Gateway attack prevention method and device

Abstract

The invention provides a gateway attack prevention method and device. The method comprises the steps: obtaining the number of access requests received by each interface of a gateway in a unit time; determining an unsafe interface based on the comparison of the obtained number of access requests received by the interface of the gateway in a unit time with the threshold value of the number of access requests received by the interface in a unit time, wherein the threshold value is determined in advance based on the maximum number of load access requests of the interface in a unit time and the proportion of the counted mean load saturation degree of the interface to the sum of the mean load saturation degrees of all interfaces of the gateway; and determining the address of an unsafe visitor at the unsafe interface based on the number of requests of the visitor, visiting the unsafe interface, for access to the unsafe interface in the unit time. The method reduces the possibility of taking the frequent visit of a normal user as the attack while recognizing the address of the unsafe visitor more accurately.

Description

technical field [0001] The invention relates to network security, in particular to a gateway attack prevention method and device. Background technique [0002] In computer networks, gateways are often used. The main function of the gateway is to prevent attacks and limit traffic, so as to ensure network security. For example, if a gateway is set up in an enterprise, messages to access the intranet of the enterprise must first enter the gateway. The gateway recognizes malicious attacks, thereby denying access, and restricting the traffic when the traffic entering the gateway is too large, so as to ensure the security of the enterprise intranet. At present, the main method of gateway attack prevention is: the number of requests entering the gateway through a certain visitor address (such as IP address) per unit time. When the number of times reaches the predetermined threshold, it is considered that the visitor address has an attack behavior, and it is pulled into the black...

AI Technical Summary

Problems solved by technology

The disadvantage of this method is: if the threshold is set too small, normal frequent requests from a certain visitor address may be regarded as attacks; if the threshold is set too large, when faced with attacks from multiple visitor addresses, it is easy to cause service unavailable, or even down

This practice req

Images