DDoS attack group analysis method based on network attack accompanying behavior

Abstract

The invention relates to a DDoS attack group analysis method based on a network attack accompanying behavior. The DDoS attack group analysis method comprises: acquiring all the control end IPs of DDoSattack behaviors within a preset time, and attack target trajectories and utilization broiler trajectories corresponding to each control end IP; calculating the attack target trajectory similarity and the utilization broiler trajectory similarity of each control terminal IP and each of the other control terminal IPs except the control end IP; constructing a relationship diagram according to all the calculated random two control end IPs, the corresponding attack target trajectory similarity and the corresponding broiler trajectory similarity; dividing the DDoS attack group according to the constructed relationship diagram. The invention collects and analyzes Internet attack resources involved in a large number of DDoS attack events, establishes a time-space multi-dimensional relationship-based attack sequence for scattered DDoS attack events, and finds the association and attribution of these attack resources during the DDoS attack events, thereby supporting discovery of important andorganized DDoS attack groups.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a DDoS attack group analysis method based on network attack accompanying behavior. Background technique [0002] In recent years, many research institutions and security companies have conducted research and elaboration on DDoS (Distributed Denial of Service) attacks, defenses, and situation, and released a series of scientific research papers and analysis reports. DDoS attack is a network attack method, which usually uses bot resources as the attack platform or uses special attack software tools to send seemingly reasonable service requests to the victim host to occupy a large amount of server resources, resulting in network congestion or server resource exhaustion. As a result, the server rejects legitimate users, and broiler resources can be understood as computer equipment that has been infected with a Trojan horse virus and can be remotely controlled. [0003] Howe...

AI Technical Summary

Problems solved by technology

[0003] However, the existing DDoS attack analysis methods are mainly methods for defending and tracing the source of a single DDoS attack. They mainly start from the DDoS attack event itself to study the detection method, defense method, and source tracing method of a single attack or a certain type of attack. Comprehensive analysis of aggregated event data, especially group analysis of the origin of the attack

Therefore, it is difficult for the existing DDoS attack analysis methods to systematically form a grasp of the attack group that initiated the attack event

Images