DDoS attack identification method and device and storage medium

Abstract

The invention provides a DDoS attack identification method and device with higher accuracy and a storage medium. The DDoS attack identification method comprises the following steps: receiving original data; analyzing the original data to obtain first processing data; grouping: grouping and converging the received data according to the first processing data; analyzing the data to obtain second processing data; pre-judgment: judging whether an attack occurs or not according to the second processing data; pre-result: generating the pre-result according to the pre-judgment result; and secondary judgment: judging whether the attack occurs or not according to the zombie, trojan and worm module and the pre-result. According to the invention, the accuracy of DDoS attack detection is improved, the false alarm rate is reduced, the performance requirement of a detection system is reduced, the problem that in a traditional detection method based on original flow, the performance requirement for hardware is too high is effectively solved, and therefore, the DDoS detection system is suitable for being deployed on various backbone large-bandwidth networks.

Description

Technical field: [0001] The invention relates to the technical field of computer network security, in particular to a DDoS attack identification method, device and storage medium. Background technique: [0002] Distributed Denial of Service (Distributed Denial of Service, referred to as DDoS) attack refers to the use of client / server technology, using a large number of computers as an attack platform, launching traffic attacks on one or more target hosts, occupying host resources, and making the target of the attack unable to operate normally. It is characterized by the fact that the origin of the attack is distributed in different places. Therefore, for DDoS attacks, the detection party usually has problems such as difficult identification and source tracing. The current identification method for DDoS attacks is to use access to NetFlow / sFlow / cFlow and other device flow records or original business traffic, and judge whether a host has a DDoS attack according to whether the...

AI Technical Summary

Problems solved by technology

[0002] Distributed Denial of Service (Distributed Denial of Service, referred to as DDoS) attack refers to the use of client / server technology, using a large number of computers as an attack platform, launching traffic attacks on one or more target hosts, occupying host resources, and making the target of the attack unable to operate normally. It is characterized by the fact that the origin of the attack is distributed in different places. Therefore, for DDoS attacks, the detection party usually has problems such as difficult identification and source tracing.

The current identification method for DDoS attacks is to use access to NetFlow / sFlow / cFlow and other device flow records or original business traffic, and judge whether a host has a DDoS attack according to whether the inbound traffic of the protected object exceeds the set threshold per unit time. However, based on the detection technology of NetFlow / sFlow / cFlow and other device flow records, because the device flow records themselves only contain quintuples and flow statistics, and lack the flow characteristics in the original flow, the detection accuracy will be relatively low. The false alarm rate is relatively high, and the detection method based on raw traffic needs to process the raw traffic in real time, so the performance requirements of the hardware are very high, and it is not suitable for deployment on large-bandwidth networks such as the backbone network of operators.

Images