DDoS attack detection method, device, equipment and computer program product

Abstract

The invention discloses a DDoS attack detection method. The method comprises the following steps: acquiring an IP flow average length corresponding to a plurality of sampling intervals, acquiring an IP packet inflow and outflow ratio growth rate corresponding to each sampling interval, and acquiring a source IP address entropy corresponding to each sampling interval; taking the IP flow average length, the IP packet inflow and outflow ratio increase rate and the source IP address entropy as a sample feature vector to obtain a training sample set; inputting the sample feature vectors into a pre-trained classification model for model training to obtain a classification result; and if the training result comprises the abnormal traffic, determining that the sample feature vector corresponding to the abnormal traffic is the distributed denial of service (DDoS) attack traffic. The invention further discloses a DDoS attack detection device and equipment and a computer program product. According to the DDoS attack detection method and device, the sample feature vectors irrelevant to the flow are adopted as the training data, the influence of the change of the flow on the detection result can be avoided, the misjudgment of the detection result is further reduced, and the accuracy of DDoS attack detection is improved.

Description

technical field [0001] The present invention relates to the technical field of network security, in particular to a DDoS attack detection method, device, equipment and computer program product. Background technique [0002] With the rapid development of computer network technology, network attacks and destructive behaviors are also increasing. Among them, DDoS (Distributed Denial of Service, Distributed Denial of Service) attack has amazing destructive power and huge impact, and is a serious attack method that threatens network security. DDoS attacks usually use botnets to send a large number of service requests to victims, resulting in a large amount of resources consumed by victims, so that they cannot respond to legitimate user requests in a timely manner, or even completely paralyzed. With the development of network technology, the traffic of DDoS attacks is also increasing, making it more and more difficult to detect. [0003] At present, the detection method of DDoS ...

AI Technical Summary

Problems solved by technology

[0005] The main purpose of the present invention is to provide a DDoS attack detection method, device, equipment and computer program product, aiming to solve the technical problem of low accuracy of existing DDoS attack detection

Images