Service access control method and device

Abstract

The invention discloses a service access control method and device. The method comprises the following steps: acquiring network link behavior state data corresponding to a request initiator which initiates a service access request in automatic protection performed for the service; detecting whether a network link behavior triggered by the request initiator is a suspicious attack behavior accordingto the network link behavior state data; rejecting the request initiator with suspicious attack behavior to access to service in a dynamically controlled time range. On the one hand, the recognitionprecision of the suspicious attack behavior is improved; on the other hand, the server only reject the service access request initiated by the request initiator in the dynamically controlled time range for the request initiator detected as the suspicious attack behavior; for the request initiator misjudged as the suspicious attack behavior, the service can be visited as normal out of the time range, and effectiveness of the service protection is guaranteed.

Description

technical field [0001] The present disclosure relates to the field of computer technology, in particular to a service access control method and device. Background technique [0002] Distributed Denial of Service attack (Distributed Denial of Service, DDoS) means that the attacker uses a large number of Internet computers implanted with backdoor Trojan horses to launch a large number of normal or abnormal requests to the target, exhausting the target host resources or network resources, so that The attacked host cannot provide services for legitimate users. In the prior art, when a DDoS attack occurs, the operation and maintenance personnel will automatically add the found request originator of the suspected attack source to the firewall through an automated script, thereby automatically blocking the service access initiated by the request originator, but this method will The request initiator has a high probability of being misjudged as a suspected attack source, and if the...

AI Technical Summary

Problems solved by technology

[0002] Distributed Denial of Service attack (Distributed Denial of Service, DDoS) means that the attacker uses a large number of Internet computers implanted with backdoor Trojan horses to launch a large number of normal or abnormal requests to the target, exhausting the target host resources or network resources, so that The attacked host cannot provide services for legitimate users

In the prior art, when a DDoS attack occurs, the operation and maintenance personnel will automatically add the found request originator of the suspected attack source to the firewall through an automated script, thereby automatically blocking the service access initiated by the request originator, but this method will The request initiator has a high probability of being misjudged as a suspected attack source, and if the request initiator is misjudged as a suspected attack source, the misjudged request initiator will not be able to access the business normally for a long time

Images