Attack detection method, device, equipment and readable storage medium
By obtaining the source IP address location information of the data stream and dynamically adjusting the judgment threshold, the problem of poor performance of existing DDoS attack detection schemes in environments with drastic changes in network traffic is solved, and more accurate attack detection is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- HANGZHOU DPTECH TECH
- Filing Date
- 2023-04-17
- Publication Date
- 2026-07-21
AI Technical Summary
Existing DDoS attack detection schemes rely on fixed thresholds, resulting in poor detection performance and a lack of flexibility in environments with drastic changes in network traffic, especially for low-speed connection attacks.
By obtaining the source IP address location information of the data stream, the judgment threshold is dynamically adjusted, and new anomaly judgment thresholds are generated using statistical information and historical records within a set period, thereby enabling the detection of attack behaviors.
Dynamic adjustment of the threshold is achieved, which improves the accuracy and adaptability of attack detection and enhances the detection effect of DDoS attacks.
Smart Images
Figure CN116488883B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer network security technology, and in particular to an attack detection method, apparatus, device, and readable storage medium. Background Technology
[0002] A DDoS attack (Distributed Denial of Service attack) is a distributed, large-scale traffic attack that uses remotely controlled machines to simulate legitimate users sending a large number of access requests to the target, forging legitimate data packets, consuming limited network bandwidth and the target's system resources, causing the target's network to become paralyzed and unable to provide normal services, thereby affecting access for legitimate users.
[0003] In related technologies, detection schemes for DDoS attacks or other attack methods with DDoS attack characteristics typically rely on experience to set fixed thresholds to determine the presence of attack behavior. For example, setting new thresholds for symbol transmission rate (SPS) of 10,000 (symbols per second) or UDP transmission rate (Million bits per second). This detection method is highly dependent on significant changes in traffic or session transmission rate, and its effectiveness in detecting low-speed connection attacks is poor. Furthermore, the threshold settings lack flexibility, and in environments with drastic network traffic fluctuations, the detection performance of fixed thresholds is significantly reduced. Summary of the Invention
[0004] In view of this, in order to solve the above-mentioned technical problems, this application provides an attack detection method, apparatus, system, device and readable storage medium.
[0005] Specifically, this application is implemented through the following technical solution:
[0006] According to a first aspect of the embodiments of this application, an attack detection method is provided, the method comprising:
[0007] Obtain statistical information of the data streams received within a first set period, wherein the statistical information includes at least the location information of the different source IP addresses in the data streams;
[0008] Based on the historical records of the statistical information of the data stream, determine the judgment threshold corresponding to the location information in the statistical information;
[0009] If the statistical information of a data stream with a first set number of consecutive data streams for a first set period meets a preset condition, then an attack is determined to exist and an alarm is issued to the user. The preset condition is that at least one of the location information in the statistical information is greater than the corresponding judgment threshold.
[0010] Optionally, the statistical information of the data stream may also include a source IP address table and the total number of different source IP addresses; the location information may include at least the location of the IP address and the number of source IP addresses belonging to the location, wherein the location may include at least one of the following: within a set area, outside a set area, and a cloud service provider;
[0011] The step of obtaining statistical information on the data streams received within the first set period includes:
[0012] Obtain the source IP address of the packet in the data stream;
[0013] If the source IP address table does not include the target source IP address, the target source IP address is added to the source IP address table, and the total number of different source IP addresses is incremented by one. The target source IP address includes the source IP address of each packet.
[0014] When adding the target source IP address to the source IP address table, the location of the target source IP address is determined and location information statistics are performed.
[0015] Optionally, determining the location information of the target source IP address and performing location information statistics includes:
[0016] The location of the source IP address is determined based on a pre-set IP address location database.
[0017] If the location of the source IP address is the same as the location in the statistics, the number of source IP addresses corresponding to the location in the statistics is incremented by one.
[0018] Optionally, determining the judgment threshold corresponding to the location information in the statistical information based on the historical records of the statistical information of the data stream includes:
[0019] Obtain historical records of statistical information of data streams corresponding to the first set period for a second set number of periods, wherein the historical records do not include statistical information of data streams that meet the preset conditions;
[0020] Determine the median number of source IP addresses belonging to the target home region in the historical records, where the target home region includes each home region in the statistics;
[0021] Based on the median, determine the threshold for determining the target's place of origin.
[0022] Optionally, determining the threshold for the target location based on the median includes:
[0023] If the set multiple of the median is not less than the set learning threshold, the set multiple of the median is determined as the determination threshold corresponding to the target location.
[0024] If the set multiple of the median is less than the set learning threshold, the set learning threshold is determined as the determination threshold corresponding to the target location.
[0025] Optionally, the method further includes:
[0026] If the historical records of statistical information of the data stream corresponding to the first set period of the second set number cannot be obtained, a preset value is determined as the judgment threshold corresponding to the location information.
[0027] According to a second aspect of the embodiments of this application, an attack detection apparatus is provided, the apparatus comprising:
[0028] The information acquisition module is used to acquire statistical information of the data streams received within a first set period, wherein the statistical information includes at least the location information of different source IP addresses in the data streams;
[0029] The threshold determination module is used to determine the judgment threshold corresponding to the location information in the statistical information based on the historical records of the statistical information of the data stream;
[0030] The attack detection module determines that an attack has occurred and sends an alarm to the user if the statistical information of a first set number of consecutive data streams for a first set period meets a preset condition. The preset condition is that at least one of the location information in the statistical information is greater than the corresponding judgment threshold.
[0031] Optionally, the statistical information of the data stream may also include a source IP address table and the total number of different source IP addresses; the location information may include at least the location of the IP address and the number of source IP addresses belonging to the location, wherein the location may include at least one of the following: within a set area, outside a set area, and a cloud service provider;
[0032] The information acquisition module is specifically used for:
[0033] Obtain the source IP address of the packet in the data stream;
[0034] If the source IP address table does not include the target source IP address, the target source IP address is added to the source IP address table, and the total number of different source IP addresses is incremented by one. The target source IP address includes the source IP address of each packet.
[0035] When adding the target source IP address to the source IP address table, the location of the target source IP address is determined and location information statistics are performed.
[0036] Optionally, determining the location information of the target source IP address and performing location information statistics includes:
[0037] The location of the source IP address is determined based on a pre-set IP address location database.
[0038] If the location of the source IP address is the same as the location in the statistics, the number of source IP addresses corresponding to the location in the statistics is incremented by one.
[0039] Optionally, the threshold determination module includes:
[0040] Obtain historical records of statistical information of data streams corresponding to the first set period for a second set number of periods, wherein the historical records do not include statistical information of data streams that meet the preset conditions;
[0041] Determine the median number of source IP addresses belonging to the target home region in the historical records, where the target home region includes each home region in the statistics;
[0042] Based on the median, determine the threshold for determining the target's place of origin.
[0043] Optionally, determining the threshold for the target location based on the median includes:
[0044] If the set multiple of the median is not less than the set learning threshold, the set multiple of the median is determined as the determination threshold corresponding to the target location.
[0045] If the set multiple of the median is less than the set learning threshold, the set learning threshold is determined as the determination threshold corresponding to the target location.
[0046] Optionally, the device further includes:
[0047] If the historical records of statistical information of the data stream corresponding to the first set period of the second set number cannot be obtained, a preset value is determined as the judgment threshold corresponding to the location information.
[0048] According to a third aspect of the embodiments of this application, an electronic device is provided, the electronic device comprising: a memory and a processor; the memory being used to store a computer program; the processor being used to execute the above-described attack detection method by invoking the computer program.
[0049] According to a fourth aspect of the embodiments of this application, a computer-readable storage medium is provided, on which a computer program is stored, wherein the program, when executed by a processor, implements the above-described attack detection method.
[0050] The technical solutions provided in this application embodiment may include the following beneficial effects:
[0051] In the technical solution provided in this application, statistical information of the data flow is obtained by statistically analyzing the trend of the number of source IP addresses of the data flow within a set period. Based on the historical records of the statistical information of the data flow within the preset detection period, new anomaly judgment thresholds are periodically generated. Thus, the presence of attack behavior in the data flow at the current moment is periodically detected according to the thresholds. This realizes the dynamic adjustment of the thresholds and the detection of attack behavior, making the threshold settings for attack detection more accurate and reasonable, and enhancing the attack detection effect.
[0052] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this application. Furthermore, no embodiment in this application needs to achieve all the effects described above. Attached Figure Description
[0053] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0054] Figure 1 This is a schematic diagram of an attack detection method illustrated in an exemplary embodiment of this application;
[0055] Figure 2 This is a schematic diagram illustrating a process for obtaining statistical information of a data stream, as shown in an exemplary embodiment of this application.
[0056] Figure 3 This is a schematic diagram illustrating a process for determining a threshold corresponding to location information, as shown in an exemplary embodiment of this application.
[0057] Figure 4 This is a flowchart illustrating another process for determining statistical information of a data stream, as shown in an exemplary embodiment of this application.
[0058] Figure 5 This is a schematic diagram of the structure of an attack detection device shown in an exemplary embodiment of this application;
[0059] Figure 6 This is a hardware schematic diagram of an electronic device illustrated in an exemplary embodiment of this application. Detailed Implementation
[0060] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.
[0061] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.
[0062] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, a first classification threshold may also be referred to as a second classification threshold, and similarly, a second classification threshold may also be referred to as a first classification threshold. Depending on the context, the word "if" as used herein may be interpreted as "when," "in response to a determination," or "when," or "in the event of a determination."
[0063] This application provides an attack detection method that can be applied to computers, servers, or other devices requiring DDoS attack detection. It is understood that this attack detection method can also be applied to detect other attack behaviors that have the same or similar attack characteristics as DDoS attacks.
[0064] See Figure 1 As shown, the attack detection method provided in this application may include the following steps:
[0065] S101, Obtain statistical information of the data streams received within a first set period, wherein the statistical information includes at least the location information of different source IP addresses in the data streams;
[0066] The statistical information of the data stream is used to represent the characteristics of the source IP address of the data stream in a data format; the location information of different source IP addresses is a statistical representation of the location of different source IP addresses in the received data stream.
[0067] The statistical information of the data stream is obtained by statistically analyzing the data stream at a frequency of a first set period, that is, by statistically analyzing the source IP address information of the data stream once every first set period. By performing statistical analysis on the data stream received within the first set period, multiple sets of statistical information of the data stream can be obtained, and the first set period corresponding to the statistical information of the multiple sets of data streams satisfies the continuity of time.
[0068] The acquisition of statistical information of the data stream received within the first set period can be achieved in any of the following ways: The executing entity of this application embodiment can perform source IP address statistics on the data stream received within the first set period when the time satisfies a first set period, thereby obtaining statistical information of the data stream; or, the statistical information of the data stream can be obtained by another device or apparatus sampling the data stream at a sampling frequency of the first set period, performing source IP address statistics on the data stream within the first set period, and outputting statistical information. The executing entity of this application embodiment actively reads or receives the statistical information of the data stream output by the other device or apparatus when the current system time corresponds to the end time of the first set period.
[0069] For example, if the first set period is one minute, then the execution subject of this application embodiment, or another device or equipment, extracts and statistically analyzes the source IP address of the data stream received within each minute at a frequency of once per minute, and outputs the statistical results of the data stream once per minute.
[0070] In another example, data stream statistics can be displayed and stored according to a second set period, which is an integer multiple of the first set period. For example, if the first set period is 1 minute and the second set period is 5 minutes, then data stream statistics are collected every minute and stored in the counter's memory. Every 5 minutes, the statistics from the current 5 data streams are sent to the relevant platform for display and stored.
[0071] S102, Based on the historical records of the statistical information of the data stream, determine the judgment threshold corresponding to the location information in the statistical information;
[0072] The historical record of the statistical information of the data stream can be relative to a certain first set period or a period range containing multiple consecutive first set periods, referring to the statistical information of the data stream located before the first set period or the period range; for the first set period or the period range, the historical record can be the statistical information of the data stream corresponding to a set number of first statistical periods, the set number being set by the user according to actual conditions; or, for the period range, the historical record can also be the statistical information of the data stream corresponding to a target set number of first statistical periods, the target set number being the product of the set number and the number of first set periods included in the period range.
[0073] For example, if the set number is 50, for a certain first set period or a period range containing 5 consecutive first set periods, the historical record can refer to the statistical information of the data stream of 50 first set periods obtained sequentially in reverse chronological order, starting from the previous period of the certain first set period or the period range; or, the historical record corresponding to the period range can also be the statistical information of the data stream of the first set period of the target set number obtained sequentially in reverse chronological order, starting from the previous period of the period range, where the target set number is the product of the set number and the number of first set periods included in the period range, which is 250.
[0074] The number of judgment thresholds corresponding to the location information is the same as the number of location categories in the location information. That is, the location information includes several types of location, and the corresponding number of judgment thresholds can be determined. Each judgment threshold represents a location category that corresponds one-to-one with the several types of location categories.
[0075] Regarding the statistical information of the data stream in the first set period mentioned in step S101, the historical record refers to the statistical information of the data stream obtained within the period range prior to the first set period. Based on the historical record of the statistical information of the data stream, the historical data of the location information in the statistical information of each set week in the historical record can be obtained, thereby determining the target data in the historical data of the location information that can represent the typical characteristics of the data set and the general level of the research object, such as any one of the arithmetic mean, median, weighted average, mode, etc., so as to obtain the judgment threshold corresponding to the location information of the first set period according to the target data.
[0076] The step of determining the judgment threshold corresponding to the location information in the statistical information based on the historical records of the statistical information of the data stream can be performed by the execution subject of this application embodiment to obtain the historical records and determine the judgment threshold; or, another device or apparatus can be used to periodically output the judgment threshold corresponding to the location information based on the historical records of the statistical information, and the execution subject of this application embodiment receives the judgment threshold output by the other device or apparatus, updates the judgment threshold stored in the execution subject with the newly received judgment threshold, and determines the updated judgment threshold as the judgment threshold corresponding to the location information.
[0077] S103, in response to the statistical information of a first set number of consecutive data streams for a first set period satisfying a preset condition, it is determined that there is an attack and an alarm is issued to the user. The preset condition is that at least one of the location information in the statistical information is greater than the corresponding judgment threshold.
[0078] The first set number is used to describe the number of first set periods corresponding to statistical information that meets preset conditions, and the value of the first set number can be a positive integer greater than 1.
[0079] Within a certain period of time, an attack detection is performed once every first preset period. When the statistical information of the data stream is detected to meet the preset conditions multiple times in a row, the number of multiple detections is equal to the first preset number. Then, it is determined that there is an attack behavior, and an alarm log can be generated and sent to the user to remind the user to pay attention to the current data stream and take further action.
[0080] For example, if the first set number is 3 and the first set period is 1 minute, then the statistical information of the data stream acquired every minute is compared with the preset conditions. If the statistical information of three consecutive one-minute data streams meets the preset conditions, it indicates that there is an attack.
[0081] In the technical solution provided in this application, statistical information of the data flow is obtained by statistically analyzing the trend of the number of source IP addresses of the data flow within a set period. Based on the historical records of the statistical information of the data flow within the preset detection period, new anomaly judgment thresholds are periodically generated. Thus, the presence of attack behavior in the data flow at the current moment is periodically detected according to the thresholds. This realizes the dynamic adjustment of the thresholds to adapt to the current network environment and attack behavior detection, making the threshold settings for attack detection more accurate and reasonable, and enhancing the attack detection effect.
[0082] In some embodiments, the statistical information of the data stream further includes a source IP address table and the total number of different source IP addresses; the location information includes at least the location of the IP address and the number of source IP addresses belonging to the location, and the location includes at least one of the following: within a set area, outside the set area, and cloud service provider;
[0083] See Figure 2 As shown, the acquisition of statistical information of the data stream received within the first set period as described in step S101 above can be achieved through the following steps:
[0084] S1011, Obtain the source IP address of the packet in the data stream;
[0085] S1012, if the source IP address table does not include the target source IP address, add the target source IP address to the source IP address table and increment the total number of different source IP addresses by one. The target source IP address includes the source IP address of each packet.
[0086] S1013, when adding the target source IP address to the source IP address table, determine the location of the target source IP address and perform location information statistics.
[0087] The source IP address table is used to record different source IP addresses in the data stream, and the total number of different source IP addresses is the same as the number of IP address entries in the source IP address table.
[0088] The location information is used to classify and count the locations of different source IP addresses, and to determine the number of different source IP addresses from different locations within the first set period. The set area and set outside the set area can be set by the user according to the actual situation. For example, the set area can be China, then set area and set outside the set area respectively represent the location of the IP address being domestic and the location being foreign.
[0089] The cloud service providers mentioned may include Chinese cloud service providers such as Alibaba Cloud and Tencent Cloud, as well as other international cloud service providers such as Amazon and Microsoft.
[0090] For each first set period, the initial values of all items in the statistical information of the data stream are 0 or empty, such as the source IP address table being empty, the total number of different source IP addresses, and the number of source IP addresses belonging to the home location being 0.
[0091] In this embodiment of the disclosure, the network operation status is monitored in real time by statistically analyzing different source IP addresses within a first set period and the location information of the source IP addresses. The statistical information will be used as the learning value for subsequent attack behavior detection thresholds.
[0092] In some embodiments, the determination of the location information of the target source IP address and the statistical analysis of the location information in step S1013 of the above embodiments can be implemented in the following manner:
[0093] The location of the source IP address is determined based on a pre-set IP address location database.
[0094] If the location of the source IP address is the same as the location in the statistics, the number of source IP addresses corresponding to the location in the statistics is incremented by one.
[0095] That is, a pre-built IP address location database is used to query the location of IP addresses added to the source IP address table within the first set period, so as to realize the statistics of the location information of the source IP addresses.
[0096] See Figure 3 As shown, in some embodiments, the step S102 above, which involves determining the threshold corresponding to the location information in the statistical information based on the historical records of the statistical information of the data stream, may include the following steps:
[0097] S1021, Obtain historical records of statistical information of data streams corresponding to the first set period for a second set number of periods, wherein the historical records do not include statistical information of data streams that meet the preset conditions;
[0098] S1022, determine the median number of source IP addresses belonging to the target home region in the historical records, wherein the target home region includes each home region in the statistics;
[0099] S1023, Determine the judgment threshold corresponding to the target location based on the median.
[0100] If the statistical information of the detected data stream meets a preset condition, indicating the presence of an attack, then the statistical information of the current data stream cannot be used as the data record for determining the judgment threshold. Therefore, in the process of obtaining the historical records of the statistical information of the data stream, after removing the statistical information that meets the preset condition, a second set number of historical records for the first set period are obtained.
[0101] In one example, when storing statistical information of the data stream that meets preset conditions, an indicator is added to distinguish it from statistical information that does not meet the preset conditions.
[0102] The determination threshold can be determined using a second set period as the historical record sampling frequency. The historical record of the data stream is acquired once every second set period, and the determination threshold is determined based on the historical record acquired this time. The second set period can be an integer multiple of the first set period.
[0103] For example, if the second set period is 5 minutes, then the historical record is obtained once every 5 minutes, that is, a new judgment threshold is output once every 5 minutes. In this case, the judgment threshold corresponding to the location information in the statistical information of each first set period within the 5 minutes is the same.
[0104] The process of determining the threshold corresponding to the aforementioned location information is illustrated below, taking as an example that the second set number is 50, the first set period is 1 minute, the location information includes locations outside the set area, and the location is a cloud service provider:
[0105] First, the statistical information corresponding to the 50 minutes prior to the current system time is determined from the cached statistical information of the data stream. For example, if 230 sets of data stream statistical information per minute have been cached in chronological order, the statistical information of the data streams from the 181st to the 230th set is determined as the historical record of the statistical information. Second, the first median of the 50 IP address values corresponding to the designated area and the second median of the number of 50 IP addresses corresponding to the cloud service provider are determined from the historical record. Finally, based on the first median and the second median, the first judgment threshold corresponding to the designated area and the second judgment threshold corresponding to the cloud service provider are determined.
[0106] In this embodiment of the disclosure, the threshold for judging attack behavior is determined by utilizing the historical records of the statistical information of the data stream, thereby realizing the dynamic adjustment of the judgment threshold. This makes the determined judgment threshold more consistent with the current network environment and improves the accuracy of attack behavior detection.
[0107] In some embodiments, after determining the median number of source IP addresses belonging to the target location, the step of determining the determination threshold corresponding to the target location based on the median may include the following implementation:
[0108] If the set multiple of the median is not less than the set learning threshold, the set multiple of the median is determined as the determination threshold corresponding to the target location.
[0109] If the set multiple of the median is less than the set learning threshold, the set learning threshold is determined as the determination threshold corresponding to the target location.
[0110] The setting of the learning threshold ensures that the determined judgment threshold is not too small. For example, assuming the learning threshold is set to 20 and the multiplier is set to 4, if the first median outside the set region is 4, and its multiplier value of 16 is less than the learning threshold, then the learning threshold of 20 is determined to be the judgment threshold corresponding to the outside region.
[0111] In this embodiment of the disclosure, a set multiple of the median or a set learning threshold is used as the determination threshold corresponding to the target location, so that the determination threshold is not too small and the threshold setting takes into account the normal burst increase of traffic in the data stream, thus setting the determination threshold more reasonably and enhancing the attack detection effect.
[0112] In some embodiments, the process of determining the determination threshold corresponding to the location information in the statistical information based on the historical records of the statistical information of the data stream further includes the following steps:
[0113] If the historical records of statistical information of the data stream corresponding to the first set period of the second set number cannot be obtained, a preset value is determined as the judgment threshold corresponding to the location information.
[0114] That is, when the number of the first set period corresponding to the statistical information of the cached data stream is less than the second set number, the judgment threshold cannot be determined based on the historical records of the statistical information. Therefore, the preset value is used as the judgment threshold corresponding to the location information.
[0115] In this embodiment of the disclosure, when the amount of initially cached statistical information data is insufficient, a preset value is used as the judgment threshold to avoid the problem of inaccurate judgment threshold setting caused by too small a data amount.
[0116] The following describes the solution of this application using the detection of DDoS attacks on domestic servers as a specific application scenario. Currently, DDoS attacks are typically attacks with discrete source addresses, and each connection attempts to simulate a real client. Comparing the source IP addresses of DDoS attack data stream packets and normal data stream packets, the source IPs of attack data stream packets often originate from overseas or cloud servers such as Alibaba Cloud and Amazon. Therefore, this application proposes an attack detection method based on this characteristic. This detection method can be implemented according to the following processing method:
[0117] Source IP address location statistics: Using a first set period as the data stream sampling frequency, real-time data stream information statistics are performed on the packets in the received data stream to obtain the statistical information of the data stream. The statistical information includes a source IP address table, the total number of different source IP addresses, the number of domestic IPs, the number of foreign IPs, and the number of cloud service provider IPs.
[0118] The various numerical statistics in the aforementioned statistical information can be implemented using counters. Initializing the statistical information of the data stream can be achieved by resetting the counter value to 0. See also... Figure 4 As shown, for each packet of the data stream received within the first set period, the source IP address of the packet is extracted; further, it is determined whether the source IP address already exists in the source IP address table. If so, the source IP address table of the next packet is checked; if not, the source IP address is added to the source IP address table, and the total number of different source IP addresses is incremented by one. Further, the location of the source IP address is determined according to a preset IP location information database, determining whether the source IP address belongs to a domestic IP or a foreign IP, and whether it belongs to a cloud service provider IP. If so, the statistical value of the number of source IP addresses in the corresponding location is incremented by one.
[0119] Threshold generation: Using a second set period as the threshold generation frequency, in each second set period, statistical information of the data stream of the first preset period is obtained from the statistical information of the stored data stream. The median of the number of domestic IPs, the number of foreign IPs, and the number of cloud service provider IPs in the target historical record is determined respectively. When the set multiple of the median is greater than the set learning threshold, the set multiple of the median is determined as the corresponding judgment threshold. The judgment thresholds corresponding to the number of domestic IPs, the number of foreign IPs, and the number of cloud service provider IPs are obtained in sequence according to the set multiples of the three medians and the set thresholds.
[0120] For example, if the second set period is 5 minutes, then the historical record of the statistical information of the data stream is obtained once every 5 minutes, and the judgment thresholds corresponding to the number of domestic IPs, the number of foreign IPs, and the number of cloud service provider IPs are output. This set of judgment thresholds is used to perform attack detection on the statistical information of the first set period obtained within the current system time and the time between the current system time and the second set period.
[0121] Attack Detection: Using a first set period as the attack detection frequency, the statistical information of the data stream is checked every first set period, and the number of domestic IPs, the number of foreign IPs, and the number of cloud service provider IPs in the statistical information are compared with the judgment thresholds corresponding to these three values. If the number of at least one of the domestic IPs, foreign IPs, and cloud service provider IPs exceeds the judgment threshold corresponding to that location, it is determined that an attack has occurred, log information is generated, and an alarm is issued to the user.
[0122] In this embodiment of the application, the three functional modules of source IP address location statistics, judgment threshold generation and attack detection are all deployed in the same device. The device can be the domestic server or another independent device that can obtain the data stream information received by the server.
[0123] It is understandable that the three functional modules of source IP address location statistics, judgment threshold generation, and attack detection can also be deployed separately in different devices or equipment. The three functional modules can communicate with each other to realize the transmission of statistical information of data streams, judgment thresholds, and the implementation of attack detection methods.
[0124] In the solution provided in this application embodiment, the number of source IP addresses belonging to domestic IPs, foreign IPs, and cloud service provider IPs in the data stream within a set period is counted, and a judgment threshold is generated based on the historical records of the number of different IPs belonging to different locations in the data stream. In this way, the existence of attack behavior in the data stream at the current moment is detected according to the judgment threshold, realizing the dynamic adjustment of the threshold and the detection of attack behavior, making the attack detection threshold setting more accurate and reasonable, and enhancing the attack detection effect.
[0125] For an example corresponding to the aforementioned attack detection method, see [link to example]. Figure 5 As shown, this application also provides an embodiment of an attack detection device, the device comprising:
[0126] The information acquisition module 501 is used to acquire statistical information of the data stream received within a first set period, wherein the statistical information includes at least the location information of different source IP addresses in the data stream;
[0127] The threshold determination module 502 is used to determine the judgment threshold corresponding to the location information in the statistical information based on the historical records of the statistical information of the data stream;
[0128] The attack detection module 503, in response to the fact that the statistical information of a first set number of consecutive data streams for a first set period meets a preset condition, determines that there is an attack and sends an alarm to the user. The preset condition is that at least one of the location information in the statistical information is greater than the corresponding judgment threshold.
[0129] Optionally, the statistical information of the data stream may also include a source IP address table and the total number of different source IP addresses; the location information may include at least the location of the IP address and the number of source IP addresses belonging to the location, wherein the location may include at least one of the following: within a set area, outside a set area, and a cloud service provider;
[0130] The information acquisition module is specifically used for:
[0131] Obtain the source IP address of the packet in the data stream;
[0132] If the source IP address table does not include the target source IP address, the target source IP address is added to the source IP address table, and the total number of different source IP addresses is incremented by one. The target source IP address includes the source IP address of each packet.
[0133] When adding the target source IP address to the source IP address table, the location of the target source IP address is determined and location information statistics are performed.
[0134] Optionally, determining the location information of the target source IP address and performing location information statistics includes:
[0135] The location of the source IP address is determined based on a pre-set IP address location database.
[0136] If the location of the source IP address is the same as the location in the statistics, the number of source IP addresses corresponding to the location in the statistics is incremented by one.
[0137] Optionally, the threshold determination module includes:
[0138] Obtain historical records of statistical information of data streams corresponding to the first set period for a second set number of periods, wherein the historical records do not include statistical information of data streams that meet the preset conditions;
[0139] Determine the median number of source IP addresses belonging to the target home region in the historical records, where the target home region includes each home region in the statistics;
[0140] Based on the median, determine the threshold for determining the target's place of origin.
[0141] Optionally, determining the threshold for the target location based on the median includes:
[0142] If the set multiple of the median is not less than the set learning threshold, the set multiple of the median is determined as the determination threshold corresponding to the target location.
[0143] If the set multiple of the median is less than the set learning threshold, the set learning threshold is determined as the determination threshold corresponding to the target location.
[0144] Optionally, the device further includes:
[0145] If the historical records of statistical information of the data stream corresponding to the first set period of the second set number cannot be obtained, a preset value is determined as the judgment threshold corresponding to the location information.
[0146] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.
[0147] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.
[0148] This application also provides an electronic device, the structural schematic diagram of which is shown below. Figure 6 As shown, the electronic device 600 includes at least one processor 601, a memory 602, and a bus 603. At least one processor 601 is electrically connected to the memory 602. The memory 602 is configured to store at least one computer-executable instruction, and the processor 601 is configured to execute the at least one computer-executable instruction to perform the steps of any attack detection method provided in any embodiment or optional implementation of this application.
[0149] Furthermore, the processor 601 can be an FPGA (Field-Programmable Gate Array) or other devices with logic processing capabilities, such as an MCU (Microcontroller Unit) or a CPU (Central Processing Unit).
[0150] In the technical solution provided in this application, statistical information of the data flow is obtained by statistically analyzing the trend of the number of source IP addresses of the data flow within a set period. Based on the historical records of the statistical information of the data flow within the preset detection period, new anomaly judgment thresholds are periodically generated. Thus, the presence of attack behavior in the data flow at the current moment is periodically detected according to the thresholds. This realizes the dynamic adjustment of the thresholds to adapt to the current network environment and attack behavior detection, making the threshold settings for attack detection more accurate and reasonable, and enhancing the attack detection effect.
[0151] This application also provides another readable storage medium storing a computer program that, when executed by a processor, implements the steps of any attack detection method provided in any embodiment or optional implementation of this application.
[0152] The readable storage media provided in this application include, but are not limited to, any type of disk (including floppy disk, hard disk, optical disk, CD-ROM, and magneto-optical disk), ROM (Read-Only Memory), RAM (Random Access Memory), EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory, magnetic cards, or optical cards. In other words, the readable storage media includes any medium by which a device (e.g., a computer) stores or transmits information in a readable form.
[0153] In the technical solution provided in this application, statistical information of the data flow is obtained by statistically analyzing the trend of the number of source IP addresses of the data flow within a set period. Based on the historical records of the statistical information of the data flow within the preset detection period, new anomaly judgment thresholds are periodically generated. Thus, the presence of attack behavior in the data flow at the current moment is periodically detected according to the thresholds. This realizes the dynamic adjustment of the thresholds to adapt to the current network environment and attack behavior detection, making the threshold settings for attack detection more accurate and reasonable, and enhancing the attack detection effect.
[0154] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims may be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings are not necessarily shown in a specific order or sequence to achieve the desired result. In some implementations, multitasking and parallel processing may be advantageous.
[0155] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any invention or the scope of the claims, but rather are primarily intended to describe features of specific embodiments of a particular invention. Certain features described in the various embodiments herein may also be implemented in combination in a single embodiment. Conversely, various features described in a single embodiment may also be implemented separately in various embodiments or in any suitable sub-combination. Furthermore, while features may function in certain combinations as described above and even initially claimed in this way, one or more features from a claimed combination may be removed from that combination in some cases, and a claimed combination may refer to a sub-combination or a variation thereof.
[0156] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.
Claims
1. An attack detection method, characterized in that, This method is applied to computers or servers that require DDoS attack detection, and the method includes: Obtain statistical information of the data streams received within a first set period. The statistical information includes at least the location information of different source IP addresses in the data streams. The location information includes at least the location of the IP address and the number of source IP addresses belonging to the location. Based on the historical records of the statistical information of the data stream, a judgment threshold corresponding to the location of each IP address in the location information received within the first set period is determined; the historical records represent the statistical information of the data stream obtained within the period range prior to the first set period, and do not include the statistical information of the data stream that meets the preset conditions. If the statistical information of a data stream with a consecutive set number of data streams in a set period all meet a preset condition, an attack is determined and an alarm is issued to the user. The preset condition is that the number of source IP addresses of at least one IP address in the location information of the statistical information is greater than the judgment threshold corresponding to the location of that IP address. The judgment threshold is determined by using a second set period as the historical record sampling frequency. The historical record of the data stream is obtained once in each second set period, and the judgment threshold is determined based on the historical record obtained this time. The second set period is an integer multiple of the first set period.
2. The method according to claim 1, characterized in that, The statistical information of the data stream also includes a source IP address table and the total number of different source IP addresses; the location includes at least one of the following: within a specified area, outside a specified area, and a cloud service provider; The step of obtaining statistical information on the data streams received within the first set period includes: Obtain the source IP address of the packet in the data stream; If the source IP address table does not include the target source IP address, the target source IP address is added to the source IP address table, and the total number of different source IP addresses is incremented by one. The target source IP address includes the source IP address of each packet. When adding the target source IP address to the source IP address table, the location of the target source IP address is determined and location information statistics are performed.
3. The method according to claim 2, characterized in that, The process of determining the location information of the target source IP address and performing location information statistics includes: The location of the source IP address is determined based on a pre-set IP address location database. If the location of the source IP address is the same as the location in the statistics, the number of source IP addresses corresponding to the location in the statistics is incremented by one.
4. The method according to claim 2, characterized in that, The step of determining the judgment threshold corresponding to the location information in the statistical information based on the historical records of the statistical information of the data stream includes: Obtain historical records of statistical information of data streams corresponding to the first set period for a second set number of periods, wherein the historical records do not include statistical information of data streams that meet the preset conditions; Determine the median number of source IP addresses belonging to the target home region in the historical records, where the target home region includes each home region in the statistics; Based on the median, determine the threshold for determining the target's place of origin.
5. The method according to claim 4, characterized in that, The step of determining the threshold corresponding to the target location based on the median includes: If the set multiple of the median is not less than the set learning threshold, the set multiple of the median is determined as the determination threshold corresponding to the target location. If the set multiple of the median is less than the set learning threshold, the set learning threshold is determined as the determination threshold corresponding to the target location.
6. The method according to claim 4, characterized in that, The method further includes: If the historical records of statistical information of the data stream corresponding to the first set period of the second set number cannot be obtained, a preset value is determined as the judgment threshold corresponding to the location information.
7. An attack detection device, characterized in that, This device is used on computers or servers that require DDoS attack detection, and the device includes: The information acquisition module is used to acquire statistical information of the data streams received within a first set period. The statistical information includes at least the location information of different source IP addresses in the data stream. The location information includes at least the location of the IP address and the number of source IP addresses belonging to the location. The threshold determination module is used to determine the judgment threshold corresponding to the location of each IP address in the location information of the statistical information received within the first set period based on the historical records of the statistical information of the data stream; the historical records represent the statistical information of the data stream obtained within the period range before the first set period, and do not include the statistical information of the data stream that meets the preset conditions. The attack detection module determines that an attack has occurred and issues an alarm to the user if the statistical information of a data stream with a first set number of consecutive data streams in a first set period all meet a preset condition. The preset condition is that the number of source IP addresses of at least one IP address in the location information of the statistical information is greater than the judgment threshold corresponding to the location of that IP address. The judgment threshold is determined by using a second set period as the historical record sampling frequency. The historical record of the data stream is obtained once in each second set period, and the judgment threshold is determined based on the historical record obtained this time. The second set period is an integer multiple of the first set period.
8. The apparatus according to claim 7, characterized in that, The statistical information of the data stream also includes a source IP address table and the total number of different source IP addresses; the location includes at least one of domestic IP addresses, foreign IP addresses, and cloud service provider IP addresses; The information acquisition module is specifically used for: Obtain the source IP address of the packet in the data stream; If the source IP address table does not include the target source IP address, the target source IP address is added to the source IP address table, and the total number of different source IP addresses is incremented by one. The target source IP address includes the source IP address of each packet. When adding the target source IP address to the source IP address table, the location of the target source IP address is determined and location information statistics are performed.
9. An electronic device, characterized in that, include: Processor, memory; The memory is used to store computer programs; The processor is configured to execute the attack detection method as described in any one of claims 1-6 by invoking the computer program.
10. A readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the attack detection method as described in any one of claims 1-6.