Security attack detection method and device, computer equipment and storage medium

Abstract

The invention discloses a security attack detection method and device, computer equipment and a storage medium. The security attack detection method comprises the steps of acquiring mirror image flow; creating a session between the source end and the destination end according to the mirror image flow aiming at the source end which requests to be connected with the destination end; discarding a first specific message corresponding to the session in the mirror image flow, and waiting for the source end to retransmit the first specific message; forwarding the first specific message retransmitted by the source end to the destination end, and detecting whether the source end enters a connection establishment state or not by tracking the session; and if it is detected that the source end does not enter the connection establishment state, determining that the destination end is subjected to the TCP reflection attack from the source end, and intercepting the flow corresponding to the session in the flow to be transmitted to the destination end. By adopting the method and the device, the problem of high false detection rate in security attack detection in the prior art is solved.

Description

technical field [0001] The present invention relates to the field of computer technology, in particular to a security attack detection method, device, computer equipment and storage medium. Background technique [0002] DDOS is the abbreviation of Distributed Denial of Service in English, which is "distributed denial of service". The DDOS type of security attack refers to the fact that the attacker initiates a large number of seemingly legitimate but malicious business requests to the attack target (such as a server) by controlling a botnet distributed throughout the Internet, in order to consume or occupy a large amount of resources of the attack target for a long time. As a result, the attack target cannot respond to normal business requests, thereby achieving the goal of denial of service by the attack target. [0003] Currently, DDOS-type security attacks mainly include: synack forgery attack, UDP (User Datagram Protocol, User Datagram Protocol) reflection attack, TCP (...

AI Technical Summary

Problems solved by technology

[0005] In order to solve the problem of high false detection rate in security attack detection in related technologies, each embodiment of the present invention provides a security attack detection method, device, computer equipment and storage medium

Images