Cryptographic attack identification method and device, equipment and medium

Abstract

The application relates to a CC attack identification method and device, equipment and medium in the e-commerce technical field, the method comprises the following steps: acquiring a first access index corresponding to each preset time period of an independent station; judging whether the first access index reaches a first preset standard, and determining that the corresponding preset time period is an attacked time period when the first access index reaches the first preset standard; determining the growth speed between the first access index corresponding to each preset time period and the first access index corresponding to the previous preset time period; judging whether the growth speed of the attacked time period reaches a second preset standard, and confirming that the independent station is attacked when the growth speed reaches the second preset standard; determining the growth acceleration between the growth speed corresponding to each preset time period and the growth speed corresponding to the previous preset time period; judging whether the growth acceleration reaches a third preset standard or a fourth preset standard; and determining the attack type of the independent station according to the reached preset standard when the growth acceleration reaches the third preset standard or the fourth preset standard. The application can efficiently and accurately identify various CC attacks and attack types.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of e-commerce, and particularly relates to a CC attack identification method and a corresponding device, computer equipment and computer readable storage medium. BACKGROUND

[0002] CC (Challenge Collapsar) is a type of DDOS attack, and attackers control some hosts to send a large number of legitimate requests to a victim server, so as to consume the resources of the victim server, so as to achieve the purpose of slow loading or even timeout of the server, and even the server crashes due to resource exhaustion, which greatly affects the shopping experience of buyers and the normal sales of sellers in the e-commerce scenario.

[0003] In the traditional technology, only this type of CC attack in which the same attacker sends a large number of legitimate requests to the victim server at a high frequency within a period of time can be identified, and other types of CC attacks are usually identified by using a special deep learning model. This implementation needs to collect a large number of training samples of CC attacks and label the CC attack types of each training sample for training of the deep learning model. However, the labeling cost of these training samples is high, and the collection is difficult, which does not conform to the cost-effectiveness.

[0004] In view of the deficiencies of the traditional technology, the present applicant has long been engaged in the research in the related field, and has found another way to solve the difficult problems in the e-commerce field. SUMMARY

[0005] The primary purpose of the present application is to solve at least one of the above problems and provide a CC attack identification method and a corresponding device, computer equipment and computer readable storage medium.

[0006] In order to achieve the various purposes of the present application, the present application adopts the following technical solutions:

[0007] A CC attack identification method provided by one of the purposes of the present application comprises the following steps:

[0008] Obtain the first access index corresponding to each preset time period of the independent station, and the first access index is the number of different access IPs for single access to the independent station;

[0009] Determine whether the first access index reaches a first preset standard, and when the first access index reaches the first preset standard, determine that the corresponding preset time period is an attacked time period;

[0010] Determine the growth rate between the first access index corresponding to each preset time period and the first access index corresponding to the previous preset time period, and determine whether the growth rate of the attacked time period reaches a second preset standard, and when the growth rate reaches the second preset standard, confirm that the independent station is attacked;

[0011] determining a growth acceleration between the growth rate corresponding to each preset time period and the growth rate corresponding to the previous preset time period, and determining the attack type to which the independent station is subjected according to the reached preset standard when the growth acceleration reaches the third preset standard or the fourth preset standard.

[0012] In further embodiments, before obtaining the first access index corresponding to each preset time period of the independent station, the method comprises the following steps:

[0013] obtaining the access IP and the access times corresponding to each preset time period of the independent station;

[0014] For each preset time period, filtering the access IP with the access times greater than one.

[0015] In further embodiments, after obtaining the access IP and the access times corresponding to each preset time period of the independent station, the method comprises the following steps:

[0016] determining whether the access times of the same access IP corresponding to consecutive preset time periods are all greater than the first threshold value;

[0017] When the determination is positive, the corresponding access IP is pulled into the blacklist, and the request sent by the access IP is not responded.

[0018] In further embodiments, determining whether the growth acceleration reaches the third preset standard or the fourth preset standard, and determining the attack type to which the independent station is subjected according to the reached preset standard when the determination is positive, comprises the following steps:

[0019] determining the increase and decrease between the growth acceleration corresponding to each preset time period and the growth acceleration corresponding to the previous preset time period;

[0020] determining whether the growth acceleration is greater than the second threshold value and the increase between the growth acceleration and the growth acceleration corresponding to the previous preset time period is greater than the third threshold value;

[0021] determining whether the decrease is greater than the fourth threshold value;

[0022] When the determinations are all positive, it is determined that the growth acceleration reaches the third preset standard, and it is determined that the independent station is subjected to the pulse attack.

[0023] or,

[0024] determining whether the growth acceleration belongs to a preset value range;

[0025] determining whether the growth acceleration is less than the fifth threshold value;

[0026] When the two determinations exist, it is determined that the growth acceleration reaches a fourth preset standard, and it is determined that the independent station is subjected to a buffer attack.

[0027] In a further embodiment, after it is determined that the independent station is subjected to a pulse attack, the method comprises the following steps:

[0028] The multiple preset time periods before the preset time period corresponding to the maximum growth acceleration are determined as start time periods.

[0029] The multiple preset time periods after the preset time period corresponding to the minimum growth acceleration are determined as end time periods.

[0030] According to the start time periods and the end time periods, an attacked time of the independent station subjected to the pulse attack is determined.

[0031] In a further embodiment, after it is determined that the independent station is subjected to a buffer attack, the method comprises the following steps:

[0032] The multiple preset time periods before the preset time period corresponding to the time when the growth acceleration starts to abnormally increase slightly are determined as start time periods.

[0033] The multiple preset time periods after the preset time period corresponding to the minimum growth acceleration are determined as end time periods.

[0034] According to the start time periods and the end time periods, an attacked time of the independent station subjected to the buffer attack is determined.

[0035] In a further embodiment, after the attacked time of the independent station subjected to the pulse attack is determined or the attacked time of the independent station subjected to the buffer attack is determined, the method comprises: performing expansion processing on a server of the independent station according to the attacked time of the independent station subjected to the pulse attack or the attacked time of the independent station subjected to the buffer attack.

[0036] In another aspect, a CC attack identification device is provided for one of the purposes of the present application, comprising an index acquisition module, an attack time period judgment module, an attack determination module, and an attack type determination module. The index acquisition module is configured to acquire a first access index corresponding to each preset time period of an independent station, the first access index being the number of different access IPs accessing the independent station at a single time. The attack time period judgment module is configured to determine whether the first access index reaches a first preset standard, and when the first access index reaches the first preset standard, determine that the corresponding preset time period is an attacked time period. The attack determination module is configured to determine the growth rate between the first access index corresponding to each preset time period and the first access index corresponding to the previous preset time period, and determine whether the growth rate of the attacked time period reaches a second preset standard. When the growth rate reaches the second preset standard, it is determined that the independent station is attacked. The attack type determination module is configured to determine the growth acceleration between the growth rate corresponding to each preset time period and the growth rate corresponding to the previous preset time period, and determine whether the growth acceleration reaches a third preset standard or a fourth preset standard. When the growth acceleration reaches the preset standard, the type of attack on the independent station is determined accordingly.

[0037] In further embodiments, before the index acquisition module, an access data acquisition submodule is configured to acquire an access IP and the number of accesses of the access IP corresponding to each preset time period of the independent station. An IP filtering submodule is configured to filter, for each preset time period, the access IP with the number of accesses greater than one.

[0038] In further embodiments, after the access data acquisition submodule, a high-frequency access confirmation unit is configured to determine whether the number of accesses of the same access IP corresponding to consecutive preset time periods is greater than a first threshold value. An IP ban unit is configured to, when the number of accesses of the same access IP is greater than the first threshold value, add the access IP to a blacklist, and not respond to the request sent by the access IP.

[0039] In further embodiments, the attack type determination module comprises an increase-decrease amplitude determination submodule configured to determine the increase amplitude and the decrease amplitude between the growth acceleration corresponding to each preset time period and the growth acceleration corresponding to the previous preset time period. A growth acceleration sharp increase judgment submodule is configured to determine whether the growth acceleration is greater than a second threshold value and the increase amplitude between the growth acceleration and the growth acceleration corresponding to the corresponding previous preset time period is greater than a third threshold value. A first growth acceleration sharp decrease judgment submodule is configured to determine whether the decrease amplitude is greater than a fourth threshold value. A pulse attack determination submodule is configured to, when the determinations are all true, determine that the growth acceleration reaches the third preset standard, and determine that the independent station is subjected to a pulse attack.

[0040] Alternatively,

[0041] The growth acceleration slightly increases judgment submodule is configured to judge whether the growth acceleration belongs to a preset value range; the second growth acceleration sharply decreases judgment submodule is configured to judge whether the growth acceleration is less than a fifth threshold value; and the buffer attack determination submodule is configured to determine that the growth acceleration reaches a fourth preset standard and the independent station is subjected to a buffer attack when the judgments are all present.

[0042] In a further embodiment, the pulse attack determination submodule is followed by a first start time period determination submodule configured to determine a plurality of preset time periods before a preset time period corresponding to the maximum growth acceleration as start time periods; a first end time period determination submodule configured to determine a plurality of preset time periods after a preset time period corresponding to the minimum growth acceleration as end time periods; and a first attacked time determination submodule configured to determine an attacked time of the independent station subjected to a pulse attack according to the start time periods and the end time periods.

[0043] In a further embodiment, the buffer attack determination submodule is followed by a second start time period determination submodule configured to determine a plurality of preset time periods before a preset time period corresponding to a time when the growth acceleration starts to slightly increase abnormally as start time periods; a second end time period determination submodule configured to determine a plurality of preset time periods after a preset time period corresponding to the minimum growth acceleration as end time periods; and a second attacked time determination submodule configured to determine an attacked time of the independent station subjected to a buffer attack according to the start time periods and the end time periods.

[0044] In a further embodiment, the pulse attack determination submodule or the buffer attack determination submodule is followed by a passive defense submodule configured to perform expansion processing on a server of the independent station according to the attacked time of the independent station subjected to a pulse attack or the attacked time of the independent station subjected to a buffer attack.

[0045] In another aspect, a computer device is provided to achieve one of the purposes of the present application, and includes a central processing unit and a memory, wherein the central processing unit is configured to invoke a computer program stored in the memory to execute the steps of the CC attack identification method.

[0046] In another aspect, a computer readable storage medium is provided to achieve another purpose of the present application, and stores a computer program implemented according to the CC attack identification method in the form of computer readable instructions, wherein the computer program is invoked by a computer to execute the steps included in the method when running.

[0047] The technical solution of the present application has multiple advantages, including but not limited to the following aspects:

[0048] The application determines whether the first access index corresponding to at least one preset time period of the independent station reaches the first preset standard, and when the first access index reaches the first preset standard, determines that the corresponding preset time period is an attacked time period. The application determines whether the growth rate between the first access index corresponding to the attacked time period and the previous preset time period reaches the second preset standard, and when the growth rate reaches the second preset standard, confirms that the independent station is attacked. Further, the application determines the growth acceleration between each preset time period of the independent station and the previous preset time period, determines whether the growth acceleration reaches the third preset standard or the fourth preset standard, and when the growth acceleration reaches the preset standard, determines the type of attack on the independent station according to the reached preset standard. The application can efficiently and accurately identify various CC attacks and their attack types, can identify various attack types, and ensures the comprehensiveness and accuracy of CC attack identification. BRIEF DESCRIPTION OF DRAWINGS

[0049] The above and / or additional aspects and advantages of the application will become apparent and more readily appreciated from the following description of the embodiments, taken in conjunction with the accompanying drawings, in which:

[0050] Figure 1 A flowchart of a typical embodiment of the CC attack identification method of the application;

[0051] Figure 2 A schematic diagram of the number of accesses corresponding to each preset time period of five target independent stations in an embodiment of the application;

[0052] Figure 3 A schematic diagram of the number of all access IPs corresponding to each preset time period of five target independent stations in an embodiment of the application;

[0053] Figure 4 A schematic diagram of the growth acceleration corresponding to each preset time period of a target independent station subjected to a pulse attack in an embodiment of the application;

[0054] Figure 5 A schematic diagram of the growth acceleration corresponding to each preset time period of a target independent station subjected to a buffer attack in an embodiment of the application;

[0055] Figure 6 A flowchart of filtering access IPs corresponding to each preset time period of an independent station and having a number of accesses greater than one in an embodiment of the application;

[0056] Figure 7 A flowchart of identifying a continuously high-frequency access IP and rejecting a request response sent to the access IP in an embodiment of the application;

[0057] Figure 8 A flowchart of determining that an independent station is subjected to a pulse attack or a buffer attack in an embodiment of the application;

[0058] Figure 9 Flowchart for determining the attacked time of the independent station subjected to the impulse attack in the embodiment of the present application;

[0059] Figure 10 Flowchart for determining the attacked time of the independent station subjected to the buffer attack in the embodiment of the present application;

[0060] Figure 11 Principle block diagram of the CC attack identification device of the present application;

[0061] Figure 12 Structural schematic diagram of a computer device used in the present application. DETAILED DESCRIPTION

[0062] The embodiments of the present application are described in detail below with reference to the accompanying drawings. The embodiments described below are examples for explaining the present application and should not be construed as limiting the present application.

[0063] It should be understood by those skilled in the art that the singular forms "a," "an," and "the" include plural referents unless the context clearly dictates otherwise. It should be further understood that the terms "comprises," "comprising," "includes," "including," "contains," "containing," "consists," "consisting," "has," "having," "includes," "including," "involve," "involving," and the like, when used in the specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. It should be understood that when we say an element is "connected" or "coupled" to another element, it can be directly connected or coupled to the other element, or intervening elements can be present. Also, as used herein, "connected" or "coupled" can include wirelessly connected or wirelessly coupled. As used herein, the term "and / or" includes all combinations of one or more of the associated listed items and all combinations of the associated listed items.

[0064] It should be understood by those skilled in the art that all terms used herein, including technical and scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which the present application pertains, unless otherwise defined. It should also be understood that terms such as those defined in a generally used dictionary should be interpreted as having a meaning consistent with the context in the art, and should not be interpreted in an idealized or overly formal sense unless specifically so defined as here.

[0065] Those skilled in the art will understand that, as used herein, the terms "client," "terminal," and "terminal device" include both devices that are solely wireless signal receivers and devices that have both receiving and transmitting hardware that can communicate bi-directionally over a bi-directional communication link. Such devices can include cellular or other communication devices with single-line or multiple-line displays, or no display, Personal Communications Service (PCS) devices that can combine a voice and / or data processor, a PDA that can include a radio frequency receiver and a pager, Internet and / or Intranet access, a Web browser, a calendar, and / or a GPS receiver, a conventional laptop and / or palmtop computer and / or other devices that have a radio frequency receiver. As used herein, the terms "client," "terminal," and "terminal device" can be portable, transportable, mounted in a vehicle (aeronautical, maritime, and / or land), or adapted and / or configured for local and / or distributed operation on Earth and / or any other location in space. As used herein, the terms "client," "terminal," and "terminal device" can also be a communication terminal, an Internet terminal, a music / video playing terminal, such as a PDA, a Mobile Internet Device (MID), and / or a mobile phone with music / video playing function, a smart television, a set-top box, and / or the like.

[0066] As used herein, the terms "server," "client," "service node," and the like refer to hardware that has the equivalent capability of a personal computer, i.e., an electronic device having a central processing unit (including an arithmetic unit and a controller), a memory, an input device, and an output device, and the like necessary components disclosed by the Von Neumann principle. A computer program is stored in the memory, the central processing unit loads the program stored in the external memory into the memory and runs it, executes the instructions in the program, and interacts with the input and output devices, thereby completing a specific function.

[0067] It should be noted that the concept of "server" in the present application can also be extended to the case of a server cluster. According to the principle of network deployment understood by those skilled in the art, the servers should be logically divided, and in physical space, these servers can be independent of each other but can be called through an interface, or can be integrated into a physical computer or a computer cluster. Those skilled in the art should understand this variation and should not be restricted by the implementation of the network deployment of the present application.

[0068] One or more technical features of the present application, unless explicitly specified, can be deployed on a server for implementation and accessed by a client remotely calling an online service interface provided by the server, or can be directly deployed and run on a client for implementation and access.

[0069] The neural network model referred to or possibly referred to in the present application, unless explicitly specified, can be deployed on a remote server and remotely called by a client, or can be deployed on a client with sufficient device capability for direct calling. In some embodiments, when it is run on a client, its corresponding intelligence can be obtained through transfer learning, so as to reduce the requirement for client hardware running resources and avoid excessive occupation of client hardware running resources.

[0070] The various data involved in the present application, unless explicitly specified, can be remotely stored on a server or stored on a local terminal device, as long as it is suitable for being called by the technical solutions of the present application.

[0071] Those skilled in the art should know that the various methods of the present application, although based on the same concept and described to present commonality among them, are independently executable unless otherwise specified. Similarly, for each embodiment disclosed in the present application, it is based on the same inventive concept, so the same concept is understood to be equivalent, and although the concept is expressed differently, it is only for the convenience of appropriate transformation of the concept.

[0072] Unless it is explicitly stated that the various embodiments disclosed in the present application are mutually exclusive, the related technical features involved in each embodiment can be cross-combined to flexibly construct new embodiments, as long as such combination does not deviate from the spirit of the present application and can meet the needs of the prior art or solve some aspects of the deficiencies in the prior art. For this variation, those skilled in the art should know.

[0073] The CC attack identification method of the present application can be programmed as a computer program product, deployed in a client or server for running to achieve, for example, in the exemplary application scenario of the present application, it can be deployed and achieved in the server of an e-commerce platform, thereby the interface opened after the running of the computer program product can be accessed, and the process of the computer program product can be interacted with through the graphical user interface to execute the method.

[0074] Please refer to Figure 1 The CC attack identification method of the present application, in its typical embodiment, comprises the following steps:

[0075] Step S1100, obtaining a first access index corresponding to each preset time period of an independent station, the first access index being the number of different access IPs accessing the independent station at a time;

[0076] The e-commerce platform in the application scenario of the present application mainly refers to a cross-border e-commerce platform, which allows each online store to run in a corresponding independent station and open services to public users. Public users can access the pages of the online store through various channels, which include but are not limited to the built-in pages of the online store, social media information display pages, etc. Public users can directly access the corresponding pages of the online store through links about these channels.

[0077] The independent station refers to a new type of official website (website) based on a SaaS technology platform, which has an independent domain name, private content, data and rights, has independent management sovereignty and management subject responsibility, is supported by socialized cloud computing capability, and can independently and freely interface with third-party software tools, publicity and promotion media and channels.

[0078] CC attack mainly attacks the independent domain name of the independent station or the webpage in the independent station. Attackers can access the corresponding independent station by accessing the independent domain name, or access the webpage in the corresponding independent station by accessing the webpage link, send a large number of legal requests to the server of the independent station, consume server resources, achieve the purpose of server resource scarcity, slow loading or even timeout, and even server resource exhaustion and crash.

[0079] The preset time period is an experience threshold which can be set by a person skilled in the art as needed, and the recommended one is any one of [1 minute, 2 minutes, 3 minutes, 4 minutes, 5 minutes], for example, 5 minutes.

[0080] Whenever a client accesses an independent station to send a request to its server, the server can generate a corresponding request log record when it receives the request, and then store each request log record in a log file. The request log record contains the IP of each client accessing the independent station, i.e. the access IP.

[0081] In one embodiment, the CC attack identification method implemented by the application can be applied to real-time CC attack identification. To this end, every other preset time period, the access ip in all request log records generated in the preset time period is obtained from the log file, the number of request log records corresponding to each access ip is calculated as the access times of each access ip, and the number of different access ips with single access times is determined as the first access indicator.

[0082] In another embodiment, the CC attack identification method implemented by the application can be applied to static CC attack identification. To this end, all request log records are obtained from the log file, divided by preset time periods, the access ip in all request log records generated in each preset time period is obtained, the number of request log records corresponding to each access ip is calculated as the access times of each access ip, and the number of different access ips with single access times is determined as the first access indicator.

[0083] Step S1200, determine whether the first access indicator reaches the first preset standard, and when it does, determine the corresponding preset time period as the attacked time period;

[0084] Referring to Figure 2 , the five line graphs in Figure 2 correspond to different target independent stations, the vertical coordinates of each line graph are the access times of the corresponding target independent station, and the horizontal coordinates are the serial numbers of the preset time periods, for example, 5 on the vertical coordinate is the fifth preset time period. Each line graph is obtained by actually obtaining the access times of each preset time period corresponding to the target independent station, and the access times are the sum of the access times of each access ip, which can be obtained according to step S1100.

[0085] Referring to Figure 3 , the five line graphs in Figure 3 correspond to different target independent stations, the vertical coordinates of each line graph are the number of all access ips of the corresponding target independent station, and the horizontal coordinates are the serial numbers of the preset time periods, for example, 5 on the vertical coordinate is the fifth preset time period. Each line graph is obtained by actually obtaining the number of all access ips of each preset time period corresponding to the target independent station, and the number of all access ips of each preset time period can be obtained according to step S1100, and then the number of all access ips can be calculated.

[0086] The target independent station is an attacked independent station. The Figure 3 and the preset time period in Figure 2 are both 5 minutes, and the Figure 3The same as the Figure 2 The target independent station corresponding to the broken line graph at the same position.

[0087] The same as the Figure 3 The same as the Figure 2 It can be found that the number of visits corresponding to each time period of the target independent station is almost the same as the number of all access IPs, and the corresponding curve trend is basically consistent. This is true for each target independent station. In addition, a large number of access IPs suddenly emerge to access each target independent station in a certain preset time period, that is, the target independent station is attacked in the preset time period. According to these phenomena, it can be concluded that the target independent station is accessed by a large number of access IPs in the attacked time period, and most of these access IPs only access once. Accordingly, the first preset standard is defined as a threshold, and the number of different access IPs accessing the independent station once in the preset time period, that is, the first access index, is measured by the first preset standard. The first access index corresponding to each preset time period is compared with the first preset standard to determine whether the first access index is greater than the first preset standard, and the preset time period corresponding to the first access index is determined as the attacked time period. The first preset standard can be set by a person skilled in the art according to prior knowledge or experimental data as needed. For example, according to the number of all access IPs corresponding to the attacked time period of each target independent station in the Figure 3 The first preset standard is set to 5000 according to the number of all access IPs corresponding to the attacked time period of each target independent station in the

[0088] Step S1300, determine the growth rate between the first access index corresponding to each preset time period and the previous preset time period, and determine whether the growth rate of the attacked time period reaches the second preset standard. When it exists, it is confirmed that the independent station is attacked;

[0089] The same as the Figure 3 The same as the Figure 2 It can be found that the number of all access IPs corresponding to the attacked time period of the target independent station and the previous preset time period grows rapidly, and most of these access IPs only access once, that is, the number of different access IPs grows rapidly. According to the phenomenon, it can be concluded that the number of different access IPs accessing the independent station once corresponding to the attacked time period of the target independent station and the previous preset time period grows rapidly. Accordingly, the difference between the number of different access IPs accessing the independent station once corresponding to each preset time period and the previous preset time period, that is, the first access index, is calculated as the growth rate, which represents the first access index grown through a preset time period. For example, the formula is as follows:

[0090] v = IP_NUM t - IP_NUM t-1

[0091] wherein: v is the growth rate, IP_NUM t is the first access index of the attack period, IP_NUM t-1 is the first access index of the previous preset time period of the attack period.

[0092] The second preset standard is defined as a threshold value, and the growth rate is compared with the second preset standard to determine whether the growth rate is fast enough. When the growth rate of the attack period of each target independent station is greater than the second preset standard, it is determined that the independent station is attacked. The second preset standard can be set by a person skilled in the art according to prior knowledge or experimental data as needed. For example, according to experimental data, the growth rate of the number of all access IPs corresponding to the attack period of each target independent station is set to 1000. Figure 3

[0093] Step S1400, determine the growth acceleration between the growth rate corresponding to each preset time period and the previous preset time period, and determine whether the growth acceleration reaches the third preset standard or the fourth preset standard. When the preset standard is reached, the type of attack on the independent station is determined accordingly.

[0094] Referring to Figure 4 , the Figure 4 graph is the growth acceleration between the growth rate corresponding to each preset time period and the previous preset time period of the target independent station subjected to the pulse attack. The difference between the growth rate corresponding to each preset time period and the previous preset time period is calculated as the growth acceleration, which represents the growth rate after a preset time period. The growth rate can be obtained according to step S1300, and the first access index involved in the growth rate can be obtained according to step S1100.

[0095] Referring to Figure 5 , the Figure 5 graph is the growth acceleration between the growth rate corresponding to each preset time period and the previous preset time period of the target independent station subjected to the buffer attack. The first access index can be obtained according to step S1100, and the growth rate can be obtained according to step S1300. The difference between the growth rate corresponding to each preset time period and the previous preset time period is calculated as the growth acceleration, which represents the growth rate after a preset time period. The growth rate can be obtained according to step S1300, and the first access index involved in the growth rate can be obtained according to step S1100.

[0096] According to Figure 4 ​It can be concluded that the growth acceleration of a certain preset time period of the target independent station subjected to the attack type of the impulse attack increases dramatically, and the growth acceleration of a certain preset time period decreases dramatically, according to Figure 5 It can be concluded that the growth acceleration of a certain preset time period of the target independent station subjected to the attack type of the buffer attack increases slightly abnormally, and the growth acceleration of a certain preset time period decreases slightly abnormally. Accordingly, the difference between the growth speed corresponding to each preset time period of the independent station and the growth speed corresponding to the previous preset time period is calculated as the growth acceleration, which represents the growth speed after a preset time period. The third preset standard is preset to measure whether the growth acceleration corresponding to each preset time period of the independent station increases dramatically and decreases dramatically, and when the growth acceleration reaches the third preset standard, it is determined that the independent station is subjected to the attack type of the impulse attack. The fourth preset standard is preset to measure whether the growth acceleration corresponding to each preset time period of the independent station increases slightly abnormally and decreases slightly abnormally, and when the growth acceleration reaches the fourth preset standard, it is determined that the independent station is subjected to the attack type of the buffer attack. The third preset standard and the fourth preset standard can be set by those skilled in the art according to the disclosure as needed.

[0097] The impulse attack represents that the independent station is suddenly subjected to a larger fluctuation attack, and the buffer attack represents that the independent station is gradually subjected to an attack.

[0098] According to the typical embodiments of the present application, it can be known that the technical solutions of the present application have many advantages, including but not limited to the following aspects:

[0099] The present application determines whether the first access index corresponding to at least one preset time period of the independent station reaches the first preset standard, and when it does, determines that the corresponding preset time period is an attacked time period, determines whether the growth speed between the first access index corresponding to the attacked time period and the first access index corresponding to the previous preset time period reaches the second preset standard, and when it does, confirms that the independent station is subjected to an attack. Further, the growth acceleration between the growth speed corresponding to each preset time period of the independent station and the growth speed corresponding to the previous preset time period is determined, and it is determined whether the growth acceleration reaches the third preset standard or the fourth preset standard, and when it does, the type of attack the independent station is subjected to is determined according to the preset standard reached. The present application can efficiently and accurately identify various CC attacks and their attack types, can identify various attack types, and ensures the comprehensiveness and accuracy of CC attack identification.

[0100] Please refer to Figure 6 In further embodiments, before step S1100, obtaining the first access index corresponding to each preset time period of the independent station, includes the following steps:

[0101] Step S1000, obtaining the access IP corresponding to each preset time period of the independent station and the number of accesses thereof;

[0102] Please according to step S1100, this step is not elaborated.

[0103] Step S1010, for each preset time period, filter the access ip whose access times is greater than one.

[0104] It can be understood that the access ip whose access times is greater than one is mostly the client ip of the normal corresponding client accessing the server, and therefore needs to be filtered.

[0105] In the embodiment, by pre-filtering the access ip whose access times is greater than one corresponding to each preset time period of the independent station, the access ip of normal access can be reasonably excluded.

[0106] Please refer to Figure 7 In a further embodiment, after obtaining the access ip corresponding to each preset time period of the independent station and the access times thereof, the following steps are included:

[0107] Step S1001, determine whether the access times of the same access ip corresponding to consecutive preset time periods are all greater than a first threshold value;

[0108] The first threshold value is used to measure whether the access times of the same access ip corresponding to the preset time period is large enough, which can be set by prior knowledge and experimental data of those skilled in the art as needed, and a demonstrative example is 2000. Accordingly, the access times of the access ip corresponding to each preset time period is compared with the first threshold value to determine whether the access times of the same access ip accessing the independent station in consecutive preset time periods are all greater than the first threshold value.

[0109] Step S1002, when there is, pull the corresponding access ip into the blacklist, and do not respond to the request sent by the access ip.

[0110] When there is, it means that the corresponding access ip frequently accesses the independent station for a period of time, intentionally attacks the server of the independent station, and makes it unable to bear the heavy load and crashes. Accordingly, the access ip is pulled into the blacklist, and the server of the independent station refuses to respond to the request sent by the access ip on the blacklist.

[0111] In the embodiment, the CC attack of the same attacker frequently sending a large number of legal requests to the victim server for a period of time can be effectively and accurately identified, and high efficiency and convenience can be achieved.

[0112] Please refer to Figure 8 In a further embodiment, step S1400, determine whether the growth acceleration reaches a third preset standard or a fourth preset standard, and when there is, determine the type of attack on the independent station according to the reached preset standard, including the following steps:

[0113] Step S1410: Determine the increase and decrease of the growth acceleration between each preset time period and the previous preset time period;

[0114] It is not difficult to understand that the change in growth acceleration between each preset time period and the previous preset time period can be quantified by the increase in growth acceleration (amplitude) and the decrease in growth acceleration (decline). In one embodiment, the ratio between the growth acceleration of each preset time period and the previous preset time period can represent the corresponding increase, and the negative value of the ratio can represent the corresponding decrease. An example formula is provided below.

[0115] amplification = a t / a t-1 ;damp=-a t / a t-1 ;

[0116] Where: amplification is the amplification, a t For the current preset time period, a t-1 This is the previous preset time period.

[0117] Step S1420: Determine whether there exists a growth acceleration greater than the second threshold and the increase between the growth acceleration and the growth acceleration in the corresponding previous preset time period is greater than the third threshold;

[0118] The second threshold is used to measure whether the growth acceleration corresponding to each preset time period is large enough. It can be set as needed by those skilled in the art based on prior knowledge and experimental data. An exemplary example is based on experimental data, i.e., according to the... Figure 4 The second threshold is set to 5000, which measures the rapid increase in growth acceleration within a corresponding preset time period. The third threshold is used to measure whether the increase in growth acceleration between each preset time period and the previous preset time period is sufficiently large. It can be set as needed based on prior knowledge and experimental data of those skilled in the art. An exemplary example is based on experimental data, i.e., based on the... Figure 4 The increase in the growth rate between the corresponding preset time period and the previous preset time period is defined as the third threshold of 10.

[0119] Accordingly, each growth acceleration is compared with a second threshold. When there is a growth acceleration greater than the second threshold, the increase between the growth acceleration greater than the second threshold and the growth acceleration of the corresponding previous preset time period is compared with a third threshold. When the increase is greater than the third threshold, it indicates that the growth acceleration of the corresponding preset time period has increased dramatically.

[0120] Step S1430, judging whether there exists the decrease greater than the fourth threshold value;

[0121] The fourth threshold value is used to measure whether the decrease between the growth acceleration corresponding to each preset time period and the last preset time period is large enough, which can be set by prior knowledge and experimental data of those skilled in the art as needed, and an exemplary example is that the fourth threshold value is set to 1.5 according to the decrease of the growth acceleration between the corresponding preset time period and the last preset time period in the experimental data, i.e. Figure 4 Accordingly, each of the decreases is compared with the fourth threshold value, and when there exists a decrease greater than the fourth threshold value, it indicates that the growth acceleration of the corresponding preset time period has a sharp decrease.

[0122] Step S1440, when the judgments all exist, it is determined that the growth acceleration reaches the third preset standard, and it is determined that the independent station is subjected to the pulse attack.

[0123] When the judgments all exist, it is determined that the growth acceleration has a sharp increase and a sharp decrease, i.e. reaches the third preset standard, which meets the characteristics of the independent station subjected to the pulse attack.

[0124] Alternatively,

[0125] Step S1401, judging whether the growth acceleration belongs to a preset value domain;

[0126] The preset value domain is used to measure whether the growth acceleration corresponding to each preset time period is abnormally increased by a small amount, and the right limit of the preset value domain is smaller than the second threshold value, which can be set by prior knowledge and experimental data of those skilled in the art as needed, and an exemplary example is that the preset value domain is set to (400, 2000) according to the growth acceleration of the corresponding preset time period in the experimental data, i.e.

[0127] Figure 5 Accordingly, it is judged whether the growth acceleration belongs to the preset value domain, and when it exists, it indicates that the corresponding growth acceleration is abnormally increased by a small amount.

[0128] Step S1402, judging whether the growth acceleration is less than a fifth threshold value;

[0129] The fifth threshold value is used to measure whether the growth acceleration corresponding to each preset time period is abnormally decreased by a small amount, which can be set by prior knowledge and experimental data of those skilled in the art as needed, and an exemplary example is that the fifth threshold value is set to -2000 according to the growth acceleration of the corresponding preset time period in the experimental data, i.e.

[0130] Figure 5

[0131] ​​​Accordingly, the growth acceleration of each preset time period is compared with the fifth threshold value, and when there is a growth acceleration less than the fifth threshold value, it means that the corresponding growth acceleration is abnormally reduced by a small amount.

[0132] In step S1403, when the judgments all exist, it is determined that the growth acceleration reaches the fourth preset standard, and it is determined that the independent station is subjected to the buffer attack.

[0133] When the judgments all exist, it is determined that the growth acceleration abnormally increases and abnormally reduces by a small amount, i.e., reaches the fourth preset standard, which meets the characteristics of the buffer attack on the independent station.

[0134] In the embodiment, based on the judgment of whether the growth acceleration reaches the third preset standard or the fourth preset standard, the buffer attack and the pulse attack, which are two CC attack types, are effectively and accurately identified, and high efficiency and convenience are achieved.

[0135] Please refer to Figure 9 In further embodiments, after it is determined that the independent station is subjected to the pulse attack, step S1440 includes the following steps:

[0136] In step S1450, it is determined that the multiple preset time periods before the preset time period corresponding to the maximum growth acceleration are start time periods.

[0137] Please refer to Figure 4 It can be seen that the three preset time periods before the preset time period corresponding to the maximum growth acceleration of the target independent station subjected to the pulse attack are the time when the pulse attack is started. Accordingly, the multiple preset time periods before the preset time period corresponding to the maximum growth acceleration are determined as start time periods, and the number of the multiple preset time periods can be set as needed by prior knowledge and experimental data of those skilled in the art, and an exemplary example is three according to experimental data.

[0138] In step S1460, it is determined that the multiple time periods after the preset time period corresponding to the minimum growth acceleration are end time periods.

[0139] Please refer to Figure 4 It can be seen that the eight preset time periods after the preset time period corresponding to the minimum growth acceleration of the target independent station subjected to the pulse attack are the time when the pulse attack is ended. Accordingly, the multiple time periods after the preset time period corresponding to the minimum growth acceleration are determined as end time periods, and the number of the multiple preset time periods can be set as needed by prior knowledge and experimental data of those skilled in the art, and an exemplary example is eight according to experimental data.

[0140] Step S1470, determining the attacked time when the independent station is subjected to the pulse attack according to the start time period and the end time period.

[0141] The attacked time can be determined according to a time period between a time stamp corresponding to the left limit of the start time period and a time stamp corresponding to the right limit of the end time period.

[0142] In a further embodiment, according to the attack time when the independent station is subjected to the pulse attack, the server of the independent station can be expanded at each attack time to passively defend against the large number of request impacts caused by the pulse attack without collapsing.

[0143] In the embodiment, the attacked time is determined based on the start time period and the end time period corresponding to the pulse attack, which can more clearly represent the characteristics of the pulse attack and help to establish targeted network security.

[0144] Please refer to Figure 10 In a further embodiment, after determining that the independent station is subjected to the buffer attack, step S1403 includes the following steps:

[0145] Step S1404, determining a plurality of preset time periods before a preset time period corresponding to when the growth acceleration starts to abnormally increase slightly as start time periods.

[0146] Please refer to Figure 5 As can be seen, the three preset time periods before the preset time period corresponding to when the growth acceleration starts to abnormally increase slightly are the time when the target independent station subjected to the buffer attack starts to be subjected to the buffer attack. Accordingly, the plurality of preset time periods before the preset time period corresponding to when the growth acceleration starts to abnormally increase slightly are determined as start time periods, and the number of the plurality of preset time periods can be set as needed by prior knowledge and experimental data of those skilled in the art, and an exemplary example is according to the experimental data, i.e., the three.

[0147] Step S1405, determining a plurality of preset time periods after a preset time period corresponding to the minimum growth acceleration as end time periods.

[0148] Please refer to Figure 5 As can be seen, the eight preset time periods after the preset time period corresponding to the minimum growth acceleration are the time when the target independent station subjected to the buffer attack ends to be subjected to the buffer attack. Accordingly, the plurality of time periods after the preset time period corresponding to the minimum growth acceleration are determined as end time periods, and the number of the plurality of preset time periods can be set as needed by prior knowledge and experimental data of those skilled in the art, and an exemplary example is according to the experimental data, i.e., the eight.

[0149] Step S1406, determining the attacked time of the independent station suffering from the buffer attack according to the start time period and the end time period.

[0150] The attacked time can be determined according to a time period between a time stamp corresponding to the left limit of the start time period and a time stamp corresponding to the right limit of the end time period.

[0151] In a further embodiment, according to the attack time of the independent station suffering from the buffer attack, the server of the independent station can be expanded at each attack time, so as to passively defend the large number of request impacts caused by the buffer attack and not to collapse.

[0152] In the embodiment, the attacked time is determined according to the start time period and the end time period corresponding to the pulse attack, so that the characteristics of the pulse attack can be more clearly represented, and the targeted network security can be established.

[0153] Please refer to Figure 11 , a CC attack identification device provided for one of the purposes of the present application, which is a functional embodiment of the CC attack identification method of the present application. The device includes an index acquisition module 1100, an attack time period judgment module 1200, an attack determination module 1300, and an attack type determination module 1400. The index acquisition module 1100 is used to acquire a first access index corresponding to each preset time period of an independent station, and the first access index is the number of different access IPs accessing the independent station at a time. The attack time period judgment module 1200 is used to determine whether the first access index reaches a first preset standard, and when the first access index reaches the first preset standard, the corresponding preset time period is determined as an attacked time period. The attack confirmation module is used to determine the growth rate between the first access index corresponding to each preset time period and the first access index corresponding to the previous preset time period, and to determine whether the growth rate of the attacked time period reaches a second preset standard. When the growth rate reaches the second preset standard, it is determined that the independent station is attacked. The attack type determination module 1400 is used to determine the growth acceleration between the growth rate corresponding to each preset time period and the growth rate corresponding to the previous preset time period, and to determine whether the growth acceleration reaches a third preset standard or a fourth preset standard. When the growth acceleration reaches the preset standard, the type of attack suffered by the independent station is determined according to the reached preset standard.

[0154] In a further embodiment, before the index acquisition module 1100, the device includes an access data acquisition submodule for acquiring access IPs and their access times corresponding to each preset time period of an independent station, and an IP filtering submodule for filtering, for each preset time period, access IPs with more than one access time.

[0155] In a further embodiment, after the access data acquisition submodule, the method comprises: a high-frequency access confirmation unit configured to determine whether the number of accesses of the same access IP in each of the continuous preset time periods is greater than a first threshold value; and an IP ban unit configured to, when the number of accesses of the same access IP in each of the continuous preset time periods is greater than the first threshold value, ban the access IP and not respond to the request sent by the access IP.

[0156] In a further embodiment, the attack type determination module 1400 comprises: an increase-decrease amplitude determination submodule configured to determine the increase amplitude and the decrease amplitude between the growth acceleration corresponding to each preset time period and the growth acceleration corresponding to the previous preset time period; a growth acceleration sharp increase judgment submodule configured to determine whether the growth acceleration is greater than a second threshold value and the increase amplitude between the growth acceleration and the growth acceleration corresponding to the corresponding previous preset time period is greater than a third threshold value; a first growth acceleration sharp decrease judgment submodule configured to determine whether the decrease amplitude is greater than a fourth threshold value; and a pulse attack determination submodule configured to, when the determinations are all true, determine that the growth acceleration reaches a third preset standard and determine that the independent station is subjected to a pulse attack.

[0157] Alternatively,

[0158] a growth acceleration small increase judgment submodule configured to determine whether the growth acceleration belongs to a preset value range; a second growth acceleration sharp decrease judgment submodule configured to determine whether the growth acceleration is less than a fifth threshold value; and a buffer attack determination submodule configured to, when the determinations are all true, determine that the growth acceleration reaches a fourth preset standard and determine that the independent station is subjected to a buffer attack.

[0159] In a further embodiment, after the pulse attack determination submodule, the method comprises: a first start time period determination submodule configured to determine a plurality of preset time periods before the preset time period corresponding to the maximum growth acceleration as a start time period; a first end time period determination submodule configured to determine a plurality of time periods after the preset time period corresponding to the minimum growth acceleration as an end time period; and a first attacked time determination submodule configured to determine the attacked time of the independent station subjected to the pulse attack according to the start time period and the end time period.

[0160] In a further embodiment, after the buffer attack determination submodule, the method comprises: a second start time period determination submodule configured to determine a plurality of preset time periods before the preset time period corresponding to the time when the growth acceleration starts to increase slightly abnormally as a start time period; a second end time period determination submodule configured to determine a plurality of preset time periods after the preset time period corresponding to the minimum growth acceleration as an end time period; and a second attacked time determination submodule configured to determine the attacked time of the independent station subjected to the buffer attack according to the start time period and the end time period.

[0161] In a further embodiment, after the pulse attack determination submodule or the buffer attack determination submodule, a passive defense submodule is included, used to perform capacity expansion processing on the server of the independent station based on the attack time of the pulse attack or the attack time of the buffer attack on the independent station.

[0162] To address the aforementioned technical problems, embodiments of this application also provide computer equipment. For example... Figure 12 The diagram shows the internal structure of a computer device. The computer device includes a processor, a computer-readable storage medium, a memory, and a network interface connected via a system bus. The computer-readable storage medium stores an operating system, a database, and computer-readable instructions. The database may store control information sequences. When the computer-readable instructions are executed by the processor, they enable the processor to implement a CC attack identification method. The processor of the computer device provides computing and control capabilities, supporting the operation of the entire computer device. The memory of the computer device may store computer-readable instructions. When these computer-readable instructions are executed by the processor, they enable the processor to execute the CC attack identification method of this application. The network interface of the computer device is used for communication with a terminal. Those skilled in the art will understand that… Figure 12 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0163] In this embodiment, the processor is used to execute... Figure 11 The system contains the specific functions of each module and its sub-modules. The memory stores the program code and various data required to execute these modules or sub-modules. The network interface is used for data transmission between the user terminal and the server. In this embodiment, the memory stores the program code and data required to execute all modules / sub-modules in the CC attack identification device of this application. The server can call the server's program code and data to execute the functions of all sub-modules.

[0164] This application also provides a storage medium storing computer-readable instructions, which, when executed by one or more processors, cause the one or more processors to perform the steps of the CC attack identification method of any embodiment of this application.

[0165] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments of the method of the present application can be completed by a computer program instructing relevant hardware, and the computer program can be stored in a computer readable storage medium. When the program is executed, it can include the processes of the above-mentioned embodiments of the method. The storage medium can be a computer readable storage medium such as a magnetic disc, an optical disc, a read-only memory (ROM), or a random access memory (RAM).

[0166] In summary, the present application can efficiently and accurately identify various CC attacks and their attack types, can identify various attack types, and ensure the comprehensiveness and accuracy of CC attack identification.

[0167] Those skilled in the art can understand that the steps, measures and schemes in the various operations, methods and processes discussed in the present application can be alternated, changed, combined or deleted. Further, other steps, measures and schemes in the various operations, methods and processes discussed in the present application can also be alternated, changed, rearranged, decomposed, combined or deleted. Further, the steps, measures and schemes in the various operations, methods and processes in the prior art can also be alternated, changed, rearranged, decomposed, combined or deleted.

[0168] The above only describes some embodiments of the present application. It should be pointed out that those skilled in the art can make several improvements and refinements without departing from the principles of the present application, and these improvements and refinements should also be considered as the protection scope of the present application.

Claims

1. A method for CC attack identification, characterized in that, The method comprises the following steps: obtaining a first access index corresponding to each preset time period of the independent station, the first access index being the number of different access IPs accessing the independent station once; determining whether the first access index reaches a first preset standard, and determining that the corresponding preset time period is an attacked time period when the first access index reaches the first preset standard; determining the growth rate between the first access index corresponding to each preset time period and the first access index corresponding to the previous preset time period, and determining whether the growth rate of the attacked time period reaches a second preset standard when the growth rate reaches the second preset standard; determining the growth acceleration between the growth rate corresponding to each preset time period and the growth rate corresponding to the previous preset time period, and determining the attack type of the independent station according to the reached preset standard when the growth acceleration reaches a third preset standard or a fourth preset standard, wherein the growth acceleration between the growth rate corresponding to each preset time period and the growth rate corresponding to the previous preset time period is determined, it is determined whether the growth acceleration is greater than a second threshold value and the growth amplitude between the growth acceleration and the growth acceleration of the corresponding previous preset time period is greater than a third threshold value, it is determined whether the growth amplitude is greater than a fourth threshold value, and it is determined that the growth acceleration reaches the third preset standard and the independent station is subjected to a pulse attack when the determinations are all true. Alternatively, it is determined whether the growth acceleration belongs to a preset value range, and it is determined whether the growth acceleration is less than a fifth threshold value, and it is determined that the growth acceleration reaches the fourth preset standard and the independent station is subjected to a buffer attack when the determinations are all true.

2. The CC attack identification method of claim 1, wherein, Before obtaining the first access index corresponding to each preset time period of the independent station, the following steps are included: obtaining the access IPs and the number of accesses of the access IPs corresponding to each preset time period of the independent station; for each preset time period, filtering the access IPs with the number of accesses greater than one.

3. The CC attack identification method of claim 2, wherein, After obtaining the access IPs and the number of accesses of the access IPs corresponding to each preset time period of the independent station, the following steps are included: determining whether the number of accesses of the same access IP corresponding to consecutive preset time periods is greater than a first threshold value; when the determination is true, the corresponding access IP is pulled into a blacklist, and the request sent by the access IP is not responded.

4. The CC attack identification method of claim 1, wherein, After determining that the independent station is subjected to a pulse attack, the following steps are included: determining a plurality of preset time periods before the preset time period corresponding to the maximum growth acceleration as start time periods; determining a plurality of preset time periods after the preset time period corresponding to the minimum growth acceleration as end time periods; determining the attacked time of the independent station subjected to the pulse attack according to the start time periods and the end time periods.

5. The CC attack identification method of claim 1, wherein, After determining that the independent station is subjected to a buffer attack, the following steps are included: determining a plurality of preset time periods before the preset time period corresponding to the time when the growth acceleration starts to increase abnormally at a small amplitude as start time periods; determining a plurality of preset time periods after the preset time period corresponding to the minimum growth acceleration as end time periods; determining the attacked time of the independent station subjected to the buffer attack according to the start time periods and the end time periods.

6. The CC attack identification method according to claim 4 or 5, characterized in that, After determining the attacked time when the independent station is subjected to the impulse attack or determining the attacked time when the independent station is subjected to the buffer attack, the method further includes: performing capacity expansion processing on a server of the independent station according to the attacked time when the independent station is subjected to the impulse attack or the attacked time when the independent station is subjected to the buffer attack.

7. A CC attack identification device, characterized in that, The method comprises the following steps: An index acquisition module is configured to acquire a first access index corresponding to each preset time period of the independent station, the first access index being a number of different access IPs accessing the independent station at a single time; An attack time period judgment module is configured to determine whether the first access index reaches a first preset standard, and when the first access index reaches the first preset standard, determine that a corresponding preset time period is an attacked time period; An attack confirmation module is configured to determine a growth rate between the first access index corresponding to each preset time period and a first access index corresponding to a previous preset time period, and determine whether the growth rate of the attacked time period reaches a second preset standard, and when the growth rate reaches the second preset standard, confirm that the independent station is subjected to an attack; An attack type determination module is configured to determine a growth acceleration between the growth rate corresponding to each preset time period and the growth rate corresponding to a previous preset time period, and determine whether the growth acceleration reaches a third preset standard or a fourth preset standard, and when the growth acceleration reaches the preset standard, determine a type of attack subjected to by the independent station according to the reached preset standard, wherein: the growth acceleration between the growth rate corresponding to each preset time period and the growth rate corresponding to a previous preset time period is determined; it is determined whether the growth acceleration is greater than a second threshold value and an increment between the growth acceleration and the growth acceleration of a corresponding previous preset time period is greater than a third threshold value; it is determined whether the decrement is greater than a fourth threshold value; when the determinations are all true, it is determined that the growth acceleration reaches the third preset standard, and it is determined that the independent station is subjected to an impulse attack; Alternatively, it is determined whether the growth acceleration belongs to a preset value range; it is determined whether the growth acceleration is less than a fifth threshold value; when the determinations are all true, it is determined that the growth acceleration reaches the fourth preset standard, and it is determined that the independent station is subjected to a buffer attack.

8. A computer device comprising a central processing unit and a memory, characterized in that The central processing unit is configured to call and run a computer program stored in the memory to perform the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer program is stored in the form of computer readable instructions and is implemented according to the method of any one of claims 1 to 6. When the computer program is called and run by a computer, the steps included in the corresponding method are performed.

Images