Attack detection method and device based on IP and HOST

Abstract

The invention discloses an attack detection method and device based on an IP and a HOST, and an attack intercepting method and device based on the IP and the HOST. The attack detection method based on the IP and the HOST comprises the following steps that a network access data packet is obtained, the IP and the HOST are analyzed out of the network access data packet, wherein the IP is a source IP address of the network access data packet, and the HOST is a target website domain name of the network access data packet; statistics is carried out on the first number of the network access data packet of the specified IP on the specified HOST within a preset time period; if the first number reaches a preset threshold value, the network access including the IP and the HOST is determined as a network attack. Therefore, according to the technical scheme, network access data packets sent when a single host of the specified IP or part of hosts of a local area network carry out network access on remaining internet servers corresponding to the HOST cannot be wrongly intercepted.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an attack detection method and device based on IP and HOST, and an attack interception method and device based on IP and HOST. Background technique [0002] With the development of the Internet, there are more and more attacks on the Internet, which bring many adverse effects to Internet servers. Among them, DOS (Denial Of Service, denial of service) and information bomb are two relatively common attack methods. The attacker's machine sends a large number of requests to the target machine to consume the system resources and bandwidth resources of the target machine, causing the target server to be overloaded and the network to be congested, thereby affecting the normal use of network services. [0003] At present, most Internet server defense methods are based on IP (Internet Protocol, Internet Interconnection Protocol) address to intercept. Carry out targeted intercep...

AI Technical Summary

Problems solved by technology

The attacker's machine sends a large number of requests to the target machine to consume the system resources and bandwidth resources of the target machine, causing the target server to be overloaded and the network to be congested, thus affecting the normal use of network services

[0003] At present, most Internet server defense methods are based on IP (Internet Protocol, Internet Interconnection Protocol) address to intercept. Carry out targeted interception

[0004] For example, when a user attacks some specific network servers due to reasons such as Trojan horse infection, and the user himself, the network access to the rest of the The access to the network server is also easily mistaken for a network attack and intercepted by the network security server

[0005] Or, in the prior art, multiple users in the local area network often share the same gateway and egress IP. When some users in the local area network attack specific network servers, other users in the local area network attack the rest of the Internet servers. Normal access will also be blocked

Images