Attack detection method, device, equipment and storage medium

Abstract

The embodiment of the invention discloses an attack detection method, device, equipment and storage medium. Wherein, the method includes: determining the current communication increment and the historical communication increment according to the intranet communication data packets of the target network device; Denial of service attack. The technical solution of the embodiment of the present invention realizes network attack detection across Internet data centers by analyzing and counting intranet communication data packets, and avoids data packets from being falsely reported due to rapid growth based on current communication increments and historical communication increments It is a distributed denial of service attack, which can reduce the false positive rate of network attacks and improve the accuracy of attack detection.

Description

technical field [0001] The embodiments of the present invention relate to the technical field of network security, and in particular, to an attack detection method, device, device, and storage medium. Background technique [0002] With the development of economy and science and technology, computer network technology is widely used in various fields, and the data in the information system becomes more and more important. The computer network connected to the information system is open and easy to be attacked and destroyed. It poses a threat to the security of information systems, so people have put forward higher requirements for computer network security. In the field of computer network security, due to distributed denial of service (Distributed Denial of Service, DDoS) attack will cause information system network bandwidth or occupation of system resources, resulting in information system can not be used normally. [0003] In the prior art, the DDoS attack detection meth...

AI Technical Summary

Problems solved by technology

But in the case of data centers across the Internet, see figure 1 , the first Internet data center 111 and the second Internet data center 112 are two different Internet data centers, data transmission and synchronization between the Internet data centers need to send a large amount of data, which will cause a surge in data traffic, and the attacking party 110 is not responsible for Internet data When the center conducts a distributed denial of service attack, sending a large number of attack data packets will also cause a surge in the traffic received by the Internet data center. The transmission is identified as a network attack, resulting in network attack detection errors and poor network attack detection accuracy

Images