Network attack defense method and device, equipment, storage medium and program product

Abstract

The invention provides a network attack defense method and device, equipment, a storage medium and a program product, and the method comprises the steps: determining at least one target server from a server cluster, wherein the target server is a server bearing a network attack; a plurality of target servers which can form an optimal server combination with the target servers are determined from a server cluster, and the optimal server combination is a server combination which is composed of the servers in the server cluster and has the highest computing power in all server combinations with the target servers; and distributing the plurality of target servers to the target servers to form an optimal server combination, and taking the optimal server combination as a defense server combination when the server cluster is attacked by the network. According to the embodiment of the invention, the optimal server combination can be accurately determined, and the optimal server combination is taken as a defense server combination when the server cluster is attacked by the network, so that the defense capability on the network attack is improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network security technology, and in particular to a method, apparatus, device, storage medium and program product for defending against network attacks. Background Technology

[0002] A Distributed Denial of Service (DDoS) attack is a type of network attack that aims to cripple a target system by depleting its resources (such as CPU, memory, and bandwidth). The primary goal of this attack is to prevent the target system from responding to legitimate user requests, thereby achieving a denial-of-service (DoS) effect.

[0003] Network traffic scrubbing is the preferred solution for defending against DDoS attacks. Specifically, by filtering and analyzing all data entering the target system, the attacked traffic is separated from normal traffic, ensuring that normal traffic reaches the target server. The network traffic scrubbing process requires a large amount of computing power for computation.

[0004] When using network traffic scrubbing solutions to defend against DDoS attacks, the servers performing network traffic scrubbing are prone to insufficient computing power under the massive traffic of a DDoS attack. They are unable to handle the filtering and analysis tasks of the massive traffic under a DDoS attack, which can easily lead to defense failure and low defense capability against network attacks. Summary of the Invention

[0005] This invention provides a method, apparatus, device, storage medium, and program product for defending against network attacks, in order to solve the problem that when using a network traffic scrubbing scheme to defend against DDoS attacks, the server performing the network traffic scrubbing is prone to insufficient computing power under the huge traffic of a DDoS attack, making it unable to cope with the filtering and analysis tasks of the huge traffic under a DDoS attack, which easily leads to defense failure and low defense capability against network attacks.

[0006] To solve the above-mentioned technical problems, the present invention is implemented as follows:

[0007] In a first aspect, embodiments of the present invention provide a method for defending against network attacks, comprising:

[0008] Identify at least one target server from the server cluster, the target server being the server subjected to a network attack;

[0009] From the server cluster, determine multiple target servers that can form an optimal server combination with the target server, wherein the optimal server combination is the server combination with the highest computing power among all server combinations consisting of servers in the server cluster and including the target server.

[0010] The multiple target servers are assigned to the target server to form the optimal server combination, which is used as the defense server combination when the server cluster is attacked by the network.

[0011] Optionally, from the server cluster, multiple target servers that can form an optimal server combination with the target server are determined, including:

[0012] Based on the target servers, the Empire Competition ICA algorithm is used to determine the plurality of target servers from the server cluster.

[0013] Optionally, based on the target server, the Empire Competition ICA algorithm is used to determine the plurality of target servers from the server cluster, including:

[0014] Initialization steps: Initialize and generate multiple candidate server combinations, each candidate server including the target server, and all other servers in each candidate server except the target server are servers in the server cluster;

[0015] Determination steps: Determine the power value of each candidate server combination, and determine the core server combination from the multiple candidate server combinations based on the power value; the power value is positively correlated with computing power;

[0016] Iterative steps: Taking all the core server combinations as the center, the ICA algorithm is used for iterative calculation. After each round of iterative calculation, the corrected core server combination is obtained. After each round of iterative calculation, it is determined whether the preset maximum number of iterations has been reached, and the judgment result is obtained.

[0017] First judgment step: If the judgment result is that the maximum number of iterations has not been reached, and the number of the corrected core server combinations calculated in this round of iteration is not 1, the corrected core server combinations calculated in this round of iteration are used as the new core server combinations, and the iteration step is returned until the judgment result is that the maximum number of iterations has been reached;

[0018] Second judgment step: If the judgment result is that the maximum number of iterations has not been reached, and the number of the corrected core server combination calculated in this round of iteration is 1, the corrected core server combination calculated in this round of iteration is determined as the optimal server combination, and the multiple target servers are determined according to the optimal server combination;

[0019] Third judgment step: If the judgment result is that the maximum number of iterations has been reached, determine the server combination with the highest power value among the core server combinations calculated in this round of iteration as the optimal server combination, and determine the multiple target servers based on the optimal server combination.

[0020] Optionally, determining the power value of each of the candidate server combinations includes:

[0021] For each of the candidate server combinations, the power value is determined based on the computing power of the target server, the computing power of the other servers, and the physical distance between the target server and the other servers.

[0022] Optionally, the target server is connected to an external network and is subjected to distributed denial-of-service (DDoS) attacks from the external network.

[0023] Secondly, embodiments of the present invention provide a network attack defense device, comprising:

[0024] The determination module is used to determine at least one target server from the server cluster, wherein the target server is a server subjected to network attacks;

[0025] An execution module is used to determine from the server cluster multiple target servers that can form an optimal server combination with the target server, wherein the optimal server combination is the server combination with the highest computing power among all server combinations consisting of servers in the server cluster and including the target server.

[0026] The allocation module is used to allocate the multiple target servers to the target server to form the optimal server combination, and the optimal server combination is used as the defense server combination when the server cluster is attacked by the network.

[0027] Optionally, the execution module is further configured to determine the plurality of target servers from the server cluster using the Empire Competition ICA algorithm based on the target servers.

[0028] Thirdly, embodiments of the present invention provide an electronic device, including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps in the network attack defense method as described in any one of the first aspects.

[0029] Fourthly, embodiments of the present invention provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps in the network attack defense method as described in any one of the first aspects.

[0030] Fifthly, embodiments of the present invention provide a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the network attack defense method as described in any one of the first aspects.

[0031] In this embodiment of the invention, at least one target server is determined from the server cluster, the target server being a server subjected to network attacks; multiple target servers that can form an optimal server combination with the target server are determined from the server cluster, wherein the optimal server combination is the server combination with the highest computing power among all server combinations consisting of servers in the server cluster and including the target server; multiple target servers are assigned to the target server to form the optimal server combination, and the optimal server combination is used as the defensive server combination when the server cluster is attacked by network attacks. This embodiment of the invention can accurately determine the optimal server combination and use the optimal server combination as the defensive server combination when the server cluster is attacked by network attacks, thereby improving the defense capability against network attacks. Attached Figure Description

[0032] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0033] Figure 1 This is a flowchart illustrating the network attack defense method according to an embodiment of the present invention;

[0034] Figure 2 This is a schematic diagram of the network attack defense device according to an embodiment of the present invention;

[0035] Figure 3 This is a schematic block diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0036] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0037] The terms "first," "second," etc., used in this embodiment of the invention are used to distinguish similar objects, not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, without limiting the number of objects; for example, the first object can be one or more. Furthermore, in this embodiment of the invention, "or" indicates at least one of the connected objects. For example, "A or B" covers three scenarios: Scenario 1: includes A but does not include B; Scenario 2: includes B but does not include A; Scenario 3: includes both A and B. The character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0038] Furthermore, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0039] It should be noted that the collection, gathering, updating, analysis, processing, use, transmission, and storage of personal information involved in the technical solutions of this invention comply with relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken to prevent unauthorized access to personal information data and to maintain personal information security and network security.

[0040] This invention provides a method for defending against network attacks, see [link to relevant documentation]. Figure 1 As shown, Figure 1 This is a flowchart illustrating a network attack defense method according to an embodiment of the present invention. The network attack defense method includes:

[0041] Step 11: Identify at least one target server from the server cluster. The target server is the server that is subjected to network attacks.

[0042] Step 12: From the server cluster, identify multiple target servers that can form the optimal server combination with the target server. The optimal server combination is the server combination with the highest computing power among all server combinations consisting of servers in the server cluster and including the target server.

[0043] Step 13: Assign multiple target servers to target servers to form the optimal server combination, and use the optimal server combination as the defense server combination when the server cluster is attacked by the network.

[0044] In some embodiments, the specific steps of determining the target server in step 11 may include: receiving a command sent by the user through an interactive terminal to specify the target server, and determining that the server specified in the command is the target server.

[0045] In some embodiments, the specific step of determining the target server in step 11 may further include: determining the target server from the server cluster according to a preset target server determination rule. This determination rule may be based on at least one server performance metric selected from CPU utilization, network bandwidth, disk I / O, and average load.

[0046] It should be noted that the target server is a server designed to withstand network attacks. The target server can directly withstand external network attacks, such as DDoS attacks, and serves as the front line in DDoS attack defense using network traffic scrubbing solutions. In practical applications, the number of target servers can be determined by the user according to actual needs; this invention does not impose further limitations in this regard.

[0047] In some embodiments, when a network attack occurs, the connection between the external network and any other servers in the cluster except the target server can be shut down through firewall response or physical shutdown. This redirects the network attack to the target server, making it the server that bears the brunt of the attack. In other words, during a network attack, only the target server in the entire server cluster is directly connected to the external network. Multiple target servers are indirectly connected to the external network through the target server, providing ample computing power to the target server to assist in defending against network attacks from the external network using network traffic scrubbing schemes. Understandably, the above-mentioned scheme of shutting down the connection between the external network and any other servers in the cluster except the target server also achieves damage control, preventing the scope of the network attack from expanding.

[0048] In step 12 of this embodiment, the optimal server combination is the server combination with the highest computing power among all server combinations consisting of servers in the server cluster and including the target server. In other words, the optimal server combination is the server combination with the highest computing power that the target server can form within the server cluster. The server combination with the highest computing power has the strongest ability to resist DDoS attacks.

[0049] In some embodiments, step 13 assigns multiple target servers to target servers, that is, constructs or preserves an internal path between the target servers and the target servers. Through this path, computing power support and data transmission can be carried out, thereby forming a server combination and obtaining a defense server combination.

[0050] Understandably, there is an upper limit to the number of servers that each target server can connect to. This upper limit is the maximum number of concurrent connections a server can connect to, and it depends on factors such as the operating system and system resources. In other words, the optimal server combination is the combination of servers that the target servers can form with the highest computing power, up to and including the maximum number of concurrent connections.

[0051] The defense server combination has abundant computing power and a strong ability to perform network traffic scrubbing to defend against network attacks, which can effectively improve the defense against network attacks.

[0052] In this embodiment of the invention, step 11 involves identifying at least one target server from the server cluster, where the target server is a server subjected to network attacks; step 12 involves identifying multiple target servers from the server cluster that can form an optimal server combination with the target server, wherein the optimal server combination is the server combination with the highest computing power among all server combinations consisting of servers in the server cluster and including the target server; and step 13 involves assigning the multiple target servers to the target server to form the optimal server combination, which is then used as the defensive server combination when the server cluster is subjected to network attacks. This embodiment of the invention can accurately determine the optimal server combination and use it as the defensive server combination when the server cluster is subjected to network attacks, thereby improving the ability to defend against network attacks.

[0053] In some embodiments, from the server cluster, multiple target servers that can form an optimal server combination with the target server are identified, including:

[0054] Based on the target server, the Imperial Competition ICA algorithm is used to identify multiple target servers from the server cluster.

[0055] The Imperialist Competitive Algorithm (ICA) is a swarm intelligence-based optimization algorithm that simulates the competition and colonization process between empires. ICA is a heuristic algorithm primarily used to solve complex optimization problems. The basic idea of ​​ICA is to view the optimization problem as a process of competition between "empires," where each "empire" consists of multiple "nations." The algorithm finds the optimal solution by simulating competition and cooperation among these nations. ICA can effectively explore the solution space and avoid getting trapped in local optima. ICA has good global search capabilities and is suitable for complex optimization problems.

[0056] In this embodiment of the invention, based on the target server, the Empire Competition ICA algorithm is used to determine multiple target servers from the server cluster. This can avoid getting trapped in local optima and select multiple target servers that, when combined with the target server, have the strongest resistance to network attacks.

[0057] In some embodiments, multiple target servers are identified from a server cluster using the Empire Competition ICA algorithm, based on the target server, including:

[0058] Initialization steps: Initialize and generate multiple candidate server combinations. Each candidate server includes a target server. In addition, all other servers in each candidate server except the target server are servers in the server cluster.

[0059] Determining the steps: Determine the power value of each candidate server combination, and determine the core server combination from multiple candidate server combinations based on the power value; power value is positively correlated with computing power;

[0060] Iteration steps: Taking the entire core server combination as the center, the ICA algorithm is used for iterative calculation. After each round of iterative calculation, the corrected core server combination is obtained. In addition, after each round of iterative calculation, it is determined whether the preset maximum number of iterations has been reached, and the judgment result is obtained.

[0061] First judgment step: If the judgment result is that the maximum number of iterations has not been reached, and the number of corrected core server combinations calculated in this round of iteration is not 1, the corrected core server combinations calculated in this round of iteration are used as the new core server combinations, and the iteration steps are returned until the judgment result is that the maximum number of iterations has been reached.

[0062] Second judgment step: If the judgment result is that the maximum number of iterations has not been reached, and the number of corrected core server combinations calculated in this round of iteration is 1, the corrected core server combination calculated in this round of iteration is determined as the optimal server combination, and multiple target servers are determined based on the optimal server combination;

[0063] The third judgment step: If the judgment result is that the maximum number of iterations has been reached, determine the server combination with the highest power value among the core server combinations calculated in this round of iteration as the optimal server combination, and determine multiple target servers based on the optimal server combination.

[0064] It should be noted that the maximum number of iterations can be set by the user according to actual needs, and this invention does not impose further limitations on this.

[0065] If the number of corrected core server combinations calculated in this iteration is not 1 before the maximum number of iterations is reached, it means that the unique optimal server combination is not yet determined, and the iteration calculation should continue to find the best combination.

[0066] If the number of core server combinations obtained in this iteration is 1 without reaching the maximum number of iterations, it means that a unique server combination has been determined. This unique server combination meets the requirements for the optimal server combination (i.e., the server combination with the highest computing power among all server combinations consisting of servers in the server cluster and having the target server).

[0067] Reaching the maximum number of iterations indicates that all rounds of iterative calculations have been completed as designed. In this case, the server combination with the highest power value among the corrected core server combinations obtained from this round of iterative calculation is determined as the optimal server combination. It is understandable that power value is positively correlated with computing power; the highest power value means the most computing power. Therefore, the server combination with the highest power value among the corrected core server combinations meets the requirements for the optimal server combination (i.e., the server combination with the most computing power among all server combinations consisting of servers in the server cluster and including the target server).

[0068] It should also be noted that in some cases, when the maximum number of iterations is reached, the number of core server combinations calculated in this iteration is exactly 1. In this case, the unique server combination has the highest power value, and this unique server combination is the optimal server combination.

[0069] In this embodiment of the invention, through initialization steps, determination steps, iteration steps, first judgment steps, second judgment steps, and third judgment steps, the invention achieves refined optimization and improves the accuracy of determining the target server.

[0070] In some embodiments, optionally, determining the power value of each candidate server combination includes:

[0071] For each candidate server combination, the power value is determined based on the computing power of the target server, the computing power of other servers, and the physical distance between the target server and other servers.

[0072] In some embodiments, the expression for determining the power value is as follows:

[0073] ;

[0074] in, Let be the power value of the kth country; It is the computing power provided by the j-th target server; It is the computing power provided by the i-th other server; The physical weight is obtained by normalizing the reciprocal of the physical distance from other servers to the assigned target server (i.e., the physical distance between the target server and other servers in this embodiment of the invention). It should be noted that "other servers" refers to the servers in the core server group other than the target server.

[0075] In this embodiment of the invention, by considering the computing power of the target server, the computing power of other servers, and the physical distance between the target server and other servers, the power value is determined for each candidate server combination. This embodiment of the invention improves the accuracy of optimization and can determine the target server with high accuracy.

[0076] In some embodiments, the target server is connected to an external network and withstands distributed denial-of-service (DDoS) attacks from that network. By connecting the target server to the external network, DDoS attacks are directed to the target server. Furthermore, through optimal server combinations, multiple target servers assist the target server in defending against network attacks from the external network, effectively improving the server cluster's ability to resist DDoS attacks and buying time for countermeasures.

[0077] The present invention will be described below with reference to specific embodiments:

[0078] The ICA algorithm simulates competition between empires, treating server computing resources as "nations" that compete and optimize among multiple empires. When a DDoS attack occurs, the ICA algorithm adaptively adjusts computing power allocation based on traffic changes, concentrating resources on critical parts to resist the attack. Through multiple rounds of competition and iteration, the allocation scheme is continuously optimized, ultimately achieving a globally optimal computing power distribution, effectively improving the ability to resist DDoS attacks.

[0079] First, initialization is required:

[0080] During initialization, a large number of server allocation combinations need to be generated (i.e., multiple candidate server combinations are generated initially), with each combination representing a country. During encoding, the target server is encoded as a1, a2, ... an, and other servers are encoded as b1, b2, ... bn. The distance from other servers to the target server is used as the physical distance and as the weight to allocate other servers to the target server, forming a set of solutions. Each set of solutions corresponds to a country.

[0081] When initializing a nation, its power value is calculated by weighting the physical distance with the computing power provided by the nation. The greater the physical distance, the smaller the weight.

[0082] The power value of the kth country is calculated using the following formula:

[0083] ;

[0084] in It is the computing power provided by the j-th target server. It is the computing power provided by the i-th other server. It is a physical weight, which can be normalized by the inverse of the physical distance from other servers to the assigned target server.

[0085] During initialization, the countries with the highest power values ​​are designated as the initial empires (i.e., the core server combination), and the other countries are designated as colonies. These colonies are then randomly assigned to the initial empires.

[0086] Then, the ICA algorithm is used for iterative calculation:

[0087] The iterative calculation process involves aligning the server composition of a colony with the server composition of the empire to which that colony belongs. For example, if the server composition of an empire is {(a1 b1 b2 b3),(a2 b4 b5)} and the server composition of one of its colonies is {(a1 b2 b3),(a2 b1 b6)}, then the server composition of the empire after aligning is {(a1 b1 b2 b3),(a2 b6)} (the server composition of the colony after aligning is the core server composition that has been corrected).

[0088] Recalculate the power values ​​of the combined server groups of the empire after they have converged.

[0089] Then, the division of colonies is calculated. When the probability of a colony's power value splitting reaches a threshold (which can be preset by the user), a portion of the empire's colonies is allocated to that colony to form a new empire.

[0090] The splitting probability is calculated using the following formula:

[0091] ;

[0092] in, For hyperparameters; It represents the colony's power level; s represents the power value of the corresponding empire; s represents the current iteration count; smax represents the maximum iteration count. It is a natural constant.

[0093] Then, we proceed with the process of competition between empires.

[0094] The power distribution data for each empire and its colonies is calculated using the following formula:

[0095] ;

[0096] in, This represents the power distribution data for the i-th empire; Hyperparameters are 0 to 1; Let be the number of colonies of the i-th empire; Let be the power value of the j-th colony of the i-th empire; Let be the power value of the i-th empire.

[0097] The competition process is as follows:

[0098] The colony with the smallest power value in the empire with the smallest power distribution data will be assigned to the empire with the largest power distribution data.

[0099] Finally, the process of imperial decay will take place, directly leading to the demise of the empire that has lost all its colonies.

[0100] The iteration is completed after smax iterations, or when only one empire remains.

[0101] When the iteration calculation reaches smax, the empire with the highest power value is taken as the optimal solution. If only one empire remains, that empire is taken as the optimal solution.

[0102] The optimal server combination corresponds to the optimal solution for server computing power allocation (i.e., the optimal server combination).

[0103] The database stores the optimal solution for the target server and its corresponding server computing power allocation. When any target server is attacked, the corresponding optimal solution for server computing power allocation can be retrieved from the database, and the computing power and resources of the corresponding server combination can be allocated to the target server to resist the attack.

[0104] This invention provides a network attack defense device, see [link to relevant documentation]. Figure 2 As shown, Figure 2 This is a schematic diagram of a network attack defense device according to an embodiment of the present invention. The network attack defense device 20 includes:

[0105] The determination module 21 is used to determine at least one target server from the server cluster, wherein the target server is a server that is subjected to network attacks;

[0106] The execution module 22 is used to determine from the server cluster multiple target servers that can form an optimal server combination with the target server, wherein the optimal server combination is the server combination with the highest computing power among all server combinations composed of servers in the server cluster and having the target server.

[0107] The allocation module 23 is used to allocate the multiple target servers to the target server to form the optimal server combination, and to use the optimal server combination as the defense server combination when the server cluster is attacked by the network.

[0108] In some embodiments, the execution module 22 is further configured to determine the plurality of target servers from the server cluster using the Empire Competition ICA algorithm based on the target servers.

[0109] In some embodiments, the execution module 22 is further configured to initialize and generate multiple candidate server combinations, each candidate server including the target server, and the other servers in each candidate server besides the target server are servers in the server cluster;

[0110] The execution module 22 is further configured to determine the power value of each of the candidate server combinations, and determine the core server combination from the plurality of candidate server combinations based on the power value; the power value is positively correlated with computing power;

[0111] The execution module 22 is further configured to perform iterative calculations using the ICA algorithm with all the core server combinations as the center, and to obtain the corrected core server combinations after each round of iterative calculations. In addition, after each round of iterative calculations, it is determined whether the preset maximum number of iterations has been reached, and a judgment result is obtained.

[0112] The execution module 22 is further configured to, if the judgment result is that the maximum number of iterations has not been reached, and the number of the corrected core server combinations obtained in this round of iteration is not 1, use the corrected core server combinations obtained in this round of iteration as the new core server combinations, return to the step of performing iterative calculations using the ICA algorithm with all the core server combinations as the center, obtain the corrected core server combinations after each round of iteration calculation, and determine whether the preset maximum number of iterations has been reached after each round of iteration calculation, and obtain the judgment result, until the judgment result is that the maximum number of iterations has been reached;

[0113] The execution module 22 is further configured to determine the modified core server combination calculated in this iteration as the optimal server combination if the judgment result is that the maximum number of iterations has not been reached and the number of the modified core server combination calculated in this iteration is 1, and determine the plurality of target servers according to the optimal server combination.

[0114] The execution module 22 is further configured to, if the judgment result is that the maximum number of iterations has been reached, determine the server combination with the highest power value among the modified core server combinations calculated in this round of iteration as the optimal server combination, and determine the multiple target servers based on the optimal server combination.

[0115] In some embodiments, the execution module 22 is further configured to determine the power value for each of the candidate server combinations based on the computing power of the target server, the computing power of the other servers, and the physical distance between the target server and the other servers.

[0116] In some embodiments, the target server is connected to an external network and is subjected to distributed denial-of-service (DDoS) attacks from the external network.

[0117] The network attack defense device provided in this embodiment of the invention can implement the various processes implemented in the method embodiment and achieve the same technical effect. To avoid repetition, it will not be described again here.

[0118] This invention provides an electronic device 30, see [link to relevant documentation]. Figure 3 As shown, Figure 3 This is a schematic diagram of the electronic device 30 according to an embodiment of the present invention, including a processor 31, a memory 32, and a program or instructions stored in the memory 32 and executable on the processor 31. When the program or instructions are executed by the processor, they implement the steps in any of the network attack defense methods of the present invention.

[0119] This invention provides a readable storage medium on which a program or instruction is stored. When the program or instruction is executed by a processor, it implements the various processes of the embodiments of the network attack defense method as described above, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0120] The readable storage medium may include, for example, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk. In some examples, the readable storage medium may be a non-transient readable storage medium.

[0121] This invention also provides a computer program product, including computer instructions, which, when executed by a processor, implement various processes of the network attack defense method embodiments described above, and achieve the same technical effect. To avoid repetition, these will not be described again here.

[0122] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0123] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0124] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of the present invention.

Claims

1. A method for defending against network attacks, characterized in that, include: Identify at least one target server from the server cluster, the target server being the server subjected to a network attack; From the server cluster, determine multiple target servers that can form an optimal server combination with the target server, wherein the optimal server combination is the server combination with the highest computing power among all server combinations consisting of servers in the server cluster and including the target server. The multiple target servers are assigned to the target server to form the optimal server combination, which is used as the defense server combination when the server cluster is attacked by the network.

2. The network attack defense method according to claim 1, characterized in that, From the server cluster, identify multiple target servers that can form an optimal server combination with the target server, including: Based on the target servers, the Empire Competition ICA algorithm is used to determine the plurality of target servers from the server cluster.

3. The network attack defense method according to claim 2, characterized in that, Based on the target servers, the Empire Competition ICA algorithm is used to determine the plurality of target servers from the server cluster, including: Initialization steps: Initialize and generate multiple candidate server combinations, each candidate server including the target server, and all other servers in each candidate server except the target server are servers in the server cluster; Determination steps: Determine the power value of each candidate server combination, and determine the core server combination from the multiple candidate server combinations based on the power value; the power value is positively correlated with computing power; Iterative steps: Taking all the core server combinations as the center, the ICA algorithm is used for iterative calculation. After each round of iterative calculation, the corrected core server combination is obtained. After each round of iterative calculation, it is determined whether the preset maximum number of iterations has been reached, and the judgment result is obtained. First judgment step: If the judgment result is that the maximum number of iterations has not been reached, and the number of the corrected core server combinations calculated in this round of iteration is not 1, the corrected core server combinations calculated in this round of iteration are used as the new core server combinations, and the iteration step is returned until the judgment result is that the maximum number of iterations has been reached; Second judgment step: If the judgment result is that the maximum number of iterations has not been reached, and the number of the corrected core server combination calculated in this round of iteration is 1, the corrected core server combination calculated in this round of iteration is determined as the optimal server combination, and the multiple target servers are determined according to the optimal server combination; Third judgment step: If the judgment result is that the maximum number of iterations has been reached, determine the server combination with the highest power value among the core server combinations calculated in this round of iteration as the optimal server combination, and determine the multiple target servers based on the optimal server combination.

4. The network attack defense method according to claim 3, characterized in that, Determine the power value of each of the candidate server combinations, including: For each of the candidate server combinations, the power value is determined based on the computing power of the target server, the computing power of the other servers, and the physical distance between the target server and the other servers.

5. The method for defending against network attacks according to claim 1, characterized in that, The target server is connected to an external network and is subjected to distributed denial-of-service (DDoS) attacks from that external network.

6. A network attack defense device, characterized in that, include: The determination module is used to determine at least one target server from the server cluster, wherein the target server is a server subjected to network attacks; An execution module is used to determine from the server cluster multiple target servers that can form an optimal server combination with the target server, wherein the optimal server combination is the server combination with the highest computing power among all server combinations consisting of servers in the server cluster and including the target server. The allocation module is used to allocate the multiple target servers to the target server to form the optimal server combination, and the optimal server combination is used as the defense server combination when the server cluster is attacked by the network.

7. The network attack defense device according to claim 6, characterized in that, The execution module is further configured to determine the plurality of target servers from the server cluster using the Empire Competition ICA algorithm based on the target servers.

8. An electronic device, characterized in that: It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps in the method for defending against network attacks as described in any one of claims 1 to 5.

9. A readable storage medium, characterized in that: The readable storage medium stores a program or instructions that, when executed by a processor, implement the steps in the network attack defense method as described in any one of claims 1 to 5.

10. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the steps of the method for defending against network attacks as described in any one of claims 1 to 5.

Images