Application layer DDoS attack detection method and device

Abstract

The invention relates to an application layer DDoS attack detection method and device. The method comprises the following steps: extracting access feature information from access data; obtaining a membership function of a comment set corresponding to each evaluation factor; determining a membership function corresponding to an access feature value according to the evaluation factor corresponding to the access feature information; calculating a membership degree of the access feature information for each comment set according to the membership function; and determining whether an access requestcorresponding to the access data is a DDoS attack. By adoption of the technical scheme, the accuracy and efficiency of detection are effectively improved, the false positive rate and the missed rateare reduced, and the security of the server is further improved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an application layer DDoS attack detection method and device. Background technique [0002] Application layer DDoS attack is a form of network attack with strong operability and serious attack damage. Its main attack target is commercial or government servers. In order to ensure network security, many application layer DDoS attack detection products have been launched on the market. Most of them use abnormal pattern matching to detect the offensiveness of data flow, that is, according to the previous attack data flow, summarize the attack data flow characteristics and behavior methods, when the existing access data flow and attack data flow characteristics and behavior methods have a high degree of matching When , it is judged that the data flow is an attack data flow. The big disadvantage of this method is that when a new attack pattern is generated, because there is no...

AI Technical Summary

Problems solved by technology

[0002] Application layer DDoS attack is a form of network attack with strong operability and serious attack damage. Its main attack target is commercial or government servers. In order to ensure network security, many application layer DDoS attack detection products have been launched on the market. Most of them use abnormal pattern matching to detect the offensiveness of data flow, that is, according to the previous attack data flow, summarize the attack data flow characteristics and behavior methods, when the existing access data flow and attack data flow characteristics and behavior methods have a high degree of matching When , it is judged that the data flow is an attack data flow. The big disadvantage of this method is that when a new attack pattern is generated, because there is no data method that can be learned and summarized, the detection effect of this method is poor.

Images