Attack request determination method and device and server

Abstract

The invention provides an attack request determination method. The method comprises the steps of receiving an access request; extracting first request information in the access request and matching the first request information with information in various preset blacklists supporting various matching parameters; and determining that the access request is an attack request when the information matches the information in any type of blacklist successfully. Through application of the technical scheme provided by the invention, the problem that in the prior art, a mode of determining the attack request only through the access times of an IP (Internet Protocol) address does not adapt to a CC (Challenge Collapsar) attack type of which access frequency for the IP address is not high, various CC attacks cannot be precisely identified and a manslaughter rate is high is solved; the access request can be judged based on various matching parameters; the judgment dimensionality is relatively wide;a judgment mode is relatively flexible; and a judgment result is relatively accurate.

Description

technical field [0001] The present application relates to the technical field of Internet security, in particular to a method, device and server for determining an attack request. Background technique [0002] With the continuous development of Internet services, the pages of the website are becoming more and more complex, and the website needs to consume more and more resources to process the requests. In this case, the more users visit, the higher the system load. Websites are vulnerable to CC (Challenge Collapsar, challenge black hole) attacks. CC attacks will cause huge resource consumption, which will cause the page to open very slowly. If CPU (Central Processing Unit, central processing unit) or bandwidth resources are consumed As far as possible, the service may be unavailable, which will affect the user's access to the network, and the user experience will be poor. [0003] In the prior art, the CC attack is mainly determined by counting the visits of IP (Internet P...

AI Technical Summary

Problems solved by technology

[0005] This application provides a method and device for determining attack requests to solve the problem that the prior art method of determining attack requests only through the number of visits to IP addresses is not applicable to CC attack types with low frequency of IP address visits, and cannot accurately identify various types CC attacks, high manslaughter rate, etc.

Images