Method for detecting brute force attack and related apparatus

A network device, comprising:

• a receiver configured to obtain to-be-detected mirrored traffic between a client and a server;
• and
• a processor coupled to the receiver and configured to:
• obtain a first session information sequence based on the to-be-detected mirrored traffic, wherein the first session information sequence comprises a plurality of pieces of session information that have a one-to-one correspondence with a plurality of login sessions between the client and the server, and wherein an arrangement order of the pieces of session information in the first session information sequence is consistent with a chronological order of the login sessions;
• use the first session information sequence as a first Markov chain;
• obtain a state chain probability value of the first Markov chain, wherein each of the pieces of session information in the first session information sequence is used as a state in the first Markov chain;
• and
• determine whether the login sessions are a brute force attack based on the state chain probability value of the first Markov chain and a first benchmark probability value, wherein the first benchmark probability value identifies the brute force attack.

A computer program product comprising computer-executable instructions for storage on a non-transitory computer-readable medium that, when executed by a processor, cause a network device to:

• obtain to-be-detected mirrored traffic between a client and a server;
• obtain a first session information sequence based on the to-be-detected mirrored traffic, wherein the first session information sequence comprises a plurality of pieces of session information that have a one-to-one correspondence with a plurality of login sessions from the client to the server using the to-be-detected mirrored traffic, and wherein an arrangement order of the pieces of session information in the first session information sequence is consistent with a chronological order of the login sessions;
• use the first session information sequence as a first Markov chain;
• obtain a state chain probability value of the first Markov chain, wherein each of the pieces of session information in the first session information sequence is used as a state in the first Markov chain;
• and
• determine whether the login sessions are a brute force attack based on the state chain probability value of the first Markov chain and a first benchmark probability value, wherein the first benchmark probability value identities the brute force attack.