Method, system and equipment for judging network attack

Abstract

The embodiment of the invention discloses a judgment method for network attack, which comprises the following steps: flow characteristic information sent by detection equipment is received; and whether the attack appears is judged by comparing the flow characteristic information sent by detection equipment with a local flow baseline which is dynamically adjusted according to history data. The embodiment of the invention also discloses a judgment system and judgment equipment for the network attack. With the embodiment of the invention, whether the attack appears is judged through the flow baseline which is dynamically adjusted, whether a host group in a large range is attacked can be promptly and effectively judged, and the timely alarm is performed to start corresponding defensive measures. The judgment method for the network attack overcomes the defect that the misreporting and the missing report of the attack are easy to appear when a unified static benchmark value is adopted for alarm protection of the network attack.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a method, system and equipment for judging a network attack. Background technique [0002] With the development of the network, the attacks on the network are becoming more and more diverse and complex. Among them, the most harmful attacks are DoS (Denial of Service, denial of service) attacks and DDoS (Distributed Denial of Service, distributed denial of service) attacks. This kind of attack consumes the resources and bandwidth of the target by sending large-scale attack packets, paralyzing the network and causing a lot of losses. [0003] In order to defend against DDos attacks, more and more network devices have begun to support the detection and defense of abnormal traffic and attack traffic. The current DDos attack detection measures usually set different static benchmark values ​​according to different attack characteristics, and judge whether the target is attacke...

AI Technical Summary

Problems solved by technology

[0005] When carrying out large-scale protection, there are hundreds of thousands of protection targets, and the traffic characteristics of each target are different, so it is impossible to customize the benchmark value for each target

However, it is impossible to define a unified benchmark value, which will cause false positives and false negatives of attacks

Since the baseline value is different at different time periods, setting a baseline value will lead to a long delay in attack detection

Images