The invention discloses a FastFlood detection method and device based on an Flink flow
processing engine, and the method comprises the steps: collecting flow data from various data sources in real time through the Flink flow
processing engine, and distributing the flow data to a corresponding
sliding time window; sliding the time window to allow the window to slide on the time axis, and capturing the flow change by setting the window size and the sliding step length; carrying out
statistical analysis on the flow data in each sliding-out window; the
statistical analysis result is compared with a preset threshold value, and whether typical features of the pulse type DDoS
attack are presented or not is judged; and if the pulse type DDoS
attack is identified, triggering a corresponding
protection mechanism. According to the method and the device, the limitation of an operator-level network scale can be spanned, seamless coverage and efficient
data acquisition can be realized,
attack characteristics can be accurately extracted in a complex and changeable network environment, and a high-sensitivity real-time detection model can be constructed.