DDoS attack event set construction method and DDoS attack defense method

Abstract

Embodiments of the present invention relate to the field of information security and disclose a method for constructing a DDoS attack event set and a DDoS attack defense method. The DDoS attack event set construction method includes: constructing an event set and setting a weight value for each event in the event set; updating the weight value corresponding to each event based on the occurrence frequency of each event and recording the update time; constructing a segment tree based on the updated weight value and update time of each event, and updating the information of each node in the segment tree; traversing each node in the segment tree, screening events that meet predetermined conditions, and obtaining a DDoS attack event set. The embodiment of the present invention uses an exponentially decaying event weight value calculation and update method to screen attack events to form a DDoS attack event set, facilitating the subsequent use of the DDoS attack event set to search for DDoS attack events from a large number of events, thereby improving the efficiency of attack event detection.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method for constructing a DDoS attack event set and a DDoS attack defense method. Background Art

[0002] Distributed denial of service (DDoS) attacks are one of the major threats facing the internet today. Rapid and accurate detection and effective defense against DDoS attacks have long been a research hotspot in network information security. Application-layer DDoS attacks frequently target specific application protocols using a variety of attack methods. These attacks often require minimal traffic to render services unavailable.

[0003] Currently, the traditional approach to combating application-layer DDoS attacks is to count the frequency of certain event requests and periodically clear timed-out requests. However, this approach has limitations within a cluster, and frequency-based statistics cannot accurately describe attack behavior. Summary of the Invention

[0004] In a first aspect, the present invention provides a method for constructing a DDoS attack event set, comprising:

[0005] Constructing an event set and setting a weight value for each event in the event set;

[0006] According to the occurrence frequency of each event, the weight value corresponding to each event is updated respectively, and the update time is recorded;

[0007] Constructing a segment tree according to the weight value and update time of each event update, and updating information of each node in the segment tree, wherein the information of each node in the segment tree is the weight value and update time of each event;

[0008] Each node in the segment tree is traversed, and events meeting predetermined conditions are screened to obtain a DDoS attack event set.

[0009] In an optional embodiment, when the weight value of each event is updated in real time, updating the weight value corresponding to each event according to the occurrence frequency of each event and recording the update time includes:

[0010] Obtain the occurrence frequency of each event at the current moment and the weight value of each event at the previous moment;

[0011] Calculating the product of the weight value at the previous moment and a predetermined attenuation multiple to obtain a first attenuation amount;

[0012] The first attenuation is added to the occurrence frequency to obtain and update the weight value of each event at the current moment, and the weight value update time of each event is recorded.

[0013] In an optional embodiment, when the weight value of each event is periodically updated, updating the weight value corresponding to each event according to the occurrence frequency of each event and recording the update time includes:

[0014] Obtain the occurrence frequency of each event in the current period and the weight value of each event in the previous period;

[0015] Calculating the product of the weight value in the previous period and the predetermined attenuation multiple to obtain a second attenuation amount;

[0016] The second attenuation is added to the occurrence frequency to obtain and update the weight value of each event in the current period, and the weight value update time of each event is recorded.

[0017] In an optional implementation, updating the information of each node in the segment tree includes:

[0018] According to the occurrence frequency of each event, traverse and update the weight value of each non-leaf node in the segment tree from top to bottom and use the update time of the current record as the update time of the weight of each non-leaf node until the leaf node is updated;

[0019] The weight values ​​of the respective parent nodes in the segment tree are updated from the leaf nodes from bottom to top, and the update time of the current record is used as the update time of the weights of the respective parent nodes until the root node is updated.

[0020] In an optional embodiment, the top-down traversal to update the weight values ​​of each non-leaf node in the segment tree and using the update time of the current record as the update time of the weight of each non-leaf node until the leaf node is updated includes:

[0021] Each non-leaf node in the segment tree passes the first attenuation or the second attenuation to a child node to update the weight value of the child node, and uses the currently recorded update time as the update time of the weight of each child node until the leaf node is updated.

[0022] In an optional embodiment, traversing each node in the segment tree and screening events that meet predetermined conditions to obtain a DDoS attack event set includes:

[0023] Each node in the segment tree is traversed, and when the weight value of the event corresponding to each node is less than a predetermined threshold, the corresponding event is removed from the event set to obtain a DDoS attack event set.

[0024] In a second aspect, the present invention provides a DDoS attack defense method, comprising:

[0025] Obtaining DDoS attack event sets of different categories according to the attack event set construction method described in any one of the aforementioned embodiments;

[0026] Detecting an attack event among events occurring at a current moment based on the DDoS attack event sets of different categories;

[0027] A predetermined defense strategy is adopted to defend against the attack event.

[0028] In a third aspect, the present invention provides a DDoS attack event set construction device, comprising:

[0029] An event set construction module, used to construct an event set and set a weight value for each event in the event set;

[0030] A weight updating module is configured to update the weight value corresponding to each event according to the occurrence frequency of each event and record the update time; construct a segment tree according to the updated weight value and update time of each event, and update the information of each node in the segment tree, wherein the information of each node in the segment tree is the weight value and update time of each event;

[0031] The screening module is used to traverse each node in the segment tree, screen events that meet predetermined conditions, and obtain a DDoS attack event set.

[0032] In a fourth aspect, the present invention provides a computer device comprising a memory and at least one processor, wherein the memory stores a computer program, and the processor is configured to execute the computer program to implement the aforementioned DDoS attack event set construction method.

[0033] In a fifth aspect, the present invention provides a computer storage medium storing a computer program, which, when executed, implements the aforementioned DDoS attack event set construction method.

[0034] The embodiments of the present invention have the following beneficial effects:

[0035] The embodiments of the present invention set an event weight value for each event and, based on an exponentially decaying and increasing event weight value calculation and update method, screen events to form a DDoS attack event set. This ensures that the DDoS attack event set accurately describes the attack behavior, facilitates subsequent use of the DDoS attack event set to search for DDoS attack events from a large number of events, and improves the efficiency of attack event detection. Furthermore, the DDoS attack event set can handle various types of attack events, improving the reliability and accuracy of attack event detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solution of the present invention, the following is a brief introduction to the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and should not be regarded as limiting the scope of protection of the present invention. In each of the drawings, similar components are numbered similarly.

[0037] Figure 1 A schematic diagram of a first implementation of a method for constructing a DDoS attack event set according to an embodiment of the present invention is shown;

[0038] Figure 2 A schematic diagram of a second implementation of the method for constructing a DDoS attack event set according to an embodiment of the present invention is shown;

[0039] Figure 3 A schematic diagram showing a third implementation of the method for constructing a DDoS attack event set according to an embodiment of the present invention is shown;

[0040] Figure 4 A schematic diagram showing a fourth implementation of a method for constructing a DDoS attack event set according to an embodiment of the present invention is shown;

[0041] Figure 5 A schematic diagram of a weight value update process for each node in a segment tree according to an embodiment of the present invention is shown;

[0042] Figure 6 A schematic diagram illustrating an implementation method of a DDoS attack defense method according to an embodiment of the present invention is shown;

[0043] Figure 7 A schematic diagram of the structure of a DDoS attack event set construction device in an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0044] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0045] The components of the embodiments of the present invention generally described and illustrated in the figures herein may be arranged and designed in a variety of different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the figures is not intended to limit the scope of the claimed invention, but rather merely represents selected embodiments of the present invention. All other embodiments derived by those skilled in the art based on the embodiments of the present invention without inventive effort are intended to be within the scope of protection of the present invention.

[0046] Hereinafter, the terms "including", "having" and their cognates, which may be used in various embodiments of the present invention, are intended only to indicate specific features, numbers, steps, operations, elements, components or combinations of the foregoing items, and should not be understood as first excluding the existence of one or more other features, numbers, steps, operations, elements, components or combinations of the foregoing items or the possibility of adding one or more features, numbers, steps, operations, elements, components or combinations of the foregoing items.

[0047] Furthermore, the terms “first,” “second,” “third,” etc., are merely used for distinguishing descriptions and are not to be understood as indicating or implying relative importance.

[0048] Unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by those skilled in the art to which the various embodiments of the present invention pertain. The terms (such as those defined in generally used dictionaries) will be interpreted as having the same meaning as in the context of the relevant technical field and will not be interpreted as having an idealized meaning or an overly formal meaning unless clearly defined in the various embodiments of the present invention.

[0049] DDoS (Distributed Denial of Service), distributed denial of service.

[0050] Segment tree, a data structure for efficiently maintaining statistical interval information.

[0051] Example 1

[0052] In the field of network information security, application-layer DDoS attacks are one of the major threats currently facing the internet. Because application-layer DDoS attacks frequently launch attack requests targeting specific application protocols and employ a variety of attack methods, these attacks often require minimal traffic to render services unavailable. Therefore, to ensure network information security, detection of application-layer DDoS attacks is necessary. The diverse nature of application-layer attack events necessitates the definition of multiple different attack events, such as requests from a specific IP address or account. These attack events are massive, even theoretically infinite, making them difficult to fully document and maintain.

[0053] Based on this, Figure 1 As shown, this embodiment provides a DDoS attack event set construction method for coping with massive attack events by constructing a DDoS attack event set, thereby realizing the detection of DDoS attack events.

[0054] S10, constructing an event set and setting a weight value for each event in the event set.

[0055] First, an event set is constructed, containing the most suspicious attack events. Each event is assigned a weight. The higher the weight, the more suspicious the attack event, thus eliminating events with smaller weights. This forms a DDoS attack event set, and each event in this set is the most suspicious attack event. This allows this event set to cope with the vast number of external events. This means comparing this attack event set with the vast number of events to identify attack events, complete DDoS attack detection, and maintain application protocols. The most suspicious attack events are the most frequent ones. For example, the event set includes different types of events, such as the number of requests from a specific IP address, incorrect password input for a specific account, the most frequently requested IP address, and the most frequently failed authentication accounts.

[0056] Furthermore, different categories of DDoS attack event sets can be formed by constructing event sets of different categories. Different categories of events have their own event sets, that is, an event set of one event category can be constructed accordingly.

[0057] In addition, you can pre-set the size of each event set, whether for a single event set or for different event sets. The size of an event set can be customized based on your specific needs and is not a specific limit. For example, you can define an event set for events like incorrect password input. If you want to maintain the top 100 most frequently occurring password error events, you can set the event set size to 100.

[0058] S20, updating the weight value corresponding to each event according to the occurrence frequency of each event, and recording the update time.

[0059] The initial weight of each event in the event set is 0, and the weight is a cumulative exponential decay value. As the event continues to occur, its weight value continues to accumulate. The number of occurrences of each event is counted in real time to update the corresponding weight value of each event, and the update time of the weight value is recorded.

[0060] In addition, as time goes by, the exponential value of the weight accumulated by the event continues to decay. In other words, the weight value of each event will be continuously updated as the frequency and time of the event change.

[0061] Exemplarily, the update logic of the weight value of each event is as follows: 1. If the same event occurs continuously, the weight of the event should be continuously accumulated; 2. As time goes by, the weight value of an event will become smaller and smaller, that is, the weight value of an event that occurs within a predetermined time period will be larger than that of an event that has not occurred within the time period; 3. The weight values ​​of the same event calculated by different machines or modules in the event set should be merged and added together.

[0062] For example, an attack event consists of event A and event B. Event A has a weight of a, and event B has a weight of b. In the first time period T1, event A occurs frequently, while event B occurs less frequently. Therefore, a is greater than b. However, in the second time period T2, event A occurs only once or twice, while event B occurs frequently. The weights of events A and B are continuously updated based on the frequency and time of the events. Therefore, in the second time period T2, a may be less than b. Furthermore, identical events within an event set are those with identical content. For example, if an attack event is set to "Incorrect password input," and 1000 accounts in the system enter an incorrect password twice, the weight of the "Incorrect password input" event will accumulate based on the frequency of the event (2 times).

[0063] In this embodiment, when updating the weight value of each event separately, an update cycle can be set in advance, and the weight value of each event can be periodically updated according to the update cycle and the occurrence frequency of each event, or the weight value of each event can be updated in real time according to the occurrence frequency of each event corresponding to each moment.

[0064] As a feasible implementation method, Figure 2 As shown, when the weight value of each event is updated in real time, step S20 can be specifically divided into the following steps:

[0065] S21, obtaining the occurrence frequency of each event at the current moment and the weight value of the previous moment corresponding to the current moment.

[0066] S22: Calculate the product of the weight value at the previous moment and the predetermined attenuation multiple to obtain a first attenuation amount.

[0067] S23, adding the attenuation amount to the occurrence frequency to obtain and update the weight value of each event at the current moment, and recording the weight value update time of each event.

[0068] In order to satisfy the calculation of the above weight values, this embodiment uses the following recursive formula to describe the weight value update process:

[0069] W t =W t-1 ×β+n t

[0070] Among them, W t represents the weight at time t, W t-1 represents the weight at time t-1, β represents the multiple of attenuation at each moment (0<β<1), n t Indicates the number of times the event is sent at time t.

[0071] In short, the events in an event set decay by β times every second. If there is an event in the event set with a weight of W at t1 seconds and it occurs n times at t2 seconds, then its weight becomes:

[0072]

[0073] As a feasible implementation method, Figure 3 As shown, when the weight value of each event is periodically updated, step S20 may be specifically the following steps:

[0074] S24, obtaining the occurrence frequency of each event in the current cycle and the weight value of each event in the previous cycle.

[0075] S25, calculating the product of the weight value in the previous cycle and the predetermined attenuation multiple to obtain a second attenuation amount.

[0076] S26 , performing an addition operation on the second attenuation and the occurrence frequency to obtain and update the weight value of each event in the current period, and recording the weight value update time of each event.

[0077] Therefore, the periodic update process of the weight value of each event is:

[0078] W t =W t-1 ×β+n t

[0079] Among them, W t represents the weight in the tth period, W t-1 represents the weight in the t-1th period, β represents the multiple of attenuation in each period (0<β<1), n t Indicates the number of events sent in the tth cycle.

[0080] In short, the events in an event set decay by β times every predetermined period. If there is an event in the event set with a weight of W in period t1 and it occurs n times in period t2, then its weight becomes:

[0081]

[0082] Therefore, in this embodiment, when updating the weight value of each event, whether it is a real-time update or a periodic update, the weight value of the event can be continuously updated according to the actual situation through the three parameters of event set size, decay period, and decay multiple.

[0083] The attenuation factor and predetermined period can be set based on actual circumstances and are not limited here. However, once the attenuation factor is set, it is fixed and does not change over time or due to other conditions. Different events can have different attenuation factors, and the attenuation factor setting corresponds to the severity of the event. For example, an event like "incorrect password" will have a larger attenuation factor than an event like "number of requests" because an incorrect password is a more serious attack event, and a larger attenuation factor means that the period for its weight value to decrease to 0 is correspondingly longer.

[0084] S30: construct a segment tree according to the weight value and update time of each event update, and update the information of each node in the segment tree.

[0085] The weight and update time of each event in an event set are used as the node information of a segment tree. A segment tree is constructed for the event set, where a leaf node corresponds to an event in the event set. As the weight of each event changes with frequency and time, the node information (weight value and last update time) of the corresponding node in the segment tree is updated accordingly.

[0086] As a feasible implementation method, Figure 4 As shown, when the weight value of each event is updated in real time, step S30 may be specifically the following steps:

[0087] S31, according to the occurrence frequency of each event, traverse and update the weight value of each non-leaf node in the segment tree from top to bottom and use the update time of the current record as the update time of the weight of each non-leaf node until the leaf node is updated.

[0088] S32, traversing from the leaf node from bottom to top to update the weight value of each parent node in the segment tree and using the update time of the current record as the update time of the weight of each parent node until the root node is updated.

[0089] Exemplarily, the lazy operation of the segment tree is used to update the node information of each node of the segment tree. Among them, each node of the segment tree maintains the minimum weight of the descendant node and the time when the weight is last updated. The weight of each node calculated by fast exponentiation based on the minimum weight of the descendant node, the time when the weight is last updated and the current time (current moment) is the current minimum event weight value in the leaf node to which the segment tree belongs. Moreover, whether it is an old event that has occurred before or a new event that has just occurred so far, the weight values ​​of the new event and the old event in the segment tree are updated from top to bottom and then from bottom to top. Moreover, since the lazy operation is used to update the node information of each node of the segment tree, if the node information of the corresponding event needs to be updated, then only the node information of the node can be updated, and a mark can be made on the node to indicate that the node has been updated, and then the child nodes of the node will no longer be updated, thereby reducing the time complexity of the update and improving the update efficiency.

[0090] When the weight value of each event is updated from top to bottom, each non-leaf node in the segment tree passes the first attenuation or the second attenuation to the child node to update the weight value of the child node, and uses the current update time as the update time of the weight of each child node until the leaf node is updated. Therefore, when the weight value of each event is updated in real time, each non-leaf node passes the cumulative attenuation multiple calculated from the current time and the weight's most recent update time to the child node, that is, multiplying the event weight values ​​corresponding to the left and right child nodes by the cumulative multiple to obtain the latest weight value. At the same time, the node's weight's most recent update time is also changed to the current time, that is, the currently recorded update time is used as the node's weight update time; until the leaf node is reached and its weight value and weight update time are updated.

[0091] Then the leaf nodes are updated from bottom to top, updating the minimum weight value and the most recent weight update time of the descendant nodes along the way until the root node is reached and its weight value and weight update time are updated.

[0092] By following the root of the tree down to the leaf nodes, we can find the event with the smallest weight in logarithmic time complexity, and can also perform elimination and replacement. To find and update the weight of the same event, a separate hash table can be used to maintain the relationship between the event and the leaf node.

[0093] For example, Figure 5 As shown in the figure, it reflects the update process of the weight value and the weight's most recent update time corresponding to each node in the segment tree when the current time is T0, the attenuation multiple is β, and the Event1 event occurs n times. Among them, weight represents the weight value, and weight-update-time represents the weight value's most recent update time.

[0094] If the current time is T0, the attenuation factor is β, and Event1 occurs n times, the weight value update process of each node in the segment tree is as follows:

[0095] Top-down update (W1→W2→W4):

[0096] 1.W2=power(β,T0-T1)*W2;

[0097] 2.W3=power(β,T0-T1)*W3;

[0098] 3. T1 = T0;

[0099] 4.W4=power(β,T0-T2)*W4+n;

[0100] 5.W5=power(β,T0-T2)*W5;

[0101] 6.T2=T0.

[0102] Bottom-up update (W4→W2→W1):

[0103] 1. W2 = max(W4, W5);

[0104] 2.W1=max(W2,W3).

[0105] S40, traverse each node in the segment tree, filter events that meet predetermined conditions, and obtain a DDoS attack event set.

[0106] By traversing each node in the segment tree, if the corresponding event's weight is less than a predetermined threshold, the corresponding event is removed from the event set, resulting in a DDoS attack event set. After traversing all nodes in the segment tree corresponding to different event sets and removing the corresponding events from each event set, a DDoS attack event set is obtained. Each event in this DDoS attack event set is the most suspicious DDoS attack event.

[0107] Since the leaf nodes in the segment tree represent individual events, and their node information is the current minimum event weight, we can simply traverse down from the root node of the segment tree until we reach a leaf node, finding the event with the minimum weight in logarithmic time complexity and removing it from the event set. Therefore, when we need to find the updated weight of the same event, we can use a separate hash table to maintain the relationship between events and leaf nodes, allowing for quick lookup of each event's weight.

[0108] In addition, the actual situation can be used as an auxiliary judgment condition to determine whether it is a DDoS attack event based on the weight value of each event in the current time. At the current moment, if the weight value of an event falls within the predetermined attack event weight value range, then the event can be determined to be an attack event; and the attack event weight value ranges corresponding to different events are different. Among them, the predetermined attack event weight value ranges corresponding to different events can be set accordingly according to the actual situation and are not limited here. For example, there is an event of "incorrect password input for a certain account", when the weight value is 3 (in a very short period of time, when the weight has been triggered 3 times before it decays, the weight can be 3), it can be considered that a user is brute-forcing the attack, and the event is treated as an attack event.

[0109] This embodiment uses an exponentially decaying event weight calculation and update method to filter attack events to form DDoS attack event sets of different categories. This ensures that the DDoS attack event sets accurately describe the attack behavior, making it easier to subsequently use the DDoS attack event sets to find DDoS attack events from a large number of events, thereby improving the efficiency of attack event detection. Furthermore, the DDoS attack event sets can cover attack events of different categories, thereby enabling identification of various attack events from a large number of events, thereby improving the reliability and accuracy of attack event detection.

[0110] Example 2

[0111] The present invention provides a DDoS attack detection method. Figure 6 , the detection method is described in detail below.

[0112] S10, constructing an event set and setting a weight value for each event in the event set.

[0113] S20, updating the weight value corresponding to each event according to the occurrence frequency of each event, and recording the update time.

[0114] S30: construct a segment tree according to the weight value and update time of each event update, and update the information of each node in the segment tree.

[0115] S40, traverse each node in the segment tree, filter events that meet predetermined conditions, and obtain a DDoS attack event set.

[0116] S50: Detect attack events occurring at the current moment based on DDoS attack event sets of different categories.

[0117] S60: adopt a predetermined defense strategy to defend against the attack event.

[0118] In this embodiment, steps S10 to S40 correspond to the steps in embodiment 1, and thus are not described again here.

[0119] By constructing event sets of different categories to generate DDoS attack event sets of different categories, the system can use these event sets to detect whether each event of different categories triggered by the application layer at the current moment is a DDoS attack event of the corresponding category. Once a DDoS attack event of the corresponding category is detected, the system can then implement corresponding defense measures based on the predefined defense strategy.

[0120] Exemplarily, the predetermined defense strategy can be set accordingly based on actual conditions and different types of attack events, which are not limited here. Specifically, the defense strategy is essentially a blacklist, which blocks the IP, account, and other executing entities that trigger the attack event based on the specific attack event. For example, if the event "wrong password input for a certain account" occurs multiple times and exceeds the predetermined number threshold, it can be considered that a user is performing brute force cracking, and the defense strategy of account blocking is adopted. In addition, when using the predetermined defense strategy to defend against each attack event, automated defense or manual defense can be performed, and the final execution of the defense strategy can detect the attack event through the defense module set by each entry and exit service of the external interaction of the application layer, and execute the defense strategy accordingly.

[0121] This embodiment detects attack events through the constructed DDoS attack event set and adopts a predetermined defense strategy to defend against the detected attack events, thereby realizing a closed loop of application layer attack event detection and defense, thereby avoiding the damage of attack events or attack behaviors to application layer services and improving network security and the availability of application layer services.

[0122] Example 3

[0123] like Figure 7 As shown, this embodiment provides a DDoS attack event set construction device, including:

[0124] An event set construction module 71 is used to construct an event set and set a weight value for each event in the event set;

[0125] The weight updating module 72 is configured to update the weight value corresponding to each event according to the occurrence frequency of each event and record the update time; construct a segment tree according to the updated weight value and update time of each event, and update the information of each node in the segment tree, wherein the information of each node in the segment tree is the weight value and update time of each event;

[0126] The screening module 73 is used to traverse each node in the segment tree, screen events that meet predetermined conditions, and obtain a DDoS attack event set.

[0127] The above-mentioned DDoS attack event set construction device corresponds to the DDoS attack event set construction method in Example 1; any optional items in Example 1 are also applicable to this embodiment and will not be described in detail here.

[0128] An embodiment of the present invention further provides a computer device, comprising a memory and at least one processor, wherein the memory stores a computer program, and the processor is configured to execute the computer program to implement the DDoS attack event set construction method of the above embodiment.

[0129] The memory may include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function; the data storage area may store data created based on the use of the computer device (such as weight values ​​of various events, segment trees, etc.). In addition, the memory may include high-speed random access memory and non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0130] An embodiment of the present invention further provides a computer-readable storage medium storing machine-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions cause the processor to execute the steps of the DDoS attack event set construction method of the above embodiment.

[0131] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and structure diagrams in the accompanying drawings show the possible architectures, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, program segment or a part of the code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in an alternative implementation, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the structure diagram and / or flowchart, and the combination of boxes in the structure diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0132] In addition, the functional modules or units in the various embodiments of the present invention may be integrated together to form an independent part, or each module may exist independently, or two or more modules may be integrated to form an independent part.

[0133] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a smart phone, a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0134] The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed by the present invention, which should be covered by the scope of protection of the present invention.

Claims

1. A method for constructing a DDoS attack event set, characterized in that: include: Constructing an event set and setting a weight value for each event in the event set; According to the occurrence frequency of each event, the weight value corresponding to each event is updated in real time, and the update time is recorded; The real-time updating of the weight value corresponding to each event and recording the update time includes: obtaining the occurrence frequency of each event at the current moment and the weight value of each event at the previous moment; calculating the product of the weight value at the previous moment and a predetermined attenuation multiple to obtain a first attenuation amount; adding the first attenuation amount to the occurrence frequency to obtain and update the weight value of each event at the current moment, and recording the weight value update time of each event; Constructing a segment tree based on the weight value and update time of each event update, and updating information of each node in the segment tree, wherein the weight value and update time of an event update in the event set are used as node information of a segment tree, and a leaf node of the segment tree corresponds to an event in the event set; The updating of the information of each node in the segment tree includes: traversing and updating the weight value of each non-leaf node in the segment tree from top to bottom according to the occurrence frequency of each event and using the update time of the current record as the update time of the weight of each non-leaf node until the leaf node is updated; traversing and updating the weight value of each parent node in the segment tree from the leaf node from bottom to top and using the update time of the current record as the update time of the weight of each parent node until the root node is updated; Each node in the segment tree is traversed, and events meeting predetermined conditions are screened to obtain a DDoS attack event set.

2. The method for constructing a DDoS attack event set according to claim 1, wherein: The method further comprises: According to the occurrence frequency of each event, the weight value corresponding to each event is periodically updated, and the update time is recorded; specifically including: Obtain the occurrence frequency of each event in the current period and the weight value of each event in the previous period; Calculating the product of the weight value in the previous period and the predetermined attenuation multiple to obtain a second attenuation amount; The second attenuation is added to the occurrence frequency to obtain and update the weight value of each event in the current period, and the weight value update time of each event is recorded.

3. The method for constructing a DDoS attack event set according to claim 1, wherein: The step of traversing and updating the weight values ​​of each non-leaf node in the segment tree from top to bottom and using the update time of the current record as the update time of the weights of each non-leaf node until the leaf node is updated includes: Each non-leaf node in the segment tree passes the cumulative attenuation multiple to the child node to update the weight value of the child node, and uses the current recorded update time as the update time of the weight of each child node until the leaf node is updated; wherein, the cumulative attenuation multiple is calculated by the current time and the most recent update time of the weight of the non-leaf node.

4. The method for constructing a DDoS attack event set according to claim 1, wherein: The traversal of each node in the segment tree and screening of events that meet predetermined conditions to obtain a DDoS attack event set includes: Each node in the segment tree is traversed, and when the weight value of the event corresponding to each node is less than a predetermined threshold, the corresponding event is removed from the event set to obtain a DDoS attack event set.

5. A DDoS attack defense method, characterized in that: include: Acquire DDoS attack event sets of different categories according to the attack event set construction method according to any one of claims 1 to 4; Detecting an attack event among events occurring at a current moment based on the DDoS attack event sets of different categories; A predetermined defense strategy is adopted to defend against the attack event.

6. A DDoS attack event set construction device, characterized in that: include: An event set construction module, used to construct an event set and set a weight value for each event in the event set; A weight updating module, configured to update the weight value corresponding to each event in real time according to the occurrence frequency of each event, and record the update time; According to the weight value and update time of each event update, a segment tree is constructed, and the information of each node in the segment tree is updated, wherein the weight value and update time of an event update in the event set are used as the node information of a segment tree, and a leaf node of the segment tree corresponds to an event in the event set; wherein the real-time update of the weight value corresponding to each event and the recording of the update time include: obtaining the occurrence frequency of each event at the current moment and the weight value of each event at the previous moment; calculating the product of the weight value at the previous moment and the predetermined attenuation multiple to obtain a first attenuation amount; and multiplying the first attenuation amount by the weight value at the previous moment by the predetermined attenuation multiple. The occurrence frequency is added to obtain and update the weight value of each event at the current moment, and the weight value update time of each event is recorded; the updating of each node information in the segment tree includes: according to the occurrence frequency of each event, traversing and updating the weight value of each non-leaf node in the segment tree from top to bottom and using the update time of the current record as the update time of the weight of each non-leaf node until the leaf node is updated; traversing and updating the weight value of each parent node in the segment tree from the leaf node from bottom to top and using the update time of the current record as the update time of the weight of each parent node until the root node is updated; The screening module is used to traverse each node in the segment tree, screen events that meet predetermined conditions, and obtain a DDoS attack event set.

7. A computer device, characterized in that: The computer device includes a memory and at least one processor, the memory stores a computer program, and the processor is configured to execute the computer program to implement the DDoS attack event set construction method according to any one of claims 1 to 4.

8. A computer storage medium, characterized in that The device stores a computer program, which, when executed, implements the method for constructing a DDoS attack event set according to any one of claims 1 to 4.

Images