Server attack judgment method and device, storage medium and electronic device

Abstract

Embodiments of the present application provide a kind of server attack determination method, device, storage medium and electronic device, wherein the method comprises: when obtaining first data packet set, determine the first quantity of data packet in first data packet set, wherein first data packet set includes the data packet that front end acquisition equipment transmits to back-end server in first period;When the difference between first quantity and second quantity is greater than or equal to first predetermined threshold, determine the third quantity of data packet in first data packet subset in first data packet set, second quantity indicates the data packet quantity that front end acquisition equipment transmits to back-end server in second period, and the length of data packet in first data packet subset is within the preset length range;According to third quantity and second predetermined threshold, judge whether back-end server is attacked.Through the embodiments of the present application, the technical problem that the accuracy of determining whether the server is attacked in the related art is low is solved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network security technology, and more specifically, to a method, apparatus, storage medium, and electronic device for determining server attacks. Background Technology

[0002] In recent years, with the rapid development of artificial intelligence, the Internet of Things (IoT), and embedded systems, the Artificial Intelligence & Internet of Things (AIoT) has emerged. Its applications in numerous fields such as homes, agriculture, and commerce are becoming increasingly widespread. The network, as the foundation of AIoT, enables information exchange and communication between different devices. The high penetration rate of smart IoT has made its security a significant concern. Currently, numerous attacks on IoT devices have occurred. Taking Distributed Denial of Service (DDoS) attacks as an example, the number of DDoS incidents is rapidly increasing. Attackers use insecure IoT devices to construct botnets, subsequently sending a large number of illegal requests to the target host (or server), consuming the target host's system resources, occupying a large amount of bandwidth, and affecting the normal operation of the host's services. Some related technologies use a single method of detecting changes in data packets to determine the presence of a DDoS attack. However, this method can misjudge small-scale DDoS attacks as normal, resulting in low detection accuracy and low precision. Furthermore, methods that use information entropy calculations to detect DDoS attacks are time-consuming and inefficient. In short, the methods used in these technologies to determine whether a server is under attack suffer from low accuracy.

[0003] There is currently no effective solution to the technical problem of low accuracy in determining whether a server is under attack in related technologies. Summary of the Invention

[0004] This invention provides a method, apparatus, storage medium, and electronic device for determining server attacks, in order to at least solve the technical problem of low accuracy in determining whether a server has been attacked in related technologies.

[0005] According to an embodiment of the present invention, a method for determining server attack is provided, comprising: upon obtaining a first data packet set, determining a first number of data packets in the first data packet set, wherein the first data packet set includes data packets transmitted by a front-end acquisition device to a back-end server within a first period; if the difference between the first number and a second number is greater than or equal to a first predetermined threshold, determining a third number of data packets in a first subset of data packets in the first data packet set, wherein the second number represents the number of data packets transmitted by the front-end acquisition device to the back-end server within a second period, the second period being the period preceding the first period, and the length of the data packets in the first subset of data packets being within a preset length range; and determining whether the back-end server is under attack based on the third number and a second predetermined threshold.

[0006] In an exemplary embodiment, determining whether the backend server is under attack based on the third quantity and the second predetermined threshold includes: determining that the backend server is under attack if the third quantity is greater than or equal to the second predetermined threshold; or determining that the backend server is not under attack if the third quantity is less than the second predetermined threshold.

[0007] In an exemplary embodiment, determining whether the backend server is under attack based on the third quantity and the second predetermined threshold includes: when the third quantity is greater than or equal to the second predetermined threshold, detecting the first data packet subset using a target neural network model to obtain a set of detection results, wherein the target neural network model is used to determine the corresponding detection results based on the characteristics of each data packet in the first data packet subset, and the set of detection results is used to indicate whether each data packet in the first data packet subset is abnormal; and determining whether the backend server is under attack based on the set of detection results.

[0008] In an exemplary embodiment, the step of detecting the first data packet subset using a target neural network model to obtain a set of detection results includes: extracting features from each data packet in the first data packet subset to obtain a set of features; and processing the set of features of each data packet in the first data packet subset using the target neural network model to obtain the set of detection results. The target neural network model is obtained by: training an original neural network model using a set of sample data packets until the loss value between the predicted sample result output by the original neural network model and the predetermined actual sample result satisfies a preset convergence condition, ending the training, and determining the original neural network model at the end of training as the target neural network model. The actual sample result corresponding to each sample data packet in the sample data packet set is used to indicate whether the sample data packet is abnormal or not, and the predicted sample result corresponding to each sample data packet in the sample data packet set is used to indicate whether the sample data packet is abnormal or not.

[0009] In one exemplary embodiment, the set of features includes at least one of the following: protocol type, which represents the communication protocol used by the front-end acquisition device when sending data packets to the back-end server; target length, which represents the length of the data packet; connection status, which represents the connection status between the front-end acquisition device sending the data packet and the back-end server; first IP count, which represents the number of IPs of the front-end acquisition devices that have established a connection with the back-end server; second IP count, which represents the number of IPs of the front-end acquisition devices communicating with the same port of the back-end server; duration, which represents the duration of the continuous connection between the front-end acquisition device sending the data packet and the back-end server; length change rate, which represents the rate of change of the length of the current data packet sent by the front-end acquisition device relative to the length of the previous data packet; and time interval, which represents the difference between the first sending time of the current data packet sent by the front-end acquisition device and the second sending time of the previous data packet sent by the front-end acquisition device.

[0010] In an exemplary embodiment, determining whether the backend server is under attack based on the set of detection results includes: determining that the backend server is under attack when the set of detection results indicates that there are abnormal data packets in the first data packet subset; or determining that the backend server is under attack when the set of detection results indicates that there are abnormal data packets in the first data packet subset and the number of abnormal data packets is greater than or equal to a first preset threshold; or determining that the backend server is under attack when the set of detection results indicates that there are abnormal data packets in the first data packet subset and the proportion of abnormal data packets in the first data packet subset is greater than or equal to a second preset threshold.

[0011] In one exemplary embodiment, the method further includes: discarding the abnormal data packet if the set of detection results indicates that there is an abnormal data packet in the first data packet subset.

[0012] According to another embodiment of the present invention, a server attack detection device is also provided, comprising: a first determining module, configured to determine a first number of data packets in the first data packet set when a first data packet set is obtained, wherein the first data packet set includes data packets transmitted by a front-end acquisition device to a back-end server within a first period; a second determining module, configured to determine a third number of data packets in a first data packet subset of the first data packet set when the difference between the first number and the second number is greater than or equal to a first predetermined threshold, wherein the second number represents the number of data packets transmitted by the front-end acquisition device to the back-end server within a second period, the second period being the period preceding the first period, and the length of the data packets in the first data packet subset being within a preset length range; and a judging module, configured to judge whether the back-end server is under attack based on the third number and the second predetermined threshold.

[0013] According to yet another embodiment of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed.

[0014] According to yet another embodiment of the present invention, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0015] This invention determines a first number of data packets in a first data packet set acquired in a first period. This first number is compared with a second number of data packets acquired in the previous period. When the difference between the first and second numbers is greater than or equal to a first predetermined threshold, a third number of data packets in a first subset of data packets in the first data packet set is determined. The length of the data packets in this first subset is within a preset length range. The third number is then compared with the second predetermined threshold to determine if the backend server is under attack. Specifically, by comparing the difference in the number of data packets in two adjacent periods to see if it is greater than or equal to the first predetermined threshold, and when the difference is determined to be greater than or equal to the first predetermined threshold, a third number of data packets in the first data packet set whose length is within a preset length range is further determined and compared with the second predetermined threshold to determine if the backend server is under attack. This dual-threshold method avoids the low accuracy problem of related technologies that rely solely on detecting changes in data packets to determine the presence of an attack. Therefore, this solves the technical problem of low accuracy in determining whether a server is under attack in related technologies, and achieves the effect of improving the accuracy of determining whether a server is under attack. Attached Figure Description

[0016] Figure 1 This is a mobile terminal hardware structure block diagram of the server attack judgment method according to an embodiment of the present invention.

[0017] Figure 2 This is a flowchart of a method for determining server attacks according to an embodiment of the present invention;

[0018] Figure 3 This is a flowchart of a DDoS attack detection method according to an embodiment of the present invention;

[0019] Figure 4 This is a schematic diagram of a DDoS attack detection device according to an embodiment of the present invention;

[0020] Figure 5 This is a structural block diagram of a server attack detection device according to an embodiment of the present invention. Detailed Implementation

[0021] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings and examples.

[0022] It should be noted that the terms "first," "second," etc., in the specification, claims, and drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0023] The methods and embodiments provided in this application can be executed on a mobile terminal, computer terminal, or similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a mobile terminal hardware structure block diagram of the server attack detection method according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0024] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the server attack judgment method in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer programs stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0025] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0026] This embodiment provides a method for determining server attacks. Figure 2 This is a flowchart of a server attack detection method according to an embodiment of the present invention, such as... Figure 2As shown, the process includes the following steps:

[0027] Step S202: If the first data packet set is obtained, determine the first number of data packets in the first data packet set, wherein the first data packet set includes data packets transmitted by the front-end acquisition device to the back-end server within the first period;

[0028] Step S204: If the difference between the first quantity and the second quantity is greater than or equal to a first predetermined threshold, determine the third quantity of data packets in the first data packet subset of the first data packet set, wherein the second quantity represents the number of data packets transmitted by the front-end acquisition device to the back-end server in the second period, the second period is the period preceding the first period, and the length of the data packets in the first data packet subset is within a preset length range.

[0029] Step S206: Determine whether the backend server has been attacked based on the third quantity and the second predetermined threshold.

[0030] Through the above steps, by determining the first number of data packets in the first data packet set acquired in the first period, and comparing the first number with the second number of data packets acquired in the previous period, when the difference between the first number and the second number is greater than or equal to a first predetermined threshold, a third number of data packets in the first data packet subset of the first data packet set is determined. The length of the data packets in the first data packet subset is within a preset length range. Then, the third number is compared with the second predetermined threshold to determine whether the backend server is under attack. In other words, by comparing whether the difference in the number of data packets in two adjacent periods is greater than or equal to the first predetermined threshold, when the difference is determined to be greater than or equal to the first predetermined threshold, a third number of data packets in the first data packet set whose length is within the preset length range is further determined and compared with the second predetermined threshold to determine whether the backend server is under attack. This dual-threshold judgment method determines whether the server is under attack, avoiding the low accuracy problem of related technologies that rely solely on detecting changes in data packets to determine the existence of an attack. Therefore, this solves the technical problem of low accuracy in determining whether a server is under attack in related technologies, and achieves the effect of improving the accuracy of determining whether a server is under attack.

[0031] The entity executing the above steps may be a server, processor, device, controller, or a processor with human-computer interaction capabilities configured on a storage device, or a processing device or processing unit with similar processing capabilities, but is not limited to these.

[0032] In the above embodiments, when a first data packet set is obtained, a first quantity of data packets in the first data packet set is determined. The first data packet set includes data packets transmitted by the front-end acquisition device to the back-end server within a first period. The following explanation uses the example of whether a DDoS attack has occurred. For example, the first period is the current period, and the number of data packets transmitted by the front-end acquisition device to the back-end server within the current period is 10,000 (or 1,000, or other quantities). If the difference between the first quantity and the second quantity is greater than or equal to a first predetermined threshold, a third quantity of data packets in the first data packet subset of the first data packet set is determined. The second quantity represents the number of data packets transmitted by the front-end acquisition device to the back-end server within a second period. The second period is the previous period of the first period, and the length of the data packets in the first data packet subset is within a preset length range. For example, the second period is the previous period of the current period. If the second quantity is 8,000 (or other quantities), that is, the number of data packets transmitted by the front-end acquisition device to the back-end server within the second period of the first period is 10,000 (or 1,000, or other quantities). If 8000 data packets are transmitted to the backend server in the second cycle, the difference between the first and second numbers is 2000. This difference is compared with a first predetermined threshold, assuming the first predetermined threshold is 500 (or 1000, or other numbers). When the difference between the first and second numbers is greater than the first predetermined threshold, the number of data packets in the first subset of the first data packet set is determined (i.e., the aforementioned third number). In practical applications, when the difference between the first and second numbers is less than the first predetermined threshold, it can be determined that the backend server is not currently under DDoS attack. The aforementioned first subset of data packets includes data packets within a predetermined length range in the first data packet set. For example, the first subset of data packets can be composed of data packets with a length of 60 bits (or 10 bits, or 100 bits, or other lengths) in the first data packet set. The number of data packets in the first subset of data packets is determined. Then, based on the third number and the second predetermined threshold, it is determined whether the backend server is under attack. Assuming the second predetermined threshold is 3000 (or other quantity), the third quantity is compared with the second predetermined threshold to determine whether the backend server is under attack. For example, if the third quantity is 3200, that is, the number of 60-bit data packets in the first data packet set is 3200. Since the third quantity is greater than the second predetermined threshold, it can be determined that the backend server is under attack. If the third quantity is less than the second predetermined threshold, for example, if the third quantity is 300, it can be determined that the backend server is not under attack.In this embodiment, by comparing whether the difference in the number of data packets in two adjacent periods is greater than or equal to a first predetermined threshold, when it is determined that the difference is greater than or equal to the first predetermined threshold, a third number of data packets in the first data packet set whose length is within a preset length range is further determined, and this third number is compared with a second predetermined threshold to determine whether the backend server has been attacked. This dual-threshold judgment method avoids the problem of low accuracy in related technologies that rely solely on detecting changes in data packets to determine the presence of an attack. Therefore, it solves the technical problem of low accuracy in determining whether a server has been attacked in related technologies, achieving the effect of improving the accuracy of determining whether a server has been attacked.

[0033] It should be noted that the first and second predetermined thresholds mentioned above can be set according to the needs of actual applications. Moreover, in practical applications, the first predetermined threshold can be set relatively small, which can improve sensitivity and thus avoid missing small-scale DDoS attacks. This avoids the problem that methods in related technologies may misjudge small-scale DDoS attacks as normal, thereby achieving the effect of reducing the false negative rate of DDoS attacks.

[0034] In an optional embodiment, determining whether the backend server is under attack based on the third quantity and the second predetermined threshold includes: determining that the backend server is under attack when the third quantity is greater than or equal to the second predetermined threshold; or determining that the backend server is not under attack when the third quantity is less than the second predetermined threshold. In this embodiment, when the third quantity is greater than or equal to the second predetermined threshold, it can be determined that the backend server is under attack, and when the third quantity is less than the second predetermined threshold, it can be determined that the backend server is not under attack. This embodiment improves the accuracy of the determination through secondary detection. Compared with the existing method of determining whether an attack exists solely by detecting changes in data packets, which has the problem of low accuracy, this embodiment uses a dual-threshold determination method to determine whether the server is under attack, thus improving the accuracy of the determination.

[0035] In an optional embodiment, determining whether the backend server is under attack based on the third quantity and the second predetermined threshold includes: when the third quantity is greater than or equal to the second predetermined threshold, detecting the first data packet subset using a target neural network model to obtain a set of detection results, wherein the target neural network model is used to determine the corresponding detection results based on the characteristics of each data packet in the first data packet subset, and the set of detection results is used to indicate whether each data packet in the first data packet subset is abnormal; and determining whether the backend server is under attack based on the set of detection results. In this embodiment, when it is determined that the third quantity is greater than or equal to the second predetermined threshold, the first data packet subset can further be detected using a target neural network model to obtain a set of detection results, which are used to indicate whether each data packet in the first data packet subset is abnormal, and then determining whether the backend server is under attack based on the set of detection results. That is, a third detection is performed using the target neural network model to determine whether each data packet in the first data packet subset is abnormal. The target neural network model can be obtained by training the original neural network model using historical data packets. For example, historical data packets can be divided into normal data packets and abnormal data packets according to their characteristics, and then the classified data packets can be trained using a BP neural network to obtain the target neural network model. This embodiment achieves the goal of detecting each data packet included in the first data packet subset using a target neural network model to obtain a set of detection results.

[0036] In an optional embodiment, the step of detecting the first data packet subset using a target neural network model to obtain a set of detection results includes: extracting features from each data packet in the first data packet subset to obtain a set of features; and processing the set of features from each data packet in the first data packet subset using the target neural network model to obtain the set of detection results. The target neural network model is obtained by: training an original neural network model using a set of sample data packets until the loss value between the predicted sample result output by the original neural network model and the predetermined actual sample result satisfies a preset convergence condition, ending the training, and determining the original neural network model at the end of training as the target neural network model. The actual sample result corresponding to each sample data packet in the sample data packet set is used to indicate whether the sample data packet is abnormal or not, and the predicted sample result corresponding to each sample data packet in the sample data packet set is used to indicate whether the sample data packet is abnormal or not. In this embodiment, features can be extracted from each data packet in the first data packet subset to obtain a set of features, and then the target neural network model can be used to process the set of features to obtain a set of detection results. The target neural network model is obtained by training the original neural network model using a set of sample data packets until the loss value between the predicted sample results output by the original neural network model and the predetermined actual sample results meets a preset convergence condition. The original neural network model at the end of training is then identified as the target neural network model. The aforementioned set of sample data packets can be obtained by classifying historical data packets. Through this embodiment, the purpose of training the original neural network model using a set of sample data packets to obtain the target neural network model is achieved, and the purpose of using the target neural network model to detect each data packet in the first subset of data packets is realized.

[0037] In an optional embodiment, the set of features includes at least one of the following: protocol type, which indicates the communication protocol used by the front-end acquisition device when sending data packets to the back-end server; target length, which indicates the length of the data packet; connection status, which indicates the connection status between the front-end acquisition device sending the data packet and the back-end server; first IP count, which indicates the number of IPs of the front-end acquisition devices that have established a connection with the back-end server; second IP count, which indicates the number of IPs of the front-end acquisition devices communicating with the same port of the back-end server; duration, which indicates the duration of the continuous connection between the front-end acquisition device sending the data packet and the back-end server; length change rate, which indicates the rate of change of the length of the current data packet sent by the front-end acquisition device relative to the length of the previous data packet; and time interval, which indicates the difference between the first sending time of the current data packet sent by the front-end acquisition device and the second sending time of the previous data packet sent by the front-end acquisition device. In this embodiment, a set of characteristics for each data packet may include the protocol type, duration, and connection status of the connection between the front-end acquisition device (or other device) and the server (or back-end server). It may also include the number of device IPs establishing a connection between the front-end acquisition device and the server (such as the first number of IPs mentioned above) and the number of device IPs communicating with the server on the same port (such as the second number of IPs mentioned above). This set of characteristics may further include the target length of the data packet sent by the front-end acquisition device to the server, the rate of change in length compared to adjacent data packets, and the time interval between data packet transmissions. This set of characteristics may include some or all of the aforementioned characteristics. Optionally, the set of characteristics may also include the aforementioned third quantity, namely the number of data packets in the first subset of data packets. Through this embodiment, by performing feature analysis on the data packets, it is possible to determine whether the data is intended for normal interaction between the front-end acquisition device and the server.

[0038] In an optional embodiment, determining whether the backend server is under attack based on the set of detection results includes: determining that the backend server is under attack when the set of detection results indicates that there are abnormal data packets in the first data packet subset; or determining that the backend server is under attack when the set of detection results indicates that there are abnormal data packets in the first data packet subset and the number of abnormal data packets is greater than or equal to a first preset threshold; or determining that the backend server is under attack when the set of detection results indicates that there are abnormal data packets in the first data packet subset and the proportion of abnormal data packets in the first data packet subset is greater than or equal to a second preset threshold. In this embodiment, when the above set of detection results indicates that there are abnormal data packets (or abnormal data packets) in the first data packet subset, it can be determined that the backend server has been attacked, such as by a DDoS attack. Optionally, when the above set of detection results indicates that there are abnormal data packets in the first data packet subset, and the number of abnormal data packets is greater than or equal to a first preset threshold (e.g., 100, 200, or other values), it can be determined that the backend server has been attacked. That is, the backend server is only determined to be attacked when the number of abnormal data packets in the first data packet subset reaches the first preset threshold. Optionally, when the above set of detection results indicates that there are abnormal data packets in the first data packet subset, and the proportion of abnormal data packets in the first data packet subset is greater than or equal to a second preset threshold (e.g., 10%, 5%, or other values), it can be determined that the backend server has been attacked. Through this embodiment, different judgment criteria can be used to determine whether the backend server has been attacked.

[0039] In an optional embodiment, the method further includes: discarding the abnormal data packets when the set of detection results indicates that there are abnormal data packets in the first data packet subset. In this embodiment, when the set of detection results indicates that there are abnormal data packets in the first data packet subset, the abnormal data packets can be discarded. Optionally, normal data packets in the first data packet subset can be forwarded to the server to ensure the normal operation of the system.

[0040] Obviously, the embodiments described above are only some embodiments of the present invention, and not all embodiments. The present invention will be specifically described below with reference to the embodiments.

[0041] This invention provides a fast DDoS attack detection method based on dual thresholds, comprising the following steps:

[0042] 1. Collect data packets within the current period (corresponding to the aforementioned first period) and count the number (corresponding to the aforementioned first number);

[0043] 2. Calculate the difference between the total number of data packets in the previous cycle (corresponding to the aforementioned second cycle) and the total number of data packets in the previous cycle (corresponding to the aforementioned second quantity);

[0044] 3. Compare the difference with a preset first threshold (corresponding to the aforementioned first predetermined threshold). If the difference is greater than the first threshold, further detect the data packet.

[0045] 4. Calculate the number of data packets with similar lengths (corresponding to the data packets in the aforementioned first subset of data packets) among the data packets that need further detection (corresponding to the aforementioned third number);

[0046] 5. Compare the number of data packets of similar length with the size of a pre-set second threshold (corresponding to the aforementioned second predetermined threshold). If the number of packets exceeds the second threshold, further detection is performed on the data packets.

[0047] 6. Based on their characteristics, the system's historical data packets are divided into two categories: normal data packets and abnormal data packets.

[0048] 7. Train the classified data packets using a BP neural network to obtain a pre-trained model (corresponding to the aforementioned target neural network model);

[0049] 8. For data packets that require a third inspection, use a pre-trained model to inspect them. If the data packet is found to be abnormal, discard it; otherwise, allow it to pass through to the server.

[0050] Figure 3 This is a flowchart of a DDoS attack detection method according to an embodiment of the present invention, such as... Figure 3 As shown, the process includes:

[0051] S302, Collect the total number of data packets received within a certain period;

[0052] S304, calculate the difference in the total number of data packets between the current period and the previous period;

[0053] S306, determine whether the difference in the total number of data packets in two adjacent periods is less than a preset threshold (i.e., the first threshold);

[0054] S308, If the judgment result of step S306 is yes, then it is determined that there is no DDoS attack at present, that is, there is no DDoS attack at present. At this time, the data packet can be allowed to pass and proceed to step S310.

[0055] S310, the data packet is transmitted to the server;

[0056] If the judgment result of step S306 is negative, the data packet is further analyzed and the process proceeds to step S312. The cycle length mentioned above is adjusted according to the actual situation of the system. The first threshold mentioned above is set relatively small to ensure higher detection sensitivity in this step and reduce the false negative rate of data packets for small-volume DDoS attacks.

[0057] S312, Further, calculate the number of data packets with similar lengths among the data packets that need to be detected a second time;

[0058] S314, determine whether the number of data packets in step S312 is less than the set second threshold;

[0059] If the number is less than the preset second threshold, it is determined that there is no DDoS attack at present; otherwise, the data packets are further analyzed and the process proceeds to step S316.

[0060] The second threshold mentioned above is adjusted according to the actual situation of the system. This step mainly determines whether a DDoS attack exists by the number of data packets of similar length.

[0061] S316 goes a step further by performing feature analysis on data packets that require a third inspection, and determining whether they are normal interactive data between the device and the server based on the features.

[0062] The feature analysis method mentioned above is implemented using a backpropagation (BP) neural network. It collects historical data packets from the system and extracts the features of the data packets, including:

[0063] 1) The protocol type, duration, and connection status of the connection between the device and the server;

[0064] 2) The number of device IPs that have established a connection with the server, and the number of device IPs that communicate with the server on the same port;

[0065] 3) The length of the data packets sent by the device to the server, the rate of change of the length of adjacent data packets, and the time interval between sending data packets;

[0066] Appropriate feature values ​​are set for the above features according to the actual situation. Historical data packets are statistically classified into two categories: normal data packets and abnormal data packets. The above data packets are used as input to the neural network for training.

[0067] S318, Using the trained BP neural network model as a classifier, judge the data packets that need further detection to determine whether they are abnormal data;

[0068] After being judged by the classifier, normal data packets are forwarded to the server via S320.

[0069] S322, after the classifier judges, if the characteristics are abnormal, it is judged as an attack data packet or an abnormal data packet;

[0070] S324, Abnormal data is discarded to ensure the normal operation of the system.

[0071] In summary, by calculating the difference between the total number of data packets in the current period and the previous period, it is determined whether the difference between the total number of data packets in two adjacent periods is less than a pre-set first threshold. The first threshold is set relatively small, which has high sensitivity and reduces the false negative rate of small-volume DDoS attacks. Secondly, the number of data packets with similar lengths in the data packets that need to be detected a second time is calculated to further detect whether a DDoS attack exists. Finally, the system's historical data packets are used in conjunction with a BP neural network to obtain a pre-trained model for a third detection of the data packets. The two threshold detections and the use of the neural network improve the efficiency and accuracy of attack detection.

[0072] This invention also provides a fast DDoS attack detection device based on dual thresholds. Figure 4 This is a schematic diagram of a DDoS attack detection device according to an embodiment of the present invention. The detection device 400 mainly includes: a first threshold detection module 402, a second threshold detection module 404, and a feature detection module 406.

[0073] The following is a description of each of the above detection modules:

[0074] First threshold detection module 402: Collects the total number of data packets received within a certain period, calculates the difference between the total number of data packets in the current period and the previous period, and determines whether the difference between the total number of data packets in two adjacent periods is less than a preset threshold. If so, it is determined that there is no DDoS attack at present; otherwise, it forwards the data packets to the second threshold detection module for further analysis.

[0075] Second threshold detection module 404: Calculates the number of data packets with similar lengths in the data packets that need to be detected a second time. If the number is less than the preset threshold, it is determined that there is no DDoS attack at present. Otherwise, the data packets are forwarded to the feature detection module for further analysis.

[0076] Feature detection module 406: Implemented using a BP neural network, it collects historical data packets from the system, extracts features from the data packets, and statistically classifies the historical data packets into two categories: normal data packets and abnormal data packets. These are used as inputs to the neural network for training to obtain a pre-trained model. This model is then used to judge data packets that need further detection to determine whether they are abnormal data. If they are abnormal data, they are discarded, and normal data packets are forwarded to the server to ensure the normal operation of the system.

[0077] Through the above embodiments, when performing the first DDoS attack detection on data packets in the system, the difference between the total number of data packets in the current period and the previous period is calculated to determine whether the difference between the total number of data packets in two adjacent periods is less than a preset first threshold. The first threshold is set relatively small and has high sensitivity, thus achieving the effect of reducing the false negative rate of small-volume DDoS attacks. After the first detection, the data packets to be further confirmed are subjected to length detection, the number of similar data packets is calculated, and compared with a preset second threshold to further detect whether a DDoS attack exists. After the second detection, the data packets that still need further confirmation are subjected to feature detection. By statistically classifying the system's historical data packets according to multiple features, a pre-trained model is obtained using a BP neural network. The data packets are then detected for the third time using this model, thus improving the accuracy of DDoS attack detection.

[0078] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0079] This embodiment also provides a device for determining server attacks. Figure 5 This is a structural block diagram of a server attack detection device according to an embodiment of the present invention, such as... Figure 5 As shown, the device includes:

[0080] The first determining module 502 is used to determine the first number of data packets in the first data packet set when the first data packet set is obtained, wherein the first data packet set includes data packets transmitted by the front-end acquisition device to the back-end server in the first period;

[0081] The second determining module 504 is used to determine a third number of data packets in the first data packet subset of the first data packet set when the difference between the first number and the second number is greater than or equal to a first predetermined threshold. The second number represents the number of data packets transmitted by the front-end acquisition device to the back-end server in a second period. The second period is the period preceding the first period. The length of the data packets in the first data packet subset is within a preset length range.

[0082] The judgment module 506 is used to determine whether the backend server is under attack based on the third quantity and the second predetermined threshold.

[0083] In an optional embodiment, the determination module 506 includes: a first determination unit, configured to determine that the backend server is under attack when the third quantity is greater than or equal to the second predetermined threshold; or, a second determination unit, configured to determine that the backend server is not under attack when the third quantity is less than the second predetermined threshold.

[0084] In an optional embodiment, the judgment module 506 includes: a detection unit, configured to, when the third quantity is greater than or equal to the second predetermined threshold, detect the first data packet subset using a target neural network model to obtain a set of detection results, wherein the target neural network model is configured to determine the corresponding detection results based on the characteristics of each data packet in the first data packet subset, and the set of detection results is used to indicate whether each data packet in the first data packet subset is abnormal; and a third judgment unit, configured to, based on the set of detection results, determine whether the backend server is under attack.

[0085] In an optional embodiment, the detection unit includes: a first obtaining subunit, configured to extract features from each data packet in the first data packet subset to obtain a set of features; and a second obtaining subunit, configured to process the set of features of each data packet in the first data packet subset using the target neural network model to obtain the set of detection results; wherein the target neural network model is obtained by: training the original neural network model using a set of sample data packets until the loss value between the predicted sample result output by the original neural network model and the predetermined actual sample result satisfies a preset convergence condition, ending the training, and determining the original neural network model at the end of the training as the target neural network model, wherein the actual sample result corresponding to each sample data packet in the set of sample data packets is used to indicate whether the sample data packet is abnormal or not, and the predicted sample result corresponding to each sample data packet in the set of sample data packets is used to indicate whether the sample data packet is abnormal or not.

[0086] In an optional embodiment, the above set of features includes at least one of the following: protocol type, which indicates the communication protocol used by the front-end acquisition device when sending data packets to the back-end server; target length, which indicates the length of the data packet; connection status, which indicates the connection status between the front-end acquisition device sending the data packet and the back-end server; first IP count, which indicates the number of IPs of the front-end acquisition devices that have established a connection with the back-end server; second IP count, which indicates the number of IPs of the front-end acquisition devices communicating with the same port of the back-end server; duration, which indicates the duration of the continuous connection between the front-end acquisition device sending the data packet and the back-end server; length change rate, which indicates the rate of change of the length of the current data packet sent by the front-end acquisition device relative to the length of the previous data packet; and time interval, which indicates the difference between the first sending time of the current data packet sent by the front-end acquisition device and the second sending time of the previous data packet sent by the front-end acquisition device.

[0087] In an optional embodiment, the third determination unit includes: a first determining subunit, configured to determine that the backend server is under attack when a set of detection results indicates that there are abnormal data packets in the first data packet subset; or, a second determining subunit, configured to determine that the backend server is under attack when a set of detection results indicates that there are abnormal data packets in the first data packet subset and the number of abnormal data packets is greater than or equal to a first preset threshold; or, a third determining subunit, configured to determine that the backend server is under attack when a set of detection results indicates that there are abnormal data packets in the first data packet subset and the proportion of abnormal data packets in the first data packet subset is greater than or equal to a second preset threshold.

[0088] In an optional embodiment, the above apparatus further includes: a discarding module, configured to discard the abnormal data packet when the set of detection results indicates that there is an abnormal data packet in the first data packet subset.

[0089] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0090] Embodiments of the present invention also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed.

[0091] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0092] Embodiments of the present invention also provide an electronic device including a memory and a processor, the memory storing a computer program and the processor being configured to run the computer program to perform the steps in any of the above method embodiments.

[0093] In one exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0094] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0095] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0096] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for determining server attacks, characterized in that, include: In the case of obtaining the first data packet set, a first number of data packets in the first data packet set is determined, wherein the first data packet set includes data packets transmitted by the front-end acquisition device to the back-end server in the first period; If the difference between the first quantity and the second quantity is greater than or equal to a first predetermined threshold, a third quantity of data packets in the first data packet subset of the first data packet set is determined, wherein the second quantity represents the number of data packets transmitted by the front-end acquisition device to the back-end server in the second period, the second period is the period preceding the first period, and the length of the data packets in the first data packet subset is within a preset length range. Based on the third quantity and the second predetermined threshold, it is determined whether the backend server is under attack; The step of determining whether the backend server is under attack based on the third quantity and the second predetermined threshold includes: when the third quantity is greater than or equal to the second predetermined threshold, detecting the first data packet subset using a target neural network model to obtain a set of detection results, wherein the target neural network model is used to determine the corresponding detection results based on the characteristics of each data packet in the first data packet subset, and the set of detection results is used to indicate whether each data packet in the first data packet subset is abnormal; and determining whether the backend server is under attack based on the set of detection results.

2. The method according to claim 1, characterized in that, The step of determining whether the backend server is under attack based on the third quantity and the second predetermined threshold includes: If the third quantity is greater than or equal to the second predetermined threshold, it is determined that the backend server is under attack; or If the third quantity is less than the second predetermined threshold, it is determined that the backend server has not been attacked.

3. The method according to claim 1, characterized in that, The detection of the first data packet subset using the target neural network model yields a set of detection results, including: Feature extraction is performed on each data packet in the first data packet subset to obtain a set of features; The target neural network model processes the set of features of each data packet in the first data packet subset to obtain the set of detection results; The target neural network model is obtained in the following way: The original neural network model is trained using a set of sample data packets until the loss value between the predicted sample result output by the original neural network model and the predetermined actual sample result meets a preset convergence condition. The training ends, and the original neural network model at the end of training is determined as the target neural network model. The actual sample result corresponding to each sample data packet in the sample data packet set is used to indicate whether the sample data packet is abnormal or not. The predicted sample result corresponding to each sample data packet in the sample data packet set is used to indicate whether the sample data packet is abnormal or not.

4. The method according to claim 3, characterized in that, The set of features includes at least one of the following: Protocol type, which indicates the communication protocol used when the front-end acquisition device sends data packets to the back-end server; Target length, whereby the target length represents the length of the data packet; Connection status, which indicates the connection status between the front-end acquisition device that sends the data packet and the back-end server; The first IP count represents the number of front-end acquisition devices that have established connections with the back-end server. The second IP count refers to the number of IPs of the front-end acquisition devices that communicate with the same port of the back-end server. Duration, which represents the duration of the continuous connection between the front-end acquisition device that sends the data packet and the back-end server; Length change rate, which represents the rate of change of the length of the current data packet sent by the front-end acquisition device relative to the length of the previous data packet; The time interval represents the difference between the first transmission time of the current data packet sent by the front-end acquisition device and the second transmission time of the previous data packet sent by the current data packet.

5. The method according to claim 3, characterized in that, The step of determining whether the backend server has been attacked based on the set of detection results includes: If the set of detection results indicates that there are abnormal data packets in the first subset of data packets, it is determined that the backend server is under attack; or If the set of detection results indicates that there are abnormal data packets in the first subset of data packets, and the number of abnormal data packets is greater than or equal to a first preset threshold, then the backend server is determined to be under attack; or If the set of detection results indicates that there are abnormal data packets in the first data packet subset, and the proportion of abnormal data packets in the first data packet subset is greater than or equal to a second preset threshold, then the backend server is determined to be under attack.

6. The method according to claim 5, characterized in that, The method further includes: If the set of detection results indicates that there are abnormal data packets in the first subset of data packets, the abnormal data packets are discarded.

7. A device for determining server attacks, characterized in that, include: The first determining module is used to determine a first number of data packets in the first data packet set when a first data packet set is obtained, wherein the first data packet set includes data packets transmitted by the front-end acquisition device to the back-end server in a first period; The second determining module is used to determine a third number of data packets in the first data packet subset of the first data packet set when the difference between the first number and the second number is greater than or equal to a first predetermined threshold. The second number represents the number of data packets transmitted by the front-end acquisition device to the back-end server in a second period. The second period is the period preceding the first period. The length of the data packets in the first data packet subset is within a preset length range. The judgment module is used to determine whether the backend server is under attack based on the third quantity and the second predetermined threshold. The judgment module determines whether the backend server is under attack based on the third quantity and the second predetermined threshold in the following manner: when the third quantity is greater than or equal to the second predetermined threshold, the first data packet subset is detected by a target neural network model to obtain a set of detection results. The target neural network model is used to determine the corresponding detection results based on the characteristics of each data packet in the first data packet subset. The set of detection results is used to indicate whether each data packet in the first data packet subset is abnormal. The backend server is then judged to be under attack based on the set of detection results.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the method described in any one of claims 1 to 6.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method described in any one of claims 1 to 6.

Images