IP address detection method and detection device, and electronic equipment

Abstract

The embodiment of the invention provides an IP address detection method, an IP address detection device and electronic equipment. In the method, service requests in a plurality of services are acquired, and each service request carries an IP address. A datum curve of the plurality of IP addresses within a preset time slot is acquired according to the IP address curve of each IP address of the plurality of IP addresses within the preset time slot, wherein the IP address curve is used for expressing a corresponding relation between the number of appearing times and appearing time of the IP address, and the datum curve is used for expressing an average variation value of the numbers of appearing times of the plurality of IP addresses corresponding to the plurality of IP addresses within the preset time slot; an offset of the IP address to be detected within the preset time slot is acquired, wherein the offset is determined via the curve of the IP address to be detected and the datum curve. When the offset is more than a preset offset threshold, the IP address to be detected is determined to be an abnormal IP address. According to the method, the IP address is completely assessed, andwhether the IP address is the normal IP address is judged, and thus recognition accuracy of the normal IP address is improved.

Description

technical field [0001] The present invention relates to the field of big data technology, in particular to a detection method, detection device and electronic equipment of an Internet Protocol (Internet Protocol, referred to as IP) address. Background technique [0002] At present, in the field of network security, the IP address dimension has always been a dimension that is difficult to accurately evaluate, that is, it is not easy to evaluate whether an IP address is a safe public exit of an IP address from the perspective of an IP address. Based on this situation, some Internet companies (such as iQIYI) obtain the relevant IP address from a third-party company as a basis for using the IP address. The third-party company is a company specializing in network security and owns all relevant IP addresses. Information, such as some cyber threat intelligence, etc. [0003] However, the inventor found in the process of realizing the present invention that the prior art has at lea...

AI Technical Summary

Problems solved by technology

In other words, third-party companies mainly focus on detecting whether an IP address has malicious behavior at a certain point in time, or for a period of time, and will not detect the normal behavior of the IP address. This approach will lead to the evaluation of the obtained IP address. inaccurate information

[0005] like figure 1 As shown, taking the detection time of one day as an example, in the process of detecting an IP address x used by a user device, a third-party company detects that the IP address x sent a spam email at 8:00 in the morning. At this time, the third-party The company determines that the IP address x is a malicious IP address, but the IP address x sends normal emails at other times of the day. It can be seen that the normal behavior of the IP address x occupies a high proportion, that is, the IP address x is in most likely non-threatening

When the third company notifies the Internet company of the behavior information of the IP address x, it will cause the IP address x to be killed by mistake

[0006] It can be seen that the IP address provided by the third-party company is not comprehensive, and the threat level of the IP address cannot be accurately measured, resulting in the normal IP address being killed by mistake

Images