Application layer slow-speed attack detection method and correlation apparatus

Abstract

The embodiments of the invention disclose an application layer slow-speed attack detection method and a correlation apparatus. The application layer slow-speed attack detection method comprises the following steps: obtaining a flow entering a server; based on the obtained flow entering the server, counting the quantity of transmission layer empty chains initiated to the server within preset duration; and if the counted quantity of the transmission layer empty chains is greater than or equal to a first threshold and the quantity of application layer data packets carrying a destination internetworking protocol address i and a public network gateway interface identification j in the flow entering the server within k periods accords with a preset threshold condition, performing application layer slow-speed attack alarm on the destination internetworking protocol address i and the public network gateway interface identification j, wherein the destination internetworking protocol address i is one of internetworking protocol addresses of the server. According to the technical scheme provided by the embodiments of the invention, the accuracy of the application layer slow-speed attack alarm is improved.

Description

technical field [0001] The invention relates to the technical field of image processing, in particular to an application layer slow attack detection method and a related device. Background technique [0002] At present, cyber attacks appear frequently and can be said to be ubiquitous. There are a large number of hackers and various computer viruses hidden in the Internet. For some servers that provide network services, it is often difficult to provide services normally when they are attacked by the network. [0003] Application layer slow attack is a common network attack method. This attack method has caused great obstacles to the normal operation of the server. Therefore, how to slowly and accurately detect whether the server is currently suffering from application layer slow attack becomes Very important. [0004] The inventors of the present invention found in the course of research and practice that the existing application layer slow attack detection algorithm gener...

AI Technical Summary

Problems solved by technology

[0004] The inventors of the present invention found in the course of research and practice that the existing application layer slow attack detection algorithm generally only judges whether the server currently suffers from application layer slow attack by statistical results of the public gateway interface in the HTTP request. However, the practice has found that the false positive rate of this detection algorithm is quite high

Images