An intelligent interception method and system for various attacks

Abstract

The invention discloses an intelligent intercepting method and system for multiple attacks. The method includes a step of acquiring information of a network access request, a step of selecting at least one feature parameter from a configuration file and a method of calculating at least one feature parameter value based on the information of the network access request and calculating at least one parameter value in a set time period, and a step of selecting a judgment rule from the judgment rule set according to the selected feature parameter and the method of calculating the feature parametervalue, and determining an interception target based on the calculated at least one feature parameter value in the set time period and the selected judgment rule. According to the method and the system, various attacks can be effectively treated, at the same time, the false intercepting rate is greatly reduced, and in addition, the access response time is reduced.

Description

technical field [0001] The invention relates to the field of wireless network communication, in particular to an intelligent interception method and system for various attacks. Background technique [0002] At present, most firewalls usually use frequency statistics to identify malicious access source IPs, but this method is too simple in function and may cause accidental killings. Moreover, traditional firewalls are serially deployed in the path of transmitting network access requests. The input of the firewall is user traffic, and according to the user traffic and according to specific rules, the transmitted data is allowed or restricted to pass through. A firewall using this method has a relatively fixed method of determining interception targets based on traffic, and cannot flexibly respond to various attacks. In addition, when determining the object to be intercepted, the user's traffic needs to be transmitted through the firewall, which will increase the access respon...

AI Technical Summary

Problems solved by technology

[0002] At present, most firewalls usually use the method of frequency statistics to identify malicious access source IP, but this method is too simple and easy to cause accidental killing

Moreover, traditional firewalls are serially deployed in the path of transmitting network access requests. The input of the firewall is user traffic. According to the user traffic and according to specific rules, the transmitted data is allowed or restricted to pass through.

The firewall using this method has a relatively fixed method of determining interception targets based on traffic, and cannot flexibly respond to various attacks.

In addition, when determining the object to be intercepted, the user's traffic needs to be transmitted through the firewall, which will increase the access response time

Images