Method and equipment for detecting network attack

Abstract

The invention discloses a method for detecting network attack comprising: receiving a data pack, getting a comparison value of an average distance value at the adjacent observation time of the data pack; accumulating and counting the comparison value, getting a statistics of the cumulative sum; judging the network attack when the statistics of the cumulative sum exceeds the presetting threshold in a presetting observation period. In the invention, the CUSUM algorithm is mainly to accumulate the variable values which are obvious higher than the average level under a normal operation condition, that is to accumulate the differences, thereby the network attack is more accurately detected and the false alarm rate is reduced; simultaneously the algorithm is simple and the network can be quickly detected.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a method and equipment for detecting network attacks. Background technique [0002] The basic principle of DDoS (Distributed Denial of Service, Distributed Denial of Service) flooding attack is that the attacker sends a large number of service requests or a large number of data packets to the victim by launching a huge number of puppet machines, and finally exhausts the victim's host or network resources, so that victims can no longer provide external services, such as figure 1 Shown is the structure diagram of DDoS Flooding attack. Because the attack tool of DDoS Flooding is very simple, and has the characteristics of huge destructiveness and difficulty of detection and defense, which makes DDoS Flooding attack become one of the biggest security threats in today's Internet network. There are many DDoS Flooding detection and defense methods, but the effect is not very go...

AI Technical Summary

Problems solved by technology

[0004] In the process of realizing the present invention, the inventors have found that there are at least the following problems in the prior art: due to the huge number of network nodes and complex network topology, normal customer access is random, and it is difficult to use only the statistical characteristics of data packets in a certain An abnormal change in time determines that a DDoS Flooding attack has occurred

The methods in the prior art can easily misreport normal network access fluctuations or normal sudden large traffic accesses as DDoS Flooding attacks

Images