DDoS sweep attack detection method, device, electronic device, and medium

Abstract

The present disclosure provides a DDoS sweep attack detection method, device, electronic device and storage medium, which relates to the field of network security technology. The method includes: obtaining the traffic log sent to the target device in each detection cycle; sorting the IP data streams in the traffic log according to the IP address, and comparing the size of the traffic floating ratio of each IP data stream with the preset traffic floating ratio in turn, and accumulating multiple consecutive adjacent IP data streams whose traffic floating ratio is less than the preset traffic floating ratio according to the IP address to obtain multiple IP data stream sets; when the data size of the first IP data stream set is greater than the preset detection threshold, determining that the IP data stream in the first IP data stream set is attack traffic data, and generating a first attack event based on the first IP data stream set. The present disclosure can effectively identify dispersed attacks in data traffic and improve the detection effect of abnormal data.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a DDoS sweep attack detection method, device, electronic device, and storage medium. Background Art

[0002] DDoS (Distributed Denial of Service) refers to the use of a large number of legitimate distributed servers to send requests to the target, thereby preventing normal legitimate users from obtaining services.

[0003] Existing abnormal attack detection mainly targets traffic anomalies targeting a single Internet Protocol (IP) IP address. It classifies and screens various features in the target address traffic, then sets thresholds based on industry experience. When the traffic in the relevant classification exceeds the corresponding threshold, an alarm event will be generated.

[0004] However, existing abnormal attack detection can only detect a considerable portion of attacks and cannot effectively detect decentralized, multi-target, small-volume attack traffic that aims to occupy link bandwidth.

[0005] Based on this, how to detect dispersed attacks in traffic data has become a technical problem that needs to be solved urgently.

[0006] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the Invention

[0007] The present disclosure provides a DDoS sweep attack detection method, device, electronic device, and storage medium, which, at least to a certain extent, overcome the problem in related technologies of being unable to detect dispersed attacks.

[0008] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by practice of the present disclosure.

[0009] According to one aspect of the present disclosure, a DDoS sweep attack detection method is provided, comprising: obtaining a traffic log sent to a target device within each detection cycle, wherein the traffic log contains multiple groups of Internet Protocol (IP) data flows and IP address information and traffic information of each IP data flow; sorting the IP data flows in the traffic log according to the IP address, and sequentially comparing the inter-flow floating ratio of each IP data flow with a preset inter-flow floating ratio, accumulating multiple consecutive adjacent IP data flows whose inter-flow floating ratio is less than the preset inter-flow floating ratio according to the IP address to obtain multiple IP data flow sets, wherein the inter-flow floating ratio of the smaller IP data flow of two adjacent IP data flows is the ratio of the difference in data size between the two adjacent IP data flows to the larger IP data flow, and the multiple IP data flow sets include a first IP data flow set; when the data size of the first IP data flow set is greater than a preset detection threshold, determining that the IP data flows in the first IP data flow set are attack traffic data, and generating a first attack event based on the first IP data flow set.

[0010] In one embodiment of the present disclosure, obtaining traffic data sent to a target device during each detection cycle includes: obtaining a device identifier of the target device, wherein the device identifier is at least one of a device interface index and an IP address; and obtaining traffic data sent to the target device during each detection cycle based on the device identifier of the target device.

[0011] In one embodiment of the present disclosure, after obtaining the traffic log sent to the target device in each detection cycle, the method further includes: filtering IP traffic in the traffic log that is smaller than a preset traffic size to filter data traffic that complies with the routing protocol.

[0012] In one embodiment of the present disclosure, the method further includes: acquiring attack events generated in multiple detection cycles and an event identifier of each attack event; and merging the multiple attack events according to the event identifier to obtain a second attack event.

[0013] In one embodiment of the present disclosure, the event identifier is at least one of an attack target and an attack type; and according to the attack target and / or attack type, multiple attack events are merged to obtain a second attack event.

[0014] In one embodiment of the present disclosure, the method further includes: determining a second duration of the second attack event; if the second attack event attacks continuously and the second duration does not reach a preset duration, marking the second attack event as a suspected attack; if the second attack event attacks continuously and the second duration reaches a preset duration, marking the second attack event as the start of an attack.

[0015] In one embodiment of the present disclosure, the method also includes: determining a second recovery duration of the second attack event; if the second attack event interrupts the attack and the second recovery duration does not reach a preset recovery duration, marking the second attack event as an attack interruption; if the second attack event interrupts the attack and the second recovery duration reaches a preset recovery duration, marking the second attack event as an attack end.

[0016] In one embodiment of the present disclosure, the above method also includes: when the proportion of the first IP number of the first IP data flow set is greater than the preset IP number proportion, determining that the first IP data flow set is attack traffic data, and generating a first attack event based on the first IP data flow set, wherein the first IP number proportion is the ratio of the total number of IP data flows between the first IP data flow set and the traffic log.

[0017] In one embodiment of the present disclosure, the preset detection threshold is set as a fixed detection threshold; alternatively, the preset detection threshold of the target device at time point t is determined by the following steps: obtaining a set P consisting of the target device's recent n-day year-on-year traffic data F near the current moment, where P = {F i |1≤i≤n|}; remove the maximum value F in the set P max and the minimum value F min Get the set Q, where Q = P-{F min ,F max}; Arrange the elements in the set Q in ascending order according to the order of the corresponding dates to obtain an ordered set D, where D={D1,D2,…,D n-2}; Calculate the baseline B at time point t using the following formula t :

[0018]

[0019] The threshold T of the target device at time point t is calculated by the following formula t :

[0020] T t =B t ·C

[0021] Among them, C is the preset floating coefficient. When T t ≤BW, the preset detection threshold of the target device at time t is T t When T t >BW, the preset detection threshold value of the target device at time point t is BW, where BW is the interface bandwidth.

[0022] According to another aspect of the present disclosure, a DDoS sweep attack detection device is provided, comprising: a data acquisition module for acquiring a traffic log sent to a target device within each detection cycle, wherein the traffic log comprises multiple groups of IP data streams and IP address information and traffic information of each IP data stream; a data accumulation module for sorting the IP data streams in the traffic log according to the IP address, and sequentially comparing the traffic floating ratios of each IP data stream with a preset traffic floating ratio, accumulating multiple consecutive adjacent IP data streams whose traffic floating ratios are less than the preset traffic floating ratio according to the IP address to obtain multiple IP data stream sets, wherein the traffic floating ratio of the smaller of two adjacent IP data streams is the ratio of the difference in data size between the two adjacent IP data streams to the larger IP data stream, and the multiple IP data stream sets include a first IP data stream set; an attack identification module for determining that the first IP data stream set is attack traffic data when the data size of the first IP data stream set is greater than a preset detection threshold, and generating a first attack event based on the first IP data stream set.

[0023] In one embodiment of the present disclosure, the above-mentioned data acquisition module is also used to obtain the device identification of the target device; based on the device identification of the target device, where the device identification is at least one of a device interface index and an IP address, the traffic data sent to the target device in each detection cycle is obtained.

[0024] In one embodiment of the present disclosure, after obtaining the traffic log sent to the target device in each detection cycle, the method further includes: filtering IP traffic in the traffic log that is smaller than a preset traffic size to filter data traffic that complies with the routing protocol.

[0025] In one embodiment of the present disclosure, the apparatus further includes a data filtering module configured to filter IP data flows in the traffic log that are smaller than a preset traffic size, so as to filter data flows that comply with the routing protocol.

[0026] In one embodiment of the present disclosure, the above-mentioned device also includes an event merging module, which is used to obtain attack events generated in multiple detection cycles and an event identifier of each attack event; merge multiple attack events according to the event identifier to obtain a second attack event.

[0027] In one embodiment of the present disclosure, the event merging module is further configured to identify the event as at least one of an attack object and an attack type; and merge multiple attack events according to the attack object and / or attack type to obtain a second attack event.

[0028] In one embodiment of the present disclosure, the above-mentioned device also includes an event marking module, which is used to determine a second duration of the second attack event; if the second attack event is a continuous attack and the second duration does not reach a preset duration, mark the second attack event as a suspected attack; if the second attack event is a continuous attack and the second duration reaches a preset duration, mark the second attack event as the start of an attack.

[0029] In one embodiment of the present disclosure, the above-mentioned event marking module is also used to determine the second recovery duration of the second attack event; when the second attack event interrupts the attack and the second recovery duration does not reach the preset recovery duration, the second attack event is marked as an attack interruption; when the second attack event interrupts the attack and the second recovery duration reaches the preset recovery duration, the second attack event is marked as an attack end.

[0030] In one embodiment of the present disclosure, the above-mentioned attack identification module is also used to determine that the first IP data flow set is attack traffic data when the proportion of the first IP number of the first IP data flow set is greater than the preset IP number proportion, and generate a first attack event based on the first IP data flow set, wherein the first IP number proportion is the ratio of the total number of IP data flows between the first IP data flow set and the traffic log.

[0031] According to another aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the above-mentioned DDoS sweep attack detection method by executing the executable instructions.

[0032] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned DDoS sweep attack detection method is implemented.

[0033] The embodiments of the present disclosure provide a DDoS sweep attack detection method, device, electronic device, and storage medium, wherein the DDoS sweep attack detection method includes: obtaining traffic data sent to a target device during each detection cycle, wherein the traffic log contains multiple Internet Protocol (IP) data flows and IP address information and traffic information of each IP data flow; sorting the IP data flows in the traffic log according to IP address, and sequentially comparing the flow rate fluctuation ratio of each IP data flow with a preset flow rate fluctuation ratio, accumulating IP data flows with flow rate fluctuation ratios less than the preset flow rate fluctuation ratio according to IP address to obtain multiple IP data flow sets, wherein the multiple IP data flow sets include a first IP data flow set; when the data size of the first IP data flow set is greater than a preset detection threshold, determining that the IP data flows in the first IP data flow set are attack traffic data, and generating a first attack event based on the first IP data flow set. The present disclosure can effectively identify dispersed attacks in data traffic and improve the detection effect of abnormal data.

[0034] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The accompanying drawings are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification, are used to explain the principles of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure, and those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0036] Figure 1 A schematic diagram showing a communication system structure according to an embodiment of the present disclosure is provided;

[0037] Figure 2 A flow chart of a DDoS sweep attack detection method according to an embodiment of the present disclosure is shown;

[0038] Figure 3 A flow chart of another DDoS sweep attack detection method according to an embodiment of the present disclosure is shown;

[0039] Figure 4 A flow chart of another DDoS sweep attack detection method according to an embodiment of the present disclosure is shown;

[0040] Figure 5 A schematic diagram of a DDoS sweep attack detection method according to an embodiment of the present disclosure is shown;

[0041] Figure 6 A schematic diagram of another DDoS sweep attack detection method according to an embodiment of the present disclosure is shown;

[0042] Figure 7 A schematic diagram of a DDoS sweep attack detection device according to an embodiment of the present disclosure is shown; and

[0043] Figure 8 A structural block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0044] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be embodied in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0045] In addition, the accompanying drawings are merely schematic illustrations of the present disclosure and are not necessarily drawn to scale. Identical reference numerals in the figures denote identical or similar parts, and thus repetitive descriptions thereof will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0046] As mentioned in the above background technology, existing abnormal attack detection mainly detects traffic anomalies targeting a single IP address. It classifies and screens various features in the target address traffic, and then sets thresholds based on industry experience. When the traffic of the relevant classification exceeds the corresponding threshold, an alarm event will be generated.

[0047] However, existing abnormal attack detection can only detect a considerable portion of attacks and cannot effectively detect decentralized, multi-target, small-volume attack traffic that aims to occupy link bandwidth.

[0048] When a large number of botnet servers send data packets to a large number of IP addresses within a certain network segment, attackers often send smaller amounts of traffic to a single IP address and distribute traffic evenly to a large number of target IP addresses to avoid detection. If the total traffic to these target IP addresses approaches or reaches the circuit bandwidth, it will cause circuit congestion, leading to network paralysis or service interruption.

[0049] In order to effectively identify this type of traffic, a segment scanning attack detection mechanism was developed based on the actual network conditions.

[0050] Based on this, in order to detect such distributed, multi-target, small-flow abnormal data packets, the embodiments of the present disclosure provide a DDoS sweep attack detection method, device, electronic device and storage medium, which uses IP segments as detection targets and bandwidth ratio as threshold for traffic detection. It can effectively identify the balanced traffic of multiple IPs in the traffic data, and issue an alarm once this balanced traffic reaches the maximum carrying bandwidth.

[0051] The DDoS sweep attack detection provided by this disclosure is a new detection method. Compared with traditional detection methods, it is independent of various attack characteristics and avoids the problem of being unable to identify unknown attack characteristics. At the same time, it effectively identifies dispersed attack flows in real traffic that traditional detection cannot effectively identify.

[0052] DDoS sweep attack detection uses the ratio of a customer's leased bandwidth to the maximum bandwidth of the backbone line as a detection threshold. When a large number of similar packets are detected in real traffic, and their combined per-second traffic volume blocks the bandwidth of the existing detection line, the sweep attack detection system can identify these packets. Combined with a response system to clean or block the relevant traffic, the security of the detection line can be guaranteed.

[0053] Figure 1 A schematic diagram shows an exemplary system architecture that can be applied to the DDoS sweep attack detection method or DDoS sweep attack detection device according to the embodiments of the present disclosure.

[0054] like Figure 1 As shown, the system architecture 100 may include terminal devices 101 , 102 , 103 , a network 104 and a server 105 .

[0055] The network 104 is a medium for providing a communication link between the terminal devices 101 , 102 , 103 and the server 105 , and can be a wired network or a wireless network.

[0056] Optionally, the above-mentioned wireless network or wired network uses standard communication technologies and / or protocols. The network is typically the Internet, but can also be any network, including but not limited to a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile, wired or wireless network, a private network or any combination of a virtual private network). In some embodiments, technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. are used to represent data exchanged over the network. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPsec), etc. can be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can also be used to replace or supplement the above-mentioned data communication technologies.

[0057] The terminal devices 101 , 102 , and 103 may be various electronic devices, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, wearable devices, augmented reality devices, virtual reality devices, and the like.

[0058] Optionally, the client of the application installed in different terminal devices 101, 102, and 103 is the same, or the client of the same type of application based on different operating systems. Based on different terminal platforms, the specific form of the client of the application can also be different, for example, the application client can be a mobile phone client, a PC client, etc.

[0059] The server 105 may be a server that provides various services, such as a background management server that provides support for devices operated by users using the terminal devices 101, 102, and 103. The background management server may analyze and process received requests and other data, and feed back the processing results to the terminal device.

[0060] Optionally, the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The terminal can be a smart phone, tablet computer, laptop computer, desktop computer, smart speaker, smart watch, etc., but is not limited to these. The terminal and the server can be directly or indirectly connected via wired or wireless communication, which is not limited in this application.

[0061] Those skilled in the art will know that Figure 1 The number of terminal devices, networks, and servers in the embodiment is merely illustrative, and any number of terminal devices, networks, and servers may be provided based on actual needs. This embodiment of the present disclosure does not limit this.

[0062] This exemplary implementation is described in detail below with reference to the accompanying drawings and examples.

[0063] First, an embodiment of the present disclosure provides a method for detecting DDoS sweep attacks, which can be executed by any electronic device with computing and processing capabilities.

[0064] Figure 2 A flow chart of a DDoS sweep attack detection method according to an embodiment of the present disclosure is shown as follows: Figure 2 As shown, the DDoS sweep attack detection method provided in the embodiment of the present disclosure includes the following steps:

[0065] S202 : Obtain a traffic log sent to the target device during each detection period, wherein the traffic log includes multiple groups of Internet Protocol (IP) data flows and IP address information and traffic information of each IP data flow.

[0066] It should be noted that the target device can be any device that requires network security protection, or a traffic collection device used to collect data traffic sent to the security protection device, such as a terminal device, server, etc.; the detection period can be any freely set time period, such as 5 seconds, 1 minute or 2 hours, etc.; the IP data stream can be a data packet sent between two devices, the IP address information of the IP data stream can include the source IP address and destination IP address of the IP data stream, and the traffic information can be the data size of the IP data stream.

[0067] In one embodiment of the present disclosure, after obtaining the traffic log sent to the target device in each detection cycle, the above method may further include: filtering the IP data streams in the traffic log that are smaller than the preset traffic size to filter the data traffic that complies with the routing protocol. There may be multiple IP data streams that comply with the routing protocol in the traffic log. After the multiple IP data streams that comply with the routing protocol are sorted according to the IP address, the traffic floating ratios of the multiple IP data streams that comply with the routing protocol are all smaller than the preset traffic floating ratios. Therefore, it is necessary to filter the traffic data that complies with the routing protocol to improve the accuracy of subsequent scanning attack detection. The preset traffic size can be set arbitrarily, such as 50k, 100K or 2M, etc.

[0068] S204, sort the IP data flows in the traffic log according to the IP address, and compare the size of the traffic floating ratio of each IP data flow with the preset traffic floating ratio in turn, and accumulate multiple consecutive adjacent IP data flows whose traffic floating ratio is less than the preset traffic floating ratio according to the IP address to obtain multiple IP data flow sets, wherein the traffic floating ratio of the smaller IP data flow between two adjacent IP data flows is the ratio of the difference in data size between the two adjacent IP data flows to the larger IP data flow, and the multiple IP data flow sets include the first IP data flow set.

[0069] It should be noted that the IP data flows in the traffic log can be sorted according to the source IP address or destination IP address of each IP data flow, and then, the inter-flow floating ratio of each IP data flow is compared with the preset inter-flow floating ratio in turn, and multiple consecutive adjacent IP data flows with a floating ratio less than the preset inter-flow floating ratio are accumulated according to the destination IP address of the IP data flow to obtain multiple IP data flow sets. The first IP data flow set can be any one of the multiple IP data flow sets.

[0070] S206: When the data size of the first IP data flow set is greater than a preset detection threshold, determine that the IP data flows in the first IP data flow set are attack traffic data, and generate a first attack event according to the first IP data flow set.

[0071] It should be noted that the preset detection threshold is used to identify whether an IP data flow set is attack data. When the data size of the IP data flow set is greater than the preset detection threshold, the IP data flow set is determined to be attack traffic data. When the data size of the IP data flow set is less than or equal to the preset traffic detection threshold, the IP data flow set is determined to be non-attack traffic data. The preset detection threshold can be freely set according to detection requirements, such as 100G, 500G, 650G, etc., and this disclosure does not impose specific limitations on this.

[0072] In one embodiment of the present disclosure, the above method may also include: when the proportion of the first IP number of the first IP data flow set is greater than the preset IP number proportion, determining that the first IP data flow set is attack traffic data, and generating a first attack event based on the first IP data flow set, wherein the first IP number proportion is the ratio of the total number of IP data flows between the first IP data flow set and the traffic log.

[0073] It should be noted that whether the first IP data flow set is attack traffic data can be judged based on the proportion of the first IP number in the first IP data flow set. After determining that the first IP data flow set is attack traffic data, a first attack event can be generated based on the first IP data flow set so as to provide an alarm for the attack event subsequently.

[0074] The DDoS sweep attack detection method provided by the disclosed embodiments accumulates IP data flows with an inter-flow fluctuation ratio less than a preset inter-flow fluctuation ratio by IP address to obtain multiple IP data flow sets. When the data size of a first IP data flow set exceeds a preset detection threshold, the IP data flows in the first IP data flow set are determined to be attack traffic data, and a first attack event is generated based on the first IP data flow set. The disclosed method can effectively identify dispersed attacks in data traffic and improve the detection of abnormal data.

[0075] In one embodiment of the present disclosure, see Figure 3 The flowchart of another DDoS sweep attack detection method shown in FIG. 1 includes the following steps: obtaining traffic data sent to the target device during each detection cycle; and

[0076] S302: Obtain a device identification of the target device, where the device identification is at least one of a device interface index and an IP address.

[0077] S304: Obtain the traffic data sent to the target device in each detection cycle according to the device identification of the target device.

[0078] It should be noted that in one embodiment of the present disclosure, the device identifier is at least one of a device interface index and an IP address. Based on the device interface index and / or IP address of the target device, the flow data sent to the target device during each detection cycle can be determined. Based on the device interface index and / or IP address of the target device, relevant data can be extracted, processed, tested, aggregated, and compared from multiple flow logs, and IP data flows with the destination IP address of the target device can be screened to obtain the flow data sent to the target device during each detection cycle.

[0079] In one embodiment of the present disclosure, netflow log information collected by an acquisition device is obtained, and traffic logs F of a target device are statistically calculated based on the device IP field and interface index or destination address field included in the netflow log information t (t is the statistical period) and single-address traffic F it (i is a certain IP address, t is the statistical period). When F t >T b , F it is sorted in descending order, and the IP data stream with a traffic value of F it <F min is removed (F min is the minimum statistical value, e.g., 150 Kbps). The traffic is compared in descending order in sequence, and whether its floating value is within a certain range is calculated. The formula is: (F int -F i(n+1)t ) / F int <V (i is a certain IP address, n ∈ {1, 2, 3,...}, t is the statistical period, V is the volatility). The proportion of the number of IPs in the default network segment of the netflow log is statistically calculated. If the proportion exceeds the preset ratio P, the next judgment is made. The IP corresponding to F int is used as the attacked target for segment scanning detection, and an alarm attack event is generated. The present disclosure can extract, process, detect, summarize, and compare relevant data from a large amount of netflow logs, and extract attack traffic to generate attack event data.

[0080] In one embodiment of the present disclosure, referring to Figure 4 the flowchart of another DDoS segment scanning attack detection method shown, the above method may further include the following steps:

[0081] S402, obtaining attack events generated within multiple detection periods, and the event identifier of each attack event.

[0082] S404, merging multiple attack events according to the event identifier to obtain a second attack event.

[0083] In one embodiment of the present disclosure, the event identifier is at least one of an attack object and an attack type;

[0084] Multiple attack events are merged according to the attack object and / or attack type to obtain a second attack event.

[0085] It should be noted that the merging task is started periodically according to the t value; the alarm event is classified according to the abnormal feature code (the scan detection feature code is 5110004) and the target device MO, and the alarm unique number is identified. The alarm unique number is used to compare with subsequent alarm event data. When the scan alarm event is the first data, its status is marked as initial. The time of this alarm event is used as the start time of the attack alarm, marked as T b ; When the scan alarm event is subsequent data, according to the trigger time T of the alarm event e and the last attack time T of the alarm a The time difference between them determines whether it is continuous. The judgment criteria are as follows:

[0086] When T e -T a =t, it means continuous attack;

[0087] When T e -T a >t: indicates interruption of attack;

[0088] If the alarm is discontinuous, the alarm status is marked as interrupted and the alarm merging task is completed. If the alarm is continuous, the latest attack time T of the alarm is updated. a . Determine whether the duration of the alarm event reaches the preset value D t , the formula is: T e -T b ≥D t When the preset value is reached, the alarm status is marked as ongoing; when the subsequent alarm event data does not have this alarm number, calculate the current time T c and the time T of the most recent alarm event e The time difference between the two determines whether it is finished. The formula is: T c -T e >R t (R t When the alarm time ends, the alarm status is marked as obsolete and the attack alarm ends.

[0089] This disclosure can classify and merge attack events and identify real attacks. Since attack event data is only scattered attack records and cannot fully represent a real attack, including the attack start time, end time, peak value, status, etc., it is necessary to merge attack events and determine the alarm status based on pre-configured preset duration and preset recovery time.

[0090] In one embodiment of the present disclosure, the method further includes:

[0091] determining a second duration of the second attack event;

[0092] If the second attack event is a continuous attack and the second duration does not reach the preset duration, the second attack event is marked as a suspected attack;

[0093] If the second attack event attacks continuously and the second duration reaches the preset duration, the second attack event is marked as the start of the attack.

[0094] In one embodiment of the present disclosure, the method further includes:

[0095] Determine a second recovery time for the second attack event;

[0096] If the second attack event interrupts the attack and the second recovery time does not reach the preset recovery time, the second attack event is marked as an attack interruption;

[0097] When the second attack event interrupts the attack and the second recovery time reaches the preset recovery time, the second attack event is marked as the end of the attack.

[0098] It should be noted that, in one embodiment of the present disclosure, the DDoS sweep attack detection provided by the present disclosure can be divided into three different types of detection, namely, extensive, cautious, and strict.

[0099] The extensive model maximizes link protection. When identifying dispersed attack traffic, it can increase the pre-set traffic fluctuation ratio to 25%, while reducing the number of IP addresses that meet the criteria to 1%. This reduces the duration of an attack to 1 minute, and extends recovery time to 60 minutes.

[0100] Cautious: This prevents excessive false positives by setting the traffic flow ratio between 5% and 10% when identifying and dispersing attack traffic. The percentage of eligible IP addresses can also be set between 10% and 50%. The attack duration can be set between 2 and 4 minutes, and the recovery time between 15 and 30 minutes.

[0101] Strict: This feature accurately identifies true attack traffic, reduces the fluctuation ratio between pre-defined traffic flows to 3%, and increases the percentage of eligible IP addresses to 70%. It also extends the duration of an attack to 5 minutes, and shortens recovery time to 5 minutes.

[0102] In one embodiment of the present disclosure, the method of the present disclosure can be divided into two processes: attack event detection and attack event merging, wherein: Figure 5 The attack event detection process is disclosed, see Figure 5The schematic diagram of a DDoS sweep attack detection method shown in the figure, after obtaining the detection object (target device), the flow data sent to the detection object is identified according to the detection object identifier, the flow data is summarized according to the IP address, the IP flow is sorted, the IP data with small flow is eliminated, the flow between IPs is compared, and it is determined whether the flow change range is within the ratio (preset flow floating ratio), the IP flow that meets the standard is summarized, and it is determined whether each flow data exceeds a threshold (preset IP number ratio), the flow number that exceeds the preset IP number ratio is identified as attack flow data, and an attack event is generated based on the attack flow data.

[0103] In one embodiment of the present disclosure, Figure 6 The attack event merging process is disclosed, see Figure 6 The schematic diagram of another DDoS sweep attack detection method shown in the figure obtains attack event data, which contains multiple attack events, obtains duration and recovery time configuration information (i.e., preset duration and preset recovery time), merges attack events according to information such as attack object and attack type, and determines whether the attack event is interrupted. If so, it continues to determine whether the recovery time (recovery duration) of the attack event reaches the preset recovery duration. When the recovery time of the attack event reaches the preset recovery duration, the attack event is marked as the attack end; if the recovery time of the attack event does not reach the preset recovery time, the attack event is marked as the attack interruption. If the attack event is not interrupted, it is determined whether the duration of the attack event reaches the preset duration. If so, the attack event is marked as the attack start; if not, the attack event is marked as a suspected attack.

[0104] In one embodiment of the present disclosure, the preset detection threshold is set as a fixed detection threshold;

[0105] Alternatively, the preset detection threshold of the target device at time point t is calculated by the following steps:

[0106] Get the set P of the target device's traffic data F for the last n days near the current time, where P = {F i |1≤i≤n|}, F i is the flow value at the i-th time point t;

[0107] Remove the maximum value F from the set P max and the minimum value F min Get the set Q, where Q = P-{F min ,F max}, F min is the minimum element value in the set P, F max is the maximum element value in the set P;

[0108] Arrange the elements in the set Q in ascending order according to the order of the corresponding dates to obtain an ordered set D, where D={D1,D2,…,D n-2};

[0109] The baseline B at time point t is calculated by the following formula t :

[0110]

[0111] The threshold T of the target device at time point t is calculated by the following formula t :

[0112] T t =B t ·C (2) Where C is the preset floating coefficient. t ≤BW, the preset detection threshold of the target device at time t is T t When T t >BW, the preset detection threshold value of the target device at time point t is BW, where BW is the interface bandwidth.

[0113] It should be noted that the time point t can be any time point in a day, such as 5 o'clock, 6 o'clock, 10 o'clock, etc., and the preset floating coefficient can be any proportional value, such as 70%, 60% or 55%, etc. When the preset detection threshold is set to a fixed detection threshold, the fixed detection threshold can be a preset ratio of the interface bandwidth BW, and the preset ratio can be any proportional value, for example, the preset ratio is 75%, 80% or 92%, etc. When the preset ratio is 80%, T i =BW×80%, where T i is a fixed detection threshold, and BW is the interface bandwidth of the target device. The preset detection threshold can be obtained through dynamic baseline automatic learning. First, a set P consisting of the target device's recent n-day year-on-year traffic data F is obtained, and the maximum value F in the set P is removed. max and element minimum F min , and arrange the remaining elements in positive order according to the order of the corresponding dates to obtain the ordered set D, calculate the baseline by formula (1), and then calculate the threshold T by formula (2) t With baseline B t , calculate the threshold T at time point t t In one embodiment of the present disclosure, when T t ≤BW, the preset detection threshold of the target device at time t is T t When T t >BW, the preset detection threshold value of the target device at time point t is BW, where BW is the interface bandwidth.

[0114] Based on the same inventive concept, the present disclosure also provides a DDoS sweep attack detection device, as shown in the following embodiment. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0115] Figure 7 A schematic diagram of a DDoS sweep attack detection device according to an embodiment of the present disclosure is shown. Figure 7 As shown, the device includes:

[0116] The data acquisition module 710 is used to acquire the traffic log sent to the target device during each detection period, wherein the traffic log includes multiple groups of IP data flows and the IP address information and traffic information of each IP data flow;

[0117] The data accumulation module 720 is configured to sort the IP data flows in the traffic log according to the IP address, and sequentially compare the inter-flow floating ratio of each IP data flow with a preset inter-flow floating ratio, and accumulate multiple consecutive adjacent IP data flows whose inter-flow floating ratio is less than the preset inter-flow floating ratio according to the IP address to obtain multiple IP data flow sets, wherein the inter-flow floating ratio of the smaller IP data flow of two adjacent IP data flows is the ratio of the difference in data size between the two adjacent IP data flows to the larger IP data flow, and the multiple IP data flow sets include the first IP data flow set;

[0118] The attack identification module 730 is configured to determine that the first IP data flow set is attack traffic data when the data size of the first IP data flow set is greater than a preset detection threshold, and to generate a first attack event based on the first IP data flow set.

[0119] In one embodiment of the present disclosure, the above-mentioned data acquisition module 710 is also used to obtain the device identification of the target device, wherein the device identification is at least one of the device interface index and the IP address; and based on the device identification of the target device, the traffic data sent to the target device in each detection cycle is obtained.

[0120] In one embodiment of the present disclosure, the device identifier is at least one of a device interface index and an IP address.

[0121] In one embodiment of the present disclosure, the above-mentioned device also includes an event merging module, which is used to obtain attack events generated in multiple detection cycles and event identifiers of each attack event; merge multiple attack events according to the event identifiers to obtain a second attack event.

[0122] In one embodiment of the present disclosure, the apparatus further includes a data filtering module configured to filter IP data flows in the traffic log that are smaller than a preset flow size, so as to filter data flows that comply with the routing protocol.

[0123] In one embodiment of the present disclosure, the event merging module is further configured to identify an event as at least one of an attack object and an attack type; and merge multiple attack events according to the attack object and / or attack type to obtain a second attack event.

[0124] In one embodiment of the present disclosure, the above-mentioned device also includes an event marking module, which is used to determine a second duration of the second attack event; if the second attack event is a continuous attack and the second duration does not reach a preset duration, mark the second attack event as a suspected attack; if the second attack event is a continuous attack and the second duration reaches a preset duration, mark the second attack event as the start of an attack.

[0125] In one embodiment of the present disclosure, the above-mentioned event marking module is also used to determine the second recovery duration of the second attack event; if the second attack event interrupts the attack and the second recovery duration does not reach the preset recovery duration, the second attack event is marked as an attack interruption; if the second attack event interrupts the attack and the second recovery duration reaches the preset recovery duration, the second attack event is marked as an attack end.

[0126] In one embodiment of the present disclosure, the above-mentioned attack identification module is also used to determine that the first IP data flow set is attack traffic data when the proportion of the first IP number of the first IP data flow set is greater than the preset IP number proportion, and generate a first attack event based on the first IP data flow set, wherein the first IP number proportion is the ratio of the total number of IP data flows between the first IP data flow set and the traffic log.

[0127] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods, or program products. Therefore, various aspects of the present disclosure may be implemented in the following forms: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, which may be collectively referred to herein as "circuits," "modules," or "systems."

[0128] Refer to the following Figure 8 800 according to this embodiment of the present disclosure will be described. Figure 8 The electronic device 800 shown is merely an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0129] like Figure 8As shown, electronic device 800 is implemented as a general-purpose computing device. Components of electronic device 800 may include, but are not limited to, the aforementioned at least one processing unit 810, the aforementioned at least one storage unit 820, and a bus 830 connecting various system components (including storage unit 820 and processing unit 810).

[0130] The storage unit stores program code, which can be executed by the processing unit 810, so that the processing unit 810 performs the steps described in the "Exemplary Method" section of the present specification according to various exemplary embodiments of the present disclosure. For example, the processing unit 810 can perform the following steps of the above-mentioned method embodiment: obtaining a traffic log sent to the target device during each detection period, wherein the traffic log contains multiple groups of Internet Protocol (IP) data flows and IP address information and traffic information of each IP data flow; sorting the IP data flows in the traffic log according to the IP address, and sequentially comparing the size of the flow-to-flow floating ratio of each IP data flow with the preset flow-to-flow floating ratio, accumulating multiple consecutive adjacent IP data flows whose flow-to-flow floating ratio is less than the preset flow-to-flow floating ratio according to the IP address to obtain multiple IP data flow sets, wherein the multiple IP data flow sets include a first IP data flow set; when the data size of the first IP data flow set is greater than a preset detection threshold, determining that the IP data flows in the first IP data flow set are attack traffic data, and generating a first attack event based on the first IP data flow set.

[0131] The storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 8201 and / or a cache memory unit 8202 , and may further include a read-only memory unit (ROM) 8203 .

[0132] The storage unit 820 may also include a program / utility 8204 having a set (at least one) of program modules 8205, such program modules 8205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0133] Bus 830 may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0134] The electronic device 800 can also communicate with one or more external devices 840 (e.g., a keyboard, a pointing device, a Bluetooth device, etc.), one or more devices that enable a user to interact with the electronic device 800, and / or any device that enables the electronic device 800 to communicate with one or more other computing devices (e.g., a router, a modem, etc.). Such communication can occur via an input / output (I / O) interface 850. Furthermore, the electronic device 800 can also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network such as the Internet) via a network adapter 860. As shown, the network adapter 860 communicates with other modules of the electronic device 800 via a bus 830. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device 800, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0135] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.

[0136] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided. The computer-readable storage medium may be a readable signal medium or a readable storage medium. A program product capable of implementing the above-mentioned method of the present disclosure is stored thereon. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes program code. When the program product is executed on a terminal device, the program code is used to cause the terminal device to execute the steps according to various exemplary embodiments of the present disclosure described in the "Exemplary Methods" section above of this specification.

[0137] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fibers, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0138] In the present disclosure, a computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, which carries readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0139] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination thereof.

[0140] In a specific implementation, the program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and the like, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0141] It should be noted that although several modules or units of the device for action execution are mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.

[0142] Furthermore, although the steps of the method of the present disclosure are described in a particular order in the accompanying drawings, this does not require or imply that the steps must be performed in this particular order, or that all steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0143] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.

[0144] Other embodiments of the present disclosure will readily occur to those skilled in the art after considering the specification and practicing the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, with the true scope and spirit of the present disclosure being indicated by the appended claims.

Claims

1. A distributed denial of service (DDoS) sweep attack detection method, characterized in that: include: Obtaining a traffic log sent to the target device during each detection period, wherein the traffic log includes multiple groups of Internet Protocol (IP) data flows and IP address information and traffic information for each IP data flow, and the multiple groups of IP data flows in the traffic log include IP data flows with multiple different destination IP addresses; The IP data flows in the traffic log are sorted according to the IP addresses, and the sizes of the inter-flow floating ratios of the respective IP data flows and the preset inter-flow floating ratios are sequentially compared, and a plurality of consecutive adjacent IP data flows whose inter-flow floating ratios are smaller than the preset inter-flow floating ratios are accumulated according to the IP addresses to obtain a plurality of IP data flow sets, wherein the inter-flow floating ratio of the smaller IP data flow of two adjacent IP data flows is the ratio of the difference in data size between the two adjacent IP data flows to the larger IP data flow, and the plurality of IP data flow sets include a first IP data flow set; When the data size of the first IP data flow set is greater than a preset detection threshold, determining that the IP data flows in the first IP data flow set are attack traffic data, and generating a first attack event according to the first IP data flow set; Sorting the IP data flows in the traffic log by IP address, including: The IP data flows in the traffic log are counted according to the device IP field and the interface index or the destination address field, and the IP data flows greater than the minimum statistical value are sorted from largest to smallest.

2. The DDoS sweep attack detection method according to claim 1, characterized in that: Obtain traffic data sent to the target device during each detection cycle, including: Obtaining a device identifier of the target device, wherein the device identifier is at least one of a device interface index and an IP address; According to the device identification of the target device, traffic data sent to the target device in each detection cycle is obtained.

3. The DDoS sweep attack detection method according to claim 1, characterized in that: After obtaining the traffic log sent to the target device during each detection period, the method further includes: The IP data flows in the traffic log that are smaller than a preset traffic size are filtered to filter the data flows that comply with the routing protocol.

4. The DDoS sweep attack detection method according to claim 1, wherein: The method further comprises: Obtain attack events generated during multiple detection cycles, as well as the event identifier of each attack event; The multiple attack events are merged according to the event identifier to obtain a second attack event.

5. The DDoS sweep attack detection method according to claim 4, characterized in that: The event identifier is at least one of an attack object and an attack type; According to the attack object and / or attack type, multiple attack events are merged to obtain a second attack event.

6. The DDoS sweep attack detection method according to claim 4, characterized in that: The method further comprises: determining a second duration of the second attack event; If the second attack event is a continuous attack and the second duration does not reach a preset duration, marking the second attack event as a suspected attack; If the second attack event attacks continuously and the second duration reaches a preset duration, the second attack event is marked as an attack start.

7. The DDoS sweep attack detection method according to claim 4, characterized in that: The method further comprises: Determining a second recovery time for the second attack event; If the second attack event interrupts the attack and the second recovery time does not reach the preset recovery time, marking the second attack event as an attack interruption; When the second attack event interrupts the attack and the second recovery time reaches a preset recovery time, the second attack event is marked as the end of the attack.

8. The DDoS sweep attack detection method according to claim 1, characterized in that: The method further comprises: When the proportion of the first IP number in the first IP data flow set is greater than the preset IP number proportion, the first IP data flow set is determined to be attack traffic data, and a first attack event is generated based on the first IP data flow set, wherein the first IP number proportion is the ratio of the total number of IP data flows between the first IP data flow set and the traffic log.

9. The DDoS sweep attack detection method according to claim 1, characterized in that: The preset detection threshold is set as a fixed detection threshold; Alternatively, the preset detection threshold of the target device at time point t is determined by the following steps: Get the set P of the target device's traffic data F for the last n days near the current time, where P = {F i |1≤i≤n|}; Remove the maximum value F from the set P max and the minimum value F min Get the set Q, where Q = P-{F min ,F max }; Arrange the elements in the set Q in ascending order according to the order of the corresponding dates to obtain an ordered set D, where D={D1,D2,…,D n-2 }; The baseline B at time point t is calculated by the following formula t : The threshold T of the target device at time point t is calculated by the following formula t : T t =B t ·C Among them, C is the preset floating coefficient. When T t ≤BW, the preset detection threshold of the target device at time t is T t When T t >BW, the preset detection threshold value of the target device at time point t is BW, where BW is the interface bandwidth.

10. A DDoS sweep attack detection device, characterized in that: include: a data acquisition module, configured to acquire a traffic log sent to a target device during each detection period, wherein the traffic log includes multiple groups of IP data flows and IP address information and traffic information of each IP data flow, and the multiple groups of IP data flows in the traffic log include IP data flows with multiple different destination IP addresses; a data accumulation module for sorting the IP data flows in the traffic log according to the IP addresses, and sequentially comparing the inter-flow floating ratio of each IP data flow with a preset inter-flow floating ratio, accumulating a plurality of consecutive adjacent IP data flows whose inter-flow floating ratio is less than the preset inter-flow floating ratio according to the IP addresses to obtain a plurality of IP data flow sets, wherein the inter-flow floating ratio of the smaller of the two adjacent IP data flows is the ratio of the difference in data size between the two adjacent IP data flows to the larger IP data flow, and the plurality of IP data flow sets include a first IP data flow set; The data accumulation module is further configured to count the IP data flows in the traffic log according to the device IP field and the interface index or the destination address field, and sort the IP data flows greater than the minimum statistical value from largest to smallest; The attack identification module is used to determine that the first IP data flow set is attack traffic data when the data size of the first IP data flow set is greater than a preset detection threshold, and generate a first attack event based on the first IP data flow set.

11. An electronic device, characterized in that: include: processor; as well as a memory for storing executable instructions of the processor; The processor is configured to execute the DDoS sweep attack detection method according to any one of claims 1 to 9 by executing the executable instructions.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the DDoS sweep attack detection method according to any one of claims 1 to 9 is implemented.

Images