CN115396202A - An identification method for brute force cracking and related components - Google Patents

Abstract

The invention discloses a brute force cracking recognition method and related components, and relates to the technical field of communication safety. The login data packet is acquired from the kernel layer, the information of the login account can be reflected in real time, the mode of violently cracking the account is more accurately identified according to the failure times of the login account in the preset time period after the current time, and the safety of the target server is ensured.

Description

An identification method for brute force cracking and related components

technical field

The invention relates to the technical field of communication security, in particular to an identification method for brute force cracking and related components.

Background technique

Brute force cracking refers to the behavior that the attacker exhaustively exhausts all possibilities of sensitive information such as the user name and password of the target server, and tries based on this until the cracking is successful. Brute force cracking has the advantages of simple operation and low cost, so it has become the preferred attack method for attackers. In order to ensure the security of the target server, it is necessary to identify the brute force cracking behavior. In the prior art, it is possible to identify whether the login account is an attack by reading the login account recorded in the system log of the target server, the number of login times of the login account, and whether the login is successful. the account used by the user. However, it takes a certain amount of time for the target server to generate system logs, and the system logs are sometimes turned off during the running of the target server, which makes it impossible to quickly and accurately identify brute force attacks. In addition, in the prior art, third-party libraries such as winpcap are used to obtain the system traffic of the target server to identify brute force cracking. However, open-source third-party libraries have potential security risks and are not conducive to maintaining the security of the target server.

Contents of the invention

The purpose of the present invention is to provide a brute force cracking identification method and related components, which can identify brute force cracking in real time and accurately, and ensure the security of the target server.

In order to solve the above technical problems, the present invention provides an identification method for brute force cracking, including:

Obtain the login data packets of each login account at the kernel layer of the target server, wherein the login data packets include the destination port accessed by the login account and the login status of the login account;

When the destination port is a risky port in the target server, determine that the login status of the login account within a preset period of time after the current moment is the number of failed logins;

When the number of failures is greater than a preset threshold, the login account is identified as a brute force cracking account.

Preferably, the login data packet further includes a transport layer protocol used by the login account to access the target server;

Before determining that the login status of the login account within a preset period of time after the current moment is the number of failed login failures, it also includes:

When it is determined that the transport layer protocol is the risky transport layer protocol corresponding to the target server, enter the step of determining the number of times the login status of the login account is login failure within a preset period of time after the current moment.

Preferably, the risk port includes:

Any one of the RDP port used for remote desktop connection in the target server, the port used for sharing files in the target server in the target server, and the port used for connecting to a shared output device in the target server or a combination of more.

Preferably, the login data packet also includes the source IP and source port used by the login account;

After identifying the login account as a brute force cracking account, it also includes:

Intercept the login account whose IP is the source IP and/or port is the source port at the kernel layer.

Preferably, after identifying the login account as a brute force cracking account, it further includes:

Generate prompt information for prompting the user that the target server is subject to brute force cracking.

Preferably, determining the number of times the login status of the login account is login failure within a preset period of time after the current moment includes:

When the login status is successful login, clear the first login failure time;

When the login status is login failure, add one to the number of login failures;

When it is determined that the first login failure time is not empty, the login duration is obtained by subtracting the first login failure time from the current login status of the login account as login failure time;

When it is determined that the first login failure time is empty, record the time when the current login status of the login account is login failure as the first login failure time, and add one to the number of login failures;

When the login duration is less than the preset time period, enter the step of identifying the login account as a brute force cracking account when the number of failures is greater than a preset threshold;

When the login duration is longer than the preset time period, the first login failure time is cleared and the time when the current login status of the login account is login failure is used as the first login failure time.

In order to solve the above technical problems, the present application also provides a brute force cracking identification system, including:

The login data packet acquisition unit is used to obtain the login data packets of each login account at the kernel layer of the target server, wherein the login data packet includes the destination port accessed by the login account and the login status of the login account;

The number of failures determination unit is configured to determine the number of failures that the login status of the login account within a preset period of time after the current moment is a login failure when the destination port is a risky port in the target server;

An identifying unit, configured to identify the login account as a brute force cracking account when the number of failures is greater than a preset threshold.

Preferably, the login data packet further includes the transport layer protocol used by the login account to access the target server, and further includes:

The risky transport layer protocol determining unit is configured to trigger the failure times determining unit when it is determined that the transport layer protocol is the risky transport layer protocol corresponding to the target server.

Preferably, the risk port includes:

Any one of the RDP port used for remote desktop connection in the target server, the port used for sharing files in the target server in the target server, and the port used for connecting to a shared output device in the target server or a combination of more.

Preferably, the login data packet also includes the source IP and source port used by the login account, and also includes:

An intercepting unit, configured to intercept, at the kernel layer, a login account whose IP is the source IP and/or whose port is the source port after identifying the login account as a brute force cracking account.

Preferably, it also includes:

A prompting unit, configured to generate prompt information for prompting the user that the target server is subject to brute force cracking after identifying the login account as a brute force cracking account.

Preferably, the unit for determining the number of failures includes:

A clearing unit, configured to clear the first failed login time when the destination port is a risky port in the target server and when the login status is successful login;

A counting unit, configured to add one to the number of login failures when the login status is login failure;

The login duration determination unit is configured to subtract the first login failure time from the current login status of the login account to the login failure time to obtain the login duration when it is determined that the first login failure time is not empty;

A first login failure time determination unit, configured to record the time when the current login status of the login account is login failure as the first login failure time when it is determined that the first login failure time is empty, and record the login failure time as the first login failure time. times plus one;

a trigger unit, configured to trigger the identification unit when the login duration is less than the preset time period;

A first login failure time updating unit, configured to clear the first login failure time when the login duration is greater than the preset time period, and use the time when the current login status of the login account is login failure as the time The time of the first login failure described above.

In order to solve the above technical problems, the present application also provides an identification device for brute force cracking, including:

memory for storing computer programs;

A processor, configured to implement the steps of the identification method for brute force cracking when executing the computer program.

In order to solve the above-mentioned technical problem, the present application also provides a server, including the above-mentioned identification device for brute-force cracking.

In order to solve the above technical problems, the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above identification method for brute force cracking are realized.

To sum up, the present invention provides a brute force cracking identification method and related components, including obtaining the login data packets of each login account at the kernel layer of the target server, and when the destination port recorded in the login data packet is a risky port in the target server It is further determined that the login status of the login account within a preset period of time after the current moment is the number of failed logins, and when the number of failures is greater than the preset threshold, the login account is identified as a brute force cracking account. Obtaining the login data packet from the kernel layer can reflect the information of the login account in real time, and the method of identifying the brute force cracking account according to the number of failures of the login account within the preset time period after the current moment is more accurate, ensuring the security of the target server.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the prior art and the accompanying drawings that need to be used in the embodiments. Obviously, the accompanying drawings in the following description are only some of the present invention. Embodiments, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

Fig. 1 is a schematic flow chart of a brute force cracking identification method provided by the present invention;

Fig. 2 is a schematic flow chart of another identification method for brute force cracking provided by the present invention;

FIG. 3 is a schematic structural diagram of a brute force cracking identification system provided by the present invention;

FIG. 4 is a schematic structural diagram of a brute-force cracking identification device provided by the present invention.

Detailed ways

The core of the present invention is to provide a brute force cracking identification method and related components, which can identify brute force cracking in real time and accurately, and ensure the security of the target server.

In order to clarify the purpose, technical solutions and advantages of the embodiments of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Please refer to FIG. 1. FIG. 1 is a schematic flow chart of a brute-force cracking identification method provided by the present invention. The brute-force cracking identification method includes:

S1: Obtain the login data packet of each login account at the kernel layer of the target server, wherein the login data packet includes the destination port accessed by the login account and the login status of the login account;

Since it takes a certain amount of time to generate system logs, obtain system logs, and identify brute force cracking according to the login account in the system log, the number of logins of the login account, and whether the login is successful, the real-time performance of identifying brute force cracking in the prior art is relatively poor. And it will also be affected by the possibility that the system log may be closed, resulting in the inability to identify the brute force cracking behavior of the server, which brings a great security risk to the server.

Therefore, in this application, the login data packet of the login account is obtained at the kernel layer of the target server, and the login data packet of the login account can be obtained in real time. The login data packet includes the destination port and the login status, where the destination port refers to the login account The port of the target server actually accessed, and the login status includes login success and login failure. It should be noted that the login data packet can also generally include source IP, source port, destination IP and transport layer protocol. The source IP and source port reflect the information of the login account, the destination IP reflects the information of the target server, and the transport layer protocol can reflect the login account information. The process of what functions in the target server the account wants to access. In addition, the login status in this application can be determined by reading the code identification code in the login data packet. For example, when the login data packet is an RDP login data packet and the code identification code is 80000003, then the login status corresponding to the RDP login data packet can be determined. The login status of the account is login failed.

It should also be noted that this application does not specifically limit how to obtain login data packet information from the kernel layer. For example, at the kernel layer, the source IP, source port, destination IP, destination ports and transport layer protocols, etc.

S2: When the destination port is a risky port in the target server, determine the number of failure times that the login status of the login account within a preset period of time after the current moment is login failure;

S3: When the number of failures is greater than the preset threshold, identify the login account as a brute force cracking account.

Considering that the attacker attacks the target server mainly through remote desktop connections, shared files or shared printers, and different brute-force cracking behaviors attack different ports in the target server, so in this application, when the destination port is the risk port in the target server At this time, it is determined that the login account corresponding to the destination port may be an attack account for brute force cracking. The risk ports in this application are predefined before brute-force cracking identification, and the risk ports are ports that attackers may access when performing brute-force cracking. This application does not specifically limit the specific types of risk ports.

In order to further enhance the accuracy of the identification result of brute force cracking in this application, after determining that the destination port is a risky port in the target server, the number of failed logins of the login account within a preset time period after the current moment will also be determined. Brute force cracking is generally done by continuously trying all possible passwords or accounts until the cracking is successful. Therefore, in the process of brute force cracking, there will inevitably be multiple login failures. Therefore, the brute force cracking behavior can be identified by judging the number of failed login failures. . Moreover, in this application, the way of identifying brute force cracking based on the number of failures of login failures within a preset time period after the current time is compared with the common method of reading the number of failures within a preset time period before the current time in the prior art. In other words, it can more accurately reflect the current attack status of the login account and ensure the real-time performance of the identification of brute force cracking results.

To sum up, the present invention provides an identification method for brute force cracking, which includes obtaining the login data packets of each login account at the core layer of the target server, and further determining the login data when the destination port recorded in the login data packet is a risky port in the target server. The login status of the account within a preset period of time after the current moment is the number of login failures, and when the number of failures is greater than the preset threshold, the login account is identified as a brute force cracking account. Obtaining the login data packet from the kernel layer can reflect the information of the login account in real time, and the method of identifying the brute force cracking account according to the number of failures of the login account within the preset time period after the current moment is more accurate, ensuring the security of the target server.

On the basis of above-mentioned embodiment:

As a preferred embodiment, the login data packet also includes the transport layer protocol used by the login account to access the target server;

Before determining the login status of the login account within the preset period of time after the current moment is the number of login failures, it also includes:

When it is determined that the transport layer protocol is the risky transport layer protocol corresponding to the target server, enter the step of determining the number of times the login status of the login account is login failure within a preset period of time after the current moment.

In this embodiment, in order to further ensure the accuracy of the results of identifying brute force cracking, the kernel layer of the target server also obtains the transport layer protocol used by the login account to access the target server. Different transport layer protocols indicate that the login account has accessed the target server different processes. Therefore, the risky transport layer protocol is pre-defined in this application. The so-called risky transport layer protocol refers to the transport layer protocol that the attacker may use when performing brute force cracking. This embodiment does not specifically limit the specific type of the risky transport layer protocol. For example, when an attacker brute-forces a target server, he usually accesses a remote-controlled process or a file-sharing process. The transport layer protocol corresponding to remote access and shared files can be used as a risky transport layer protocol.

In summary, on the basis of detecting whether the destination port is a risky port in the target server, this embodiment further detects whether the transport layer protocol is a risky transport layer protocol corresponding to the target server. Only when the detected destination port is a risky port in the target server Only when the risky port and the transport layer protocol is the risky transport layer protocol corresponding to the target server will enter the subsequent step of identifying brute force cracking. On the one hand, it reduces the task of identifying brute force cracking, and on the other hand, it ensures the accuracy of the identification results of identifying brute force cracking. .

As a preferred embodiment, risk ports include:

Any one or a combination of the RDP port used for remote desktop connection in the target server, the port used for sharing files in the target server, and the port used for connecting to a shared output device in the target server.

In this embodiment, considering that the attacker usually implements brute force cracking on the target server through remote desktop connections, shared files, and shared printers and other output devices, the RDP used for remote desktop connections in the target server port, the port used to share the files in the target server, and any one or more combinations of the ports used to connect to the shared output device in the target server are used as risk ports to further optimize the identification method for brute force cracking and ensure Target server security.

For example, when the destination port is 3389, it means that the login account wants to perform a remote desktop connection with the target server. At this time, it is considered that the login account may be a brute force cracking account.

As a preferred embodiment, the login data packet also includes the source IP and source port used by the login account;

After identifying the login account as a brute force account, it also includes:

Intercept login accounts whose IP is source IP and/or port is source port at the kernel layer.

After the brute force cracking is identified, in order to ensure that the target server will no longer accept the brute force cracking initiated by the attacker, in this embodiment, the source IP and source port used by the login account are also obtained in the kernel layer, and the Intercept the login account whose IP is the source IP and the port is any one of the source ports, so as to realize the protection of the target server.

As a preferred embodiment, after identifying the login account as a brute force cracking account, it also includes:

Generate a prompt message for prompting the user that the target server is being brute force cracked.

In order to promptly remind the user that the target server has received brute force cracking, in this embodiment, after identifying the login account as a brute force cracking account, a prompt message for prompting the user that the target server has been subjected to brute force cracking is also generated, such as issuing a voice prompt or outputting it on a display device. Prompt information, etc., this application does not specifically limit the specific type of prompt information.

In addition, after the login account is identified as a brute force cracking account, the quintuple data of the login account can also be processed, that is, output source IP, source port, destination IP, destination port, and transport layer protocol, so that the maintenance personnel of the target server can check Brute force cracking behavior is analyzed to ensure the security of the target server.

As a preferred embodiment, determining the login status of the login account within a preset period of time after the current moment is the number of failed login failures, including:

When the login status is successful login, clear the first login failure time;

When the login status is login failure, add one to the number of login failures;

When it is determined that the first login failure time is not empty, the login duration is obtained by subtracting the first login failure time from the current login status of the login account as the login failure time;

When it is determined that the first login failure time is empty, record the current login status of the login account as the time when the login failed as the first login failure time, and add one to the number of login failures;

When the login duration is less than the preset time period, enter the step of identifying the login account as a brute force cracking account when the number of failures is greater than the preset number threshold;

When the login duration is longer than the preset time period, the first login failure time is cleared and the time when the current login status of the login account is login failure is used as the first login failure time.

Please refer to FIG. 2 . FIG. 2 is a schematic flowchart of another identification method for brute force cracking provided by the present invention. In this embodiment, the determination of the number of failed login attempts within the preset period of time after the current moment for the login status of the login account is as follows: first determine the login status of the login account at the current moment, and when the login status is successful login, consider The login account is not the account of the attacker corresponding to the brute force cracking, so the time of the first login failure is cleared; when the login status is login failure, it is considered that the login account may be the corresponding account of the attacker of the brute force cracking, so the number of login failures is increased by one In order to further confirm whether the login account is a brute force cracking account based on the total number of failures within the preset time period. In order to determine the number of failures of the login account within the preset time period, the duration of the preset time period needs to be determined first. When the first login failure time is not empty, the current login status of the login account is the time when the login failed minus the first login failure time to get the login duration, and only when the login duration is less than the preset time period, it will enter the step of identifying the login account as a brute force cracking account when the number of failures is greater than the preset threshold, and when the login duration is greater than the preset time period Clear the first login failure time and use the time when the current login status of the login account is login failure as the first login failure time. When the first login failure time is empty, it indicates that the login account failed to log in for the first time, so the time when the current login status of the login account is recorded as login failure is the first login failure time, and the number of login failures is increased by one.

It can be seen that in this embodiment, the method of determining the number of login failures in which the login status of the login account is the number of login failures within the preset time period after the current moment is simple and accurate, which can further optimize the accuracy of the identification result of brute force cracking.

Please refer to FIG. 3. FIG. 3 is a schematic structural diagram of a brute force identification system provided by the present invention. The brute force identification system includes:

The login data packet acquisition unit 11 is used to obtain the login data packets of each login account at the kernel layer of the target server, wherein the login data packet includes the destination port accessed by the login account and the login status of the login account;

The number of failures determination unit 12 is used to determine the number of times that the login status of the login account within a preset period of time after the current moment is the number of failed logins when the destination port is a risky port in the target server;

The identification unit 13 is configured to identify the login account as a brute force cracking account when the number of failures is greater than the preset number of times threshold.

For the relevant introduction of a brute-force cracking identification system that you please provide, please refer to the embodiment of the above-mentioned brute-force cracking identification method, and please do not repeat it here.

On the basis of above-mentioned embodiment:

As a preferred embodiment, the login data packet also includes the transport layer protocol used by the login account to access the target server, and also includes:

The risk transport layer protocol determination unit is configured to trigger the failure times determination unit when it is determined that the transport layer protocol is the risk transport layer protocol corresponding to the target server.

As a preferred embodiment, risk ports include:

Any one or a combination of the RDP port used for remote desktop connection in the target server, the port used for sharing files in the target server, and the port used for connecting to a shared output device in the target server.

As a preferred embodiment, the login data packet also includes the source IP and source port used by the login account, and also includes:

The interception unit is used to intercept the login account whose IP is the source IP and/or the port is the source port at the kernel layer after identifying the login account as a brute force cracking account.

As a preferred embodiment, it also includes:

The prompt unit is configured to generate prompt information for prompting the user that the target server is subject to brute force cracking after identifying the login account as a brute force cracking account.

As a preferred embodiment, the unit for determining the number of failures includes:

The clearing unit is used to clear the first login failure time when the destination port is a risky port in the target server and the login status is successful login;

The counting unit is used to add one to the number of login failures when the login status is login failure;

The login duration determination unit is used to obtain the login duration by subtracting the first login failure time from the current login status of the login account when it is determined that the first login failure time is not empty;

The first login failure time determination unit is used to record the current login status of the login account as the first login failure time when the first login failure time is determined to be empty, and add one to the number of login failures;

A trigger unit, configured to trigger the identification unit 13 when the login duration is less than a preset time period;

The first login failure time update unit is used to clear the first login failure time when the login duration is longer than the preset time period, and use the time when the current login status of the login account is login failure as the first login failure time.

Please refer to FIG. 4. FIG. 4 is a schematic structural diagram of a brute force identification device provided by the present invention. The brute force identification device includes:

Memory 21, used to store computer programs;

The processor 22 is configured to implement the steps of the identification method for brute force cracking when executing the computer program.

For the relevant introduction of a brute-force cracking identification device provided in this application, please refer to the above-mentioned embodiment of brute-force cracking identification, and this application will not repeat it here.

The present application also provides a server, including the above identification device for brute force cracking.

For the relevant introduction of a server provided in this application, please refer to the above embodiment of the identification method for brute force cracking, which will not be repeated here.

The present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above identification method for brute force cracking are implemented.

For the relevant introduction of a computer-readable storage medium provided by the present application, please refer to the above-mentioned embodiment of the identification method for brute force cracking, and details are not repeated here.

It can be understood that if the methods in the above embodiments are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or part of the contribution to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , executing all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM for short), random access memory (Random Access Memory, RAM for short), magnetic disk or optical disk, etc., which can store program codes. medium.

Each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same and similar parts of each embodiment can be referred to each other. As for the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and for the related information, please refer to the description of the method part.

It should also be noted that in this specification, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements not expressly listed, or elements inherent in the process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

The above description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention will not be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (10)

1. A brute force cracking recognition method is characterized by comprising the following steps:

obtaining login data packets of all login accounts at a kernel layer of a target server, wherein the login data packets comprise target ports accessed by the login accounts and login states of the login accounts;

when the target port is a risk port in the target server, determining that the login state of the login account in a preset time period after the current moment is the number of failed login failures;

and when the failure times are larger than a preset time threshold value, identifying the login account as a brute force account.

2. The method for identifying brute force of claim 1, wherein the login packet further comprises a transport layer protocol used by the login account to access the target server;

before determining that the login state of the login account in the preset time period after the current time is the failure times of login failure, the method further comprises the following steps:

and when the transmission layer protocol is determined to be a risk transmission layer protocol corresponding to the target server, entering a step of determining that the login state of the login account in a preset time period after the current time is the number of failed login failures.

3. The method for identifying brute force attacks of claim 1, wherein the risk port comprises:

any one or more of a RDP port in the target server for remote desktop connection, a port in the target server for sharing files in the target server, and a port in the target server for connecting a shared output device.

4. The method for identifying brute force of claim 1, wherein the login packet further comprises a source IP and a source port used by the login account;

after the login account is identified as a brute force account, the method further comprises the following steps:

and intercepting a login account of which the IP is the source IP and/or the port is the source port at the kernel layer.

5. The method for identifying brute force of claim 4, wherein after identifying the login account as a brute force account, further comprising:

and generating prompt information for prompting the user that the target server is cracked violently.

6. The identification method for brute force attack according to any one of claims 1 to 5, wherein determining the login status of the login account within a preset time period after the current time as the number of failed login failures comprises:

when the login state is login success, clearing the first login failure time;

when the login state is login failure, adding one to the login failure times;

when the first login failure time is determined not to be empty, subtracting the first login failure time from the time when the current login state of the login account is login failure to obtain login duration;

when the first login failure time is determined to be null, recording the time when the current login state of the login account is login failure as the first login failure time, and adding one to the login failure times;

when the login duration is less than the preset time period, entering a step of identifying the login account as a brute force account when the failure times are greater than a preset time threshold;

and when the login duration is longer than the preset time period, clearing the first login failure time and taking the time when the current login state of the login account is login failure as the first login failure time.

7. A brute force identification system, comprising:

the login data packet acquisition unit is used for acquiring login data packets of all login accounts in a kernel layer of a target server, wherein the login data packets comprise destination ports accessed by the login accounts and login states of the login accounts;

a failure frequency determining unit, configured to determine, when the destination port is a risk port in the target server, that a login state of the login account within a preset time period after a current time is a failure frequency of login failure;

and the identification unit is used for identifying the login account as a brute force account when the failure times are larger than a preset time threshold value.

8. An apparatus for identifying brute force, comprising:

a memory for storing a computer program;

a processor for implementing the steps of the brute force identification method according to any one of claims 1 to 6 when executing the computer program.

9. A server, characterized in that it comprises brute force crack recognition means according to claim 8.

10. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the steps of the method for identification of brute force attacks according to any one of claims 1 to 6.

Images