Method and apparatus for processing network attack

Abstract

The embodiment of the invention discloses a processing method and a processing device of network attack. The method includes: after determining the attacked target, searching the recorded attach accident corresponding to the attacked target to determine the controlled host computer in the attack network; according to the recorded control accident researched by the controlled host computer and corresponding to the controlled host computer, determining the control host computer in the attack network; and determining the detected host computer which has the same communication with a plurality ofcontrol host computers as an attack operator. Correspondingly, the embodiment of the invention further provides a processing device. The technical proposal provided by the embodiment of the inventioncan provide a whole network attack topology and find out the real attack organization controller.

Description

technical field [0001] The present invention relates to the technical field of communications, and in particular to a network attack processing method and processing device. Background technique [0002] DDOS (Distributed Denial of Service, distributed denial of service attack) attack is one of the flood attacks, mainly refers to the attacker using the main control host as a springboard (possibly multi-level and multi-level) to control a large number of infected Hosts form an attack network to carry out large-scale denial of service attacks on victim hosts. This kind of attack can often amplify the attack of a single attacker in a series form, thus causing a significant impact on the victim host and causing serious network congestion. [0003] There are many ways to detect DDOS attacks in the prior art, such as traffic anomaly detection, packet sending frequency detection, characteristic packet detection, and the like. Traffic anomaly detection is mainly based on the princ...

AI Technical Summary

Problems solved by technology

[0005] The information obtained when the prior art detection method detects a DDOS attack is only an isolated event in the entire DDOS attack, for example, it is either some control packets or attack packets, or the flow of certain protocols of the victim host is large. Anomalies in scale, etc., but in fact these events are closely related, the existing technology does not take these isolated events into consideration, so it cannot provide a complete network attack topology, and cannot find the real attack controller

Images