A slow attack detection method and apparatus

Abstract

A slow attack detection method and apparatus are disclosed. The slow attack detection method is characterized in that the method comprises: determining a preset attack characteristic for calculating an attack value according to a preset attack value calculation rule; Determining values of each preset attack characteristic in the received message, and calculating an attack value of the message according to the characteristic value; Comparing whether the calculated attack value is greater than the preset attack threshold; Determining the the message is a slow attack message when the calculated attack value is greater than a preset attack threshold value, and calculating a new attack threshold value; wherein the new attack threshold is used for subsequent slow attack detection, and the new attack threshold is not greater than the old attack threshold.

Description

technical field [0001] The embodiments of this specification relate to the technical field of network communication, and in particular, to a slow attack detection method and device. Background technique [0002] With the rapid development of the network, network security issues are also increasing. DDoS (Distributed Denial of Service, Distributed Denial of Service) attack is one of the most powerful and difficult attacks at present, and its main purpose is to make the designated target unable to provide normal services. In the past, DDoS attacks were mainly single-packet large-flow attacks. In recent years, they have evolved into slow attacks. This slow attack is more concealed. It is a deformation of the normal network protocol and fully meets the protocol requirements. Therefore, Protection against slow attacks is more difficult. [0003] Slow attacks mainly consume server resources by maintaining a connection with the server with a small amount of data and a low rate. ...

AI Technical Summary

Problems solved by technology

In the past, DDoS attacks were mainly single-packet large-flow attacks. In recent years, they have evolved into slow attacks. This slow attack is more concealed. It is a deformation of the normal network protocol and fully meets the protocol requirements. Therefore, Protection against slow attacks is more difficult

[0003] Slow attacks mainly consume server resources by maintaining a connection with the server with a small amount of data and a low rate

The detection of slow attacks in the existing technology mainly judges whether it is a slow attack by detecting attributes such as the size of the requested data, the time and rate of the server response, so there is a certain false positive rate

Images