DDoS attack detection method, device and equipment and storage medium

Abstract

The embodiment of the invention discloses a DDoS attack detection method, device and equipment and a storage medium. According to the method and the device, the information entropy is determined basedon the traffic behaviors of multiple tenants, specifically, the traffic behaviors can be divided into the data domain traffic and the signaling domain traffic, so that the determined information entropy can reflect the relevance of the traffic behaviors of the tenants and the DDoS attack behaviors in the time dimension; correlation and triggering between DDoS attack behaviors and flow behaviors can also be reflected, then DDoS attack behavior detection is carried out on the flow behaviors of the multiple tenants according to the information entropy, and a mode of correlation between the flowbehaviors of the multiple tenants and attack characteristics of the DDoS attack behaviors is established; the problems that in a traditional detection mode, private protocol characteristics and service logic characteristics of different tenants cannot be accurately matched, DDoS attack behaviors hidden in data domain flow corresponding to the tenants and DDoS attack behaviors hidden in corresponding signaling domain flow cannot be found, and then detection is inaccurate are solved.

Description

technical field [0001] The embodiments of the present invention relate to the technical field of network security, and in particular to a DDoS attack detection method, device, equipment and storage medium. Background technique [0002] 5G technology can meet the needs of users in various application scenarios, and connect communication between people and people, people and things, and things and things faster and better, so as to achieve the goal of interconnecting everything. The multi-tenant mode based on Network Slicing is an important feature of 5G networks. Tenants can use different types of slicing modes to respond to various communication needs and select heterogeneous transaction / interaction modes to achieve massive connections and differentiated bandwidth. Model selection and communication quality selection to adapt to its own business use cases. While 5G technology provides a large number of access points and high-quality and large-bandwidth access capabilities fo...

AI Technical Summary

Problems solved by technology

[0003] However, at present, the main means to ensure the availability of 5G networks from DDoS attacks still rely on traditional firewalls and traffic detection and cleaning equipment for protection.

Since

Images