An attack detection method, apparatus, device, and storage medium

Abstract

This application discloses an attack detection method, apparatus, device, and storage medium, comprising: at least statistically analyzing first connection requests at each time point within at least one time point encompassing a first duration to obtain an observation sequence, wherein the observation sequence includes observation features of each time point within the at least one time point, and the first connection request is a connection request for which a corresponding acknowledgment data packet has been sent but no response to the acknowledgment data packet has been received; determining a target state sequence based on the observation sequence; the target state sequence includes the target state at each time point within the at least one time point; determining an attack state based on the target state sequence; thereby improving the accuracy of DDoS attack detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of wireless communication, and relates to but is not limited to an attack detection method, device, equipment and storage medium. BACKGROUND

[0002] Among many attack types, a semi-open attack (SYN Flood) is a commonly used attack means of a distributed denial of service (DDoS), which is mainly designed for a vulnerability in a transmission control protocol (TCP) protocol connection establishment phase. In the SYN Flood, an attack source sends a large number of TCP synchronization (SYN) message segments to an attack target in a short time by forging a large number of false source international interconnection protocol (IP) addresses, but does not complete the third handshake to quickly exhaust the connection resources of the victim server. Therefore, most of the space of the server buffer is allocated to the semi-connection message requests caused by the SYN attack, so that the incoming new connection requests will be blocked. Therefore, the problem solving of the DDoS attack has always been a difficulty in network security research. SUMMARY

[0003] The embodiments of the present application provide an attack detection method, device, equipment and storage medium, which can improve the accuracy of DDoS attack detection.

[0004] The embodiments of the present application provide an attack detection method, which comprises:

[0005] At least the first connection request of each time point in at least one time point included in a first time length is counted to obtain an observation sequence, the observation sequence comprises observation features of each time point in the at least one time point, and the first connection request is a connection request corresponding to a confirmation data packet which has been sent but has not received a response to the confirmation data packet;

[0006] Based on the observation sequence, a target state sequence is determined, and the target state sequence comprises target states of each time point in the at least one time point;

[0007] Based on the target state sequence, an attack state is determined.

[0008] The embodiments of the present application provide an attack detection device, which comprises:

[0009] A statistical unit is used to statistically analyze the first connection requests at least at least once within a first duration to obtain an observation sequence. The observation sequence includes observation features of each time point within the at least once duration. The first connection request is a connection request for which a corresponding acknowledgment data packet has been sent but no response to the acknowledgment data packet has been received.

[0010] A determining unit is configured to determine a target state sequence based on the observed sequence; the target state sequence includes the target state at each time point at the at least one time point.

[0011] The judgment unit is used to determine the attack state based on the target state sequence.

[0012] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps in the attack detection method described above.

[0013] This application also provides a storage medium storing a computer program that, when executed by a processor, implements the above-described attack detection method.

[0014] The attack detection method, apparatus, device, and storage medium provided in this application embodiment statistically analyzes first connection requests at least at least one time point within a first duration to obtain an observation sequence. The observation sequence includes observation features at each time point within the at least one time point. The first connection request is a connection request for which a corresponding acknowledgment data packet has been sent but no response to the acknowledgment data packet has been received. Based on the observation sequence, a target state sequence is determined. The target state sequence includes the target state at each time point within the at least one time point. Based on the target state sequence, an attack state is determined. Thus, the target state at each time point is predicted based on the statistical results of the first connection requests at multiple time points, and attack judgment is performed based on the target states at multiple time points. Attack detection is performed based on the relationship between features at different times, thereby improving the accuracy of DDoS attack detection. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of an optional structure of the attack detection system provided in the embodiments of this application;

[0016] Figure 2 A schematic diagram of an optional process for an attack detection method provided in an embodiment of this application;

[0017] Figure 3 A schematic diagram of an optional process for an attack detection method provided in an embodiment of this application;

[0018] Figure 4 An optional schematic diagram of a state sequence and an observation sequence provided for an embodiment of the present application;

[0019] Figure 5 An optional structural schematic diagram of an attack method provided for an embodiment of the present application;

[0020] Figure 6 An optional flow schematic diagram of an attack detection method provided for an embodiment of the present application;

[0021] Figure 7 An optional model schematic diagram of an HMM provided for an embodiment of the present application;

[0022] Figure 8 An optional structural schematic diagram of an attack detection apparatus provided for an embodiment of the present application;

[0023] Figure 9 An optional structural schematic diagram of an electronic device provided for an embodiment of the present application. DETAILED DESCRIPTION

[0024] To make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the following will further describe the specific technical solutions of the present application with reference to the accompanying drawings of the embodiments of the present application. The following embodiments are used to illustrate the present application, but not to limit the scope of the present application.

[0025] The embodiments of the present application can be provided as an attack detection method and device, and a storage medium. In actual application, the attack detection method can be implemented in an electronic device, and each functional entity in the electronic device can be cooperatively implemented by hardware resources of the electronic device (such as a terminal device, a server), such as computing resources (such as a processor) and communication resources (such as used to support various communication modes such as optical cable and cellular).

[0026] The attack detection method provided by the embodiments of the present application is applied to an attack detection system. As shown in Figure 1 The attack detection system includes a client 101 and a server 102, and the client 101 and the server 102 can communicate based on a network 103.

[0027] The client 101 can send a connection request to the server 102 to request to establish a connection with the server 102.

[0028] In an example, the client 101 is a legitimate client, and the client 101 can establish a TCP connection between the client 101 and the server 102 through a three-way handshake, and transmit data based on the established TCP connection. Wherein, the sending of the connection request is the first handshake in the three-way handshake.

[0029] In an example, the client 101 is an illegal client, the client 101 forges a large number of false source IP addresses to send a large number of connection requests to the server 102 for the first handshake, and the server 102 sends an acknowledgement packet to the client to perform the second handshake with the client 101, and the client 101 cannot complete the third handshake after receiving no reply from the client 101, and the client 101 performs a SYN Flood attack on the server 102 as an attack source.

[0030] In the implementation of the present application, the server can perform the following processing: at least counting the first connection request of each time point in the at least one time point included in the first time length to obtain an observation sequence, the observation sequence including the observation feature of each time point in the at least one time point, the first connection request being a connection request corresponding to an acknowledgement packet that has been sent but has not received a response to the acknowledgement packet; determining a target state sequence based on the observation sequence; the target state sequence including the target state of each time point in the at least one time point; determining an attack state based on the target state sequence. Here, the attack state includes: being attacked and not being attacked.

[0031] In actual application, the attack detection system can include multiple clients, and the server can simultaneously receive connection requests sent by multiple clients and attempt to establish a connection with each client.

[0032] In combination with Figure 1 The attack detection system shown in the figure, the embodiment provides an attack detection method, which can improve the accuracy of DDoS attack detection.

[0033] Next, in combination with the schematic diagram of the attack detection system shown in the figure, the embodiments of the attack detection method and device provided by the embodiments of the present application, and the storage medium are described.

[0034] The embodiment provides an attack detection method, which is applied to an electronic device implemented as a server. The functions realized by the method can be realized by calling program codes in the processor of the electronic device. Of course, the program codes can be saved in the computer storage medium. Therefore, the electronic device at least includes a processor and a storage medium.

[0035] The electronic device can be any device with information processing capability. In an embodiment, the electronic device can be a smart terminal, such as a notebook computer, an AR / VR device, a mobile terminal, etc. In another embodiment, the electronic device can also be a terminal device with computing function that is not convenient to move, such as a desktop computer, a desktop computer, etc. In still another embodiment, the electronic device can also be a server, such as a cloud server, etc.

[0036] Of course, the embodiments of the present application are not limited to being provided as methods and hardware, but can also have various implementation manners, for example, being provided as a storage medium (storing instructions for executing the attack detection method provided by the embodiments of the present application).

[0037] Figure 2 For the implementation flowchart of the attack detection method of the embodiments of the present application, as shown in Figure 2 the method comprises the following steps:

[0038] S201, the server at least statistics the first connection request of each time point in the at least one time point included in the first time length, to obtain a to-be-observed sequence.

[0039] The to-be-observed sequence includes the observation feature of each time point in the at least one time point, and the first connection request is a connection request corresponding to a confirmation data packet that has been sent but has not received a response to the confirmation data packet. The first connection request can be referred to as a half connection.

[0040] In the embodiments of the present application, for a connection request sent by a client, the connection request completes interaction with the server through three times of handshake to realize the establishment of connection. Specifically: the server receives the connection request (SYN packet) sent by the client, the server returns a response (SYN+ACK) to the connection request to the client, and then the server receives the reply of the client to the SYN+ACK. When the server sends SYN+ACK and does not receive the reply of SYN+ACK, the connection request is a half connection request, and the connection corresponding to the connection request is a half connection.

[0041] In the embodiments of the present application, the server statistics the first connection request received in the first time length, wherein the first connection request is a connection request for which the server has replied a confirmation data packet but has not received a response to the confirmation data packet.

[0042] When the server statistics the first connection request, the observation feature of the first connection request corresponding to one or more time points in the first time length is statistics, and based on the observation feature of each time point corresponding to the statistics of the multiple time points, a to-be-observed sequence is obtained.

[0043] In an example, the time points in the first time length include: time point 1, and the observation feature of time point 1 in the to-be-observed sequence includes: observation feature 1.

[0044] In an example, the time points in the first time length include: time point 1, time point 2, time point 3 and time point 4, and the to-be-observed sequence includes: observation feature 1, observation feature 2, observation feature 3 and observation feature 4, wherein observation feature 1, observation feature 2, observation feature 3 and observation feature 4 correspond to time point 1, time point 2, time point 3 and time point 4 respectively.

[0045] S202, the server determines a target state sequence based on the to-be-observed sequence; the target state sequence includes target states of each time point at the at least one time point.

[0046] After the server determines the to-be-observed sequence, the server determines a target state sequence based on the to-be-observed sequence.

[0047] In the implementation of the present application, the server can determine the target state sequence corresponding to the to-be-observed sequence through a Hidden Markov Model (HMM). Here, the visible state sequence of the Hidden Markov Model is called an observation sequence, and the observation sequence is a combination of possible observation features. The hidden state sequence of the Hidden Markov Model is called a state sequence or a hidden state sequence, and the state sequence includes a set of states divided by the server based on the connection request. The HMM can be obtained from a database or other devices, or can be trained by the server itself.

[0048] In the embodiment of the present application, when the server is subjected to a DDoS attack, the server successively experiences a first connection request state, a second connection state, and a third connection state. When the duration of the third connection state reaches a second time threshold, the DDoS attack is completed. The state sequence includes the following states: the first connection request state, i.e., the sending state, the second connection state, i.e., the half-connection state, and the third connection state, i.e., the half-connection persistence state. The sending state is a state in which connection requests are continuously received. The half-connection state is a state in which there are a large number of half-connection requests, i.e., the number of half-connection requests exceeds a first threshold. The half-connection persistence state is a state in which the half-connection state lasts for more than a first time threshold. In the embodiment of the present application, the state sequence can also include a fourth connection state, i.e., a closed state, and a fifth connection state, i.e., an established state. The closed state is a state in which no connection request is received, and the established state is a state in which the number of established connection requests exceeds a second threshold. The first threshold and the second threshold are independent thresholds, which can be the same or different. The size of the first threshold or the second threshold can be fixed, or can be determined based on the number of connection requests received by the server.

[0049] In the embodiment of the present application, the state sequence can also include states other than the sending state, the half-connection state, and the half-connection persistence state. The embodiment of the present application does not limit the states included in the state sequence.

[0050] Here, the target state sequence includes target states of each time point included in the first time duration, and the target state belongs to the state sequence.

[0051] In one example, the time points within the first duration include: time point 1, time point 2, time point 3, and time point 4. The sequence to be observed includes: observation feature 1 corresponding to time point 1, observation feature 2 corresponding to time point 2, observation feature 3 corresponding to time point 3, and observation feature 4 corresponding to time point 4. The target state sequence determined based on the sequence to be observed includes: target state 1 corresponding to time point 1, target state 2 corresponding to time point 2, target state 3 corresponding to time point 3, and target state 4 corresponding to time point 4.

[0052] S203. The server determines the attack status based on the target state sequence.

[0053] After determining the target state sequence, the server determines the attack state based on the target state sequence. The attack state includes being attacked and not being attacked. Here, the server can directly determine the attack state based on the target state sequence, or, if the target state sequence indicates that the server may be under attack, it can obtain auxiliary information and determine the attack state based on this auxiliary information.

[0054] When the server determines that the attack status is under attack, it can perform one or more of the following actions to stop a potential DDoS attack:

[0055] 1. Issue an alarm message;

[0056] Step 2: Release the half-open connection requests.

[0057] The attack detection method, apparatus, device, and storage medium provided in this application embodiment statistically analyzes first connection requests at least at least one time point within a first duration to obtain an observation sequence. The observation sequence includes observation features at each time point within the at least one time point. The first connection request is a connection request for which a corresponding acknowledgment data packet has been sent but no response to the acknowledgment data packet has been received. Based on the observation sequence, a target state sequence is determined. The target state sequence includes the target state at each time point within the at least one time point. Thus, the target state at each time point is predicted based on the statistical results of the first connection requests at multiple time points, and attack judgment is performed based on the target states at multiple time points. Attack detection is performed based on the relationship between features at different times, thereby improving the accuracy of DDoS attack detection.

[0058] In some embodiments, such as Figure 3 As shown, S201 at least counts the first connection requests at each time point within at least one time point included in the first duration, to obtain the sequence to be observed, including:

[0059] S2011. For each time point within the first duration, statistically analyze the observation characteristics of the first connection request at that time point.

[0060] S2012, based on the observation characteristics corresponding to each time point in the first time length, the to-be-observed sequence is constituted.

[0061] For each time point in the first time length, the server counts the first connection requests on each time point to obtain the observation characteristics of each time point, and obtains the observation sequence based on the observation characteristics of each time point in the first time length.

[0062] In an example, the time points in the first time length include time point 1, and the first connection requests of the time point are counted to obtain observation characteristic 1. At this time, the observation characteristics of time point 1, i.e., observation characteristic 1, are included in the to-be-observed sequence.

[0063] In an example, the time points in the first time length include time point 1, time point 2, time point 3, and time point 4. The first connection requests of each time point among time point 1, time point 2, time point 3, and time point 4 are counted to obtain observation characteristic 1, observation characteristic 2, observation characteristic 3, and observation characteristic 4. Observation characteristic 1, observation characteristic 2, observation characteristic 3, and observation characteristic 4 correspond to time point 1, time point 2, time point 3, and time point 4, respectively, and observation characteristic 1, observation characteristic 2, observation characteristic 3, and observation characteristic 4 constitute the to-be-observed sequence.

[0064] In some embodiments, the counting of the observation characteristics of the first connection requests on the time point includes at least one of the following:

[0065] Counting the number of first connection requests of the time point;

[0066] Determining a target duration based on the duration of each first connection request in the first connection requests of the time point.

[0067] In the embodiments of the present application, the observation characteristics can include one or both of the number of first connection requests and the target duration. The target duration can be the average of the durations of the first connection requests, or the maximum duration in the durations of the first connection requests.

[0068] In an example, there are 10 half-connection requests in the server, and the durations of the half-connection requests are t1, t2, t3, … t10, respectively. The server can take the average of t1, t2, t3, … t10 as the target duration, or take the maximum value in t1, t2, t3, … t10 as the target duration.

[0069] In some embodiments, S201 counts at least one first connection request on each time point included in the first time length to obtain the to-be-observed sequence, including:

[0070] counting the first connection request in each of the at least one time point included in the first time duration, and counting the number of connection requests in each of the at least one time point included in the first time duration, to obtain the to-be-observed sequence.

[0071] Here, the observation feature further includes: the number of connection requests.

[0072] In the embodiments of the present application, the observation feature can include: the number of first connection requests, the target duration, and the number of connection requests, and can further include other statistical parameters of connection requests, which are not limited in the embodiments of the present application.

[0073] In some embodiments, S202 includes:

[0074] For a first observation feature corresponding to a first time point in the to-be-observed sequence, based on the first probability, an initial probability matrix, a state transition matrix, and an observation probability matrix, a state generating a second probability is determined as a target state corresponding to the first time point, the second probability is a maximum probability of appearing a first observation sequence, the first observation sequence includes the first observation feature and a second observation sequence; the initial probability matrix is a probability of each state in a state sequence, the observation probability matrix is a probability of each observation feature in an observation sequence appearing under each state in the state sequence, the first probability is a maximum probability of appearing the second observation sequence, and the second observation sequence includes observation features corresponding to all time points before the first time point in the first time duration.

[0075] In some embodiments, S202 includes:

[0076] Here, the initial probability matrix, the state transition matrix, and the observation probability matrix can be respectively marked as Π, A, and B. The initial probability matrix can also be referred to as a probability distribution of an initial state, Π = {π i}, π i characterizes a state Q of a server in a TCP connection request process as a connection state i i an initial appearance probability, π i can be represented as π i = P (Q = S i ), S i represents an i th connection state in a state sequence. The state transition matrix can also be referred to as a state transition probability matrix, A = [aij ] N×N a ij The state Q represents the state at a certain time point t. t State S i The state Q at the next time point t+1 t+1 Transition to state S j The probability, a ij It can be represented as a ij =P(Q) t+1 =S j |Q t =S i (1≤i,j≤N). The observation probability matrix can also be called the probability distribution matrix of the observed values, B=[b jk ] M×N b represents the probability of each observed feature in the observation sequence occurring in each state of the state sequence. jk The state Q represents a certain time point t. t Q t State S j Observational characteristics O at time point t t V is the k-th observation feature in the observation sequence. k The probability, b jk It can be represented as b jk =P(O t =V k |Q t =S j (1≤j≤N, 1≤k≤M). Where N is the number of states in the state sequence and M is the number of observed features in the observation sequence.

[0077] like Figure 4 As shown, the states in the state sequence include: state 401-1, state 401-2, state 401-3, and state 401-4. The observed features in the observation sequence include: feature 402-1, feature 402-2, feature 402-3, feature 402-4, and feature 402-5. The initial probability matrix Π is a 4*1 matrix, and the elements in the initial probability matrix represent the initial probability of the occurrence of state 401-1, state 401-2, state 401-3, and state 401-4, respectively. The transition matrix A is a 4*4 matrix, and the elements in the state transition matrix represent the probability of transitioning from state 401-1, state 401-2, state 401-3, and state 401-4 to any other state. The observation probability matrix B is a 4*5 matrix, and each element represents the probability of feature 402-1, feature 402-2, feature 402-3, feature 402-4, and feature 402-5 occurring under state 401-1, state 401-2, state 401-3, and state 401-4, respectively.

[0078] In the case that the to-be-observed sequence includes an observation feature, a state with the maximum probability of occurrence of the current observation feature is determined as a target state corresponding to the observation feature based on the initial probability matrix and the observation probability matrix.

[0079] In the case that the to-be-observed sequence includes observation features F1, F2, F3 and F4 arranged in time sequence, the state sequence includes four states: state 1, state 2, state 3 and state 4, the observation sequence includes five observation features, the observation features F1, F2, F3 and F4 belong to the observation sequence, the initial state matrix is a 4*1 matrix, the state transition matrix is a 4*4 matrix, and the observation probability matrix is a 4*5 matrix, the probability of occurrence of the observation feature F1 in each state is calculated respectively, and the state corresponding to the maximum probability P1 of occurrence of the observation feature F1 is determined as the target state 1 of occurrence of the observation feature F1. In the case that the target state 1 is determined, the probability of occurrence of the observation feature F2 in each state is calculated based on the probability P1 of occurrence of the observation feature F1 in the target state 1, and the state corresponding to the maximum probability P2 of occurrence of the observation feature F2 is determined as the target state 2 of occurrence of the observation feature F2. In the case that the probability of occurrence of the observation feature F1 in the target state 1 and the probability of occurrence of the observation feature F2 in the target state 2 are P2, the probability of occurrence of the observation feature F3 in each state is calculated, and the state corresponding to the maximum probability P3 of occurrence of the observation feature F3 is determined as the target state 3 of occurrence of the observation feature F3. Similarly, the state corresponding to the maximum probability P4 of occurrence of the observation feature F4 is determined as the target state 4 of occurrence of the observation feature F4 based on P3, so as to obtain the target state sequence: target state 1, target state 2, target state 3 and target state 4.

[0080] In the embodiment of the present application, the model parameters of the HMM include: the initial probability matrix Π, the state transition matrix A and the observation probability matrix B, wherein the HMM can be obtained by learning the training data, and the supervised learning and the unsupervised learning can be respectively implemented according to whether the training data includes the observation sequence and the corresponding state sequence or only the observation sequence.

[0081] When the training data includes U observation sequences with the same length and the corresponding state sequences: {(V1, S1), (V2, S3), …, (VU, SU)}, the maximum likelihood estimation method can be used to estimate the initial probability matrix Π, the state transition matrix A and the observation probability matrix B.

[0082] The estimation of a ij

[0083] ​The frequency of state i at time t transitioning to state j at time t+1 in the training data is A ij The estimate of the state transition probability a ij As shown in equation (1):

[0084]

[0085] Where A ij is the number of times state i transitions to state j, i = 1, 2, …, N, j = 1, 2, …, N.

[0086] For the estimate of the observation probability b j (k):

[0087] The frequency of state j observing k in the training data is B j (k), then the estimate of the probability of state j observing k is b j (k): As shown in equation (2):

[0088]

[0089] Where B jk is the number of times k is observed in state j, j = 1, 2, …, N, k = 1, 2, …, M.

[0090] For the estimate of the initial probability π i

[0091] The frequency of state i appearing as the initial state in the training data is F i , then the estimate of the initial state probability of state i is π i As shown in equation (3):

[0092]

[0093] Where F i is the number of times state i appears as the initial state, i = 1, 2, …, N.

[0094] When the training data includes U length observation sequences O = {V1, V2, …, VU}, the initial probability matrix Π, the state transition matrix A, and the observation probability matrix B are estimated using the following method:

[0095] Setting the initialized model parameters, the model parameters include: the initial probability matrix, the state transition matrix, and the observation probability matrix;

[0096] Based on the initialized model parameters and the training observation data, the updated model parameters are obtained; ​​​

[0097] In a case where the updated model parameters do not converge, the initialized model parameters are replaced by the updated model parameters, and the process of obtaining updated model parameters based on the initialized model parameters and the training observation data is repeated until the updated model parameters converge.

[0098] Here, an initialized initial probability matrix, an initialized state transition matrix and an initialized observation probability matrix are set, updated initial probability matrix, updated state transition matrix and updated observation probability matrix are obtained based on the initialized initial probability matrix, the initialized state transition matrix and the initialized observation probability matrix and the training observation data; in a case where the updated initial probability matrix, the updated state transition matrix and the updated observation probability matrix do not satisfy a convergence condition, the updated initial probability matrix, the updated state transition matrix and the updated observation probability matrix are replaced by the initialized initial probability matrix, the initialized state transition matrix and the initialized observation probability matrix, and the process of obtaining updated initial probability matrix, updated state transition matrix and updated observation probability matrix based on the initialized initial probability matrix, the initialized state transition matrix and the initialized observation probability matrix and the training observation data is repeated.

[0099] In the embodiments of the present application, HMM parameters λ are initialized to obtain initialized HMM parameters λ0, where λ0={initialized initial probability matrix Π0, initialized state transition matrix A0, initialized observation probability matrix B0}, an estimated value of λ, i.e. updated HMM parameters λ1, is determined based on λ0 and O, in a case where λ1 does not converge, λ2 is determined based on λ1 and O, in a case where λ2 does not converge, λ3 is determined based on λ2 and O, and so on, until λ n-1 and O determine λ n , and λ n converges, λ n is taken as the final HMM parameters.

[0100] In some embodiments, the process of obtaining updated model parameters based on the initialized model parameters and the training observation data comprises: determining an expectation of a log-likelihood function of complete data based on the initialized model parameters; and maximizing the expectation to estimate updated model parameters.

[0101] In the embodiments of the present application, the log-likelihood function of complete data is shown in formula (4),

[0102] log P(O,S|λ) formula (4);

[0103] For model parameters λ, the expectation of the log-likelihood function of complete data can be shown in formula (5):

[0104]

[0105] Where, λ * This is an estimate of λ, i.e., the updated λ.

[0106] Maximize the expectation of the log-likelihood function to obtain the updated model parameters.

[0107] In this embodiment of the application, formula (5) can be expressed as formula (6):

[0108]

[0109] Given λ, P(O|λ) is a constant, so maximizing the expectation of the log-likelihood function can be expressed as formula (7):

[0110]

[0111] Where, λ * This is the optimal solution for parameter λ.

[0112] make in Then P(O,S|λ) * This can be expressed as formula (8):

[0113]

[0114] At this time, Q(λ,λ) * This can be expressed as formula (9):

[0115]

[0116] The inherent constraints of HMM are shown in Equation (10):

[0117]

[0118]

[0119]

[0120] For constrained optimization problems, the Lagrange multiplier method is used for solution. Through iterative execution, the updated model parameters are obtained sequentially.

[0121] Among them, based on λ n =(Π) n A n B n The initial probability π in the updated initial probability matrix obtained after the nth iteration i n+1 The transition probability α in the updated turntable transition matrix ij n+1, the observation probability b in the updated observation probability matrix j (k) n+1 respectively as formula (11), formula (12), formula (13) shows:

[0122]

[0123]

[0124]

[0125] At this time, the updated model parameters are as shown in formula (14),

[0126] λ n+1 =(Π n+1 ,A n+1 ,B n+1 ) formula (14);

[0127] Finally, output the final model parameters

[0128] In some embodiments, S202 determines the attack state based on the target state sequence, comprising:

[0129] Determination method 1, when the target state sequence includes at least a first number of consecutive first states, the first state is a second state that lasts more than a first time threshold, and the number of first connection requests in the second state exceeds a first number threshold, the attack state is determined to be attacked.

[0130] Here, the first number can be determined based on the total number of target states in the target state sequence, or it can be a fixed number.

[0131] The first state is a semi-connection persistent state, i.e., a third connection state. When the number of semi-connection persistent states in the target state sequence is greater than the first number, it is determined that the current attack state is attacked. When the number of semi-connection persistent states in the target state sequence does not reach the first number, it is determined that the current attack state is not attacked.

[0132] In an example, the first number is 3, and when the target state sequence is: {sending state, sending state, semi-connection state, semi-connection state, semi-connection persistent state}, it is determined that the current attack state is not attacked.

[0133] In an example, the first number is 3, and when the target state sequence is: {sending state, sending state, semi-connection state, semi-connection state, semi-connection persistent state}, it is determined that the current attack state is not attacked.

[0134] In some embodiments, S202 determines the attack state based on the target state sequence, including:

[0135] In a determination mode 2, when the second target state included in the target sequence state is a set state, the target observation feature in the to-be-observed sequence is compared with an observation threshold value; in a case where the target observation feature is greater than the observation threshold value, the attack state is determined to be attacked, and the target observation feature is the latest observation feature in the to-be-observed sequence.

[0136] Here, the second target state is the last target state in the target state sequence according to the time sequence.

[0137] When the second target state in the target state sequence is a set state, it indicates that the server currently has a risk of being attacked. The set state includes one or both of the second connection state and the third connection state.

[0138] When the server determines that the second target state is a set state, the observation feature corresponding to the second target state in the to-be-observed sequence, i.e., the target observation feature, is obtained, the target observation feature is compared with the observation threshold value, in a case where the target observation feature is greater than the observation threshold value, the attack state is determined to be attacked, and in a case where the target observation feature is less than or equal to the observation threshold value, the attack state is determined to be not attacked.

[0139] Here, the type of the observation threshold value corresponds to the type of the observation feature.

[0140] In a case where the observation feature includes the number of first connection requests, the observation threshold value includes a second number threshold value, and in a case where the number of first connection requests included in the target observation feature is greater than the second number threshold value, it is determined that the target observation feature is greater than the observation threshold value.

[0141] In a case where the observation feature includes a target duration, the observation threshold value includes a third time threshold value, and in a case where the target duration included in the target observation feature is greater than the third time threshold value, it is determined that the target observation feature is greater than the observation threshold value.

[0142] In a case where the observation feature includes the number of first connection requests and the target duration, the observation threshold value includes the second number threshold value and the third time threshold value, and in a case where the number of first connection requests included in the target observation feature is greater than the second number threshold value, and the target duration included in the target observation feature is greater than the third time threshold value, it is determined that the target observation feature is greater than the observation threshold value.

[0143] In actual applications, the server can use one of the determination mode 1 and the determination mode 2 or a combination of both to determine the attack state.

[0144] In an example, the attack state is determined by using determination mode 1.

[0145] In an example, the attack state is determined by using determination mode 1.

[0146] In an example, the attack state is determined by using determination mode 1 and determination mode 2, when the attack state is determined to be attacked by using determination mode 1, and the attack state is determined to be attacked by using determination mode 2, it is confirmed that the attack state is attacked.

[0147] The attack detection method provided by the embodiment of the application can well simulate the dynamic change of the network data stream by using the characteristics of the HMM, and determine the attack state by combining the relationship between the observation features at different time points, and then accurately predict the current network state.

[0148] Next, the attack detection method provided by the embodiment of the application is further described.

[0149] As one of the major threats to the current Internet security, SYN Flood attack has attracted many research experts. The detection of SYN Flood attack is an important basis for responding to the attack in time.

[0150] In the related art, the detection methods of SYN Flood attack include:

[0151] Method 1, an artificial intelligence-based method,

[0152] Method 2, a statistical-based method,

[0153] Method 3, an information entropy-based method.

[0154] Method 1 can automatically learn the parameter training of the network model by mining the hidden information between the data, and can test the new data according to the trained model, and usually can obtain high accuracy, but ignores the relationship between the features, and cannot guarantee high accuracy.

[0155] Method 2 can effectively detect some specific types of SYN Flood attack, but when the attack type is to avoid system detection, the network attribute features change, and the system false negatives are easily generated. Meanwhile, when the network normal traffic is large during the attack process, the SYN Flood attack traffic is covered, so that the statistical relationship between the attack features cannot accurately show the current attack state.

[0156] Method 3 has strong versatility, and can effectively detect various types of SYN Flood attacks, but due to the real-time variability and dynamics of network attack traffic, it is very difficult to set a detection model threshold that can maximize the inclusion of all abnormal traffic attacks.

[0157] The embodiment of the application provides a SYN Flood attack detection method based on a Hidden Markov Model (HMM), which detects SYN Flood attacks according to the number of network connection requests, the number of half connections, and the duration of the number of half connections, so that the accuracy of SYN Flood attack detection is greatly improved, and the problem of high false positive rate and false negative rate caused by not considering the connection between adjacent time features in the related art is solved.

[0158] The present application takes the connection state based on the TCP protocol as the research object, and proposes a SYN Flood attack detection method based on HMM. First, the SYN Flood attack problem based on the TCP protocol is described, and the observation sequence, hidden state set and state transition relationship parameters in the HMM are determined, and finally the Baum-Welch algorithm and Viterbi algorithm are used to judge the most possible attacked state of the current system.

[0159] 1. Analysis of HMM modeling problem

[0160] In the process of SYN Flood attack based on the TCP protocol, the attacker sends a large number of TCP SYN data packets to the server by controlling a large number of computers in the network. Since the source IP address in the TCP SYN data packet sent by the attacker is fake, it will cause the server to maintain a large number of false connection requests, so that the TCP state machine is always maintained in the half connection state, which seriously consumes system resources and affects the speed of the system to process connection requests. The SYN Flood attack process is shown in 501 of FIG. 5, the client as the attack end continuously sends SYN to the server, and the server sends SYN+ACK to the client, and does not receive the ACK feedback from the client. The interaction process under normal traffic is shown in 502 of FIG. 5, the client sends SYN to the server, the server sends SYN_ACK to the client, and the client feeds back ACK to the server, thereby completing the three-way handshake to establish a connection. After the connection is established, the client pushes data (ACK PUSH) to the server, and the server feeds back ACK to the client. Figure 5 Figure 5

[0161] In the entire SYN Flood attack process, the following attack characteristics will appear:

[0162] Attack characteristic 1: large number of connection requests​​

[0163] The attack source causes serious consumption of server resources by continuously sending a large number of connection requests to the server, so that the server cannot respond to normal connection requests, and therefore, the number of connection requests established in the SYN Flood attack process is much larger than the number of connection requests established in normal cases.

[0164] Attack feature 2: There are a large number of connection requests in the received state (SYN_RCVD)

[0165] The attack source causes the client to never send an ACK packet for confirmation response to the server by forging a large number of source IP addresses, and therefore, the server continuously retransmits the SYN+ACK packet to the client, causing a large number of connection requests in the SYN_RCVD state, i.e., half-connection requests, in the SYN Flood attack process, at this time, the server is in a half-connection state.

[0166] Attack feature 3: Long duration of the half-connection state

[0167] In the SYN Flood attack process, the longest time from when the server receives the SYN packet of the attacker to when the server confirms that the packet is invalid is much longer than the duration in normal cases, because the attacker forges a large number of source IP addresses and cannot perform ACK confirmation to the server, causing the duration of the half-connection state to increase, i.e., being in a half-connection persistent state.

[0168] Through the above analysis of the characteristics in the SYN Flood attack process, the attacker first continuously sends a large number of connection requests to the server, because the attack source is a forged IP address, causing the server to have a large number of half-connection requests in the SYN_RCVD state, and further causing the duration of the half-connection state of the server to continuously increase, and finally successfully launching a SYN Flood attack on the server, therefore, the SYN Flood attack belongs to a composite attack. A composite attack can be understood as a complete attack process composed of multiple individual attacks, i.e., a successful attack process often includes multiple attack steps.

[0169] The flow of the composite attack is as shown in Figure 6 , including:

[0170] S601, the server continuously receives connection requests.

[0171] The connection request is a request sent by the attack end to request to establish a connection with the server.

[0172] At this time, the server is in a sending state.

[0173] S602, the server has a large number of half-connections.

[0174] At this time, the server is in a semi-connection state.

[0175] S603, the semi-connection state duration is growing.

[0176] At this time, the server is in a semi-connection state.

[0177] S604, the attack end completes the DDoS attack.

[0178] In the embodiment of the application, in the HMM, the connection request number, the semi-connection number and the longest survival time of the semi-connection number are taken as the observation sequence of the HMM, the closed state (CLOSED), the sending state, the semi-connection state, the semi-connection duration state (TIME) and the establishment completion (ESTABLISHED) are taken as the hidden state of the HMM, and each step in the process of the SYN Flood attack based on the TCP protocol completes a state transition between states. According to the characteristics of the HMM, the current attack state of the attacker can be predicted through the observation sequence, and finally the purpose of successfully detecting the SYN Flood attack is achieved.

[0179] In an example, as shown in Figure 7 , the hidden state sequence includes the sending state, the semi-connection state, the semi-connection duration state, and each state has corresponding observation characteristics, thereby constituting the observation sequence.

[0180] 2, HMM initialization parameter setting

[0181] The hidden state set in the HMM five-tuple (S, O, π, A, B), that is, the state sequence S and the observation sequence O, as shown in Figure 7 , the following three parameters of the model will be initialized and parameter set: initial state probability Π, state transition matrix A, and observation probability matrix B.

[0182] Initial state probability distribution matrix Π

[0183] The initial state probability distribution matrix Π can be represented as Π={π i}, wherein π i =S i ) represents the probability of the initial occurrence of different connection states S i of the TCP connection request process when the system performs SYN Flood.

[0184] π i can be represented as , wherein 1≤i≤N, and N represents the number of states in the state sequence S.

[0185] State transition probability matrix A

[0186] The state transition probability matrix A can be expressed as A=[a ij ] N×N , where a ij =P(Q t+1 =S j |Q t =S i )(1≤i,j≤N), and [a ij ] represents the probability that all different TCP connection states are in state S i at time t and are transferred to state S j at time t+1 during the attack, where t represents the order of state occurrence.

[0187] [a ij ] can be expressed as where 1≤j≤N, 1≤k≤M.

[0188] The probability distribution matrix B of the observation value

[0189] The probability distribution matrix B of the observation value can be expressed as B=[b jk ] M×N ; b jk =P(O t =V k |Q t =S j )(1≤j≤N, 1≤k≤M) represents the probability of the corresponding corresponding feature, i.e., the kth observation value V k , when the different connection states S j appear.

[0190] b jk can be expressed as where 1≤j≤N, 1≤k≤M.

[0191] Parameter training of HMM

[0192] Using the Expectation Maximization (EM) algorithm in HMM, i.e., Baum-Welch, according to the observation sequence feature O={O1O2…O T} and the hidden state sequence Q={Q1Q2…Q T} corresponding to each connection state at time T in the training set, the parameters in the HMM are trained to maximize P(O|λ).

[0193] The training steps of the HMM include:

[0194] S1, determine the log-likelihood function composed of observation data O and hidden state data S, and the log-likelihood function can be expressed as formula (4):

[0195] log P(O,S|λ) Equation (4)

[0196] S2, E-step: Calculate the posterior probability of the hidden variable (i.e., the expectation of the hidden variable) as the current estimate of the hidden variable according to the initial value of the parameter λ or the value of the parameter λ obtained in the last iteration, wherein the posterior probability of the hidden variable is calculated by a Q function, i.e., a likelihood function shown in Equation (5);

[0197]

[0198] S3, M-step: Maximize the Q function to obtain the latest parameter λ. Wherein the maximization of the Q function can be represented as Equation (15):

[0199]

[0200] Repeat S2 and S3 until the HMM model converges.

[0201] Wherein, the solving algorithm process of the parameter λ is as follows:

[0202] Equation (5) can be represented as Equation (6):

[0203]

[0204] For a given parameter λ, P(O|λ) is a constant, so Equation (9) can be represented as Equation (7):

[0205]

[0206] Wherein, λ * is the optimal solution of the parameter λ.

[0207] Let Wherein Then P(O,S|λ * ) can be represented as Equation (8):

[0208]

[0209] At this time, Q(λ,λ * ) can be represented as Equation (9):

[0210]

[0211] The intrinsic constraint condition of the HMM is shown in Equation (10):

[0212]

[0213]

[0214]

[0215] For the constrained optimization problem, the Lagrange multiplier method is used for solution. After iterative execution, the corresponding initial probabilities, transition probabilities and confusion matrix are obtained in sequence. The initial probabilities, transition probabilities and confusion matrix are shown in Equations (11), (12) and (13) respectively:

[0216]

[0217]

[0218]

[0219] λ n+1 =(π) n+1 A n+1 B n+1 ) formula (14);

[0220] Finally, the final model parameters are output.

[0221] The server inputs the optimal model parameters obtained from the solution into the Viterbi algorithm to calculate the hidden state under the current observation sequence, and determines the attack state of the server based on the hidden state.

[0222] This application provides an attack detection device 800, such as... Figure 8 As shown, the attack detection device 800 includes:

[0223] The statistics unit 801 is used to at least count the first connection requests of each time point in at least one time point included in the first duration to obtain the observation sequence. The observation sequence includes the observation features of each time point in the at least one time point. The first connection request is a connection request in which the corresponding acknowledgment data packet has been sent but no response to the acknowledgment data packet has been received.

[0224] The determining unit 802 is used to determine a target state sequence based on the observation sequence; the target state sequence includes the target state at each time point at the at least one time point;

[0225] The judgment unit 803 is used to determine the attack state based on the target state sequence.

[0226] In some embodiments, the statistical unit 801 is also used for

[0227] For each time point within the first duration, statistically analyze the observation characteristics of the first connection request at that time point;

[0228] The observation sequence is constructed based on the observation features corresponding to each time point within the first duration.

[0229] In some embodiments, the statistical unit 801 is further configured to:

[0230] count the number of the first connection requests at the time point;

[0231] determine a target duration based on the duration of each of the first connection requests at the time point.

[0232] In some embodiments, the statistical unit 801 is further configured to:

[0233] count the number of the first connection requests at the time point;

[0234] In some embodiments, the determining unit 802 is further configured to:

[0235] for a first observation feature corresponding to a first time point in the observation sequence, determine that a state generating a second probability is a first target state corresponding to the first time point based on the first probability, the state transition matrix and the observation probability matrix, the second probability being a maximum probability of occurrence of a first observation sequence, the first observation sequence comprising the first observation feature and a second observation sequence; the observation probability matrix being a probability of occurrence of each observation feature in an observation sequence under each state in the state sequence, the first probability being a maximum probability of occurrence of the second observation sequence, the second observation sequence comprising observation features corresponding to all time points before the first time point in the first time duration.

[0236] In some embodiments, the apparatus 800 further comprises a training unit configured to:

[0237] set an initialized model parameter, the model parameter comprising an initial probability matrix, a state transition matrix and an observation probability matrix;

[0238] obtain an updated model parameter based on the initialized model parameter and training observation data;

[0239] in a case where the updated model parameter does not converge, replace the initialized model parameter with the updated model parameter, and repeat obtaining an updated model parameter based on the initialized model parameter and training observation data until the updated model parameter converges.

[0240] In some embodiments, the training unit is further configured to:

[0241] determine an expectation of a log-likelihood function of complete data based on the initialized model parameter;

[0242] maximizing the expected estimation update of the model parameters.

[0243] In some embodiments, the determining unit 803 is further configured to:

[0244] When the target state sequence includes at least a first number of consecutive first states, the first state being a second state lasting more than a first time threshold, and the number of first connection requests in the second state exceeding a first number threshold, the attack state is determined to be attacked.

[0245] In some embodiments, the determining unit 803 is further configured to:

[0246] When the second target state included in the target sequence state is a set state, the target observation feature in the to-be-observed sequence is compared with an observation threshold, the second target state being the last target state in the target state sequence according to the time sequence, and the target observation feature being an observation feature corresponding to the second target state in the to-be-observed sequence.

[0247] When the target observation feature is greater than the observation threshold, the attack state is determined to be attacked.

[0248] The above device embodiments are similar to the descriptions of the above method embodiments, and have similar beneficial effects to the method embodiments. For technical details not disclosed in the device embodiments of the present application, please refer to the description of the method embodiments of the present application for understanding.

[0249] It should be noted that, in the embodiments of the present application, if the attack detection method described above is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in the embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a magnetic disk or an optical disk, and various media that can store program codes. Thus, the embodiments of the present application are not limited to any specific hardware and software combination.

[0250] Correspondingly, the embodiments of the present application provide an electronic device, including a memory and a processor, the memory stores a computer program capable of running on the processor, and the processor executes the program to realize the steps of the attack detection method provided in the above embodiments.

[0251] Correspondingly, the embodiment of the present application provides a storage medium, that is, a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the attack detection method provided in the above embodiment.

[0252] It should be noted that the description of the above storage medium and device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects as the method embodiments. For technical details of the storage medium and device embodiments of the present application that are not disclosed, please refer to the description of the method embodiments of the present application for understanding.

[0253] It should be noted that, Figure 9 A hardware entity diagram of an electronic device (implemented as a server) of the embodiment of the present application is shown in FIG. 9. Figure 9 As shown in FIG. 9, the electronic device 900 includes a processor 901, at least one communication bus 902, a user interface 903, at least one external communication interface 904, and a memory 905. The communication bus 902 is configured to realize the connection and communication between the components. The user interface 903 can include a display screen, and the external communication interface 904 can include a standard wired interface and a wireless interface.

[0254] The memory 905 is configured to store instructions and applications executable by the processor 901, and can also cache data (for example, observation features) to be processed by the processor 901 and modules in the electronic device, or data that has been processed. The memory 905 can be implemented by a FLASH or a Random Access Memory (RAM).

[0255] It should be understood that the "one embodiment" or "an embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in some embodiments" appearing throughout the specification does not necessarily mean the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the sequence number of each process does not mean the execution order, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The sequence number of the above embodiments of the present application is only for description, not representing the advantages and disadvantages of the embodiments.

[0256] It should be noted that, in the present document, the terms "comprising", "containing", or any other similar term are intended to encompass non-exclusive inclusion, such that processes, methods, articles, or apparatuses that comprise a list of elements are not limited to those elements, but can also include other elements not expressly listed, or also include elements inherent in such processes, methods, articles, or apparatuses. Without further limitation, an element defined by the phrase "comprising a" does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0257] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed components can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0258] The units described above as separate components can or can not be physically separated, and the components shown as units can or can not be physical units; they can be located in one place or distributed on multiple network units; and part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0259] In addition, each functional unit in each embodiment of the present application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be realized in the form of hardware or hardware plus software functional unit.

[0260] Those of ordinary skill in the art can understand that all or part of the steps of the above method embodiments can be completed by program instruction related hardware, and the aforementioned program can be stored in a computer readable storage medium, and the program executes the steps of the above method embodiments when executed; and the aforementioned storage medium includes: mobile storage device, read only memory (Read Only Memory, ROM), magnetic disc or optical disc, and various storage program codes.

[0261] Alternatively, the above-mentioned integrated units of the present application, if realized in the form of software function modules and sold or used as independent products, can also be stored in a computer-readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in the embodiments of the present application. The aforementioned storage medium includes: mobile storage devices, ROM, magnetic disks or optical disks, and various media that can store program codes.

[0262] The above is only an embodiment of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An attack detection method characterized by, The method comprises: For a synchronous flood (SYN Flood) attack of a transmission control protocol (TCP) protocol, at least a first connection request at each time point in a first time length is counted to obtain an observation sequence, the observation sequence comprising an observation feature at each time point in the at least one time point, the observation feature comprising a number of the first connection request at each time point and / or a target duration determined based on a duration of the first connection request at each time point; the first connection request is a connection request corresponding to a confirmation packet for which a response has not been received after the confirmation packet has been sent, and the first connection request is a half-connection request; wherein the target duration determined based on the duration of the first connection request at each time point is determined based on the following steps: counting the duration of all the first connection requests at the time point, and calculating an average value or a maximum value of the duration as the target duration; Based on the observation sequence, a target state sequence is determined; the target state sequence comprises a target state at each time point in the at least one time point, and the target state is a TCP connection state, the TCP connection state comprising a half-connection state and a half-connection duration state; the half-connection state is a connection state when a server receives a first connection request sent by a client, returns a SYN+ACK packet in response to the first connection request, and does not receive a reply to the SYN+ACK packet from the client during a three-way handshake process of the TCP protocol; and the half-connection duration state is a state in which the duration of the half-connection state exceeds a first time threshold; Based on the target state sequence, an attack state is determined.

2. The method of claim 1, wherein, The at least counting of the first connection request at each time point in the at least one time point in the first time length to obtain the observation sequence comprises: For each time point in the first time length, an observation feature of the first connection request at the time point is counted; Based on the observation feature corresponding to each time point in the first time length, the observation sequence is formed.

3. The method of claim 2, wherein, The counting of the observation feature of the first connection request at the time point comprises at least one of the following: The number of the first connection request at the time point is counted; A target duration is determined based on the duration of each first connection request in the first connection request at the time point.

4. The method of claim 1, wherein, The at least counting of the first connection request at each time point in the at least one time point in the first time length to obtain the observation sequence comprises: The first connection request at each time point in the at least one time point in the first time length and the number of the connection request at each time point in the at least one time point in the first time length are counted to obtain the observation sequence.

5. The method of claim 1, wherein, The determination of the target state sequence based on the observation sequence comprises: For a first observation feature corresponding to a first time point in the to-be-observed sequence, a state generating a second probability is determined as a first target state corresponding to the first time point based on a first probability, a state transition matrix, and an observation probability matrix, the second probability being a maximum probability of occurrence of a first observation sequence, the first observation sequence including the first observation feature and a second observation sequence; the observation probability matrix being a probability of occurrence of each observation feature in an observation sequence under each state in a state sequence, the state sequence being a hidden state sequence of a hidden Markov model; the first probability being a maximum probability of occurrence of the second observation sequence, the second observation sequence including observation features corresponding to all time points before the first time point in the first time length.

6. The method of claim 5, wherein, The method further includes: setting initialized model parameters, the model parameters including an initial probability matrix, a state transition matrix, and an observation probability matrix; obtaining updated model parameters based on the initialized model parameters and training observation data; in the case where the updated model parameters do not converge, replacing the initialized model parameters with the updated model parameters, and repeating obtaining updated model parameters based on the initialized model parameters and training observation data until the updated model parameters converge.

7. The method of claim 6, wherein, The obtaining of the updated model parameters based on the initialized model parameters and the training observation data includes: determining an expectation of a log-likelihood function of complete data based on the initialized model parameters; maximizing the expectation to estimate the updated model parameters.

8. The method of claim 1, wherein, The determination of the attack state based on the target state sequence includes: when at least a first number of first states are included in the target state sequence, determining that the attack state is attacked, the first state being a second state lasting for more than a first time threshold, and a number of the first connection requests under the second state being more than a first number threshold.

9. The method of claim 1, wherein, The determination of the attack state based on the target state sequence includes: when a second target state included in the target state sequence is a set state, comparing a target observation feature in the to-be-observed sequence with an observation threshold, the second target state being a last target state in the target state sequence according to a time sequence, the target observation feature being an observation feature corresponding to the second target state in the to-be-observed sequence; in the case where the target observation feature is greater than the observation threshold, determining that the attack state is attacked.

10. An attack detection apparatus characterized by comprising: The apparatus includes: A statistical unit is configured to, for a synchronization flood (SYN Flood) attack of a transmission control protocol (TCP) protocol, count first connection requests at each time point in a first time duration to obtain an observation sequence, the observation sequence including observation features of each time point in the at least one time point, the observation features including a number of first connection requests at each time point and / or a target duration determined based on a duration of the first connection requests at each time point; the first connection request is a connection request for which a corresponding acknowledgement packet has been sent but no response to the acknowledgement packet has been received, and the first connection request is a half-connection request; wherein the target duration determined based on the duration of the first connection requests at each time point is determined based on the following steps: counting durations of all first connection requests at the time point, and calculating an average or maximum of the durations as the target duration; A determination unit is configured to determine a target state sequence based on the observation sequence; the target state sequence includes target states of each time point in the at least one time point, and the target state is a TCP connection state including a half-connection state and a half-connection duration state; the half-connection state is a connection state when a server receives a first connection request sent by a client, returns a SYN+ACK packet in response to the first connection request, and does not receive a reply to the SYN+ACK packet from the client during a three-way handshake process of the TCP protocol; and the half-connection duration state is a state in which the duration of the half-connection state exceeds a first time threshold. A judgment unit is configured to determine an attack state based on the target state sequence.

11. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the steps in the attack detection method of any one of claims 1 to 9.

12. A storage medium having stored thereon a computer program, characterized in that The computer program is executed by the processor to implement the attack detection method of any one of claims 1 to 9.

Images