Network control method, device thereof and equipment and machine readable storage medium

Abstract

The invention provides a network control method, a device thereof and equipment and a machine readable storage medium, and the method comprises the steps: analyzing a message, and recording a suspicious behavior and a corresponding source IP address if the suspicious behavior exists; calculating a corresponding suspicious value according to the corresponding suspicious behavior recorded by each source IP address; and performing network control on the corresponding source IP address according to the suspicious value. According to the technical scheme, the suspicious behaviors of the source IP addresses are analyzed, the suspicious values are obtained according to the suspicious behaviors, and the source IP addresses with high suspicious degree can be obtained according to the suspicious values, so that network control is carried out on the source IP addresses, and the possibility that normal users are mistakenly limited is reduced.

Description

technical field [0001] The present disclosure relates to the technical field of communications, and in particular, to a network control method, device, equipment, and machine-readable storage medium. Background technique [0002] DDoS (Distributed Denial of Service, Distributed Denial of Service), hackers use DDoS attackers to control multiple machines to attack simultaneously to achieve the purpose of "preventing normal users from using services", thus forming DDoS attacks. With the continuous development of the Internet With the development and fierce competition, all kinds of DDoS attackers began to appear. The common ones are as follows: [0003] Bandwidth consumption attacks, DDoS bandwidth consumption attacks are mainly direct flood attacks. The direct torrent attack adopts a simple and natural attack method, which takes advantage of the resource advantages of the attacker. When the attack flow sent by a large number of proxies converges on the target, it is enough t...

AI Technical Summary

Problems solved by technology

[0005] Application-layer attacks, typically such as the legendary dummy attack that is popular in China, use puppet machines to simulate the data flow of the legendary server, and can complete functions such as registration and login of the ordinary legendary game server, making the legendary game running on the server appear A large number of dummies affect the login and game of normal players, and in serious cases, they cannot log in at all

[0006] For anti-DDoS attacks, it is generally necessary to limit the traffic rate in the end, but the general traffic rate limit is simple and rude, and the egress traffic exceeding the user-configured threshold is randomly discarded. The end result is that many normal access users are indiscriminately restricted, that is, Guard off

Images