Method, device and system for quantifying defense results

Abstract

The embodiment of the present application provides a method and system for quantifying defense results, wherein the method includes: obtaining a set of suspicious data flows, the set of suspicious data flows being each of the set of suspicious IP addresses contained in the original data flow located at the defense end of the cloud platform The data traffic corresponding to the suspicious IP address is composed; the normal data traffic is obtained, and the normal data traffic is the remaining data traffic after the defense end cleans the suspicious data traffic set according to the preset defense strategy; the performance parameters of the authorized host, the host The performance parameter is a set of parameters extracted on the target end after the defense end sends the normal data traffic to the target end; the defense result is quantified based on the target parameter set; the target parameter set at least includes: Collection of suspicious data traffic, normal data traffic, and host performance parameters. Since the evaluation angles and indicators for calculating the defense results in this application are more comprehensive, the defense results are more accurate.

Description

technical field [0001] The present application relates to the field of network technologies, and in particular to methods, devices and systems for quantifying defense results. Background technique [0002] With the continuous advancement of network technology, there are more and more network attacks in the network field. At present, among many network attacks, Distributed Denial of Service (DDoS) has become a relatively serious attack means. For this reason, a defensive end is added to the original system architecture to block DDoS attacks. [0003] Such as figure 1 As shown in FIG. 2 , it is a schematic diagram of an existing network system architecture. As can be seen from the figure, the system architecture includes the business end, routing equipment, defense end and target end. Among them, the business end includes normal business end and attack end. The attack end sends various forms of attack data traffic, and the defense end blocks attack data traffic according ...

AI Technical Summary

Problems solved by technology

[0005] At present, due to the incomplete methods used in the evaluation of defense results, incomplete parameter indicators, and incomplete data flow, the results of evaluating defense results are inaccurate

Images