Method and device for adjusting target hitting characteristics according to attacking logs

Abstract

The invention relates to a method and device for adjusting target hitting characteristics according to attacking logs. An IP address of a terminal can hit the plurality of target hitting characteristics in a certain period of time when the terminal attacks a protected web server, and each target hitting characteristic corresponds to a small number of attacking logs. Therefore, the target hitting characteristics and target websites of all attacking logs in the same IP address in the first time interval are the same, and when the number of all the attacked logs in the first time interval is larger than or equal to a first preset threshold, it is considered that a false alarm is given when the IP address browses the target website, the IP address and the target website are simultaneously avoided in the target hitting characteristics, and therefore the terminal with the IP address is not intercepted when the terminal browses the target website and is matched with the target hitting characteristics, terminals with other IP addresses are intercepted when the terminals browse the target website and are matched with the target hitting characteristics, and the attacking logs are generated. False alarms are reduced without directly abolishing a certain rule and on the premise of not reducing the defending effect.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a method and device for adjusting hit features according to attack logs. Background technique [0002] The defense based on Web site attacks can be defended with a web application firewall (WAF). Web application firewalls have a built-in rule base, which extracts common attack features that attack web sites. When a packet passes through the web firewall, the detection engine compares it with the predefined features to detect whether the packet submitted to the web server is There is an attack. The built-in rule base will set a default action for each rule according to the complexity and severity of the rules. If a rule is matched, the WAF firewall will determine how to further process the packet according to the default action of the rule. [0003] Due to the complexity and diversity of network packets, user network implementation environments are different, and rule fa...

AI Technical Summary

Problems solved by technology

[0005] This method has obvious disadvantages: manual analysis of logs is very inefficient. On the one hand, more manpower is required for log analysis. On the other hand, log analysts also have certain skill requirements, and they need to be familiar with attacks to give correct analysis. As a result, the requirements for manpower and skills are relatively high, and the overall investment is relatively large

The adjustment of features cannot be fine-tuned. If there is a false positive, it is generally to enable or disable the rule. A certain rule may not apply to a certain URL and IP address, but it is still applicable to other environments. Directly disabling a certain rule may will reduce the defense effect

Images