Method and device for identifying access attacks

Abstract

The embodiment of the application provides a method and device for identifying access attacks. The method comprises the following steps: acquiring a first time interval sequence of the adjacent access in each access from the current identification user or IP in a first preset range; implementing spectrum analysis on the first time interval sequence to obtain the weight coefficients of the fundamental frequency and each subharmonic frequency of the first time interval sequence; judging whether the ratio of the weight coefficient of the fundamental frequency of the first time interval sequence to the average value of the weight coefficients of each subharmonic frequency of the first time interval sequence is greater than the preset threshold value; and if the ratio is greater than the preset threshold value, identifying each access from the current identification user or IP in the first preset range as the access attack. According to the method and device provided by the embodiment of the application, the identification is processed based on the time interval sequence of the adjacent access in each access from the same identification user or IP, and thus the diversity of various access can be shielded, the various access can be effectively identified, and relatively good universality can be achieved.

Description

technical field [0001] The present application relates to the technical field of network security, and in particular, to a method and apparatus for identifying an access attack. Background technique [0002] With the development of the Internet, the network traffic has become larger and larger, and it is necessary to continuously expand the network bandwidth and servers to process these visits. However, many of these massive accesses may be access attacks, which may seriously affect users and network resources. Therefore, how to accurately identify which of these massive accesses are access attacks is of great significance. [0003] In the prior art, it is very costly to analyze the behavior of some access attacks separately, because each access attack will have its own different characteristics, and the rules for some access attacks may not necessarily be applicable to other access attacks. In addition, with the increase of rules, the amount of calculation and the complex...

AI Technical Summary

Problems solved by technology

[0003] In the existing technology, the cost of analyzing certain access attack behaviors separately will be very high, because each access attack will have its own different characteristics, and the rules for some access attacks may not be applicable to other access attacks , and with the increase of rules, the amount of calculation and the complexity of the system will rise sharply, and subsequent maintenance will be very problematic

At the same time, some access attacks may be hidden in the access of normal users, which increases the difficulty of identifying access attacks

Images