Anti-attack method based on threat intelligence

Abstract

The invention relates to an anti-attack method based on threat intelligence. An HAProxy server obtains a high-level threat IP from an ElasticSearch platform, if the access frequency of the updated advanced threat IP to the HAProxy server exceeds a threshold value, network layer blocking is performed, an access log is not recorded, otherwise, the access behavior of the client is recorded in the network layer, an access log marked is generated based on any access behavior of updating the advanced threat IP, the access log is analyzed and fed back to the node of the corresponding HAProxy server.The invention discloses a distributed synchronization advanced threat IP. The method has the advantages that the advanced threat IP is directly blocked on the network layer from the source, the accessflow of the client is reduced, the protection effect is achieved, the flow of the server is reduced, the function of directly blocking the malicious IP is achieved, the flow occupied by unnecessary data packets in the network is avoided, and the method is high in accuracy, low in false alarm rate and low in cost.

Description

technical field [0001] The present invention relates to the transmission of digital information, such as the technical field of telegram communication, and in particular to an attack defense method based on threat intelligence. Background technique [0002] With the rapid development and increasing attention in the field of computer security, the term "threat intelligence" has rapidly emerged in this field, which is evidence-based knowledge about existing or potential threats to IT and information assets, including situations, mechanisms , indicators, inferences and feasible suggestions. These knowledge can provide decision-making basis for threat response. Therefore, many security companies are providing threat intelligence services, and the security emergency response centers of many enterprises have also begun to receive threat intelligence, and the proportion of business is gradually increasing. The purpose of helping enterprises judge the current development status and ...

AI Technical Summary

Problems solved by technology

[0005] The present invention solves the immeasurable threat to customers caused by long-term and persistent IP attacks in the prior art. Traditional web security protection mainly blocks IP access behaviors in real time by identifying these attack types, and there are false positives and delays. The problem of high degree and low efficiency provides an optimized threat intelligence-based attack defense method

Images