Method and device for dynamic threshold anomaly traffic detection of DDOS (distributed denial of service) attack

Abstract

The invention discloses a method and a device for dynamic threshold anomaly traffic detection of DDOS (distributed denial of service) attack. The method includes: acquiring historical data of anomaly traffic detection, and generating a traffic threshold above a tolerable line and a traffic threshold below the tolerable line of anomaly traffic detection according to the historical data of anomaly traffic detection; comparing a traffic value obtained by detection to the traffic threshold above the tolerable line and the traffic threshold below the tolerable line of anomaly traffic detection; if the traffic value is larger than the traffic threshold above the tolerable line or smaller than the traffic threshold below the tolerable line, sending out an anomaly traffic detection alarm. By the method and the device for dynamic threshold anomaly traffic detection of the DDOS attack, the traffic threshold above the tolerable line and the traffic threshold below the tolerable line can be generated effectively by utilization of the historical data, the defect of high difficulty in threshold determination in the process of anomaly traffic detection of the DDOS attack n the prior art is made up, accuracy of DDOS anomaly traffic detection is improved significantly through a statistics-based threshold determination method, and false alarm rate of anomaly traffic detection alarm is lowered.

Description

technical field [0001] The present invention relates to the technical field of network security in the communication field, in particular to a DDOS attack dynamic threshold abnormal traffic detection method and device. Background technique [0002] DDOS is the abbreviation of Distributed Denial of Service, that is, distributed denial of service. DDOS attack, that is, distributed denial of service attack, refers to a host computer controlling a large number of puppet hosts on the network to launch a denial of service attack on the attack target at the same time, in order to exhaust server resources. At present, there are usually two methods of detecting DDOS attacks: anomaly detection and misuse detection. [0003] When using the misuse detection method, it is necessary to extract the characteristics of each attack, and then compare the current traffic characteristics with the signatures of each attack in the attack knowledge base. If they match, it can be determined that th...

AI Technical Summary

Problems solved by technology

Since in a complete multi-step attack, the attack may last for many days, the misuse detection method cannot detect that the system is attacked in real tim

Images