attack.
- the difference between the state chain probability value and the first reference probability value is less than or equal to a pre-configured threshold.
- the state chain probability value of the first Markov chain is determined according to an initial probability value of the first Markov chain and a transition probability value of the first Markov chain.
- the detecting method further includes: the network device acquiring historical mirrored traffic between the client and the server, where the network device obtains the mirrored traffic to be detected between the client and the server; The device obtains a second session information sequence according to the historical mirrored traffic, where the second session information sequence includes a plurality of historical session information, and the plurality of historical session information and the client transmit the mirrored traffic through the history.
- the network device uses the second session information sequence as the second Markov chain, and acquires an initial probability value of the second Markov chain and the first a transition probability value of the second Markov chain, wherein each of the historical session information in the second session information sequence is used as the second A state Volkov chain.
- the initial probability and transition probability of the second Markov chain are obtained according to the historical mirrored traffic, and then the initial probability and transition probability of the first Markov chain are determined according to the initial probability and transition probability of the second Markov chain. It helps to improve the accuracy of the initial probability and transition probability of the first Markov chain, thus helping to improve the detection accuracy of brute force attacks.
- the detecting method before the network device acquires the mirrored traffic to be detected between the client and the server, the detecting method further includes: acquiring, by the network device, a state chain probability of the second Markov chain value;
- the network device determines the first reference probability value according to a state chain probability value of the second Markov chain.
- the first reference probability value can be obtained by the transition probability of the second Markov chain. This helps to improve the accuracy of the state chain probability threshold, which helps to improve the detection accuracy of brute force attacks.
- the network device determines the first reference probability value according to the state chain probability value of the second Markov chain, including: the network device uses the second Markov chain The state probability value is taken as the first reference probability value.
- the network device determines, according to the state chain probability value of the first Markov chain and the first reference probability value, that the multiple login session is a brute force attack.
- the detecting method further includes: determining, by the network device, whether the brute force attack initiated by the multiple login session is successful according to the second reference probability value and the state chain probability value of the first Markov chain, The second baseline probability value is used to identify the brute force attack of the successful attack.
- the second reference probability value is determined according to the state chain probability value of the third Markov chain in the case where the third session information sequence is used as the third Markov chain.
- the third session information sequence includes a plurality of historical session information, and the plurality of historical session information included in the third session information sequence and the plurality of historical login sessions between the client and the server are in one-to-one correspondence.
- the plurality of historical login sessions corresponding to the plurality of historical session information included in the third session information sequence are successful brute force attacks, and each historical session information in the third session information sequence is used as the third Marco a state in the chain of links, the order in which the plurality of historical session information included in the third session information sequence is arranged in the third session information sequence corresponds to the plurality of historical session information included in the third session information sequence
- the multiple historical login sessions occur in the same order of time.
- the present application provides a network device having a function of implementing the above detection method or design.
- the functions may be implemented by hardware or by corresponding software implementation by hardware.
- the hardware or software includes one or more modules corresponding to the above functions.
- a processor, a communication interface, and a memory the memory stores related instructions, the communication interface performs data transmission with other network devices, and the processor executes instructions in the memory to complete various steps in the upper detection method or design.
- the present application provides a computer readable storage medium.
- Program code for execution of the network device is stored in the computer readable storage medium.
- the program code includes instructions for performing the detection method of any of the first aspect or the first aspect.
- the present application provides a computer program product comprising instructions.
- the network device can be caused to perform the detection method of any one of the first aspect or the first aspect.
- the present application provides a system chip, including an input/output interface, at least one processor, at least one memory, and a bus, the at least one memory is configured to store an instruction, and the at least one processor is configured to invoke the at least one A memory instruction to perform the operation of the detection method of the first aspect or any of the designs.
- FIG. 1 is a schematic structural diagram of a network system to which a detection method of an embodiment of the present application is applied;
- FIG. 2 is a schematic structural diagram of a network device according to an embodiment of the present application.
- FIG. 3 is a schematic flowchart of a detection method of an embodiment of the present application.
- FIG. 4 is a schematic diagram of mirrored traffic according to an embodiment of the present application.
- FIG. 5 is a schematic flowchart of a detection method according to an embodiment of the present application.
- FIG. 6 is a schematic diagram of mirrored traffic according to an embodiment of the present application.
- FIG. 7 is a schematic diagram of mirrored traffic according to an embodiment of the present application.
- FIG. 8 is a schematic diagram of mirrored traffic according to an embodiment of the present application.
- FIG. 9 is a schematic flowchart of a detection method according to an embodiment of the present application.
- FIG. 10 is a schematic flowchart of a detection method according to an embodiment of the present application.
- FIG. 11 is a schematic structural diagram of a network device according to an embodiment of the present application.
- FIG. 1 is a schematic structural diagram of a network system to which a method for detecting a brute force attack according to an embodiment of the present application is applied. It should be understood that the embodiment of the present application is not limited to the system architecture shown in FIG. 1. In addition, the device in FIG. 1 may be hardware, functionally divided software, or a combination of the two.
- the network system shown in FIG. 1 may include a server 110, a message forwarding device 120, and a client 130.
- the server 110 may be various application servers such as a web server, a File Transfer Protocol (FTP) server, a game server, an e-commerce server, and the like.
- Clients 130 may be various application clients implemented in software, such as browsers, game clients, and the like.
- the message forwarding device 120 may be a network device having a message forwarding function, such as a switch, a firewall, a router, and the like.
- the application service provider provides an application service to the user through the message transmitted between the server 110 and the client 130.
- the message transmitted between the server 110 and the client 130 is forwarded via the message forwarding device 120.
- the number of the server 110, the packet forwarding device 120, and the client 130 shown in FIG. 1 is only an example, and the number of the server 110, the packet forwarding device 120, and the client 130 in the network system is No restrictions.
- the packet forwarding device 120 For the structure of the server 110, the packet forwarding device 120, and the client 130, reference may be made to the structure of the server, the packet forwarding device, and the client in the prior art, and details are not described herein again.
- the login process includes the following basic steps: the client 130 sends an authentication request packet to the server 110, and the authentication request packet carries the username and password. After receiving the authentication request from the client 130, the server 110 encrypts the password and database in the authentication request packet. The passwords corresponding to the user names saved in the comparison are compared. If the two are consistent, the authentication is successful, otherwise the authentication fails, and the authentication is completed. After the server 110 authenticates the username and the password, the server 110 can send an authentication response packet to the client 130. The authentication response packet indicates the authentication result, and the authentication result is that the authentication succeeds or the authentication fails.
- the server 110 can provide services to the client 130.
- the client 130 can be said to be successfully logged in.
- the server 110 fails to authenticate, the server 110 refuses to provide service to the client 130. In this case, it can be said that the client 130 fails to log in.
- the packet interaction process of transmitting the authentication request message from the client 130 to the server 110 to the server 110 and returning the corresponding authentication response message to the client 130 may be referred to as a login session.
- the protocol that carries the authentication request and the authentication response may be referred to as an authentication protocol for the login session.
- An example of an authentication protocol for a login session is the Secure Shell (SSH) protocol.
- SSH uses an encrypted channel to protect the user name and password transmitted during the login process. This improves the security of the login process and prevents unauthorized transmission of user names and passwords in plain text. On the other hand, however, it is because of the use of encrypted channels, it also increases the difficulty of identifying brute force attacks.
- the address of the client 130 may be referred to as the source address of the login session, that is, the client 130 sends the source address of the authentication request message to the server; the client 130 sends the authentication request message to the server 110.
- a port may be referred to as a source port of a login session; an address of the server 110 may be referred to as a destination address of the login session, and a port on the server 110 that receives the authentication request message and sends the authentication response message may be referred to as a destination port of the login session.
- IP internet protocol
- the client 130 as an attacker can initiate multiple login sessions to the server 110 by exhausting the user password to log in to the server 110.
- the source address, the destination address, the destination port, and the login session with the same authentication protocol may be referred to as an attack event.
- the attack event can include one or more attack procedures.
- Each login process includes a login session for the login session included in the attack event, and the source port has the same login session. In other words, the quintuple of the login session included in each attack process is the same.
- Each attack process can also be called a brute force attack.
- the brute force attack can be called a successful brute force attack.
- This application proposes a method for detecting brute force attacks and a method for detecting whether a brute force attack is successful.
- the detection method can be performed by the network device 140 of FIG.
- a schematic structure of network device 140 is shown in FIG.
- network device 140 can include a processor 141, a memory 142, and a communication interface 143.
- the communication interface 143 can be used to obtain mirrored traffic between the client 130 and the server 110 from the message forwarding device 120.
- the memory 142 can be used to store program code executed by the processor 141, mirrored traffic acquired from the message forwarding device, and detection results, etc.; the processor 141 is configured to execute program code stored in the memory 142, and according to the image stored in the memory 142. Information such as traffic is detected by brute force attacks, and even whether the brute force attack is successful.
- network device 140 may also include display 144.
- the display 144 is used to display relevant information in the process of the processor 141 detecting a brute force attack. For example, display 144 can display whether the login session between client 130 and server 110 is a brute force attack.
- the main idea of the detection method proposed in the present application may include: treating the session information of each login session as a state in the Markov chain, and time-consuming multiple session information corresponding to the multiple login session according to the time of the multiple login session. Sorting sequentially, and using the sorted session information sequence as a Markov chain, calculating the state chain probability value of the Markov chain, and determining whether the multiple login sessions are violent according to the state chain probability value. Crack the attack.
- the session information used to describe a login session in the embodiment of the present application refers to information that can be quantized or quantified in the traffic generated by the login session.
- the session information of the login session may be the sum of the lengths of multiple messages in the login session.
- a packet included in a plurality of packets may be a packet sent by a client and carrying a username and a password, such as an authentication request packet, and another packet may be sent by the server and carried the authentication result. Messages, such as authentication response messages.
- the frequency or time interval of information interaction in the login session may be used as the session information of the login session.
- FIG. 3 is a schematic flowchart of a method for detecting a brute force attack according to an embodiment of the present application. It should be understood that FIG. 3 illustrates steps or operations of the detection method, but these steps or operations are merely examples, and other embodiments of the present application may also perform other operations or variations of the operations in FIG.
- the detection method shown in FIG. 3 may include S310, S320, and S330.
- the detection method shown in FIG. 3 can be performed by network device 140.
- the network device acquires the mirrored traffic to be detected between the client and the server.
- the network device uses the port mirroring function of the packet forwarding device to obtain the total mirrored traffic related to the designated port of the server within a time period from the packet forwarding device 120 according to the IP address of the server 110 and the port number of the open application service. Then, the address information of the peer device that interacts with the server on the port is obtained, and the address information includes an IP address and a port number. The address information of each peer device is used as the address information of the client, and a client and a server are filtered out from the total mirrored traffic according to the quintuple (ie, the source address, the destination address, the source port, the destination port, and the authentication protocol). Mirror traffic to be detected.
- the quintuple ie, the source address, the destination address, the source port, the destination port, and the authentication protocol.
- the network device acquires a first session information sequence according to the mirrored traffic to be detected, where the first session information sequence includes multiple session information.
- the plurality of session information in the first session information sequence is in one-to-one correspondence with the multiple login sessions initiated by the client through the mirrored traffic to be detected, and the sequence and the sequence information of the plurality of session information in the first session information sequence are The time sequence in which multiple login sessions occur is the same.
- An implementation manner of the network device acquiring the first session information sequence according to the mirrored traffic to be detected is as follows.
- the network device sequentially obtains session information of each login session initiated by the client 130 to the server 110 from the mirrored traffic to be detected according to the time of the login session.
- the client 130 initiates multiple login sessions to the server 110 through the mirrored traffic to be detected, and the network device can obtain multiple session information from the mirrored traffic to be detected.
- the number of session information is the same as the number of login sessions, and multiple session information is in one-to-one correspondence with multiple login sessions.
- the network device obtains the corresponding session information in the order of the time when the login session occurs. Therefore, the sequence of the multiple session information acquired by the network device is consistent with the chronological sequence of the multiple login sessions.
- the plurality of session information acquired in the above manner is sorted to generate a first session information sequence.
- the first session sequence may also be obtained by other means. For example, after acquiring a plurality of session information from the mirrored traffic to be detected, the network device sorts the multiple session information according to the chronological order in which the multiple login sessions occur, to obtain a first session information sequence.
- the multiple login session is in one-to-one correspondence with the plurality of session information, and the order of the multiple session information in the first session information sequence is the same as the time sequence of the multiple login sessions.
- FIG. 4 is a schematic diagram of mirrored traffic including multiple login session related packets according to an embodiment of the present application.
- the mirrored traffic shown in Figure 4 includes 24 information, which are sorted in chronological order. Each line of information indicates a packet exchanged between the client and the server.
- the first column is the IP address of the packet sender
- the second column is the IP address of the packet receiving end
- the third column is the protocol name of the packet. It is listed as some information obtained by parsing the packet header.
- the information includes the source port number, the destination port number, the packet type identifier, the sequence number of the packet, the packet length, the timestamp value (Timestamp Value, TSval), and the timestamp. Response field (Timestamp Echo Reply field, TSecr) and so on.
- a single login session consists of three consecutive message interactions.
- the first interaction message in a login session is an authentication request packet sent by the client to the server.
- the authentication request packet can include a username and password.
- the second exchange message in a login session is that the server sends an acknowledgment message to the client, and the acknowledgment message is used to indicate that the server has received the username and password.
- the third interaction message in the login session is that the server sends an authentication response packet to the client to notify the client that the authentication succeeds or the authentication fails.
- the client initiated eight login sessions to the server.
- the source address of the login session is the client's IP address "192.168.13.158”
- the destination address is the client's IP address "192.168.13.150”
- the source port is the client port "36358”
- the destination port is "22"
- the authentication protocol Is "SSH”.
- the source address, the destination address, the source port, and the destination port of the eight login sessions are the same. Therefore, the session information of each login session can be obtained in sequence, thereby obtaining the first session information sequence.
- the first session information sequence composed of the eight session information corresponding to the eight login sessions is: 184-184-184-184-184-184-136.
- the network device uses the first session information sequence as the first Markov chain, and obtains a state chain probability value of the first Markov chain, where each session information in the first session information sequence is used as the first Marco. A state in the chain.
- the state chain probability value of the first Markov chain may be obtained according to the initial probability value and the transition probability value of the first Markov chain.
- an initial probability value and a transition probability value of the first Markov chain may be stored in the network device.
- the length of the first Markov chain is expressed as n 1
- the initial probability value of the first Markov chain is expressed as p 0
- the probability value of the transition from the i-th state to the i+1th state in the first Markov chain Expressed as p ij
- each session information as a state, and using the first session information sequence "184-184-184-184-184-184-184-136" obtained in S320 as the first Markov chain, then
- the initial state in a Markov chain is 184
- the first Markov chain includes seven state transitions
- the first six is 184 to 184
- the seventh is 184 to 136.
- the state chain probability value of the first Markov chain can be calculated as:
- the network device determines, according to the state chain probability value of the first Markov chain and the first reference probability value, whether the multiple login session is a brute force attack, and the first reference probability value is used to identify the brute force attack.
- a first reference probability value may be stored in the network device.
- the network device determines, according to the state chain probability value of the first Markov chain and the first reference probability value, whether the multiple login session is a brute force attack, and the method may include: the network device adopts the first Marco The state chain probability value of the chain is compared with the first reference probability value; if the state chain probability value of the first Markov chain is less than or equal to the first reference probability value, the network device determines that the multiple login session is a brute force attack .
- the network device can determine that the eight login sessions included in FIG. 4 are brute force attacks.
- the network device may sequentially compare the state chain probability values of the first Markov chain with the plurality of first reference probability values. As long as the state chain probability value of the first Markov chain is less than or equal to any of the plurality of first reference probability values, the network device can determine that the multiple login sessions are brute force attacks.
- the network device determines, according to the state chain probability value of the first Markov chain and the first reference probability value, whether the multiple login session is a brute force attack, and the method may include: the network device will be the first Mar The state chain probability value of the Koff chain is subtracted from the first reference probability value to obtain a difference between the two; if the difference is less than or equal to the pre-configured threshold, the network device determines that the multiple login session is a brute force attack.
- the network device may subtract the state chain probability values of the first Markov chain from the plurality of first reference probability values, respectively. As long as any difference obtained by subtraction is less than or equal to a pre-configured threshold, the network device can determine that the multiple login sessions are brute force attacks.
- the initial probability value and the transition probability value used to calculate the state chain probability value of the first Markov chain in S330 may be manually preset, or may be a network device according to the relationship between the client 130 and the server 110. Historical mirrored traffic acquired.
- FIG. 5 is a schematic flowchart of a method for a network device to obtain an initial probability value and a transition probability value according to a historical mirrored traffic. It should be understood that FIG. 5 illustrates the steps or operations of the method, but the steps or operations are merely examples, and the embodiments of the present application may perform other operations or variations of the operations in FIG. 5.
- the method illustrated in FIG. 5 may include S510, S520, and S530.
- the method can be performed by network device 140.
- S510 The network device acquires historical mirrored traffic between the client and the server.
- Historical mirrored traffic means that the mirrored traffic was generated before S310.
- the network device acquires a second session information sequence according to the historical mirrored traffic.
- the second session information sequence includes multiple historical session information, and multiple historical session information and multiple historical login sessions initiated by the client to the server through historical mirrored traffic.
- One-to-one correspondence the order of the plurality of historical session information in the second session information sequence is consistent with the chronological order in which the plurality of historical login sessions occur.
- multiple historical login sessions were determined as brute force attacks.
- Historical mirror traffic here can also be viewed as sample traffic for manually calibrated brute force attacks.
- the historical login session refers to a login session initiated by the client 130 to the server 110 prior to S310.
- the history session information indicates session information of a historical login session.
- the login session initiated by the historical mirrored traffic to the server is the historical login session.
- the session information obtained from the historical mirrored traffic is the historical session information.
- the network device can refer to S320, and details are not described herein.
- the network device can obtain three second session information sequences according to the implementation manner described in S320, and the three second session information sequences are Figure 6, Figure 7, and Figure 8 correspond one-to-one.
- the attacker initiated seven login sessions through the mirrored traffic shown in Figure 6, and initiated six login sessions through the mirrored traffic shown in Figure 7, and initiated seven login sessions through the mirrored traffic shown in Figure 8.
- the second session information sequence consisting of seven session information of the seven login sessions corresponding to FIG. 6 is: 184-184-184-184-184-184; the six session information of the six login sessions corresponding to FIG. 7 is composed of The second session information sequence is: 184-184-184-184-184; the second session information sequence consisting of seven session information of the seven login sessions corresponding to FIG. 8 is: 184-184-184-184-184-184-136.
- the network device uses the second session information sequence as the second Markov chain, and obtains an initial probability value of the second Markov chain and a transition probability value of the second Markov chain, where the second session information sequence is used.
- Each of the historical session information is a state in the second Markov chain.
- An implementation manner in which the network device acquires the second Markov chain transition probability value is as follows.
- n*n state transition probability values can be obtained from all second Markov chains.
- the state transition value matrix P composed of the n*n state transition probability values is expressed as:
- p ij represents the transition probability of the transition from the i-th state to the j-th state in the n states
- i and j are positive integers less than or equal to n.
- p 2 represents the total number of transitions from the sth state to the tth state in all second Markov chains
- p 1 represents the total number of states in all second Markov chains
- x represents all The number of second Markov chains in the second Markov chain with the t-th state as the initial state.
- Network devices can pass formulas Get the initial probability values for each state in all second Markov chains.
- the probability value of the transition from "184" to "184" can be calculated.
- the probability value of "184" to "136” can be calculated.
- the probability value of the transfer of "136” to "184” The probability value of the transfer of "136" to "136"
- the state transition value matrix P is:
- the initial probability value and the state transition value of the first Markov chain may be obtained according to the initial probability value and the state transition value.
- the initial probability value of the second Markov chain can be used as the initial probability value of the first Markov chain
- the transition probability value of the second Markov chain can be taken as the transition probability value of the first Markov chain.
- the first reference probability value used in S340 may be determined according to a state chain probability value of the second Markov chain.
- the network device can also perform S540 and S550.
- the network device acquires a state chain probability value of the second Markov chain.
- the S550 network device determines a first reference probability value based on a state chain probability value of the second Markov chain.
- the state chain probability value of the second Markov chain may be used as the first reference probability value.
- the state chain probability value of the state chain probability values of the plurality of second Markov chains may be used as the first reference probability value.
- the second session information sequence "184-184-184-184-184-184-184" corresponding to FIG. 6 is used as the second Markov chain
- the state chain probability value of the second Markov chain is
- the second session information sequence "184-184-184-184-184" corresponding to FIG. 7 is taken as the second Markov chain
- the state chain probability value of the Markov chain is
- the second session information sequence "184-184-184-184-136" corresponding to FIG. 8 is taken as the second Markov chain
- the state chain probability value of the second Markov chain is Finally, you can Largest The first benchmark probability value.
- the state chain probability values of the plurality of second Markov chains may be used as the first reference probability value. For example, you can with As three first reference probability values.
- S350 may be further included.
- the network device After determining that the multiple login session is a brute force attack, the network device determines, according to the second reference probability value and the state chain probability value of the first Markov chain, whether the brute force attack initiated by the multiple login session is successful.
- the second baseline probability value is used to identify the brute force attack of the successful attack.
- the second reference probability value may be determined by the network device according to the historical mirrored traffic before S350.
- the network device may obtain a third session information sequence from the historical mirrored traffic, the third session information sequence includes a plurality of historical session information, and the third session information sequence includes a plurality of historical session information and the client and the server.
- the plurality of historical login sessions are in one-to-one correspondence, and the plurality of historical session information included in the third session information sequence is arranged in the third session information sequence and the plurality of historical session information corresponding to the plurality of historical session information included in the third session information sequence
- the time of the conversation takes place in the same order.
- the multiple historical login sessions corresponding to the plurality of historical session information included in the third session information sequence are successful brute force attacks.
- the historical mirrored traffic here can also be viewed as a sample traffic of a manually hacked successful brute force attack.
- the network device may use the third session information sequence as a third Markov chain, and determine a second reference probability value according to the state chain probability value of the third Markov chain.
- each historical session information in the third session information sequence is a state in the third Markov chain.
- the third session information sequence and the second session information sequence may be the same sequence.
- the second session information sequence may be used as the third session information sequence.
- the second session information sequence corresponding to FIG. 8 can be used as the third session information sequence, that is, FIG. 8 State chain probability value of the corresponding second Markov chain "184-184-184-184-184-136" As the second reference probability value.
- the network device determines, according to the second reference probability value and the state chain probability value of the first Markov chain, whether the brute force attack initiated by the multiple login session is successful, and in a possible implementation manner, if the network device determines If the probability value of the state chain of a Markov chain is less than or equal to the second reference probability value, it is determined that the brute force attack initiated by the multiple login session has been successfully attacked.
- the network device determines that the multiple login session is a brute force attack, because the state chain probability of the first Markov chain corresponding to the multiple login session Less than the second base probability value Therefore, the network device can determine that the brute force attack initiated by the multiple login sessions has succeeded.
- the network device determines that the difference between the state chain probability value of the first Markov chain and the second reference probability value is less than or equal to a pre-configured threshold, determining that the multiple login session is initiated. The brute force attack has been successfully attacked.
- the session information of the login session that is successfully logged in is different from the session information of the login session that fails to log in.
- the session information of the login session that failed to log in is 184
- the session information of the login session that is successfully registered is 136.
- S310 in FIG. 3 or FIG. 10, FIG. 5 or S510 in FIG. 9 may be specifically performed by the communication interface 143 of the network device in FIG. 2, FIG. 3 or FIG. S320 to S350 in the same, and S520 to S550 in FIG. 5 or FIG. 9 may be specifically performed by the processor 141 of the network device in FIG. 2.
- the source address of the historical login session in FIGS. 6 to 8 is the same as the source address of the login session in FIG. 4, and the destination address of the historical login session in FIGS. 6 to 8 is the same as the login session in the embodiment in FIG.
- the destination addresses are the same.
- the destination port of the historical login session in FIG. 6 to FIG. 8 is the same as the destination port of the login session in FIG. 4, and the authentication protocol of the historical login session in FIG. 6 to FIG. 8 is the same as the login session in FIG.
- the certification agreement is the same. It should be understood that this is only an embodiment, and the embodiment of the present application is not limited thereto.
- the source address, destination address, source port, destination port, and authentication protocol of the historical login session and the source address, destination address, source port, destination port, and authentication protocol of the login session to be detected may be different in whole or in part.
- FIG. 11 A schematic structural diagram of a network device according to an embodiment of the present application is shown in FIG. It should be understood that the network device 1100 shown in FIG. 11 is only an example, and the network device in the embodiment of the present application may further include other modules or units, or include modules similar to those of the modules in FIG. 11, or not including the figure. All modules in 11.
- the network device 1100 shown in FIG. 11 may include an obtaining module 1110 and a processing module 1120.
- Network device 1100 can be used to perform the steps performed by network device 140 in the detection methods illustrated in any of Figures 3, 5, 9, and 10.
- the obtaining module 1110 can be used to execute S310 in FIG. 3 or FIG. 10, FIG. 5 or S510 in FIG. 9, and the processing module 1120 can be used to execute S320 to S350 in FIG. 3 or FIG. And S520 to S550 in FIG. 5 or FIG.
- the disclosed systems, devices, and methods may be implemented in other manners.
- the device embodiments described above are merely illustrative.
- the division of the unit is only a logical function division.
- there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
- the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
- the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
- each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
- the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product.
- the technical solution of the present application which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including
- the instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application.
- the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Mining & Analysis (AREA)
- Theoretical Computer Science (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Artificial Intelligence (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Biology (AREA)
- Evolutionary Computation (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Life Sciences & Earth Sciences (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Computer And Data Communications (AREA)
Abstract
本申请提供暴力破解攻击的检测方法和相关装置。该检测方法包括:获取客户端与服务器之间待检测的镜像流量;根据待检测的镜像流量获取第一会话信息序列,第一会话信息序列包括多个会话信息,多个会话信息与多次登录会话一一对应,多个会话信息在第一会话信息序列中的排列顺序与多次登录会话发生的时间先后顺序一致;将第一会话信息序列作为第一马尔科夫链,获取第一马尔科夫链的状态链概率值,第一会话信息序列中的每一个会话信息作为第一马尔科夫链中的一个状态;根据第一马尔科夫链的状态链概率值和第一基准概率值,确定多次登录会话是否为暴力破解攻击。本申请提供的暴力破解攻击的检测方法和相关装置,有助于检测出暴力破解攻击。
Description
本申请要求于2017年12月18日提交中国专利局、申请号为201711365840.8、申请名称为“暴力破解攻击的检测方法和相关装置”的中国专利申请的优先权,其全部内容通过引用结合在本申请中。
本申请涉及计算机领域,并且更具体地,涉及暴力破解攻击的检测方法、网络设备和计算机可读存储介质。
在云计算环境中,暴露在公网环境中的云服务器,每天都面临着大量的攻击。其中,以针对云服务器上部署的应用服务进行的密码暴力破解攻击最为常见。
所谓暴力破解攻击,是指攻击者对这些应用服务的密码进行穷举式扫描。如果用户配置的密码强度不够,则很容易被攻击者的密码字典命中。也就是说,这些应用服务的密码很容易被破解。
应用服务的密码被破解,攻击者就可以非法访问应用服务,这将导致用户的数据泄露,甚至应用服务器被攻击者控制。因此,检测暴力破解攻击对云服务器的安全而言是非常需要的。
发明内容
本申请提供一种暴力破解攻击的检测方法和相关装置,有助于检测出暴力破解攻击。
第一方面,本申请提供了一种暴力破解攻击的检测方法。该检测方法包括:网络设备获取客户端与服务器之间待检测的镜像流量;所述网络设备根据所述待检测的镜像流量获取第一会话信息序列,所述第一会话信息序列包括多个会话信息,所述多个会话信息与所述客户端通过所述待检测的镜像流量向所述服务器发起的多次登录会话一一对应,所述多个会话信息在所述第一会话信息序列中的排列顺序与所述多次登录会话发生的时间先后顺序一致;所述网络设备将所述第一会话信息序列作为第一马尔科夫链,并获取所述第一马尔科夫链的状态链概率值,其中,所述第一会话信息序列中的每一个会话信息作为所述第一马尔科夫链中的一个状态;所述网络设备根据所述第一马尔科夫链的状态链概率值和第一基准概率值,确定所述多次登录会话是否为暴力破解攻击,所述第一基准概率值用于识别暴力破解攻击。
该检测方法中,将多次登录会话的多个会话信息看作马尔科夫链,计算该马尔科夫链的状态链概率值,并根据该状态链概率值判断这多次登录会话是否为暴力破解攻击。也就是说,该检测方法中,将暴力破解攻击的判断问题转换为概率问题,根据概率判断登录会话是否为暴力破解攻击,有助于有检测出暴力破解攻击。
在一种可能的设计中,所述每一个会话信息为对应的登录会话中携带用户名和密码的 报文的长度和携带认证结果的报文的长度之和。
在一种可能的设计中,所述根据攻击概率阈值和所述第一状态链概率,确定所述待检测的多次登录会话是否为暴力破解攻击,包括:若所述第一状态链概率大于或等于所述攻击概率阈值,确定所述待检测的多次登录会话为暴力破解攻击。
在一种可能的设计中,所述网络设备根据所述第一马尔科夫链的状态链概率值和第一基准概率值,确定所述多次登录会话是否为暴力破解攻击,包括:若所述第一马尔科夫链的状态链概率值小于或等于所述第一基准概率值,则所述网络设备确定所述多次登录会话为暴力破解攻击;或若所述第一马尔科夫链的状态链概率值与所述第一基准概率值的差值小于或等于预先配置的阈值,则所述网络设备确定所述多次登录会话为暴力破解攻击。
在一种可能的设计中,所述第一马尔科夫链的状态链概率值是根据所述第一马尔科夫链的初始概率值和所述第一马尔科夫链的转移概率值确定的。
其中,所述网络设备获取客户端与服务器之间待检测的镜像流量之前,所述检测方法还包括:所述网络设备获取所述客户端与所述服务器之间历史的镜像流量;所述网络设备根据所述历史的镜像流量获取第二会话信息序列,所述第二会话信息序列包括多个历史会话信息,所述多个历史会话信息与所述客户端通过所述历史的镜像流量向所述服务器发起的多次历史登录会话一一对应,所述多个历史会话信息在所述第二会话信息序列中的排列顺序与所述多次历史登录会话发生的时间先后顺序一致,并且所述多次历史登录会话为暴力破解攻击;所述网络设备将所述第二会话信息序列作为所述第二马尔科夫链,并获取所述第二马尔科夫链的初始概率值和所述第二马尔科夫链的转移概率值,其中,将所述第二会话信息序列中的每一个历史会话信息作为所述第二马尔科夫链中的一个状态。
所述网络设备确定所述第一马尔科夫链的初始概率值为所述第二马尔科夫链的初始概率值,所述第一马尔可夫链的转移概率值为所述第二马尔科夫链的转移概率值
该设计中,根据历史的镜像流量得到第二马尔科夫链的初始概率和转移概率,再根据第二马尔科夫链的初始概率和转移概率确定第一马尔科夫链的初始概率和转移概率,有助于提高第一马尔科夫链的初始概率和转移概率的准确率,从而有助于提高暴力破解攻击的检测准确率。
在一种可能的设计中,所述网络设备获取客户端与服务器之间待检测的镜像流量之前,所述检测方法还包括:所述网络设备获取所述第二马尔科夫链的状态链概率值;
所述网络设备根据所述第二马尔科夫链的状态链概率值确定所述第一基准概率值。
该设计中,第一基准概率值可以通过第二马尔科夫链的转移概率得到。这有助于提高状态链概率阈值的准确率,从而有助于提高暴力破解攻击的检测准确率。
在一种可能的设计中,所述网络设备根据所述第二马尔科夫链的状态链概率值确定所述第一基准概率值,包括:所述网络设备将所述第二马尔科夫链的状态概率值作为所述第一基准概率值。
在一种可能的设计中,所述网络设备根据所述第一马尔科夫链的状态链概率值和所述第一基准概率值,确定所述多次登录会话为暴力破解攻击的情况下,所述检测方法还包括:所述网络设备根据第二基准概率值和所述第一马尔科夫链的状态链概率值,确定所述多次登录会话发起的暴力破解攻击是否攻击成功,所述第二基准概率值用于识别攻击成功的暴力破解攻击。
在一种可能的设计中,所述第二基准概率值是将第三会话信息序列作为第三马尔科夫 链的情况下,根据所述第三马尔科夫链的状态链概率值确定的,其中,所述第三会话信息序列包括多个历史会话信息,所述第三会话信息序列包括的多个历史会话信息与所述客户端和所述服务器之间的多次历史登录会话一一对应,所述第三会话信息序列包括的多个历史会话信息对应的多次历史登录会话是成功的暴力破解攻击,所述第三会话信息序列中的每一个历史会话信息作为所述第三马尔科夫链链中的一个状态,所述第三会话信息序列包括的多个历史会话信息在所述第三会话信息序列中的排列顺序与所述第三会话信息序列包括的多个历史会话信息对应的多次历史登录会话发生的时间先后顺序一致。
第二方面,本申请提供了一种网络设备,该网络设备具有实现上述检测方法或设计的功能。所述功能可以通过硬件实现,也可通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个上述功能相对应的模块。比如处理器、通信接口和存储器,该存储器存储相关的指令,通信接口与其他网络设备进行数据传输,处理器执行该存储器中的指令,以完成上检测方法或设计中的各个步骤。
第三方面,本申请提供了一种计算机可读存储介质。该计算机可读存储介质中存储用于网络设备执行的程序代码。该程序代码包括用于执行第一方面或第一方面的任意一种设计中的检测方法的指令。
第四方面,本申请提供了一种包含指令的计算机程序产品。当该计算机程序产品在网络设备上运行时,使得网络设备可以执行第一方面或第一方面的任意一种设计中的检测方法。
第五方面,本申请提供了一种系统芯片,该系统芯片包括输入输出接口、至少一个处理器、至少一个存储器和总线,该至少一个存储器用于存储指令,该至少一个处理器用于调用该至少一个存储器的指令,以进行第一方面或任意一种设计中的检测方法的操作。
图1是应用本申请实施例的检测方法的网络系统的示意性架构图;
图2是本申请实施例的网络设备的示意性结构图;
图3是本申请实施例的检测方法的示意性流程图;
图4是本申请实施例的镜像流量的示意图;
图5是本申请实施例的检测方法的示意性流程图;
图6是本申请实施例的镜像流量的示意图;
图7是本申请实施例的镜像流量的示意图;
图8是本申请实施例的镜像流量的示意图;
图9是本申请实施例的检测方法的示意性流程图;
图10是本申请实施例的检测方法的示意性流程图;
图11是本申请实施例的网络设备的示意性结构图。
下面将结合附图,对本申请中的技术方案进行描述。
图1是应用本申请实施例的暴力破解攻击的检测方法的网络系统的示意性架构图。应理解,本申请实施例并不限于图1所示的系统架构中,此外,图1中的设备可以是硬件, 也可以是从功能上划分的软件或者以上二者的结合。
图1所示的网络系统中可以包括服务器110、报文转发设备120和客户端130。
服务器110可以是各种应用服务器,例如Web服务器、文件传输协议(File Transfer Protocol,FTP)服务器、游戏服务器、电子商务服务器等等。客户端130可以是以软件实现的各种应用客户端,例如浏览器、游戏客户端等等。报文转发设备120可以是具有报文转发功能的网络设备,例如交换机、防火墙、路由器等等。通过服务器110和客户端130之间传输的报文,应用服务提供商向用户提供应用服务。服务器110和客户端130之间传输的报文经由报文转发设备120被转发。
应理解,图1中所示的服务器110、报文转发设备120和客户端130的数量只是示例,本申请实施例对网络系统中的服务器110、报文转发设备120和客户端130的数量并不作限制。
服务器110、报文转发设备120和客户端130的结构可以参考现有技术中的服务器、报文转发设备和客户端的结构,此处不再赘述。
在服务器110和客户端130之间开始传输承载有业务数据的报文之前,客户端130需要先完成登录过程。登录过程包括以下基本步骤:客户端130向服务器110发送认证请求报文,认证请求报文中携带用户名和密码;服务器110从客户端130接收认证请求后,将认证请求报文中的密码和数据库中保存的用户名对应的密码进行比对,如果二者一致则认证成功,否则认证失败,从而完成认证。服务器110对用户名和密码进行认证后,可以向客户端130发送认证响应报文,认证响应报文指示认证结果,认证结果即认证成功或认证失败。
若服务器110认证成功,则服务器110可以为客户端130提供服务。这种情况下,可以称客户端130登录成功。
若服务器110认证失败,则服务器110拒绝为客户端130提供服务。这种情况下,可以称客户端130登录失败。
从客户端130向服务器110发送认证请求报文至服务器110向客户端130返回对应的认证响应报文的报文交互过程可以称为一次登录会话。
承载认证请求和认证响应的协议可以称为登录会话的认证协议。登录会话的认证协议的一种示例为安全外壳(Secure Shell,SSH)协议。SSH采用加密通道对登录过程中传输的用户名和密码进行保护,从而提升登录过程的安全性,防止以明文方式传输用户名和密码被非法截取。然而另一方面,正是由于采用加密通道,也增加了识别暴力破解攻击的难度。
在本申请中,为了简明起见,客户端130的地址可以称为登录会话的源地址,即客户端130向服务器发送认证请求报文的源地址;客户端130向服务器110发送认证请求报文的端口可以称为登录会话的源端口;服务器110的地址可以称为登录会话的目的地址,服务器110上接收认证请求报文以及发送认证响应报文的端口可以称为登录会话的目的端口。
例如,登录会话的源地址的一种示例为客户端130的互联网协议(internet protocol,IP)地址,登录会话的目的地址的一种示例为服务器110的IP地址。
在实施暴力破解攻击时,作为攻击者的客户端130可以通过穷举用户密码的方式向服务器110发起多次登录会话,以登录服务器110。
客户端130在一个时间段内向服务器110发起的所有登录会话中,源地址、目的地址、目的端口和认证协议相同的登录会话可以称为一次攻击事件。该攻击事件可以包括一次或多次攻击过程。每次攻击过程包括的登录会话为该攻击事件包括的登录会话中,源端口相同的登录会话。换句话说,每次攻击过程包括的登录会话的五元组相同。每个攻击过程也可以称为一次暴力破解攻击。
若客户端130向服务器110发起暴力破解攻击后,客户端130成功登录服务器110,则可以称这次暴力破解攻击为成功的暴力破解攻击。
本申请提出了检测暴力破解攻击的方法,以及提出了检测暴力破解攻击是否攻击成功的方法。该检测方法可以由附图1中的网络设备140执行。网络设备140的一种示意性结构如图2所示。
如图2所示,网络设备140可以包括处理器141、存储器142和通信接口143。通信接口143可以用于从报文转发设备120获取客户端130与服务器110之间的镜像流量。存储器142可以用于存储处理器141执行的程序代码、从报文转发设备获取的镜像流量以及检测结果等;处理器141用于执行存储器142中存储的程序代码,以及根据存储器142中存储的镜像流量等信息检测暴力破解攻击,甚至检测该暴力破解攻击是否成功。
可选地,网络设备140还可以包括显示器144。显示器144用于显示处理器141检测暴力破解攻击的过程中的相关信息。例如,显示器144可以显示客户端130与服务器110之间的登录会话是否为暴力破解攻击。
本申请提出的检测方法的主要思想可以包括:将每次登录会话的会话信息当作马尔科夫链中的一个状态,将多次登录会话对应的多个会话信息按照这多次登录会话的时间先后顺序进行排序,并将排序后的会话信息序列当作马尔科夫(Markov)链,计算该马尔科夫链的状态链概率值,根据该状态链概率值判断这多次登录会话是否为暴力破解攻击。
本申请实施例中用于描述一次登录会话的会话信息是指进行该登录会话所产生的流量中,可以量化,或可以数值化的信息。例如,登录会话的会话信息可以是该登录会话中多个报文的长度之和。多个报文中包括的一种报文可以是由客户端发送的、携带了用户名和密码的报文,例如认证请求报文,另一种报文可以是由服务器发送的、携带了认证结果的报文,如认证响应报文。又如,可以将登录会话中信息交互的频率或时间间隔等作为该登录会话的会话信息。
图3为本申请实施例提供的一种暴力破解攻击的检测方法的示意性流程图。应理解,图3示出了检测方法的步骤或操作,但这些步骤或操作仅是示例,本申请实施例还可以执行其他操作或者图3中的各个操作的变形。
图3所示的检测方法可以包括S310、S320和S330。图3所示的检测方法可以由网络设备140执行。
S310,网络设备获取客户端与服务器之间待检测的镜像流量。
例如,网络设备根据服务器110的IP地址和开放应用服务的端口号,利用报文转发设备的端口镜像功能,从报文转发设备120获取一个时间段内服务器指定端口有关的总的镜像流量。然后获得与服务器上述端口存在报文交互的对端设备的地址信息,地址信息包括IP地址和端口号。将每个对端设备的地址信息作为客户端的地址信息,依据五元组(即源地址、目的地址、源端口、目的端口和认证协议)从总的镜像流量中筛选出一个客户端与服务器之间的待检测的镜像流量。
S320,网络设备根据待检测的镜像流量获取第一会话信息序列,第一会话信息序列包括多个会话信息。第一会话信息序列中的多个会话信息与客户端通过待检测的镜像流量向服务器发起的多次登录会话一一对应,所述多个会话信息在第一会话信息序列中的排列顺序与所述多次登录会话发生的时间先后顺序一致。
网络设备根据待检测的镜像流量获取第一会话信息序列的一种实现方式如下。
网络设备按照登录会话的发生时间从前往后的顺序,从该待检测的镜像流量中依次获取客户端130向服务器110发起的每次登录会话的会话信息。
客户端130通过该待检测的镜像流量向服务器110发起多次登录会话,则网络设备可以从该待检测的镜像流量中得到多个会话信息。会话信息的数量与登录会话的数量相同、多个会话信息与多次登录会话一一对应。
由于网络设备是按照登录会话的发生时间的先后顺序获取对应的会话信息的,因此网络设备获取到的多个会话信息的排列顺序与这多次登录会话发生的时间先后顺序一致。将采用上述方式获取的多个会话信息进行排序从而生成第一会话信息序列。
上述获取第一会话信息序列的实现方式只是一种示例,本申请实施例中还可以通过其他方式获取第一会话序列。例如,网络设备从待检测的镜像流量中获取多个会话信息后,再根据多次登录会话发生的时间先后顺序将这多个会话信息进行排序,得到第一会话信息序列。其中,多次登录会话与多个会话信息一一对应,多个会话信息在第一会话信息序列中的排列顺序与这多次登录会话发生的时间先后顺序相同。
附图4是本申请实施例提供的包含多次登录会话相关报文的镜像流量的示意图。图4所示的镜像流量中包括24信息,这24行信息是按照生成的时间先后顺序排序的。每一行信息表示客户端与服务器之间交互的一个报文,第一列为报文发送端的IP地址,第二列为报文接收端的IP地址,第三列为报文的协议名,第四列为通过解析报文头得到的一些信息,这些信息包括源端口号、目的端口号、报文类型标识、报文的序列号、报文长度、时间戳值(Timestamp Value,TSval)、时间戳回应字段(Timestamp Echo Reply field,TSecr)等等。
如附图4所示,一次登录会话由连续的三次报文交互构成。一次登录会话中的第一次交互报文是客户端向服务器发送的认证请求报文,认证请求报文中可以包括用户名和密码。一次登录会话中的第二次交互报文是服务器向客户端发送确认报文,该确认报文用于指示服务器已收到用户名和密码。一次登录会话中的第三次交互报文是服务器向客户端发送认证响应报文,通知客户端认证成功或认证失败。
通过图4所示的镜像流量,客户端向服务器发起了八次登录会话。每次登录会话的源地址为客户端的IP地址“192.168.13.158”,目的地址为客户端的IP地址“192.168.13.150”,源端口为客户端的端口“36358”,目的端口为“22”,认证协议为“SSH”。
这八次登录会话的源地址、目的地址、源端口、目的端口和认证协议相同,因此可以依次获取每次登录会话的会话信息,从而得到第一会话信息序列。
若将每次登录会话中,认证请求报文的长度(即第一行信息的括号中的数值100)与认证响应报文的长度(即第三行信息的括号中的数值100)的和作为该次登录会话的会话信息,则这八次登录会话对应的八个会话信息组成的第一会话信息序列为:184-184-184-184-184-184-184-136。
S330,网络设备将第一会话信息序列作为第一马尔科夫链,并获取第一马尔科夫链的 状态链概率值,其中,第一会话信息序列中的每一个会话信息作为第一马尔科夫链中的一个状态。
其中,网络设备将第一会话信息序列作为第一马尔科夫链后,可以根据第一马尔科夫链的初始概率值和转移概率值,获取第一马尔科夫链的状态链概率值。
在执行S330之前,网络设备中可以存储有第一马尔科夫链的初始概率值和转移概率值。
第一马尔科夫链的长度表示为n
1,第一马尔科夫链的初始概率值表示为p
0,第一马尔科夫链中第i个状态向第i+1个状态转移的概率值表示为p
ij,则第一马尔科夫链的状态链概率值p可以通过公式p=p
0*∏p
ij计算得到,其中,“∏”表示乘积,n
1为正整数,i为小于n
1的正整数。
例如,将每个会话信息当作一个状态,并将S320中得到的第一会话信息序列“184-184-184-184-184-184-184-136”作为第一马尔科夫链,则第一马尔科夫链中的初始状态为184,第一马尔科夫链中包括七次状态转移,前六次为184向184转移,第七次为184向136转移。
S340,网络设备根据第一马尔科夫链的状态链概率值和第一基准概率值,确定这多次登录会话是否为暴力破解攻击,第一基准概率值用于识别暴力破解攻击。
在执行S340之前,网络设备中可以存储有第一基准概率值。
在一种实现方式中,网络设备根据第一马尔科夫链的状态链概率值和第一基准概率值,确定这多次登录会话是否为暴力破解攻击,可以包括:网络设备将第一马尔科夫链的状态链概率值与第一基准概率值作比较;若第一马尔科夫链的状态链概率值小于或等于第一基准概率值,则网络设备确定这多次登录会话为暴力破解攻击。
若网络设备的存储器142中存储有多个不同的第一基准概率值,则网络设备可以将第一马尔科夫链的状态链概率值依次与这多个第一基准概率值作比较。只要第一马尔科夫链的状态链概率值小于或等于这多个第一基准概率值中的任意一个,则网络设备可以确定这多次登录会话为暴力破解攻击。
在另一种实现方式中,网络设备根据第一马尔科夫链的状态链概率值和第一基准概率值,确定这多次登录会话是否为暴力破解攻击,可以包括:网络设备将第一马尔科夫链的状态链概率值与第一基准概率值相减从而得到二者的差值;若差值小于或等于预先配置的阈值,则网络设备确定这多次登录会话为暴力破解攻击。
若网络设备的存储器142中存储有多个不同的第一基准概率值,则网络设备可以将第 一马尔科夫链的状态链概率值与这多个第一基准概率值分别相减。只要相减得到的任意一个差值小于或等于预先配置的阈值,则网络设备可以确定这多次登录会话为暴力破解攻击。
可选地,S330中计算第一马尔科夫链的状态链概率值所使用的初始概率值和转移概率值可以是人工预先设定的,也可以是网络设备根据客户端130与服务器110之间历史的镜像流量获取的。
图5为网络设备根据历史的镜像流量获取初始概率值和转移概率值的方法的示意性流程图。应理解,图5示出了该方法的步骤或操作,但这些步骤或操作仅是示例,本申请实施例还可以执行其他操作或者图5中的各个操作的变形。
图5所示的方法可以包括S510、S520和S530。该方法可以由网络设备140执行。
S510,网络设备获取客户端与服务器之间历史的镜像流量。历史的镜像流量是指该镜像流量是在S310之前产生的。
网络设备获取历史的镜像流量的实现方式,可以参考S310,此处不再赘述。
S520,网络设备根据历史的镜像流量获取第二会话信息序列,第二会话信息序列包括多个历史会话信息,多个历史会话信息与客户端通过历史的镜像流量向服务器发起的多次历史登录会话一一对应,多个历史会话信息在第二会话信息序列中的排列顺序与这多次历史登录会话发生的时间先后顺序一致。经过人工分析确定多次历史登录会话为暴力破解攻击。这里历史的镜像流量也可以被视为经人工标定的暴力破解攻击的样本流量。
历史登录会话是指在S310之前,客户端130向服务器110发起的登录会话。历史会话信息指示历史登录会话的会话信息。
因为历史的镜像流量是在S310之前产生的,因此通过历史的镜像流量向服务器发起的登录会话即为历史登录会话,从历史的镜像流量中获取的会话信息即为历史会话信息。
网络设备获取第二会话信息序列的实现方式,可以参考S320,此处不再赘述。
例如,三组历史的镜像流量分别入图6、图7和图8所示,网络设备按照S320中描述的实现方式,可以得到三个第二会话信息序列,这三个第二会话信息序列与图6、图7和图8一一对应。
其中,攻击者通过图6所示的镜像流量发起了七次登录会话,通过图7所示的镜像流量发起了六次登录会话,通过图8所示的镜像流量发起了七次登录会话。
图6对应的七次登录会话的七个会话信息组成的第二会话信息序列为:184-184-184-184-184-184-184;图7对应的六次登录会话的六个会话信息组成的第二会话信息序列为:184-184-184-184-184-184;图8对应的七次登录会话的七个会话信息组成的第二会话信息序列为:184-184-184-184-184-184-136。
S530,网络设备将第二会话信息序列作为第二马尔科夫链,并获取第二马尔科夫链的初始概率值和第二马尔科夫链的转移概率值,其中,将第二会话信息序列中的每一个历史会话信息作为第二马尔科夫链中的一个状态。
网络设备获取第二马尔科夫链转移概率值的一种实现方式如下。
假设所有的第二马尔科夫链的状态空间总共包括n种状态,则可以根据所有的第二马尔科夫链得到n*n个状态转移概率值。这n*n个状态转移概率值构成的状态转移值矩阵P表示为:
其中,p
ij表示n种状态中的第i种状态向第j种状态转移的转移概率,i和j为小于或等于n的正整数。
p
ij可以通过下面的公式计算得到:
其中,p
2表示所有的第二马尔科夫链中第s种状态向第t种状态转移的总次数,p
1表示所有的第二马尔科夫链中的状态的总数量,x表示所有的第二马尔科夫链中以第t种状态为初始状态的第二马尔科夫链的数量。
例如,将图6、图7和图8对应的第二会话信息序列“184-184-184-184-184-184-184”、“184-184-184-184-184-184”和“184-184-184-184-184-184-136”作为三个第二马尔科夫链时,这三个第二马尔科夫链中,共有两种状态,20个状态,因此,根据前述的公式,可以计算得到“184”和“136”的初始概率值均为
这三个第二马尔科夫链中,有3个第二马尔科夫链以“184”为初始状态,状态的总数量为20个,“184”向“184”转移的次数为16次,因此,根据前述的公式,可以计算得到“184”向“184”转移的概率值为
也就是说,第二马尔科夫链的状态空间包括“184”和“136”时,其状态转移值矩阵P为:
网络设备获取到第二马尔科夫链的初始概率值和状态转移值后,可以根据该初始概率值和状态转移值得到第一马尔科夫链的初始概率值和状态转移值。例如,可以将第二马尔科夫链的初始概率值作为第一马尔科夫链的初始概率值,将第二马尔科夫链的转移概率值作为第一马尔科夫链的转移概率值。
在一种可能的实现方式中,S340中使用的第一基准概率值可以是根据第二马尔可夫链的状态链概率值确定的。
如图9所示,在S530之后,网络设备还可以执行S540和S550。
S540,网络设备获取第二马尔科夫链的状态链概率值。
S550网络设备根据第二马尔科夫链的状态链概率值确定第一基准概率值。
例如,若S530中仅得到一个第二马尔科夫链,则可以将该第二马尔科夫链的状态链概率值作为第一基准概率值。
一种可选方式是,若S530中得到多个第二马尔科夫链,则可以将这多个第二马尔科夫链的状态链概率值中最大的状态链概率值作为第一基准概率值。
例如,将图6对应的第二会话信息序列“184-184-184-184-184-184-184”作为第二马尔科夫链,该第二马尔科夫链的状态链概率值为
将图7对应的第二会话信息序列“184-184-184-184-184-184”作为第二马尔科夫链,该马尔科夫链的状态链概率值为
将图8对应的第二会话信息序列“184-184-184-184-184-184-136”作为第二马尔科夫链,该第二马尔科夫链的状态链概率值为
最后,可以将
中最大的
最为第一基准概率值。
本申请实施例的检测方法中,如图10所示,在S340之后,还可以包括S350。
S350,网络设备在确定多次登录会话为暴力破解攻击后,根据第二基准概率值和第一马尔科夫链的状态链概率值来确定这多次登录会话发起的暴力破解攻击是否攻击成功,第二基准概率值用于识别攻击成功的暴力破解攻击。
在一种可能的实现方式中,第二基准概率值可以是网络设备在S350之前根据历史的镜像流量确定的。
例如,网络设备可以从历史的镜像流量中获取第三会话信息序列,第三会话信息序列包括多个历史会话信息,第三会话信息序列包括的多个历史会话信息与客户端和服务器之间的多次历史登录会话一一对应,第三会话信息序列包括的多个历史会话信息在第三会话信息序列中的排列顺序与第三会话信息序列包括的多个历史会话信息对应的多次历史登录会话发生的时间先后顺序一致。经过人工分析确定第三会话信息序列包括的多个历史会话信息对应的多次历史登录会话是攻击成功的暴力破解攻击。这里历史的镜像流量也可以被视为经人工标定的攻击成功的暴力破解攻击的样本流量。
网络设备可以将第三会话信息序列作为第三马尔科夫链,根据第三马尔科夫链的状态链概率值确定第二基准概率值。其中,第三会话信息序列中的每一个历史会话信息作为第三马尔科夫链链中的一个状态。
第三会话信息序列与第二会话信息序列可是相同的序列。例如,第二会话信息序列对应的多次历史登录会话发起的暴力破解攻击成功时,可以将该第二会话信息序列作为第三会话信息序列。
例如,通过图8所示的镜像流量发起的多次历史登录会话为攻击成功的暴力破解攻击,因此,可以将图8对应的第二会话信息序列作为第三会话信息序列,即可以将图8对应的第二马尔科夫链“184-184-184-184-184-184-136”的状态链概率值
作为第二基准概率值。
网络设备根据第二基准概率值和第一马尔科夫链的状态链概率值,确定多次登录会话发起的暴力破解攻击是否攻击成功时,在一种可能的实现方式中,若网络设备确定第一马尔科夫链的状态链概率值小于或等于第二基准概率值,则确定这多次登录会话发起的暴力 破解攻击已攻击成功。
在另一种可能的实现方式中,若网络设备确定第一马尔科夫链的状态链概率值与第二基准概率值的差值小于或等于预先配置的阈值,则确定这多次登录会话发起的暴力破解攻击已攻击成功。
应注意的是,本申请实施例中,登录成功的登录会话的会话信息与登录失败的登录会话的会话信息应该不一样。例如,图4、图6至图8中,登录失败的登录会话的会话信息为184,登录成功的登录会话的会话信息为136。
在上述实施例中,附图3或附图10中的S310、附图5或附图9中的S510具体可以由附图2中的网络设备的通信接口143执行,附图3或附图10中的S320至S350、以及附图5或附图9中的S520至S550具体可以由附图2中的网络设备的处理器141执行。
图6至图8中的历史登录会话的源地址与图4中的登录会话的源地址相同,图6至图8中的历史登录会话的目的地址与图4中的实施例中的登录会话的目的地址相同,图6至图8中的历史登录会话的目的端口与图4中的登录会话的目的端口相同,图6至图8中的历史登录会话的认证协议与图4中的登录会话的认证协议相同。应理解,这只是一种实施例,本申请的实施例对此并不限制。例如,历史登录会话的源地址、目的地址、源端口、目的端口和认证协议与待检测的登录会话的源地址、目的地址、源端口、目的端口和认证协议,可以全部或部分不同。
本申请一个实施例的网络设备的示意性结构图如图11所示。应理解,图11示出的网络设备1100仅是示例,本申请实施例的网络设备还可包括其他模块或单元,或者包括与图11中的各个模块的功能相似的模块,或者并非要包括图11中所有模块。
图11所示的网络设备1100可以包括获取模块1110和处理模块1120。
网络设备1100可以用于执行图3、图5、图9和图10中任意一个所示的检测方法中由网络设备140执行的步骤。
例如,获取模块1110可以用于执行附图3或附图10中的S310、附图5或附图9中的S510,处理模块1120可以用于执行附图3或附图10中的S320至S350、以及附图5或附图9中的S520至S550。
本领域普通技术人员可以意识到,结合本文中所公开的实施例描述的各示例的单元及算法步骤,能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行,取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能,但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到,为描述的方便和简洁,上述描述的系统、装置和单元的具体工作过程,可以参考前述方法实施例中的对应过程,在此不再赘述。
在本申请所提供的几个实施例中,应该理解到,所揭露的系统、装置和方法,可以通过其它的方式实现。例如,以上所描述的装置实施例仅仅是示意性的,例如,所述单元的划分,仅仅为一种逻辑功能划分,实际实现时可以有另外的划分方式,例如多个单元或组 件可以结合或者可以集成到另一个系统,或一些特征可以忽略,或不执行。另一点,所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口,装置或单元的间接耦合或通信连接,可以是电性,机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的,作为单元显示的部件可以是或者也可以不是物理单元,即可以位于一个地方,或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外,在本申请各个实施例中的各功能单元可以集成在一个处理单元中,也可以是各个单元单独物理存在,也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时,可以存储在一个计算机可读取存储介质中。基于这样的理解,本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来,该计算机软件产品存储在一个存储介质中,包括若干指令用以使得一台计算机设备(可以是个人计算机,服务器,或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括:U盘、移动硬盘、只读存储器(Read-Only Memory,ROM)、随机存取存储器(Random Access Memory,RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述,仅为本申请的具体实施方式,但本申请的保护范围并不局限于此,任何熟悉本技术领域的技术人员在本申请揭露的技术范围内,可轻易想到变化或替换,都应涵盖在本申请的保护范围之内。因此,本申请的保护范围应以所述权利要求的保护范围为准。
Claims (15)
- 一种暴力破解攻击的检测方法,其特征在于,包括:网络设备获取客户端与服务器之间待检测的镜像流量;所述网络设备根据所述待检测的镜像流量获取第一会话信息序列,所述第一会话信息序列包括多个会话信息,所述多个会话信息与所述客户端通过所述待检测的镜像流量向所述服务器发起的多次登录会话一一对应,所述多个会话信息在所述第一会话信息序列中的排列顺序与所述多次登录会话发生的时间先后顺序一致;所述网络设备将所述第一会话信息序列作为第一马尔科夫链,并获取所述第一马尔科夫链的状态链概率值,其中,所述第一会话信息序列中的每一个会话信息作为所述第一马尔科夫链中的一个状态;所述网络设备根据所述第一马尔科夫链的状态链概率值和第一基准概率值,确定所述多次登录会话是否为暴力破解攻击,所述第一基准概率值用于识别暴力破解攻击。
- 根据权利要求1所述的检测方法,其特征在于,所述每一个会话信息为对应的登录会话中携带用户名和密码的报文的长度和携带认证结果的报文的长度之和。
- 根据权利要求1或2所述的检测方法,其特征在于,所述网络设备根据所述第一马尔科夫链的状态链概率值和第一基准概率值,确定所述多次登录会话是否为暴力破解攻击,包括:若所述第一马尔科夫链的状态链概率值小于或等于所述第一基准概率值,则所述网络设备确定所述多次登录会话为暴力破解攻击;或若所述第一马尔科夫链的状态链概率值与所述第一基准概率值的差值小于或等于预先配置的阈值,则所述网络设备确定所述多次登录会话为暴力破解攻击。
- 根据权利要求1至3中任一项所述的检测方法,其特征在于,所述第一马尔科夫链的状态链概率值是根据所述第一马尔科夫链的初始概率值和所述第一马尔科夫链的转移概率值确定的;所述网络设备获取客户端与服务器之间待检测的镜像流量之前,所述检测方法还包括:所述网络设备获取所述客户端与所述服务器之间历史的镜像流量;所述网络设备根据所述历史的镜像流量获取第二会话信息序列,所述第二会话信息序列包括多个历史会话信息,所述多个历史会话信息与所述客户端通过所述历史的镜像流量向所述服务器发起的多次历史登录会话一一对应,所述多个历史会话信息在所述第二会话信息序列中的排列顺序与所述多次历史登录会话发生的时间先后顺序一致,并且所述多次历史登录会话为暴力破解攻击;所述网络设备将所述第二会话信息序列作为所述第二马尔科夫链,并获取所述第二马尔科夫链的初始概率值和所述第二马尔科夫链的转移概率值,其中,将所述第二会话信息序列中的每一个历史会话信息作为所述第二马尔科夫链中的一个状态;所述网络设备确定所述第一马尔科夫链的初始概率值为所述第二马尔科夫链的初始概率值,所述第一马尔可夫链的转移概率值为所述第二马尔科夫链的转移概率值。
- 根据权利要求4所述的检测方法,其特征在于,所述网络设备获取客户端与服务器之间待检测的镜像流量之前,所述检测方法还包括:所述网络设备获取所述第二马尔科夫链的状态链概率值;所述网络设备根据所述第二马尔科夫链的状态链概率值确定所述第一基准概率值。
- 根据权利要求1至5中任一项所述的检测方法,其特征在于,所述网络设备根据所述第一马尔科夫链的状态链概率值和所述第一基准概率值,确定所述多次登录会话为暴力破解攻击的情况下,所述检测方法还包括:所述网络设备根据第二基准概率值和所述第一马尔科夫链的状态链概率值,确定所述多次登录会话发起的暴力破解攻击是否攻击成功,所述第二基准概率值用于识别攻击成功的暴力破解攻击。
- 根据权利要求6所述的检测方法,其特征在于,所述第二基准概率值是将第三会话信息序列作为第三马尔科夫链的情况下,根据所述第三马尔科夫链的状态链概率值确定的,其中,所述第三会话信息序列包括多个历史会话信息,所述第三会话信息序列包括的多个历史会话信息与所述客户端向所述服务器发起的多次历史登录会话一一对应,所述第三会话信息序列包括的多个历史会话信息对应的多次历史登录会话是攻击成功的暴力破解攻击,所述第三会话信息序列中的每一个历史会话信息作为所述第三马尔科夫链链中的一个状态,所述第三会话信息序列包括的多个历史会话信息在所述第三会话信息序列中的排列顺序与所述第三会话信息序列包括的多个历史会话信息对应的多次历史登录会话发生的时间先后顺序一致。
- 一种网络设备,其特征在于,包括:获取模块,用于获取客户端与服务器之间待检测的镜像流量;处理模块,用于根据所述待检测的镜像流量获取第一会话信息序列,所述第一会话信息序列包括多个会话信息,所述多个会话信息与所述客户端通过所述待检测的镜像流量向所述服务器发起的多次登录会话一一对应,所述多个会话信息在所述第一会话信息序列中的排列顺序与所述多次登录会话发生的时间先后顺序一致;所述处理模块还用于将所述第一会话信息序列作为第一马尔科夫链,并获取所述第一马尔科夫链的状态链概率值,其中,所述第一会话信息序列中的每一个会话信息作为所述第一马尔科夫链中的一个状态;所述处理模块还用于根据所述第一马尔科夫链的状态链概率值和第一基准概率值,确定所述多次登录会话是否为暴力破解攻击,所述第一基准概率值用于识别暴力破解攻击。
- 根据权利要求8所述的网络设备,其特征在于,所述每一个会话信息为对应的登录会话中携带用户名和密码的报文的长度和携带认证结果的报文的长度之和。
- 根据权利要求8或9所述的网络设备,其特征在于,所述处理模块具体用于:若所述第一马尔科夫链的状态链概率值小于或等于所述第一基准概率值,则确定所述多次登录会话为暴力破解攻击;或若所述第一马尔科夫链的状态链概率值与所述第一基准概率值的差值小于或等于预先配置的阈值,则确定所述多次登录会话为暴力破解攻击。
- 根据权利要求8至10中任一项所述的网络设备,其特征在于,所述第一马尔科夫链的状态链概率值是根据所述第一马尔科夫链的初始概率值和所述第一马尔科夫链的转移概率值确定的,其中,所述获取模块还用于获取所述客户端与所述服务器之间历史的镜像流量;所述处理模块还用于根据所述历史的镜像流量获取第二会话信息序列,所述第二会话 信息序列包括多个历史会话信息,所述多个历史会话信息与所述客户端通过所述历史的镜像流量向所述服务器发起的多次历史登录会话一一对应,所述多个历史会话信息在所述第二会话信息序列中的排列顺序与所述多次历史登录会话发生的时间先后顺序一致,并且所述多次历史登录会话为暴力破解攻击;所述处理模块还用于将所述第二会话信息序列作为所述第二马尔科夫链,并获取所述第二马尔科夫链的初始概率值和所述第二马尔科夫链的转移概率值,其中,将所述第二会话信息序列中的每一个历史会话信息作为所述第二马尔科夫链中的一个状态;所述处理模块还用于确定所述第一马尔科夫链的初始概率值为所述第二马尔科夫链的初始概率值,所述第一马尔可夫链的转移概率值为所述第二马尔科夫链的转移概率值。
- 根据权利要求11所述的网络设备,其特征在于,所述获取模块还用于:在获取客户端与服务器之间待检测的镜像流量之前,获取所述第二马尔科夫链的状态链概率值;所述处理模块还用于根据所述第二马尔科夫链的状态链概率值确定所述第一基准概率值。
- 根据权利要求8至12中任一项所述的网络设备,其特征在于,所述处理模块还用于:在根据所述第一马尔科夫链的状态链概率值和所述第一基准概率值,确定所述多次登录会话为暴力破解攻击的情况下,根据第二基准概率值和所述第一马尔科夫链的状态链概率值,确定所述多次登录会话发起的暴力破解攻击是否攻击成功,所述第二基准概率值用于识别攻击成功的暴力破解攻击。
- 根据权利要求13所述的网络设备,其特征在于,所述第二基准概率值是将第三会话信息序列作为第三马尔科夫链的情况下,根据所述第三马尔科夫链的状态链概率值确定的,其中,所述第三会话信息序列包括多个历史会话信息,所述第三会话信息序列包括的多个历史会话信息与所述客户端向所述服务器之间发起的多次历史登录会话一一对应,所述第三会话信息序列包括的多个历史会话信息对应的多次历史登录会话是攻击成功的暴力破解攻击,所述第三会话信息序列中的每一个历史会话信息作为所述第三马尔科夫链链中的一个状态,所述第三会话信息序列包括的多个历史会话信息在所述第三会话信息序列中的排列顺序与所述第三会话信息序列包括的多个历史会话信息对应的多次历史登录会话发生的时间先后顺序一致。
- 一种计算机可读存储介质,其特征在于,所述计算机可读存储介质中存储用于网络设备执行的程序代码,所述程序代码包括用于执行权利要求1至7中任一项所述的检测方法的指令。
Priority Applications (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
MX2020006422A MX2020006422A (es) | 2017-12-18 | 2018-08-29 | Metodo para detectar ataque de fuerza bruta y aparato relacionado. |
EP18890392.6A EP3720077B1 (en) | 2017-12-18 | 2018-08-29 | Method for detecting brute force attack and related apparatus |
US16/904,113 US11388189B2 (en) | 2017-12-18 | 2020-06-17 | Method for detecting brute force attack and related apparatus |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201711365840.8 | 2017-12-18 | ||
CN201711365840.8A CN109936545B (zh) | 2017-12-18 | 2017-12-18 | 暴力破解攻击的检测方法和相关装置 |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US16/904,113 Continuation US11388189B2 (en) | 2017-12-18 | 2020-06-17 | Method for detecting brute force attack and related apparatus |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2019119860A1 true WO2019119860A1 (zh) | 2019-06-27 |
Family
ID=66982767
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2018/102881 WO2019119860A1 (zh) | 2017-12-18 | 2018-08-29 | 暴力破解攻击的检测方法和相关装置 |
Country Status (5)
Country | Link |
---|---|
US (1) | US11388189B2 (zh) |
EP (1) | EP3720077B1 (zh) |
CN (1) | CN109936545B (zh) |
MX (1) | MX2020006422A (zh) |
WO (1) | WO2019119860A1 (zh) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN111770111A (zh) * | 2020-01-06 | 2020-10-13 | 南京林业大学 | 一种攻击防御树的定量分析方法 |
Families Citing this family (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN110324375B (zh) * | 2018-03-29 | 2020-12-04 | 华为技术有限公司 | 一种信息备份方法及相关设备 |
CN110417747B (zh) * | 2019-07-08 | 2021-11-05 | 新华三信息安全技术有限公司 | 一种暴力破解行为的检测方法及装置 |
CN112445785B (zh) * | 2019-08-30 | 2024-05-31 | 深信服科技股份有限公司 | 一种账号爆破检测方法及相关装置 |
US11876790B2 (en) * | 2020-01-21 | 2024-01-16 | The Boeing Company | Authenticating computing devices based on a dynamic port punching sequence |
CN113497789B (zh) * | 2020-03-20 | 2024-03-15 | 北京观成科技有限公司 | 一种暴力破解攻击的检测方法、检测系统和设备 |
CN111355750B (zh) * | 2020-04-23 | 2022-11-08 | 京东科技控股股份有限公司 | 用于识别暴力破解密码行为的方法和装置 |
CN112153033B (zh) * | 2020-09-16 | 2023-04-07 | 杭州安恒信息技术股份有限公司 | 一种检测webshell的方法和装置 |
CN113114620B (zh) * | 2021-03-02 | 2023-03-17 | 深信服科技股份有限公司 | 一种暴力破解的检测方法和装置,及存储介质 |
US12041088B2 (en) * | 2021-03-24 | 2024-07-16 | Corelight, Inc. | System and method for identifying authentication method of secure shell (SSH) sessions |
CN113676348B (zh) * | 2021-08-04 | 2023-12-29 | 南京赋乐科技有限公司 | 一种网络通道破解方法、装置、服务器及存储介质 |
CN113938312B (zh) * | 2021-11-12 | 2024-01-26 | 北京天融信网络安全技术有限公司 | 一种暴力破解流量的检测方法及装置 |
CN115459962B (zh) * | 2022-08-22 | 2024-08-06 | 北京国瑞数智技术有限公司 | 一种基于统计的暴力破解检测方法和系统 |
CN115333858B (zh) * | 2022-10-11 | 2022-12-23 | 北京华云安信息技术有限公司 | 登录页面破解方法、装置、设备以及存储介质 |
CN115865493A (zh) * | 2022-11-30 | 2023-03-28 | 网易(杭州)网络有限公司 | 基于流量的分布式拒绝服务攻击检测方法、装置及介质 |
CN116319021B (zh) * | 2023-03-23 | 2023-09-29 | 长扬科技(北京)股份有限公司 | 一种横向移动检测方法、装置、电子设备及存储介质 |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20080127349A1 (en) * | 2006-11-08 | 2008-05-29 | Ormazabal Gaston S | PREVENTION OF DENIAL OF SERVICE (DoS) ATTACKS ON SESSION INITIATION PROTOCOL (SIP)-BASED SYSTEMS USING METHOD VULNERABILITY FILTERING |
CN105024885A (zh) * | 2015-07-29 | 2015-11-04 | 盛趣信息技术(上海)有限公司 | 反外挂的网络游戏系统 |
CN107204965A (zh) * | 2016-03-18 | 2017-09-26 | 阿里巴巴集团控股有限公司 | 一种密码破解行为的拦截方法及系统 |
CN107347047A (zh) * | 2016-05-04 | 2017-11-14 | 阿里巴巴集团控股有限公司 | 攻击防护方法和装置 |
CN107454043A (zh) * | 2016-05-31 | 2017-12-08 | 阿里巴巴集团控股有限公司 | 一种网络攻击的监控方法及装置 |
Family Cites Families (18)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20070300300A1 (en) * | 2006-06-27 | 2007-12-27 | Matsushita Electric Industrial Co., Ltd. | Statistical instrusion detection using log files |
KR100935861B1 (ko) * | 2007-11-12 | 2010-01-07 | 한국전자통신연구원 | 네트워크 보안 위험도 예측 방법 및 장치 |
CA2729657A1 (en) * | 2008-08-11 | 2010-02-18 | Karl Martin | Method and system for secure coding of arbitrarily shaped visual objects |
US9438419B1 (en) * | 2011-07-12 | 2016-09-06 | The Florida State University Research Foundation, Inc. | Probabilistic password cracking system |
CN104052617A (zh) * | 2013-03-13 | 2014-09-17 | 北京千橡网景科技发展有限公司 | 基于连续时间马尔可夫链进行用户行为分析的方法和设备 |
US9519775B2 (en) * | 2013-10-03 | 2016-12-13 | Qualcomm Incorporated | Pre-identifying probable malicious behavior based on configuration pathways |
US20150161389A1 (en) * | 2013-12-11 | 2015-06-11 | Prism Technologies Llc | System and method for the detection and prevention of battery exhaustion attacks |
GB2541143A (en) * | 2014-05-05 | 2017-02-08 | Univ Texas | Variant annotation, analysis and selection tool |
US9529087B2 (en) * | 2014-07-24 | 2016-12-27 | GM Global Technology Operations LLC | Curb detection using lidar with sparse measurements |
US10382454B2 (en) * | 2014-09-26 | 2019-08-13 | Mcafee, Llc | Data mining algorithms adopted for trusted execution environment |
US10331429B2 (en) * | 2015-09-04 | 2019-06-25 | Siemens Aktiengesellschaft | Patch management for industrial control systems |
CN106936781B (zh) * | 2015-12-29 | 2019-11-15 | 亿阳安全技术有限公司 | 一种用户操作行为的判定方法及装置 |
US10333968B2 (en) * | 2016-02-10 | 2019-06-25 | Verisign, Inc. | Techniques for detecting attacks in a publish-subscribe network |
US10284580B2 (en) * | 2016-05-04 | 2019-05-07 | The University Of North Carolina At Charlotte | Multiple detector methods and systems for defeating low and slow application DDoS attacks |
CN107402921B (zh) * | 2016-05-18 | 2021-03-30 | 创新先进技术有限公司 | 识别用户行为的事件时序数据处理方法、装置及系统 |
CN106330949B (zh) * | 2016-09-13 | 2019-07-16 | 哈尔滨工程大学 | 一种基于马尔科夫链的入侵检测方法 |
US10652252B2 (en) * | 2016-09-30 | 2020-05-12 | Cylance Inc. | Machine learning classification using Markov modeling |
CN107070852B (zh) * | 2016-12-07 | 2020-07-03 | 东软集团股份有限公司 | 网络攻击检测方法和装置 |
-
2017
- 2017-12-18 CN CN201711365840.8A patent/CN109936545B/zh active Active
-
2018
- 2018-08-29 WO PCT/CN2018/102881 patent/WO2019119860A1/zh unknown
- 2018-08-29 EP EP18890392.6A patent/EP3720077B1/en active Active
- 2018-08-29 MX MX2020006422A patent/MX2020006422A/es unknown
-
2020
- 2020-06-17 US US16/904,113 patent/US11388189B2/en active Active
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20080127349A1 (en) * | 2006-11-08 | 2008-05-29 | Ormazabal Gaston S | PREVENTION OF DENIAL OF SERVICE (DoS) ATTACKS ON SESSION INITIATION PROTOCOL (SIP)-BASED SYSTEMS USING METHOD VULNERABILITY FILTERING |
CN105024885A (zh) * | 2015-07-29 | 2015-11-04 | 盛趣信息技术(上海)有限公司 | 反外挂的网络游戏系统 |
CN107204965A (zh) * | 2016-03-18 | 2017-09-26 | 阿里巴巴集团控股有限公司 | 一种密码破解行为的拦截方法及系统 |
CN107347047A (zh) * | 2016-05-04 | 2017-11-14 | 阿里巴巴集团控股有限公司 | 攻击防护方法和装置 |
CN107454043A (zh) * | 2016-05-31 | 2017-12-08 | 阿里巴巴集团控股有限公司 | 一种网络攻击的监控方法及装置 |
Non-Patent Citations (1)
Title |
---|
See also references of EP3720077A4 |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN111770111A (zh) * | 2020-01-06 | 2020-10-13 | 南京林业大学 | 一种攻击防御树的定量分析方法 |
Also Published As
Publication number | Publication date |
---|---|
MX2020006422A (es) | 2020-09-17 |
EP3720077B1 (en) | 2022-06-22 |
CN109936545B (zh) | 2020-07-24 |
US11388189B2 (en) | 2022-07-12 |
CN109936545A (zh) | 2019-06-25 |
EP3720077A1 (en) | 2020-10-07 |
US20200322378A1 (en) | 2020-10-08 |
EP3720077A4 (en) | 2020-11-25 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2019119860A1 (zh) | 暴力破解攻击的检测方法和相关装置 | |
Xu et al. | Am I eclipsed? A smart detector of eclipse attacks for Ethereum | |
CN109417553B (zh) | 经由内部网络监视来检测使用泄漏证书的攻击 | |
KR101486782B1 (ko) | 무한 중첩된 해시 체인들에 의한 1회용 패스워드 인증 | |
Sood et al. | Cryptanalysis of password authentication schemes: Current status and key issues | |
EP3466024B1 (en) | Distinguishing vertical brute force attacks from benign errors | |
US9736147B1 (en) | Artificial intelligence encryption model (AIEM) with device authorization and attack detection (DAAAD) | |
US11265323B2 (en) | Fictitious account generation on detection of account takeover conditions | |
EP2078260B1 (en) | Detecting stolen authentication cookie attacks | |
CN112425118A (zh) | 公钥-私钥对账户登录和密钥管理器 | |
WO2019095856A1 (zh) | 一种网络身份认证方法、系统及其使用的用户代理设备 | |
US20190379653A1 (en) | Accelerated communication attack detection | |
US11784993B2 (en) | Cross site request forgery (CSRF) protection for web browsers | |
Acar et al. | A privacy‐preserving multifactor authentication system | |
Andola et al. | An enhanced smart card and dynamic ID based remote multi-server user authentication scheme | |
Sarvabhatla et al. | A secure and light weight authentication service in hadoop using one time pad | |
US20140189805A1 (en) | Reverse authorized syn cookie | |
Guo et al. | Extending registration and authentication processes of FIDO2 external authenticator with qr codes | |
Vemuri et al. | Insider Attack Detection and Prevention using Server Authentication using Elgamal Encryption | |
Namitha et al. | A survey on session management vulnerabilities in web application | |
Patel et al. | Modeling and analysis of internet key exchange protocolv2 and a proposal for its variant | |
Maddipati | Implementation of Captcha as Graphical Passwords For Multi Security | |
CN111385093B (zh) | 一种结合慢hash与动态盐的web系统设计方法 | |
Knickerbocker | Combating Phishing through Zero-Knowledge Authentication | |
US20080025212A1 (en) | Method and apparatus for remotely accessing resources over an insecure network |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 18890392 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
ENP | Entry into the national phase |
Ref document number: 2018890392 Country of ref document: EP Effective date: 20200702 |