Method and device for defending distributed denial of service attack

Abstract

The invention relates to the technical field of network safety and especially relates to a method and a device for defending distributed denial of service (DDOS) attack. The method and device are used for solving the problem in the prior art that a protected terminal can not be effectively protected in real time when a flow cleaning device encounters with DDOS attack. The method provided by the embodiment of the invention comprises the following steps: judging if the flow cleaning device encounters with DDOS attack according to a flow statistic data reported by the flow cleaning device corresponding to the protected terminal when a cloud security service center detects that the state of the protected terminal meets a preset fault condition; sending an instruction for capturing the message to the flow cleaning device after confirming that the flow cleaning device encounters with DDOS attack; receiving the message sent by the flow cleaning device and generating an updating defense strategy for the flow cleaning device by analyzing the attack features of the received message; and sending the generated updating defense strategy to the flow cleaning device, so that the flow cleaning device defends the DDOS attack.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a method and device for defending against distributed denial of service (Distributed Denial of Service, DDOS) attacks. Background technique [0002] At present, network security issues are becoming increasingly prominent, and DDOS attacks have become one of the most common attack methods on the Internet. [0003] In the prior art, a traffic cleaning device is mainly used for protection against DDOS attacks launched on the network, and the operation mode of the traffic cleaning device is as follows. [0004] The attack and defense personnel manually configure the protection strategy of the traffic cleaning device in advance according to the customer's business characteristics and network environment. The pre-configured protection strategy directly affects the protection effect of the traffic cleaning device. However, due to the complex and changeable characteris...

AI Technical Summary

Problems solved by technology

[0008] The embodiment of the present application provides a method and device for defending against DDOS attacks, which are used to solve the problem that the traffic cleaning device in the prior art cannot update the protection strategy in time and cannot effectively protect the protected end in real time when encountering a DDOS attack

Images