Attack defense method and device

Abstract

The embodiment of the invention provides an attack defense method and device, and the method comprises the steps: when access flow is monitored, the performance state of equipment is determined; when the performance state is a target state, a score value corresponding to the access flow is determined; calculation is performed according to the present performance data, and a trust threshold value of the equipment is determined; when the score value is lower than the trust threshold value, whether the access flow matches with a preset attack characteristic is determined; and when the access flow matches with the attack characteristic, the access flow is cut. According to the embodiment, a trust score function of WAF equipment is triggered under a flow excess pressure state, whether the score value corresponding to the access flow is lower than the trust threshold value is judged to determine if the access flow needs to be subjected to a deep attack detection, so that attack flow can be detected and intercepted, safety of web server can be ensured, which means, the protecting effect is reached.

Description

technical field [0001] The present application relates to the technical field of data communication, in particular to an attack defense method and an attack defense device. Background technique [0002] With the prevalence of e-commerce, online banking, and e-government, the business value carried by the website (Web) server is getting higher and higher, and the security threats faced by the Web server are also increasing. Therefore, the defense against the Web application layer It has become an inevitable trend, and Web Application Firewall (WAF) has become popular. Among them, the Web Application Firewall is a product that provides protection for Web applications by implementing a series of security policies for HTTP / HTTPS. [0003] Usually, when the performance resources of the WAF device are idle, if the access traffic sent by the client (Client) wants to access the server (Server) at the back end of the firewall (Firewall), it needs to pass the detection of the WAF dev...

AI Technical Summary

Problems solved by technology

At this time, if the attacker constructs attack traffic by operating a client such as a personal computer to attack the server, and the WAF device does not detect any access traffic, the attack traffic cannot be intercepted, that is, the attack traffic is released.

The attack traffic can reach the server and cause an attack on the server

[0004] Obviously, when the existing WAF device is in the state of overpressure of access traffic, the method of releasing all access traffic cannot achieve the effect of protection

Images