An attack detection method, apparatus, device, and computer storage medium

Abstract

Embodiments of the present application disclose a kind of attack detection method, device and computer storage medium, and the method comprises: based on the network to be detected, determine the total flow of several internet protocol (IP) addresses respectively;The total flow of the several IP addresses is respectively coarsely detected, when the first detection result indicates that the total flow of one IP address in the several IP addresses exceeds the first dynamic threshold, determine the one IP address as abnormal IP address, and the total flow of the abnormal IP address is finely detected;When the second detection result indicates that the flow statistical value corresponding to one flow type in the abnormal IP address exceeds the second dynamic threshold, determine that the one flow type exists attack exception, and generate attack alarm information. In this way, without setting the premise of protection object, the abnormal attack detection of facing the whole network flow can be realized, and the change of service flow can also be self-adaptive, while the accuracy of detection is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to an attack detection method and device, equipment and a computer storage medium. BACKGROUND

[0002] Distributed Denial of Service (DDoS) attack is currently an important problem in network security that needs to be solved urgently, and has characteristics such as large attack scale, wide distribution range and serious damage. Therefore, in order to reduce the influence of DDoS attack, it is necessary to detect DDoS attack.

[0003] In the related art, the DDoS defense scheme is based on a specific protection object, and does not have the function of situation awareness analysis on the whole network traffic without setting a target, and preventing attacks initiated or suffered in the existing network. In addition, the existing DDoS defense scheme may also need manual configuration of the threshold, resulting in a large workload, difficulty in adapting to changes in business traffic, and the problem of low detection accuracy. SUMMARY

[0004] The present application expects to provide an attack detection method, device, equipment and computer storage medium, which can not only adapt to the change of business traffic, but also improve the detection accuracy.

[0005] To achieve the above object, the technical scheme of the present application is as follows:

[0006] In a first aspect, the embodiments of the present application provide an attack detection method, which comprises:

[0007] Based on a network to be detected, determining the total traffic of a plurality of Internet Protocol (IP) addresses respectively;

[0008] Performing coarse-grained detection on the total traffic of the plurality of IP addresses respectively to obtain a first detection result;

[0009] When the first detection result indicates that the total traffic of one IP address in the plurality of IP addresses exceeds a first dynamic threshold, determining that the one IP address is an abnormal IP address, and performing fine-grained detection on the total traffic of the abnormal IP address to obtain a second detection result;

[0010] When the second detection result indicates that the traffic statistical value corresponding to one traffic type in the abnormal IP address exceeds a second dynamic threshold, determining that the one traffic type has attack anomaly, and generating attack alarm information.

[0011] In some embodiments, the first dynamic threshold and the second dynamic threshold are obtained by self-learning according to the traffic of the network to be detected within a preset time period.

[0012] In some embodiments, the determining of the total traffic of each of the plurality of IP addresses based on the network to be detected comprises:

[0013] obtaining the total traffic of the network to be detected;

[0014] performing traffic statistics on the plurality of IP addresses respectively according to the total traffic, to obtain the total traffic of each of the plurality of IP addresses.

[0015] In some embodiments, the coarse-grained detection of the total traffic of each of the plurality of IP addresses comprises:

[0016] determining a first dynamic threshold for each of the plurality of IP addresses;

[0017] comparing the total traffic of each of the plurality of IP addresses with the first dynamic threshold of each of the plurality of IP addresses to determine the first detection result.

[0018] In some embodiments, the determining of the first dynamic threshold for each of the plurality of IP addresses comprises:

[0019] based on a first IP address, obtaining at least one total traffic sample within a preset time period, and determining the at least one total traffic sample as a first training set;

[0020] performing self-learning on the first training set by using a preset time smoothing algorithm to obtain the first dynamic threshold of the first IP address;

[0021] wherein the first IP address is any one of the plurality of IP addresses.

[0022] In some embodiments, the performing of self-learning on the first training set by using a preset time smoothing algorithm to obtain the first dynamic threshold of the first IP address comprises:

[0023] selecting a maximum value from the first training set, and determining the maximum value as the first dynamic threshold of the first IP address.

[0024] In some embodiments, the fine-grained detection of the total traffic of the abnormal IP address comprises:

[0025] classifying and counting the total traffic of the abnormal IP address according to traffic types to determine traffic statistical values of at least two traffic types respectively;

[0026] determining a second dynamic threshold value of each of the at least two traffic types;

[0027] comparing the traffic statistical value of each of the at least two traffic types with the second dynamic threshold value of each of the at least two traffic types to determine the second detection result.

[0028] In some embodiments, the determining the second dynamic threshold value of each of the at least two traffic types comprises:

[0029] based on the first traffic type, obtaining at least one traffic statistical value sample in a preset time period, and determining the at least one traffic statistical value sample as a second training set;

[0030] performing self-learning on the second training set by using a preset time smoothing algorithm to obtain the second dynamic threshold value of the first traffic type;

[0031] The first traffic type is any one of the at least two traffic types of the abnormal IP address.

[0032] In some embodiments, the performing self-learning on the second training set by using a preset time smoothing algorithm to obtain the second dynamic threshold value of the first traffic type comprises:

[0033] selecting a maximum value from the second training set, and determining the maximum value as the second dynamic threshold value of the first traffic type.

[0034] In some embodiments, the performing fine-grained detection on the total traffic of the abnormal IP address to obtain a second detection result comprises:

[0035] classifying and counting the total traffic of the abnormal IP address according to traffic types to determine traffic statistical values of at least two traffic types;

[0036] determining a traffic prediction value of each of the at least two traffic types and a third dynamic threshold value of each of the at least two traffic types;

[0037] performing subtraction operation on the traffic statistical value of each of the at least two traffic types and the traffic prediction value of each of the at least two traffic types to obtain a traffic difference value of each of the at least two traffic types;

[0038] comparing the traffic difference value of each of the at least two traffic types with the third dynamic threshold value of each of the at least two traffic types to determine the second detection result.

[0039] Correspondingly, the method further comprises:

[0040] When the second detection result indicates that a traffic difference value corresponding to a traffic type in the abnormal IP address exceeds a third dynamic threshold value, it is determined that the traffic type has an attack anomaly, and attack alarm information is generated.

[0041] In some embodiments, the determining of the traffic prediction value of each of the at least two traffic types comprises:

[0042] Based on a first traffic type, a traffic statistical value at an i-1 time and a traffic prediction value at the i-1 time are obtained.

[0043] According to the traffic statistical value at the i-1 time and the traffic prediction value at the i-1 time, a traffic prediction value at an i time is calculated by using a preset time smoothing algorithm.

[0044] According to the traffic prediction value at the i time, a traffic prediction value corresponding to the first traffic type is determined; wherein i is an integer greater than zero, and the first traffic type is any one of the at least two traffic types.

[0045] In some embodiments, the determining of the third dynamic threshold value of each of the at least two traffic types comprises:

[0046] Based on a first traffic type, at least one traffic statistical value sample in a preset time period is obtained.

[0047] According to the at least one traffic statistical value sample, at least one traffic prediction value sample is calculated by using a preset time smoothing algorithm.

[0048] The at least one traffic statistical value sample and the at least one traffic prediction value sample are subjected to a reduction operation to obtain at least one traffic difference value sample, and the at least one traffic difference value sample is determined as a third training set.

[0049] The average value of all traffic difference value samples in the third training set is calculated to obtain a sample mean, and the standard deviation of all traffic difference value samples in the third training set is calculated to obtain a sample standard deviation.

[0050] According to the sample mean and the sample standard deviation, a third dynamic threshold value of the first traffic type is determined.

[0051] The first traffic type is any one of the at least two traffic types of the abnormal IP address.

[0052] In some embodiments, the determining of the third dynamic threshold value of the first traffic type according to the sample mean and the sample standard deviation comprises:

[0053] determining a first weight value of the sample mean and a second weight value of the sample standard deviation;

[0054] performing a weighted calculation on the sample mean and the sample standard deviation according to the first weight value and the second weight value to obtain a third dynamic threshold value of the first traffic type.

[0055] In a second aspect, an embodiment of the present application provides an attack detection apparatus, the attack detection apparatus comprising a determination unit, a detection unit and an alarm unit; wherein,

[0056] The determination unit is configured to determine total traffic of a plurality of Internet Protocol (IP) addresses respectively based on a network to be detected.

[0057] The detection unit is configured to perform coarse-grained detection on the total traffic of the plurality of IP addresses respectively to obtain a first detection result, and when the first detection result indicates that the total traffic of an IP address in the plurality of IP addresses exceeds a first dynamic threshold value, determine that the IP address is an abnormal IP address, and perform fine-grained detection on the total traffic of the abnormal IP address to obtain a second detection result.

[0058] The alarm unit is configured to determine that an attack anomaly exists in a traffic type when the second detection result indicates that a traffic statistical value corresponding to the traffic type in the abnormal IP address exceeds a second dynamic threshold value, and generate attack alarm information.

[0059] In a third aspect, an embodiment of the present application provides an electronic device, the electronic device comprising a memory and a processor; wherein,

[0060] The memory is configured to store a computer program capable of running on the processor.

[0061] The processor is configured to execute the method according to the first aspect when the computer program is running.

[0062] In a fourth aspect, an embodiment of the present application provides a computer storage medium, characterized by storing a computer program, wherein the computer program is executed by at least one processor to implement the method according to the first aspect.

[0063] The attack detection method, device, equipment and computer storage medium provided by the embodiment of the application determine the total flow of each of a plurality of Internet Protocol (IP) addresses based on a network to be detected; perform coarse-grained detection on the total flow of each of the plurality of IP addresses, determine an IP address as an abnormal IP address when the first detection result indicates that the total flow of the IP address exceeds a first dynamic threshold, and perform fine-grained detection on the total flow of the abnormal IP address; determine that an attack anomaly exists in a flow type when the second detection result indicates that a flow statistical value corresponding to the flow type exceeds a second dynamic threshold, and generate attack alarm information. In this way, two-level detection is adopted, the total flow of the IP is screened first, and then the IP is screened according to different flow types, which not only avoids the pressure on the server when analyzing the total flow, but also realizes abnormal attack detection for the total network flow without setting a protection object, and the threshold dynamic learning method is also used to adapt to the change of the business flow, thereby improving the accuracy of detection. BRIEF DESCRIPTION OF DRAWINGS

[0064] Figure 1 A flowchart of an attack detection method provided by the embodiment of the application is provided.

[0065] Figure 2 A flowchart of coarse-grained detection provided by the embodiment of the application is provided.

[0066] Figure 3 A flowchart of fine-grained detection provided by the embodiment of the application is provided.

[0067] Figure 4 A flowchart of another fine-grained detection provided by the embodiment of the application is provided.

[0068] Figure 5 A flowchart of determining a third dynamic threshold provided by the embodiment of the application is provided.

[0069] Figure 6 A network architecture diagram of an attack detection method provided by the embodiment of the application is provided.

[0070] Figure 7 A detailed flowchart of an attack detection method provided by the embodiment of the application is provided.

[0071] Figure 8 A component structure diagram of an attack detection device provided by the embodiment of the application is provided.

[0072] Figure 9 A component structure diagram of another attack detection device provided by the embodiment of the application is provided.

[0073] Figure 10 A specific hardware structure schematic diagram of an electronic device is provided for the embodiments of the present application. DETAILED DESCRIPTION

[0074] In order to enable persons skilled in the art to more fully understand the features and technical contents of the embodiments of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. It can be understood that the specific embodiments described herein are only used to explain the related application, and not to limit the application. In addition, it should be noted that, for the purpose of description, only the parts related to the application are shown in the drawings.

[0075] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in the specification herein is for describing the embodiments of the present application only and is not intended to limit the present application.

[0076] In the following description, “some embodiments” are described, which describe a subset of all possible embodiments, but it can be understood that “some embodiments” can be the same subset or different subsets of all possible embodiments, and can be combined with each other without conflict.

[0077] It should be noted that the terms “first”, “second”, “third” involved in the embodiments of the present application are only used to distinguish similar objects, and do not represent a specific order of the objects. It can be understood that “first”, “second”, “third” can be interchanged in a specific order or sequence as allowed, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0078] In actual application, the current DDoS defense scheme is based on a specific protection object, and does not have the function of situation awareness analysis on the traffic of the whole network without setting a target, and preventing attacks initiated or suffered in the existing network. In the related art, there are two threshold setting methods for DDoS defense scheme: dynamic threshold and static threshold. Among them, for the whole network scene, the business is complex and variable, and manual configuration and adjustment of static threshold will bring a large workload, which is difficult to adapt to the change of business traffic; and the existing dynamic threshold learning method not only exists between the false positive rate and the false negative rate, but also has low detection accuracy and unstable learning.

[0079] In short, for the prior art, not only does it not have full-network no-target detection of DDoS attacks, but also the detection IP capacity is 100,000 levels, and manual setting of static thresholds is tedious, dynamic learning thresholds are unstable, and detection accuracy is low. That is, the existing attack detection methods generally have a very limited network size that can be covered in the detection process, and can only detect local networks as target attacks, which cannot meet the needs of full-network detection. And for the setting of thresholds, if a static threshold is set, the workload is large and prone to errors; if a dynamic threshold is set, the stability and accuracy are generally poor.

[0080] Based on this, the embodiment of the present application provides an attack detection method, and the basic idea of the method is: based on a network to be detected, determining the total flow of each of a plurality of Internet Protocol (IP) addresses; performing coarse-grained detection on the total flow of each of the plurality of IP addresses to obtain a first detection result; when the first detection result indicates that the total flow of an IP address in the plurality of IP addresses exceeds a first dynamic threshold, determining that the IP address is an abnormal IP address, and performing fine-grained detection on the total flow of the abnormal IP address to obtain a second detection result; when the second detection result indicates that a flow statistical value corresponding to a flow type in the abnormal IP address exceeds a second dynamic threshold, determining that the flow type has an attack anomaly, and generating an attack alarm information. In this way, two-level detection is adopted, the total flow of the IP is first screened, and then the different flow types of the IP are screened, which not only avoids the pressure on the server when analyzing the total flow, but also realizes abnormal attack detection for the full-network flow without setting the protection object, and at the same time, the threshold dynamic learning method is adopted, which can also adapt to the changes of business flow, thereby improving the detection accuracy.

[0081] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0082] Embodiment One

[0083] Referring to Figure 1 , a flowchart of an attack detection method provided by an embodiment of the present application is shown. As Figure 1 indicated, the method can include:

[0084] S101: determining the total flow of each of a plurality of Internet Protocol (IP) addresses.

[0085] It should be noted that the attack detection method of the embodiments of the present application is applied to the full traffic of the whole network backbone network, and can support detection capability of tens of millions of IP. Specifically, based on the full traffic collected on the backbone network, the full traffic can be forwarded to a plurality of traffic analysis platforms through mirroring, light splitting, forwarding and the like, and then the traffic analysis platforms perform traffic analysis, and take corresponding measures and issue corresponding measures for the traffic with abnormalities.

[0086] It should be further noted that the attack detection method described in the embodiments of the present application can be executed in the traffic analysis platform. The detection target is any attack type that can be detected based on traffic, which can realize perception and visual presentation of attack situation in the whole network range, has detection capability of inter-network and international export, and can avoid the notification of the Ministry of Industry and Information Technology on the attack of full bandwidth of inter-network and international export.

[0087] In the embodiments of the present application, the attack type can be a distributed denial of service (DDoS) attack, but is not limited to this. It can be understood that for the DDoS attack, it mainly includes the following four aspects:

[0088] (1) Network layer attack. Here, a typical attack type is a user datagram protocol (UDP) reflection attack, which mainly uses large traffic to congest the network bandwidth of the attacked party, so that the attacked party cannot normally respond to customer access.

[0089] (2) Transmission layer attack. Here, typical attack types include flooding attack, connection number attack, etc., which occupy the connection pool resources of the server to achieve the purpose of denial of service.

[0090] (3) Session layer attack. Here, a typical attack type is a security socket layer (SSL) connection attack, which occupies the SSL session resources of the server to achieve the purpose of denial of service.

[0091] (4) Application layer attack. Here, typical attack types include domain name server (DNS) flooding attack, hypertext transport protocol (HTTP) flooding attack, game bot attack, etc., which occupy the application processing resources of the server to greatly consume the processing performance of the server to achieve the purpose of denial of service.

[0092] Specifically, for S101, in some embodiments, the determining the total traffic of each of the plurality of IP addresses based on the network to be detected can include:

[0093] obtaining the total traffic of the network to be detected;

[0094] performing traffic statistics on the plurality of IP addresses respectively based on the total traffic, to obtain the total traffic of each of the plurality of IP addresses.

[0095] It can be understood that, when a DDoS attack is performed on the backbone network without setting a protection IP, the total traffic of all destination IP addresses obtained from the total traffic can be taken as monitoring objects, and then real-time total traffic (byte number) of all IP addresses is counted, so as to determine the total traffic of each of the plurality of IP addresses.

[0096] For example, taking a DDoS attack as an example, the total traffic collected by the backbone network is distributed to the traffic analysis platform 1 and the traffic analysis platform 2 through forwarding, and then each traffic analysis platform (the traffic analysis platform 1 or the traffic analysis platform 2) counts the total traffic of each IP address in the backbone network traffic received by each traffic analysis platform.

[0097] It should be further noted that there are at least 5 million inter-visit IPs on the China Mobile backbone network. If the total traffic is analyzed based on the total IP, a considerable pressure will be caused on the server. Therefore, in order to meet the detection of IP in the order of millions or even tens of millions on the backbone network, and to reduce the pressure on the server, and to reduce the deployment of the server as much as possible without increasing the current server, the embodiment of the present application provides a DDoS attack detection method based on two-stage detection.

[0098] S102: performing coarse-grained detection on the total traffic of each of the plurality of IP addresses, to obtain a first detection result.

[0099] It should be noted that, after the total traffic of each of the plurality of IP addresses is determined, the first dynamic threshold of each of the plurality of IP addresses can be determined through self-learning, and then the total traffic of each of the plurality of IP addresses is compared with the first dynamic threshold of each of the plurality of IP addresses, to obtain the first detection result. In some embodiments, referring to Figure 2 , a flowchart of coarse-grained detection provided by an embodiment of the present application is shown. As Figure 2 shown, the flowchart can include:

[0100] S201: determining the first dynamic threshold of each of the plurality of IP addresses.

[0101] S202: comparing the total flow of each of the IP addresses with a respective first dynamic threshold to determine the first detection result.

[0102] It should be noted that each IP address corresponds to a respective total flow, and in the coarse-grained detection process, the total flow corresponding to each IP is detected respectively, that is, each IP address can obtain a respective first detection result after coarse-grained detection, and the IP address and the first detection result have a corresponding relationship.

[0103] It should be further noted that in the embodiments of the present application, the first dynamic threshold is obtained by self-learning according to the flow of the network to be detected in a preset time period, that is, the threshold self-learning process, and the value can be used as a flag for measuring IP flow anomaly.

[0104] Here, the first dynamic threshold is obtained by learning the total flow of each IP in a pre-set period of time, that is, the IP address and the first dynamic threshold have a corresponding relationship, and further, in the coarse-grained detection process, each IP address uses a respective first dynamic threshold for detection.

[0105] Further, for the determination of the first dynamic threshold, in some embodiments, for S201, the determination of the first dynamic threshold of each of the IP addresses can include:

[0106] Based on the first IP address, at least one total flow sample in a preset time period is obtained, and the at least one total flow sample is determined as a first training set;

[0107] The first training set is self-learned by using a preset time smoothing algorithm to obtain the first dynamic threshold of the first IP address;

[0108] Wherein, the first IP address is any one of the IP addresses.

[0109] It should be noted that the first training set can include total flow samples of the first IP address at different times, and the first dynamic threshold is obtained by learning a plurality of total flow samples by using a preset time smoothing algorithm. It can be understood that the total flow sample is constantly changing, and the first dynamic threshold is updated accordingly, so that the threshold used in each detection process is obtained based on the recent usage, improving the accuracy of attack detection between different IP addresses.

[0110] In a specific example, the self-learning of the first training set by using the preset time smoothing algorithm to obtain the first dynamic threshold of the first IP address can include: selecting a maximum value from the first training set, and determining the maximum value as the first dynamic threshold of the first IP address.

[0111] That is, as the IP usage status is continuously updated, the selected first training set data is also continuously updated, different first training sets correspond to different maximum values; further, different maximum values correspond to different first dynamic thresholds, so that the threshold self-learning and dynamic updating of the first dynamic threshold are realized.

[0112] In the embodiments of the present application, the threshold self-learning is based on time series to predict the traffic trend, the time smoothing algorithm is suitable for short-term prediction of any time series that has no obvious function rule but has some kind of correlation between before and after, and is suitable for traffic model regular or irregular service IP. Therefore, it is very suitable for the method of detecting DDoS attack without target in the whole network, and the traffic of different service types and different IPs is counted, the traffic fluctuation trend is dynamically learned, and then the manual operation to configure the threshold is reduced, and the user configuration is facilitated.

[0113] S103: When the first detection result indicates that the total traffic of an IP address in the plurality of IP addresses exceeds the first dynamic threshold, determining the IP address as an abnormal IP address.

[0114] It should be noted that the first detection result indicates the comparison result of the total traffic of each of the plurality of IP addresses and the corresponding first dynamic threshold. Specifically, if the total traffic of an IP address is greater than the corresponding first dynamic threshold, it can be indicated that the traffic of the IP address is abnormal, and the IP address is also determined as an abnormal IP address; if the total traffic of an IP address is less than or equal to the corresponding first dynamic threshold, it can be indicated that the IP address does not exist traffic abnormality, and at this time, no processing is performed, that is, the purpose of the coarse-grained detection is to filter out the IP address with abnormal traffic.

[0115] Exemplarily, taking 10 IP addresses as an example, the total traffic of each of the 10 IP addresses is compared with the corresponding first detection threshold, for example, the total traffic of the 8th IP address exceeds the corresponding first dynamic threshold, the 8th IP address is determined as an abnormal IP address, and the remaining 9 IP addresses do not exceed the corresponding first dynamic threshold, and the remaining 9 IP addresses are not processed.

[0116] S104: performing fine-grained detection on the total traffic of the abnormal IP address to obtain a second detection result.

[0117] It should be noted that the embodiments of the present application can adopt two-stage detection, such as first-stage coarse-grained detection and second-stage fine-grained detection. The first-stage coarse-grained detection is used to determine an abnormal IP address, and then the second-stage fine-grained detection is performed on the abnormal IP address. Specifically, the abnormal IP address can be subjected to fine-grained detection according to traffic types.

[0118] In some embodiments, referring to Figure 3 , a flowchart of fine-grained detection provided by the embodiments of the present application is shown. As shown in Figure 3 , the flowchart can include the following steps:

[0119] S301: Classify and count the total traffic of the abnormal IP address according to traffic types to determine traffic statistical values of at least two traffic types respectively.

[0120] S302: Determine second dynamic thresholds of the at least two traffic types respectively.

[0121] S303: Compare the traffic statistical values of the at least two traffic types respectively with the second dynamic thresholds respectively to determine the second detection result.

[0122] It should be noted that the classification of the total traffic of the abnormal IP address according to traffic types can be based on bit rate (Byte Per Second, BPS) or network throughput rate (Packet Per Second, PPS). The BPS represents the number of bytes transmitted per second, which can also be referred to as download speed; and the PPS represents the number of packets transmitted per second. In this way, the classification of the abnormal IP address according to traffic types based on BPS or PPS, if there is a traffic type exceeding the second dynamic threshold, an alarm can be generated, and alarm information can be recorded; if the traffic type does not exceed the dynamic threshold, no alarm is generated, and the flowchart can be ended directly.

[0123] It should be further noted that there is a corresponding relationship between the traffic statistical value of each traffic type and the second dynamic threshold. In some embodiments, the second dynamic threshold is obtained by self-learning according to the traffic of the network to be detected within a preset time period, that is, the threshold self-learning process. The value can be used as a mark to measure the abnormality of the traffic type.

[0124] Here, the second dynamic threshold is obtained by learning the traffic statistical value of each traffic type within a period of time set in advance, that is, there is a corresponding relationship between the traffic type and the second dynamic threshold, and further, in the fine-grained detection process, each traffic type uses the corresponding second dynamic threshold for detection.

[0125] Specifically, for S302, in some embodiments, the determining the second dynamic threshold value of each of the at least two traffic types can include:

[0126] Based on the first traffic type, obtaining at least one traffic statistical value sample in a preset time period, and determining the at least one traffic statistical value sample as a second training set;

[0127] Using a preset time smoothing algorithm to perform self-learning on the second training set to obtain a second dynamic threshold value of the first traffic type;

[0128] The first traffic type is any one of the at least two traffic types of the abnormal IP address.

[0129] It should be noted that the second training set can include several traffic statistical value samples based on the first traffic type at different times, and the second dynamic threshold value is obtained by learning the several traffic statistical value samples through the preset time smoothing algorithm. It can be understood that the continuous change of the traffic statistical sample corresponding to the traffic type causes the second dynamic threshold value to be updated, so that the threshold value used in each detection process is obtained based on the recent usage condition, thereby improving the accuracy of attack detection in different traffic type ranges.

[0130] In a specific example, the using a preset time smoothing algorithm to perform self-learning on the second training set to obtain a second dynamic threshold value of the first traffic type can include: selecting a maximum value from the second training set, and determining the maximum value as the second dynamic threshold value of the first traffic type.

[0131] It should be noted that as the usage condition of the traffic type is continuously updated, the selected second training set data is also continuously updated, and different second training sets correspond to different maximum values. Further, different maximum values correspond to different second dynamic threshold values, so that threshold self-learning and dynamic updating of the second dynamic threshold value are achieved.

[0132] It should also be noted that threshold self-learning is based on time series to predict traffic trends, and the time smoothing algorithm is suitable for short-term prediction of any time series that has no obvious function rule but does have some correlation between before and after, and is suitable for traffic model regular or irregular business traffic types. Therefore, it is very suitable for the method of detecting DDoS attacks without target in the whole network, and it is suitable for different business types, different IPs, and different traffic types for traffic statistics, dynamic learning of traffic fluctuation trends, and reduction of manual operation to configure threshold values, thereby facilitating user configuration.

[0133] S105: When the second detection result indicates that a traffic statistical value corresponding to a traffic type in the abnormal IP address exceeds the second dynamic threshold, it is determined that the traffic type exists attack abnormality, and attack alarm information is generated.

[0134] It should be noted that the second detection result indicates the comparison result of the traffic statistical value corresponding to different traffic types in the abnormal IP address and the respective second dynamic threshold. Specifically, if the traffic statistical value corresponding to a traffic type is greater than the corresponding second dynamic threshold, it can be indicated that the traffic of the traffic type is abnormal, and attack alarm information is generated. If the traffic statistical value corresponding to a traffic type is less than or equal to the corresponding second dynamic threshold, it can be indicated that the traffic of the traffic type does not exist, and no processing is performed, that is, the purpose of the fine-grained detection is to filter out the traffic type with abnormal traffic from the abnormal IP address.

[0135] Exemplarily, taking 20 traffic types in the abnormal IP as an example, the traffic statistical values corresponding to the 20 traffic types are compared with the respective second detection threshold. For example, if the traffic statistical value corresponding to the 18th traffic type exceeds the second dynamic threshold corresponding thereto, attack alarm information is generated. Except for the 18th traffic type, the remaining 19 traffic types do not exceed the respective second dynamic threshold, and the remaining 19 traffic types are not processed.

[0136] The embodiment provides an attack detection method. Based on a network to be detected, total traffic of a plurality of Internet Protocol (IP) addresses is determined. The total traffic of the plurality of IP addresses is subjected to coarse-grained detection. When the first detection result indicates that total traffic of an IP address in the plurality of IP addresses exceeds a first dynamic threshold, the IP address is determined as an abnormal IP address, and the total traffic of the abnormal IP address is subjected to fine-grained detection. When the second detection result indicates that a traffic statistical value corresponding to a traffic type in the abnormal IP address exceeds a second dynamic threshold, it is determined that the traffic type exists attack abnormality, and attack alarm information is generated. In this way, two-level detection is adopted, the total traffic of the IP is screened first, and then different traffic types of the IP are screened, which can avoid the pressure of the server based on the analysis of the total traffic, and realizes rapid detection of the abnormal traffic type in the abnormal IP with attack under the condition of the total network traffic.

[0137] Embodiment Two

[0138] Based on the same inventive concept as the foregoing embodiments, refer to Figure 4 which shows another fine-grained detection flowchart provided by the embodiment of the application. As shown in Figure 4 , the flowchart can include:

[0139] S401: Classify and count the total flow of the abnormal IP address according to the flow type to determine the flow statistical value of each of the at least two flow types.

[0140] S402: Determine the flow prediction value of each of the at least two flow types and the third dynamic threshold value of each of the at least two flow types.

[0141] S403: Perform subtraction operation on the flow statistical value of each of the at least two flow types and the flow prediction value of each of the at least two flow types to obtain the flow difference value of each of the at least two flow types.

[0142] S404: Compare the flow difference value of each of the at least two flow types with the third dynamic threshold value of each of the at least two flow types to determine the second detection result.

[0143] S405: When the second detection result indicates that the flow difference value corresponding to a flow type in the abnormal IP address exceeds the third dynamic threshold value, it is determined that the flow type exists attack anomaly, and attack alarm information is generated.

[0144] It should be noted that in the fine-grained detection process, the second dynamic threshold value obtained by learning can be compared with the flow statistical value corresponding to different flow types to determine the second detection result; or the third dynamic threshold value obtained by learning can be compared with the flow difference value corresponding to different flow types to determine the second detection result. In the embodiments of the present application, the selection can be made according to the specific circumstances, and no limitation is made herein.

[0145] Taking the third dynamic threshold value as an example, for the determination of the flow difference value of each flow type, the corresponding flow prediction value also needs to be determined. In some embodiments, the determination of the flow prediction value of each of the at least two flow types can include:

[0146] Based on the first flow type, the flow statistical value at the i-1 time and the flow prediction value at the i-1 time are obtained;

[0147] According to the flow statistical value at the i-1 time and the flow prediction value at the i-1 time, the flow prediction value at the i time is calculated by using a preset time smoothing algorithm;

[0148] According to the flow prediction value at the i time, the flow prediction value corresponding to the first flow type is determined.

[0149] It should be noted that i is an integer greater than zero. In addition, the first flow type is any one of the at least two flow types.

[0150] In a specific example, the calculating the traffic prediction value at the ith moment according to the traffic statistical value at the i-1th moment and the traffic prediction value at the i-1th moment by using a preset time smoothing algorithm can include:

[0151] performing subtraction operation on the traffic statistical value at the i-1th moment and the traffic prediction value at the i-1th moment to obtain a smoothing difference value at the i-1th moment;

[0152] performing calculation according to the traffic prediction value at the i-1th moment, the smoothing difference value at the i-1th moment and a preset smoothing constant to obtain the traffic prediction value at the ith moment.

[0153] It should be noted that in actual application, the threshold self-learning is based on time series to predict the traffic trend, the time smoothing algorithm is suitable for short-term prediction of any time series which has no obvious function rule but has some correlation between before and after, and is suitable for traffic model regular or irregular service IP. Therefore, it is very suitable for the method of detecting DDoS attack without target in the whole network, and the traffic of different service types and different IPs is counted, the traffic fluctuation trend is dynamically learned, and then the manual operation of configuring the threshold is reduced, and the user configuration is facilitated.

[0154] Specifically, the embodiment of the present application can determine the traffic prediction value by using the time smoothing algorithm. Here, the formula and parameter of the time smoothing algorithm are as follows:

[0155] The calculation formula of the time smoothing algorithm is shown in formula (1), that is, the traffic prediction value at the i+1th moment is calculated as follows,

[0156] S i+1 =a*Y i +(1-a)*S i =S i +a*(Y i -S i ) (1)

[0157] wherein Y i is the traffic statistical value (or called: observation value, actual value, etc.) at the ith moment; S i is the traffic prediction value at the ith moment, which is also the smoothing value at the i-1th moment; S i+1 is the traffic prediction value at the i+1th moment, which is also the smoothing value at the ith moment; here, i represents the moment, 0

[0158] Here, a is a smoothing constant (or called: weight coefficient, weight, etc.), and its value range is (0, 1). In order to ensure the prediction accuracy, it is recommended that the value of a is between 0.6 and 0.7.

[0159] It should be further explained that the determination method of the smoothing constant (weighting factor) a is as follows:

[0160] S0=Y0

[0161] S1=a*Y0+(1-a)*S0=a*Y0+(1-a)*Y0=Y0

[0162] S2=a*Y1+(1-a)*S1=a*Y1+(1-a)*Y0

[0163] S3=a*Y2+(1-a)*S2=a*Y2+a(1-a)*Y1+(1-a) 2 *Y0

[0164] S4=a*Y3+a(1-a)*Y2+a(1-a) 2 *Y1+(1-a) 3 Y0

[0165] Through the above derivation process, the weighting factors are obtained in turn: a, a(1-a), a(1-a) 2 , …, a(1-a) n-2 , a(1-a) n-1 ; it can be known that the closer to the observation value at the i-th moment, the greater the weighting factor given.

[0166] In this way, according to the above formula (1), the flow prediction value at the i-th moment can be determined, and then combined with the flow statistical value at the i-th moment, the flow difference value of each of the at least two flow types can be calculated; the flow difference value of each of the at least two flow types is compared with the third dynamic threshold value of each of the at least two flow types, so as to determine the second detection result, and further determine whether the flow type is abnormal attack, so as to generate attack alarm information.

[0167] Further, for the third dynamic threshold value, in some embodiments, referring to Figure 5 , a flow diagram for determining a third dynamic threshold value is shown. As Figure 5 shown, the flow can include:

[0168] S501: based on the first flow type, obtaining at least one flow statistical value sample within a preset time period.

[0169] S502: according to the at least one flow statistical value sample, at least one flow prediction value sample is calculated by using a preset time smoothing algorithm.

[0170] S503: Perform a subtraction operation on the at least one traffic statistical value sample and the at least one traffic prediction value sample to obtain at least one traffic difference value sample, and determine the at least one traffic difference value sample as a third training set.

[0171] S504: Perform an average value calculation on all traffic difference value samples in the third training set to obtain a sample average value, and perform a standard deviation calculation on all traffic difference value samples in the third training set to obtain a sample standard deviation.

[0172] S505: Determine a third dynamic threshold value of the first traffic type according to the sample average value and the sample standard deviation, wherein the first traffic type is any one of at least two traffic types of the abnormal IP address.

[0173] In a specific example, for S505, the determination of the third dynamic threshold value of the first traffic type according to the sample average value and the sample standard deviation can include:

[0174] determining a first weight value of the sample average value and a second weight value of the sample standard deviation;

[0175] performing a weighted calculation on the sample average value and the sample standard deviation according to the first weight value and the second weight value to obtain the third dynamic threshold value of the first traffic type.

[0176] It should be noted that in the learning process of the third dynamic threshold value, there are two stages of training and detection. The training stage is to learn the traffic within a certain time, learn the traffic fluctuation within a certain time, and take the maximum traffic fluctuation as the maximum traffic fluctuation value max that the traffic can tolerate; the detection stage is to apply the learned max value to actual detection, compare the difference value between the true value and the prediction value at a certain time t, if the former is greater than the latter, it is considered that an anomaly has occurred; if the former is less than the latter, it is considered to be a normal traffic fluctuation, and the detection of the next time t+1 is performed.

[0177] The training stage will count the real traffic and its corresponding prediction value within a certain time to obtain the difference value D between the real value and the prediction value i :

[0178] D i = Y i -S i (2)

[0179] According to formula (2), the value obtained by training is value = c x average (D i ) + b x deviation (D i ). Wherein, average (D i) is D i , the average value of dev(D i ) is the standard deviation of the difference between all sample true values and predicted values. Wherein, b = 3 * c, c = 1.

[0180] Further, the detection stage can compare the value of different attack types according to different IP statistics with the difference between the true value and the predicted value of the real-time traffic, and further judge the anomaly. If the true value-predicted value> value, it is considered that an anomaly has occurred.

[0181] The embodiment provides an attack detection method, and the specific implementation of the foregoing embodiment is described in detail through the foregoing embodiment. As can be seen from the foregoing embodiment, the technical scheme of the foregoing embodiment is used to realize dynamic threshold self-learning, so that the threshold value does not need to be manually configured, the dynamic threshold value can be automatically and stably learned, the service traffic change is self-adaptive, and the detection accuracy is improved.

[0182] Embodiment three

[0183] Based on the same inventive concept as the foregoing embodiment, refer to Figure 6 , which shows a network architecture schematic diagram of an attack detection method provided by the embodiment of the application. As Figure 6 shown, the network architecture at least includes a backbone network and a plurality of traffic analysis platforms (such as traffic analysis platform 1 and traffic analysis platform 2). Among them, based on the traffic collected on the backbone network, the traffic is forwarded to the traffic analysis platform (traffic analysis platform 1 or traffic analysis platform 2) through mirroring, light splitting, forwarding and the like, and then the traffic analysis platform analyzes the full-amount traffic, takes corresponding measures for the traffic with anomalies, and issues corresponding measures. Here, the traffic analysis platform analyzes based on the full-amount forwarded traffic, and the traffic will be aggregated between different traffic analysis platforms to analyze the full-network IP. However, it is estimated that there are at least 5 million inter-visit IPs on the China Mobile backbone network, and if the full-amount IP is analyzed based on the full-amount traffic, it will cause considerable pressure on the server. In the embodiment of the application, the attack detection method provided by the embodiment of the application is used in the traffic analysis platform, which can realize the efficiency of the traffic analysis platform, realize the real-time detection of the full-amount traffic of the DDoS attack detection without changing the existing network architecture and server arrangement, reduce the pressure of the server arrangement, and save the cost.

[0184] In order to meet the IP detection of millions or even tens of millions of level on the backbone network, reduce the pressure of deploying servers, and reduce the deployment of servers as much as possible without increasing the current servers, and realize the perception and visual presentation of attack situation from the perspective of the whole network, have the detection ability of inter-network and international export, avoid the notification of the Ministry of Industry and Information Technology on the attack of inter-network and international export to occupy the bandwidth, the embodiment of the application provides a method for detecting DDoS attack from the perspective of the whole network based on two levels.

[0185] Referring to Figure 7 , a detailed flowchart of an attack detection method provided by the embodiment of the application is shown. As Figure 7 shown, the detailed flowchart can include:

[0186] S701: acquiring the whole network traffic to be detected.

[0187] S702: entering the first level detection, and counting the total traffic of all IPs.

[0188] S703: automatically learning the detection threshold of all IPs and dynamically setting the threshold.

[0189] S704: judging whether the total traffic exceeds the IP total traffic threshold, if yes, entering the second level detection.

[0190] S705: counting the traffic corresponding to the specific traffic type of the IP entering the second level detection.

[0191] S706: automatically learning the threshold of different traffic types of the IP and dynamically setting the threshold.

[0192] S707: judging whether the traffic corresponding to the traffic type exceeds the threshold.

[0193] S708: if yes, generating an attack alarm.

[0194] S709: if no, ending the detection.

[0195] It should be noted that for step S704, if the judgment result is yes, S705 can be continued; if the judgment result is no, the next attack detection can be directly returned to step S702. For step S707, if the judgment result is yes, S708 can be continued, that is, an attack alarm is generated; if the judgment result is no, S709 can be directly executed, that is, the detection is ended.

[0196] It also needs to be explained that in actual application, the whole network is detected for DDoS attack on backbone network without purpose IP, that is, no protection IP is set, and the DDoS attack flow of the purpose IP of the whole network is detected in two stages, the first stage detects the preliminary flow anomaly, and the second stage detects the attack in more fine granularity, and different flow types are counted, so as to locate the attack anomaly more quickly. The two-stage detection process is as follows:

[0197] The first stage detection process: all purpose IPs of the obtained whole flow are taken as monitoring objects, and the real-time total flow (byte number) of all IPs is counted, the maximum allowable value of flow fluctuation in a period of time is obtained through learning of the flow, the value is taken as a symbol for measuring flow anomaly, that is, the value is taken as a dynamically learned threshold value. If the total flow of the IP is higher than the dynamic threshold value, the secondary detection is entered.

[0198] The second stage detection process: the abnormal IP is counted based on BPS or PPS according to flow type, if the flow type exceeds the learned dynamic threshold value, the corresponding alarm is generated, and the alarm information is recorded. If the flow type does not exceed the dynamic threshold value, no alarm is generated, and the secondary detection is ended.

[0199] In this way, the above is the whole process of the second stage detection of DDoS attack, which not only reduces the performance consumption of server resources, but also meets the demand of whole network flow detection on backbone network, perceives flow anomaly in the network, between networks and international export, and avoids the notification of the Ministry of Industry and Information Technology.

[0200] That is, the embodiment of the application proposes a second-stage whole network no-target detection DDoS scheme, and also proposes a dynamic threshold value updating and value (dynamic threshold value) calculation method. Here, the training stage counts real flow and corresponding prediction value in a period of time, obtains the difference D between the real value and the prediction value i : D i = Y i -S i ; then the value obtained by training is value = c x average (D i ) + b x deviation (D i ). Wherein, average (D i ) is the average value of D i , and deviation (D i) is the standard deviation of the difference between the true value and the predicted value of all samples. Wherein, b = 3xc, c = 1. In this way, the method for detecting DDoS attack without target in the whole network is proposed in the embodiment of the application, which can perceive the attack situation on the backbone network, quickly detect DDoS attack in the network, between networks, and international export, and support detection capability of tens of millions of IP. Without manual configuration of threshold value, dynamic threshold value can be automatically and stably learned, adaptive to business flow change, and the detection accuracy is improved. The pressure of the server when analyzing based on the full flow can be avoided, the abnormal flow type in the abnormal IP existing attack is quickly detected under the condition of the whole network flow, and the threshold value dynamic learning method is adopted to solve the problems of tedious work and low detection accuracy caused by manual setting of threshold value.

[0201] The embodiment provides an attack detection method, and the specific implementation of the foregoing embodiment is described in detail through the foregoing embodiment. As can be seen from the foregoing embodiment, the technical scheme of the foregoing embodiment is used for detecting flow anomaly without setting a protection object, thereby perceiving the whole network DDoS attack situation, quickly detecting DDoS attack in the network, between networks, and international export, and supporting detection capability of tens of millions of IP. Without manual configuration of threshold value, dynamic threshold value can be automatically and stably learned, adaptive to business flow change, and the detection accuracy is improved.

[0202] Embodiment four

[0203] Based on the same inventive concept as the foregoing embodiment, refer to Figure 8 which shows a component structure schematic diagram of an attack detection device provided by the embodiment of the application. As Figure 8 shown, the attack detection device 80 can include a determination unit 801, a detection unit 802, and an alarm unit 803; wherein,

[0204] The determination unit 801 is configured to determine the total flow of each of a plurality of Internet Protocol (IP) addresses based on a network to be detected.

[0205] The detection unit 802 is configured to perform coarse-grained detection on the total flow of each of the plurality of IP addresses to obtain a first detection result, and when the first detection result indicates that the total flow of an IP address in the plurality of IP addresses exceeds a first dynamic threshold value, determine that the IP address is an abnormal IP address, and perform fine-grained detection on the total flow of the abnormal IP address to obtain a second detection result.

[0206] The alarm unit 803 is configured to determine that an attack anomaly exists in a flow type corresponding to a flow statistical value when the second detection result indicates that the flow statistical value corresponding to the flow type exceeds a second dynamic threshold value, and generate attack alarm information.

[0207] In some embodiments, the first dynamic threshold and the second dynamic threshold are obtained through self-learning according to the traffic of the network to be detected within a preset time period.

[0208] In some embodiments, the determining unit 801 is specifically configured to acquire the total traffic of the network to be detected; and perform traffic statistics on the plurality of IP addresses respectively according to the total traffic, to obtain the total traffic of each of the plurality of IP addresses.

[0209] In some embodiments, the detecting unit 802 is specifically configured to determine a first dynamic threshold of each of the plurality of IP addresses; and compare the total traffic of each of the plurality of IP addresses with the first dynamic threshold of each of the plurality of IP addresses, to determine the first detection result.

[0210] In some embodiments, referring to Figure 9 , the attack detection apparatus 80 can further include a self-learning unit 804 configured to acquire at least one total traffic sample within a preset time period based on a first IP address, determine the at least one total traffic sample as a first training set, perform self-learning on the first training set by using a preset time smoothing algorithm, and obtain a first dynamic threshold of the first IP address; wherein the first IP address is any one of the plurality of IP addresses.

[0211] In some embodiments, the self-learning unit 804 is specifically configured to select a maximum value from the first training set, and determine the maximum value as the first dynamic threshold of the first IP address.

[0212] In some embodiments, the detecting unit 802 is specifically configured to classify and statistically determine a traffic statistical value of each of at least two traffic types according to the total traffic of the abnormal IP address, determine a second dynamic threshold of each of the at least two traffic types, and compare the traffic statistical value of each of the at least two traffic types with the second dynamic threshold of each of the at least two traffic types, to determine the second detection result.

[0213] In some embodiments, the self-learning unit 804 is further configured to acquire at least one traffic statistical value sample within a preset time period based on a first traffic type, determine the at least one traffic statistical value sample as a second training set, perform self-learning on the second training set by using a preset time smoothing algorithm, and obtain a second dynamic threshold of the first traffic type; wherein the first traffic type is any one of the at least two traffic types of the abnormal IP address.

[0214] In some embodiments, the self-learning unit 804 is specifically configured to select a maximum value from the second training set, and determine the maximum value as the second dynamic threshold of the first traffic type.

[0215] In some embodiments, the detection unit 802 is specifically configured to: classify and count the total flow of the abnormal IP address according to flow types, to determine flow statistical values of at least two flow types respectively; determine flow prediction values of the at least two flow types respectively and third dynamic thresholds of the at least two flow types respectively; perform subtraction operation on the flow statistical values of the at least two flow types respectively and the flow prediction values of the at least two flow types respectively, to obtain flow difference values of the at least two flow types respectively; and compare the flow difference values of the at least two flow types respectively with the third dynamic thresholds of the at least two flow types respectively, to determine the second detection result.

[0216] Correspondingly, the alarm unit 803 is further configured to: when the second detection result indicates that a flow difference value corresponding to a flow type in the abnormal IP address exceeds a third dynamic threshold, determine that the flow type exists attack anomaly, and generate attack alarm information.

[0217] In some embodiments, the determination unit 801 is further configured to: based on a first flow type, obtain a flow statistical value at an i-1 time and a flow prediction value at the i-1 time; and according to the flow statistical value at the i-1 time and the flow prediction value at the i-1 time, calculate a flow prediction value at an i time by using a preset time smoothing algorithm; and according to the flow prediction value at the i time, determine a flow prediction value corresponding to the first flow type; wherein i is an integer greater than zero, and the first flow type is any one of the at least two flow types.

[0218] In some embodiments, the self-learning unit 804 is further configured to: based on a first flow type, obtain at least one flow statistical value sample in a preset time period; according to the at least one flow statistical value sample, calculate at least one flow prediction value sample by using a preset time smoothing algorithm; perform subtraction operation on the at least one flow statistical value sample and the at least one flow prediction value sample, to obtain at least one flow difference value sample, and determine the at least one flow difference value sample as a third training set; perform average value calculation on all flow difference value samples in the third training set, to obtain a sample mean value; and perform standard deviation calculation on all flow difference value samples in the third training set, to obtain a sample standard deviation; according to the sample mean value and the sample standard deviation, determine a third dynamic threshold of the first flow type; wherein the first flow type is any one of the at least two flow types of the abnormal IP address.

[0219] In some embodiments, the self-learning unit 804 is specifically configured to determine a first weight of the sample mean and a second weight of the sample standard deviation; and perform weighted calculation on the sample mean and the sample standard deviation according to the first weight and the second weight to obtain the third dynamic threshold of the first traffic type.

[0220] It can be understood that, in this embodiment, the "unit" can be a partial circuit, a partial processor, a partial program or software, and of course can also be a module, and can also be non-modular. Moreover, the components in this embodiment can be integrated in a processing unit, or can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software function module.

[0221] The integrated unit, if realized in the form of a software function module and not sold or used as an independent product, can be stored in a computer-readable storage medium, based on this understanding, the technical solutions of the embodiment can be embodied in the form of a software product in essence or in the form of a software product that contributes to the prior art or the whole or part of the technical solutions. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the method described in the embodiment. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (Read Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk or an optical disk, and various program code storage media.

[0222] Therefore, the embodiment provides a computer storage medium, which stores an attack detection program, and the attack detection program is executed by at least one processor to implement the steps of the method in any one of the foregoing embodiments.

[0223] Based on the components of the attack detection device 80 and the computer storage medium, refer to Figure 10 , which shows a specific hardware structure schematic diagram of an electronic device 90 provided by the embodiment of the application. As Figure 10 indicated, it can include a communication interface 901, a memory 902 and a processor 903; each component is coupled together through a bus system 904. It can be understood that the bus system 904 is used to realize the connection communication between the components. In addition to the data bus, the bus system 904 also includes a power bus, a control bus and a status signal bus. However, for the purpose of clear illustration, only the data bus is shown in Figure 10The various buses are collectively marked as bus system 904. Among them, the communication interface 901 is used for receiving and sending signals in the process of transmitting information with other external network elements;

[0224] The memory 902 is used for storing computer programs capable of running on the processor 903;

[0225] The processor 903 is used for executing the following when running the computer programs:

[0226] Based on the network to be detected, determine the total traffic of each of a plurality of IP addresses;

[0227] Coarse-grained detection is performed on the total traffic of each of the plurality of IP addresses to obtain a first detection result;

[0228] When the first detection result indicates that the total traffic of one IP address among the plurality of IP addresses exceeds a first dynamic threshold, the one IP address is determined to be an abnormal IP address, and fine-grained detection is performed on the total traffic of the abnormal IP address to obtain a second detection result;

[0229] When the second detection result indicates that a traffic statistical value corresponding to one traffic type among the abnormal IP addresses exceeds a second dynamic threshold, it is determined that the one traffic type has an attack anomaly, and an attack alarm information is generated.

[0230] It is to be appreciated that the memory 902 in embodiments of the application can be volatile, nonvolatile, or a combination of both. By way of example, the nonvolatile memory can be read-only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), electrically EPROM (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which acts as external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double-data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), SynchBurst DRAM (SLDRAM), and direct Rambus RAM (DRRAM). The memory 902 of the subject systems and methods is intended to include, without being limited to, these and any other suitable types of memory.

[0231] The processor 903 can be an integrated circuit chip logic circuit having a processing capability. In implementation, each step of the above method can be completed by integrated logic circuit of hardware in the processor 903 or instructions in the form of software. The processor 903 described above can be a general processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. Each method, step and logic block diagram disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware code processor for execution, or a combination of hardware and software modules in the code processor for execution. The software module can be located in a random access memory, a flash memory, a read only memory, a programmable read only memory or an electrically erasable programmable memory, a register, etc. The storage medium in the art. The storage medium is located in the memory 902, and the processor 903 reads the information in the memory 902, and combines the hardware to complete the steps of the above method.

[0232] It can be understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented within one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, micro-controllers, microprocessors, other electronic units designed to perform the functions described herein, or a combination thereof.

[0233] For software implementation, the techniques described herein can be implemented with modules (e.g., procedures, functions, and so on) that perform the functions described herein. The software codes can be stored in memory and executed by processors. The memory can be implemented within the processors or external to the processors.

[0234] Optionally, as another embodiment, the processor 903 is further configured to execute the steps of the method in any of the preceding embodiments when running the computer program.

[0235] Optionally, as another embodiment, the embodiments of the present application further provide another electronic device 90, which can comprise the attack detection apparatus 80 in any of the preceding embodiments.

[0236] In the embodiments of the present application, for the electronic device 90, two-stage detection is adopted, specifically, the total flow of IP is first screened, and then different flow types of IP are screened, so that not only the pressure of the server when analyzing based on the total flow is avoided, but also abnormal attack detection facing the total network flow is realized without setting the protection object, and at the same time, the threshold value dynamic learning mode is adopted, so that the change of the business flow can be self-adapted, and the detection accuracy is improved.

[0237] It should be noted that in the present application, the terms "comprising", "containing" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of another identical element in the process, method, article or device including the element.

[0238] The serial numbers of the embodiments of the present application described above are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0239] The methods disclosed in the several method embodiments provided by the present application can be combined arbitrarily without conflict to obtain new method embodiments.

[0240] The features disclosed in the several product embodiments provided by the present application can be combined arbitrarily without conflict to obtain new product embodiments.

[0241] The features disclosed in the several method or device embodiments provided by the present application can be combined arbitrarily without conflict to obtain new method or device embodiments.

[0242] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An attack detection method characterized by, The method comprises: determining total traffic of a plurality of Internet Protocol (IP) addresses respectively based on a network to be detected; performing coarse-grained detection on the total traffic of the plurality of IP addresses respectively to obtain a first detection result; when the first detection result indicates that the total traffic of an IP address among the plurality of IP addresses exceeds a first dynamic threshold, determining that the IP address is an abnormal IP address, and performing fine-grained detection on the total traffic of the abnormal IP address to obtain a second detection result; when the second detection result indicates that a traffic statistical value corresponding to a traffic type among the abnormal IP addresses exceeds a second dynamic threshold, determining that the traffic type has an attack anomaly, and generating an attack alarm information; the fine-grained detection on the total traffic of the abnormal IP address to obtain the second detection result comprises: classifying and counting the total traffic of the abnormal IP address according to traffic types to determine traffic statistical values of at least two traffic types respectively; determining traffic prediction values of the at least two traffic types respectively and third dynamic thresholds of the at least two traffic types respectively; performing subtraction operation on the traffic statistical values of the at least two traffic types respectively and the traffic prediction values respectively to obtain traffic difference values of the at least two traffic types respectively; comparing the traffic difference values of the at least two traffic types respectively with the third dynamic thresholds of the at least two traffic types respectively to determine the second detection result; determining the third dynamic thresholds of the at least two traffic types respectively comprises: based on a first traffic type, obtaining at least one traffic statistical value sample in a preset time period; according to the at least one traffic statistical value sample, calculating at least one traffic prediction value sample by using a preset time smoothing algorithm; performing subtraction operation on the at least one traffic statistical value sample and the at least one traffic prediction value sample to obtain at least one traffic difference value sample, and determining the at least one traffic difference value sample as a third training set; performing average value calculation on all traffic difference value samples in the third training set to obtain a sample mean value, and performing standard deviation calculation on all traffic difference value samples in the third training set to obtain a sample standard deviation; determining the third dynamic threshold of the first traffic type according to the sample mean value and the sample standard deviation; wherein the first traffic type is any one of the at least two traffic types of the abnormal IP address.

2. The method of claim 1, wherein, The first dynamic threshold and the second dynamic threshold are obtained by self-learning according to the traffic of the network to be detected in a preset time period.

3. The method of claim 1, wherein, The determination of the total traffic of the plurality of IP addresses respectively based on the network to be detected comprises: obtaining total traffic of the network to be detected; performing traffic counting on the plurality of IP addresses respectively according to the total traffic to obtain the total traffic of the plurality of IP addresses respectively.

4. The method of claim 1, wherein, The coarse-grained detection on the total traffic of the plurality of IP addresses respectively to obtain the first detection result comprises: determining first dynamic thresholds of the plurality of IP addresses respectively; The total flow of each of the plurality of IP addresses is compared with a respective first dynamic threshold to determine the first detection result.

5. The method of claim 4, wherein, The first dynamic threshold of each of the plurality of IP addresses is determined by: Based on the first IP address, at least one total flow sample in a preset time period is obtained, and the at least one total flow sample is determined as a first training set; The first dynamic threshold of the first IP address is obtained by self-learning the first training set using a preset time smoothing algorithm; The first IP address is any one of the plurality of IP addresses.

6. The method of claim 5, wherein, The first dynamic threshold of the first IP address is obtained by self-learning the first training set using a preset time smoothing algorithm, including: The maximum value is selected from the first training set, and the maximum value is determined as the first dynamic threshold of the first IP address.

7. The method of claim 1, wherein, The total flow of the abnormal IP address is detected in detail to obtain a second detection result, including: The total flow of the abnormal IP address is classified and counted according to the flow type to determine the flow statistical value of each of at least two flow types; A second dynamic threshold of each of the at least two flow types is determined; The flow statistical value of each of the at least two flow types is compared with the respective second dynamic threshold to determine the second detection result.

8. The method of claim 7, wherein, The second dynamic threshold of each of the at least two flow types is determined by: Based on the first flow type, at least one flow statistical value sample in a preset time period is obtained, and the at least one flow statistical value sample is determined as a second training set; The second dynamic threshold of the first flow type is obtained by self-learning the second training set using a preset time smoothing algorithm; The first flow type is any one of the at least two flow types of the abnormal IP address.

9. The method of claim 8, wherein, The second dynamic threshold of the first flow type is obtained by self-learning the second training set using a preset time smoothing algorithm, including: The maximum value is selected from the second training set, and the maximum value is determined as the second dynamic threshold of the first flow type.

10. The method of claim 1, wherein, The method further includes: When the second detection result indicates that the flow difference value corresponding to a flow type in the abnormal IP address exceeds a third dynamic threshold, it is determined that the flow type has an attack anomaly, and an attack alarm information is generated.

11. The method of claim 1, wherein, The flow prediction value of each of the at least two flow types is determined by: Based on the first flow type, the flow statistical value at the i-1 time and the flow prediction value at the i-1 time are obtained; The flow prediction value at the i time is calculated using a preset time smoothing algorithm according to the flow statistical value at the i-1 time and the flow prediction value at the i-1 time; The flow prediction value corresponding to the first flow type is determined according to the flow prediction value at the i time; wherein i is an integer greater than zero, and the first flow type is any one of the at least two flow types.

12. The method of claim 1, wherein, The third dynamic threshold of the first flow type is determined according to the sample mean and the sample standard deviation, including: determine a first weight of the sample mean and a second weight of the sample standard deviation; weight the sample mean and the sample standard deviation according to the first weight and the second weight to obtain a third dynamic threshold of the first traffic type.

13. An attack detection apparatus characterized by comprising: The attack detection device comprises a determination unit, a detection unit, an alarm unit and a self-learning unit; wherein, The determination unit is configured to determine the total traffic of each of a plurality of Internet Protocol (IP) addresses based on a network to be detected. The detection unit is configured to perform coarse-grained detection on the total traffic of each of the plurality of IP addresses to obtain a first detection result, and when the first detection result indicates that the total traffic of an IP address among the plurality of IP addresses exceeds a first dynamic threshold, determine that the IP address is an abnormal IP address, and perform fine-grained detection on the total traffic of the abnormal IP address to obtain a second detection result. The alarm unit is configured to determine that an attack anomaly exists in a traffic type when the second detection result indicates that a traffic statistical value corresponding to the traffic type exceeds a second dynamic threshold, and generate attack alarm information. The detection unit is specifically configured to classify and count the total traffic of the abnormal IP address according to traffic types to determine the traffic statistical value of each of at least two traffic types, determine the traffic prediction value of each of the at least two traffic types and the third dynamic threshold of each of the at least two traffic types, perform subtraction operation on the traffic statistical value of each of the at least two traffic types and the traffic prediction value of each of the at least two traffic types to obtain the traffic difference value of each of the at least two traffic types, and compare the traffic difference value of each of the at least two traffic types with the third dynamic threshold of each of the at least two traffic types to determine the second detection result. The self-learning unit is configured to obtain at least one traffic statistical value sample in a preset time period based on a first traffic type, calculate at least one traffic prediction value sample based on the at least one traffic statistical value sample using a preset time smoothing algorithm, perform subtraction operation on the at least one traffic statistical value sample and the at least one traffic prediction value sample to obtain at least one traffic difference value sample, determine the at least one traffic difference value sample as a third training set, calculate the average value of all traffic difference value samples in the third training set to obtain a sample mean, calculate the standard deviation of all traffic difference value samples in the third training set to obtain a sample standard deviation, and determine the third dynamic threshold of the first traffic type based on the sample mean and the sample standard deviation; wherein, the first traffic type is any one of the at least two traffic types of the abnormal IP address.

14. An electronic device, comprising: The electronic device comprises a memory and a processor; wherein, The memory is configured to store a computer program capable of running on the processor; The processor is configured to execute the method of any one of claims 1 to 12 when running the computer program.

15. A computer storage medium, comprising, The computer storage medium stores a computer program, and the computer program is executed by at least one processor to implement the method in any one of claims 1 to 12.

Images