Application layer rapid attack detection method and related device

Abstract

The embodiment of the invention discloses a method and related device for detecting a quick attack of an application layer. The method for detecting the quick attack of the application layer comprises the following steps of: obtaining the traffic entering a server; counting the number of application layer data packets carrying a target internetworking protocol address i and a public gateway interface identifier j in the traffic entering the server in K time intervals; and, if the counted number of the application layer data packets carrying the target internetworking protocol address i and the public gateway interface identifier j in the traffic entering the server in K time intervals accords with a threshold value condition, alarming the quick attack of the application layer for the target internetworking protocol address i and the public gateway interface identifier j, wherein the target internetworking protocol address i is one internetworking protocol address in the server; and the K is a positive integer, which is greater than or equal to 1. By means of the scheme in the embodiment of the invention, the quick attack alarm accuracy of the application layer is increased easily.

Description

technical field [0001] The invention relates to the technical field of image processing, in particular to an application layer rapid attack detection method and a related device. Background technique [0002] At present, cyber attacks appear frequently and can be said to be ubiquitous. There are a large number of hackers and various computer viruses hidden in the Internet. For some servers that provide network services, it is often difficult to provide services normally when they are attacked by the network. [0003] Application layer rapid attack is a common network attack method, which has caused great obstacles to the normal operation of the server. Therefore, how to quickly and accurately detect whether the server is currently suffering from application layer rapid attack becomes very important. [0004] The inventors of the present invention have found in the course of research and practice that the existing application-layer rapid attack detection algorithm generally...

AI Technical Summary

Problems solved by technology

[0004] The inventors of the present invention have found in the course of research and practice that the existing application-layer rapid attack detection algorithm generally only judges whether the server is currently suffering from application-layer rapid attack based on the statistical results of the number of HTTP requests received by the server. However, practice has found that the false positive rate of this detection algorithm is quite high.

Images