Method and device for determining attack destination IP of DDOS attack

Abstract

The application provides a method and device for determining an attack destination IP of DDOS attack. The method comprises the following steps: acquiring a traffic ranking list, wherein the traffic ranking list comprises a target source IP, a plurality of destination IPs and the traffic between the target source IP and each destination IP, and the traffics are ranked according to the traffic size; acquiring an abnormal a traffic threshold value by multiplying by the total traffic size according to a preset coefficient; judging whether the maximum traffic in the traffic ranking list is less than the abnormal traffic threshold value; if the maximum traffic is less than the abnormal traffic threshold value, orderly accumulating the maximum traffic and the next traffic in the traffic ranking list, comparing whether an accumulation result is less than the normal traffic threshold value, and determining the destination IP corresponding to the accumulation result as the attack destination IP until the accumulation result is not less than the abnormal traffic threshold value. By use of the method provided by the application, the problem that the attack traffic is not led or the normal service is influenced since the related technology is hard to determine the attack destination IP of the DDOS attack is solved.

Description

technical field [0001] The present application relates to the field of security protection, in particular to a method and device for determining an attack destination IP of a DDOS attack. Background technique [0002] In a DDOS (Distributed Denial of Service, Distributed Denial of Service) attack, both the source of the attack and the purpose of the attack are uncertain. When a server is controlled by a hacker to become a puppet machine and attacks to multiple IPs, a general abnormal traffic cleaning device will pull the attack traffic based on the attack destination IP. If the abnormal traffic cleaning device pulls more attack destination IPs than the actual attacked IPs, misleading will occur, resulting in normal traffic being killed by mistake. Therefore, determining the attack destination IP of a DDOS attack is very important for protecting against DDOS attacks. [0003] In related technologies, when there may be a DDOS attack from any attack source IP in the network, ...

AI Technical Summary

Problems solved by technology

[0005] In view of this, this application provides a method and device for determining the attack destination IP of a DDOS attack, which is used to solve the problem in related technologies that it is difficult to determine the attack destination IP of a DDOS attack, resulting in that the attack traffic is not pulled or the normal business is affected The problem

Images