Method and device for computing malice index

Abstract

Embodiments of the invention provide a method and a device for computing a malice index. The method comprises the steps of determining an Internet protocol (IP) address corresponding to attack behavior when detecting the attack behavior; obtaining the recorded malice index corresponding to the IP address according to the IP address; and computing and updating the malice index corresponding to the IP address based on the recorded malice index. According to the method, the malice index is only iteratively computed and updated according to the recorded malice index and the current attack condition, such as the attack condition in the period or the short time, so that the storage of a large amount of logs is not needed, and thus the occupation of a storage space is reduced, and meanwhile, one or more attack behavior within a predetermined time is recorded as one attack behavior, so that a condition that each malice index is close to 1 can be avoided, and the accuracy for distinguishing the malice index of each IP is improved.

Description

technical field [0001] Embodiments of the present invention relate to the field of computer technology, and more specifically, embodiments of the present invention relate to a method and device for calculating a malicious index. Background technique [0002] This section is intended to provide a background or context for implementations of the invention that are recited in the claims. The descriptions herein are not admitted to be prior art by inclusion in this section. [0003] In the existing DDoS (Distributed Denial of Service, Distributed Denial of Service) defense system, there are blacklist IP (Internet Protocol, Internet Protocol), whitelist IP and gray list IP, wherein: blacklist IP is in DDoS defense system It can refer to malicious IPs that have been manually confirmed, and the access behavior of these IPs will be directly discarded; whitelist IPs in the DDoS defense system can refer to manually confirmed benign IPs, and the access behavior of these IPs will be di...

AI Technical Summary

Problems solved by technology

[0004] The IP in the existing gray list IP has only one level, and the malicious index of each IP in the gray list cannot be accurately distinguished. Among them, the malicious index can refer to the degree of maliciousness of the IP in the gray list IP, and the larger the value, the higher the IP level. The more previous attacks

Images