A CC protection method based on CDN node logs

Abstract

The invention discloses a CC protection method based on a CDN node log, and the method comprises the following steps: 1, obtaining the IP request information in the CDN node log, and carrying out theanalysis and judgment of whether the attack exists or not according to the IP request information; 2, if the request is judged to be normal, and if the request is judged to be attack, extracting features from the IP request information and adding the features into an attack feature library, and then obtaining a cloud performance load and a source station server performance load; 3, comparing the cloud load performance and the source station server load performance extracted in the step 2 with a preset threshold value, and if the cloud performance load and the source station server performanceload are both lower than the preset threshold value, judging that the cloud load and the source station server performance load are normal and not intercepting the cloud load and the source station server performance load; if any load of the cloud performance load and the source station server performance load is judged to be abnormal, intercepting the abnormal IP; interception of different forcesis carried out by combining the cloud end performance state and the source station performance state in the interception process, and the probability and risk of mistaken interception are reduced.

Description

technical field [0001] The invention relates to a CC protection method, in particular to a CC protection method based on a CDN node log. Background technique [0002] CC attack is a common denial-of-service attack technology, which can greatly affect the availability and stability of site services. At present, the main protection strategy of CC is to block cloud vendors after unilateral judgment, without combining the performance load of the origin server; it cannot fully Using resources on the source site or making too many requests arrive at the source site will cause performance overload on the source site; in some special environments (interface requests with high-frequency call characteristics will be judged as attacks with a high probability by CC engine analysis, But for the actual production environment of the origin site, it is the expected normal situation) will lead to false interception. [0003] The existing CC protection is generally based on the IP request in...

AI Technical Summary

Problems solved by technology

However, this protection method only considers the defense end (i.e., the performance status of the cloud server) during site use, and does not refer to the performance status of the origin server and adjust the defense in real time; assuming that the cloud load status is normal, but business requests make the origin server load abnormal, then the origin station will still fail to operate normally, so that it will not be able to provide usable services as a whole

Images