Network attack detection method and apparatus

Abstract

The invention discloses a network attack detection method and an apparatus. The method comprises the following steps of acquiring target resource access times of an access source in a period to be detected, wherein the target resource is at least one resource related to a target domain name; according to the target resource access times of the access source, calculating a conditional entropy to be detected, wherein the conditional entropy to be detected is a conditional entropy of the access source when the target resource is accessed in the period to be detected; determining whether the conditional entropy to be detected is in a first detection data set, wherein under the condition that the conditional entropy to be detected is in the first detection data set, a situation that the target domain name is attacked in the period to be detected is determined. In the related technology, only according to an access frequency of the access source or only according to a frequency of being accessed of the target resource, whether the target domain name is attacked is determined so that network attack detection accuracy is low. By using the method and the apparatus of the invention, the above technical problem is solved.

Description

technical field [0001] The invention relates to the field of the Internet, in particular to a network attack detection method and device. Background technique [0002] CC attack (Challenge Collapsar) is a DDos attack method at the application layer. Its principle is based on the barrel theory. It mainly attacks applications that require more resource overhead in the application layer. For example, frequent access requires a large amount of CPU resources on the server for calculation. pages, or applications that require heavy access to the database. The main feature of CC attacks is that the attack traffic does not need to be large, and the number of access requests does not need to be large, but it can occupy a large amount of server resources and make the server paralyzed. [0003] At present, most of the detection methods for CC attacks start from the access source, such as the IP that sends the request, through real-time statistics of the request frequency of the IP, and...

AI Technical Summary

Problems solved by technology

[0004] However, regardless of whether it is to count the frequency of IP requests or the frequency of access to target resources, the detection methods in the prior art are considered relatively one-sidedly, and the overall situation of access is not considered comprehensively, so that missed or false detections often occur when detecting attacks The detection accuracy is usually not high

Furthermore, the pre-set threshold will also affect the detection results. When the threshold is set unreasonably, the accuracy of the detection results will also be reduced.

[0005] For the above problems, no effective solution has been proposed

Images