DDoS attack detection method and device, terminal equipment and storage medium

Abstract

The invention relates to the technical field of Internet, in particular to a DDoS attack detection method and device, terminal equipment and a storage medium. The method is applied to the terminal equipment, an anti-DDoS plug-in is installed in the terminal equipment, and the method comprises the steps that a control instruction for the anti-DDoS plug-in is acquired, and the control instruction comprises a traffic capture instruction and a traffic log generation strategy; controlling the anti-DDoS plug-in to perform traffic capture according to the traffic capture instruction to obtain traffic capture data, and generating a traffic log according to a traffic log generation strategy and the traffic capture data; and performing DDoS attack detection according to the traffic log. By adopting the scheme, the log file related to the DDoS can be conveniently and quickly collected from the terminal equipment with excellent performance.

Description

Technical Field

[0001] The present disclosure relates to the field of Internet technology, and in particular to a DDoS attack detection method, apparatus, terminal equipment and storage medium. Background Art

[0002] Today, people's work, life and study are inseparable from the Internet. While enjoying the convenience brought by the Internet, people are also facing very serious Internet security issues, and Distributed Denial of Service (DDoS) is a common attack method that affects Internet security.

[0003] DDoS is a type of denial of service attack, which is mainly aimed at occupying and consuming resources. It achieves the purpose of denial of service by sending a large number of requests to service providers or occupying resources for a long time. This attack is seemingly reasonable requests, which cannot be blocked by system upgrades and patches, nor can it be defended by intrusion detection systems. The focus of DDoS is to use distributed clients to send a large number of seemingly legitimate requests to service providers, occupy a large amount of resources for a long time, and achieve the purpose of denial of service.

[0004] In the related technology, the equipment that specializes in analyzing DDoS attacks is relatively independent and requires other terminal devices to import related log files for analysis. Therefore, how to collect log files from terminal devices conveniently, quickly and with high performance has become the focus of people's attention. Summary of the invention

[0005] The present disclosure aims to solve one of the technical problems in the related art at least to some extent.

[0006] To this end, the first objective of the present disclosure is to propose a DDoS attack detection method to collect DDoS-related log files from terminal devices in a convenient, fast and high-performance manner.

[0007] The second objective of the present disclosure is to provide a DDoS attack detection device.

[0008] The third objective of the present disclosure is to provide a terminal device.

[0009] A fourth objective of the present disclosure is to provide a computer-readable storage medium.

[0010] A fifth object of the present disclosure is to provide a computer program product.

[0011] To achieve the above-mentioned purpose, the first embodiment of the present disclosure proposes a DDoS attack detection method, which is applied to a terminal device, and an anti-DDoS plug-in is installed in the terminal device, including:

[0012] Obtain control instructions for the anti-DDoS plug-in, where the control instructions include traffic capture instructions and traffic log generation strategies;

[0013] Control the anti-DDoS plug-in to capture traffic according to the traffic capture instruction, obtain the traffic capture data, and generate traffic logs according to the traffic log generation strategy and the traffic capture data;

[0014] Detect DDoS attacks based on traffic logs.

[0015] Optionally, obtain control instructions for the anti-DDoS plug-in, including:

[0016] At first preset time intervals, the traffic logs generated within the first preset time interval are sent to the cloud platform, so that the cloud platform optimizes the traffic log generation strategy and the traffic capture instructions according to the traffic logs to obtain the optimized traffic log generation strategy and the optimized traffic capture instructions;

[0017] Receive control instructions for the anti-DDoS plug-in sent by the cloud platform, where the control instructions include optimized traffic capture instructions and optimized traffic log generation strategies.

[0018] Optionally, sending the traffic log generated within the first preset time period to the cloud platform includes:

[0019] Assembling the traffic logs generated within the first preset time period to obtain assembled traffic log messages;

[0020] Encapsulate the assembled traffic log message to obtain a reporting message;

[0021] Send the report message to the cloud platform.

[0022] Optionally, the method further comprises:

[0023] Every second preset time period, the terminal device information data and heartbeat data corresponding to the terminal device are sent to the cloud platform.

[0024] Optionally, the traffic log generation strategy includes at least one of the following:

[0025] The file size of the traffic log;

[0026] The file generation format of traffic logs;

[0027] The file generation frequency of traffic logs;

[0028] Filter keywords for traffic capture data.

[0029] Optionally, the traffic capture instruction includes at least one of the following contents:

[0030] Traffic capture start time point;

[0031] The time point when traffic capture stops.

[0032] Optionally, perform DDoS attack detection based on traffic logs, including:

[0033] The traffic log is sent to a DDoS analysis device so that the DDoS analysis device can detect DDoS attacks based on the traffic log.

[0034] To achieve the above-mentioned purpose, the second embodiment of the present disclosure proposes a DDoS attack detection device, which is applied to a terminal device, wherein an anti-DDoS plug-in is installed in the terminal device, including:

[0035] An instruction acquisition unit, used to acquire control instructions for the anti-DDoS plug-in, wherein the control instructions include traffic capture instructions and traffic log generation strategies;

[0036] A log generating unit, used to control the anti-DDoS plug-in to capture traffic according to the traffic capturing instruction, obtain traffic capturing data, and generate a traffic log according to the traffic log generating strategy and the traffic capturing data;

[0037] An attack detection unit is used to perform DDoS attack detection according to the traffic log.

[0038] To achieve the above-mentioned purpose, a third aspect of the present disclosure provides a terminal device, including: a processor, and a memory communicatively connected to the processor;

[0039] Memory stores computer-executable instructions;

[0040] The processor executes the computer-executable instructions stored in the memory to implement the method shown in any one of the first aspects above.

[0041] To achieve the above-mentioned objectives, an embodiment of the fourth aspect of the present disclosure proposes a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method shown in any one of the above-mentioned first aspects.

[0042] To achieve the above-mentioned objective, a fifth aspect of the present disclosure provides a computer program product, including a computer program, which, when executed by a processor, implements the method shown in any one of the above-mentioned first aspects.

[0043] In summary, the method, apparatus, device and storage medium provided by the present invention realize the collection of DDoS traffic data through an anti-DDoS plug-in, and generate traffic logs according to the traffic log generation strategy, which can collect DDoS-related log files from terminal devices conveniently, quickly and with high performance, and can perform intelligent DDoS attack detection.

[0044] Additional aspects and advantages of the present disclosure will be given in part in the following description and in part will be obvious from the following description or learned through practice of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The above and / or additional aspects and advantages of the present disclosure will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0046] Figure 1 A flowchart of a DDoS attack detection method provided by an embodiment of the present disclosure;

[0047] Figure 2 An optimized flow chart of a traffic log generation strategy provided by an embodiment of the present disclosure;

[0048] Figure 3 A control flow chart of an anti-DDoS plug-in provided in an embodiment of the present disclosure;

[0049] Figure 4 A flow chart of capturing and reporting traffic logs provided by an embodiment of the present disclosure;

[0050] Figure 5 A structural diagram of a DDoS attack detection device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0051] Embodiments of the present disclosure are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present disclosure, and should not be construed as limiting the present disclosure.

[0052] The present disclosure is described in detail below with reference to specific embodiments.

[0053] In the first embodiment, if Figure 1 As shown, Figure 1 This is a flow chart of a DDoS attack detection method provided by an embodiment of the present disclosure, which can be implemented by a computer program and can be run on a device for DDoS attack detection. The computer program can be integrated into an application or run as an independent tool application.

[0054] The DDoS attack detection device may be a terminal device with a DDoS attack detection function.

[0055] The DDoS attack detection method can be executed by a terminal device, which is a physical device that carries an anti-DDoS plug-in.

[0056] For example, the DDoS attack detection method includes the following steps:

[0057] S101, obtaining control instructions for the anti-DDoS plug-in, wherein the control instructions include traffic capture instructions and traffic log generation strategies;

[0058] According to some embodiments, the anti-DDoS plug-in refers to a plug-in installed in a terminal device for performing traffic capture and traffic log generation.

[0059] In some embodiments, the traffic capture instruction refers to an instruction used to capture the original traffic data generated in the terminal device.

[0060] In some embodiments, the traffic log generation policy refers to a policy adopted when generating a traffic log.

[0061] It is easy to understand that when a terminal device performs DDoS attack detection, the terminal device can obtain control instructions for the anti-DDoS plug-in.

[0062] S102, controlling the anti-DDoS plug-in to capture traffic according to the traffic capture instruction, obtaining traffic capture data, and generating a traffic log according to the traffic log generation strategy and the traffic capture data;

[0063] According to some embodiments, when a terminal device obtains a control instruction for an anti-DDoS plug-in, the terminal device can control the anti-DDoS plug-in to capture traffic according to the traffic capture instruction, obtain traffic capture data, and control the anti-DDoS plug-in to generate a traffic log according to a traffic log generation strategy and traffic capture data.

[0064] S103, performing DDoS attack detection according to the traffic log.

[0065] According to some embodiments, when a terminal device obtains a traffic log, the terminal device may perform DDoS attack detection based on the traffic log.

[0066] In summary, the method provided in this embodiment realizes the collection of DDoS traffic data through the anti-DDoS plug-in, and generates traffic logs according to the traffic log generation strategy. It can collect DDoS-related log files from terminal devices conveniently, quickly and with high performance, and can perform intelligent DDoS attack detection.

[0067] This embodiment also provides another DDoS attack detection method, which can be executed by a terminal device, in which an anti-DDoS plug-in is installed.

[0068] For example, the DDoS attack detection method may include the following steps:

[0069] S201, sending the terminal device information data and heartbeat data corresponding to the terminal device to the cloud platform every second preset time period;

[0070] According to some embodiments, the cloud platform is used to interact with the anti-DDoS plug-in through messages, receive messages reported by the anti-DDoS plug-in, and issue control instructions to the anti-DDoS plug-in.

[0071] In some embodiments, the second preset duration does not specifically refer to a fixed duration, and the second preset duration may be, for example, one day.

[0072] In some embodiments, the terminal device information data includes but is not limited to the device Media Access Control Address (MAC), serial number (SN), software and hardware version numbers, etc.

[0073] It should be noted that the terminal device information data and heartbeat data corresponding to the terminal device are sent to the cloud platform every second preset time period. Therefore, heartbeat keep-alive can be performed between the cloud platform, thereby establishing a stable connection channel with the cloud platform, and data can be transmitted between the cloud platform based on the connection channel.

[0074] S202, sending the traffic log generated within the first preset time period to the cloud platform at every first preset time period, so that the cloud platform optimizes the traffic log generation strategy and the traffic capture instruction according to the traffic log, and obtains the optimized traffic log generation strategy and the optimized traffic capture instruction;

[0075] According to some embodiments, the traffic logs generated within a first preset time period may be assembled to obtain assembled traffic log messages; the assembled traffic log messages may be encapsulated to obtain reporting messages; and the reporting messages may be sent to a cloud platform.

[0076] In some embodiments, the first preset duration does not specifically refer to a fixed duration, and the first preset duration may be, for example, one day.

[0077] According to some embodiments, when assembling the traffic logs generated within the first preset time period, all the traffic logs generated within the first preset time period and the log information corresponding to the traffic logs may be assembled to obtain an assembled traffic log message.

[0078] In some embodiments, the log information corresponding to the traffic log includes but is not limited to file size, main content, generation frequency, etc.

[0079] According to some embodiments, the traffic log generation strategy includes, but is not limited to, at least one of the following:

[0080] The file size of the traffic log;

[0081] The file generation format of traffic logs;

[0082] The file generation frequency of traffic logs;

[0083] Filter keywords for traffic capture data.

[0084] In some embodiments, the traffic capture instruction includes at least one of the following:

[0085] Traffic capture start time point;

[0086] The time point when traffic capture stops.

[0087] Take a scenario as an example. Figure 2 This is an optimization flow chart of a traffic log generation strategy provided by an embodiment of the present disclosure. Figure 2 As shown, the anti-DDoS plug-in includes a management module and a traffic analysis module. The management module includes a heartbeat and message reporting module and a plug-in control module. The traffic analysis module includes a traffic log reporting module, a traffic log generation module, and an original traffic capture module.

[0088] In the process of optimizing the traffic log generation strategy, first, the traffic log generation module can regularly (for example, every day) assemble various types of information in the generated traffic log file into messages and send them to the heartbeat and message reporting module; then, the heartbeat and message reporting module can encapsulate the received messages into reporting messages and send them to the cloud platform; finally, the cloud platform can parse the received reporting messages and optimize the traffic log generation strategy and traffic capture instructions based on the message content, which will be subsequently sent to the plug-in control module to actually adjust the capture of traffic data and the traffic log generation strategy.

[0089] S203, receiving a control instruction for the anti-DDoS plug-in sent by the cloud platform, wherein the control instruction includes an optimized traffic capture instruction and an optimized traffic log generation strategy;

[0090] It should be noted that the traffic capture instructions and traffic log generation strategies in the control instructions can also be customized as needed. In this case, the cloud platform can obtain the traffic capture instructions and traffic log generation strategies input by the user for the terminal device, generate control instructions based on the traffic capture instructions and traffic log generation strategies, and send them to the terminal device. Therefore, the flexibility and convenience of obtaining control instructions can be improved.

[0091] S204, controlling the anti-DDoS plug-in to capture traffic according to the optimized traffic capture instruction, obtaining traffic capture data, and generating a traffic log according to the optimized traffic log generation strategy and the traffic capture data;

[0092] Take a scenario as an example. Figure 3 This is a control flow chart of an anti-DDoS plug-in provided by an embodiment of the present disclosure. Figure 3 As shown, first, the heartbeat and message reporting module periodically reports the heartbeat data and terminal device information data to the cloud platform; then, after receiving the heartbeat data of the terminal device, the cloud platform sends the control instruction to the plug-in control module; then, the plug-in control module sends the traffic capture instruction to the original traffic capture module, thereby starting and / or stopping traffic capture; finally, the plug-in control module sends the traffic log generation strategy to the traffic log generation module, thereby generating a traffic log file of a specified size, format and content according to the traffic log generation strategy.

[0093] According to some embodiments, during the process of the terminal device controlling the anti-DDoS plug-in generating a traffic log according to the optimized traffic log generation strategy and the traffic capture data, the log information corresponding to the traffic log can also be recorded.

[0094] S205: Send the traffic log to a DDoS analysis device, so that the DDoS analysis device performs DDoS attack detection according to the traffic log.

[0095] According to some embodiments, various types of traffic data generated in the terminal device can be collected and processed by the anti-DDoS plug-in and reported to the DDoS analysis device, so that the DDoS analysis device can perform DDoS attack detection according to the traffic log.

[0096] Take a scenario as an example. Figure 4 The following is a flow chart of capturing and reporting traffic logs provided by the embodiment of the present disclosure. Figure 4As shown, first, when the traffic capture instruction indicates to turn on traffic capture, the original traffic capture module collects the original traffic data in the terminal device; then, the original traffic capture module sends the captured traffic capture data to the traffic log generation module; then, the traffic log generation module generates the corresponding traffic log file according to the traffic log generation strategy, and sends it to the traffic log reporting module, and records the log information of the traffic log file; finally, the traffic log reporting module summarizes the received traffic log files and sends them to the DDoS analysis device for subsequent analysis and processing, so that the DDoS analysis device can perform DDoS attack detection according to the traffic log.

[0097] In summary, the method provided in this embodiment realizes the collection of DDoS traffic data through an anti-DDoS plug-in, and generates and reports traffic logs according to the traffic log generation strategy. At the same time, the traffic capture instructions and the traffic log generation strategy can be dynamically optimized and adjusted according to the generation of traffic log files. DDoS-related log files can be collected from terminal devices conveniently and quickly with high performance. It can be used in conjunction with a cloud platform and DDoS analysis equipment to achieve intelligent DDoS attack detection with good defense effect.

[0098] In order to implement the above embodiments, the present disclosure also proposes a DDoS attack detection device.

[0099] like Figure 5 As shown, the DDoS attack detection device 500 includes:

[0100] The instruction acquisition unit 501 is used to acquire control instructions for the anti-DDoS plug-in, wherein the control instructions include traffic capture instructions and traffic log generation strategies;

[0101] The log generating unit 502 is used to control the anti-DDoS plug-in to capture traffic according to the traffic capturing instruction, obtain the captured traffic data, and generate a traffic log according to the traffic log generating strategy and the captured traffic data;

[0102] The attack detection unit 503 is used to perform DDoS attack detection according to the traffic log.

[0103] Optionally, when the instruction acquisition unit 501 is used to acquire a control instruction for the anti-DDoS plug-in, it is specifically used to:

[0104] At first preset time intervals, the traffic logs generated within the first preset time interval are sent to the cloud platform, so that the cloud platform optimizes the traffic log generation strategy according to the traffic logs to obtain an optimized traffic log generation strategy;

[0105] Receive control instructions for the anti-DDoS plug-in sent by the cloud platform, where the control instructions include traffic capture instructions and optimized traffic log generation strategies.

[0106] Optionally, when the instruction acquisition unit 501 is used to send the traffic log generated within the first preset time period to the cloud platform, it is specifically used to:

[0107] Assembling the traffic logs generated within the first preset time period to obtain assembled traffic log messages;

[0108] Encapsulate the assembled traffic log message to obtain a reporting message;

[0109] Send the report message to the cloud platform.

[0110] Optionally, the instruction acquisition unit 501 is further configured to:

[0111] Every second preset time period, the terminal device information data and heartbeat data corresponding to the terminal device are sent to the cloud platform.

[0112] Optionally, the traffic log generation strategy includes at least one of the following:

[0113] The file size of the traffic log;

[0114] The file generation format of traffic logs;

[0115] The file generation frequency of traffic logs;

[0116] Filter keywords for traffic capture data.

[0117] Optionally, the traffic capture instruction includes at least one of the following contents:

[0118] Traffic capture start time point;

[0119] The time point when traffic capture stops.

[0120] Optionally, when the attack detection unit 503 is used to perform DDoS attack detection according to the traffic log, it is specifically used to:

[0121] The traffic log is sent to a DDoS analysis device so that the DDoS analysis device can detect DDoS attacks based on the traffic log.

[0122] It should be noted that the above explanations of the DDoS attack detection method embodiment are also applicable to the DDoS attack detection device of this embodiment, and will not be repeated here.

[0123] In summary, the device provided by the embodiment of the present disclosure realizes the collection of DDoS traffic data through an anti-DDoS plug-in, and generates traffic logs according to the traffic log generation strategy. It can collect DDoS-related log files from terminal devices conveniently, quickly and with high performance, and can perform intelligent DDoS attack detection.

[0124] In order to implement the above embodiments, the present disclosure also proposes a terminal device, including: a processor, and a memory communicatively connected to the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method provided by the above embodiments.

[0125] In order to implement the above embodiments, the present disclosure further proposes a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the methods provided by the above embodiments.

[0126] In order to implement the above embodiments, the present disclosure also proposes a computer program product, including a computer program, which implements the methods provided by the above embodiments when executed by a processor.

[0127] The collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in this disclosure shall comply with the relevant laws and regulations and shall not violate public order and good morals.

[0128] It should be noted that personal information from users should be collected for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. In addition, such collection / sharing should be carried out after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign the agreement / authorization including authorization of relevant user information before the user uses the function. In addition, any necessary steps should be taken to protect and safeguard access to such personal information data and ensure that others who have access to personal information data comply with its privacy policy and procedures.

[0129] The present disclosure anticipates providing implementation schemes for users to selectively block the use or access of personal information data. That is, the present disclosure anticipates providing hardware and / or software to prevent or block access to such personal information data. Once the personal information data is no longer needed, risks can be minimized by limiting data collection and deleting the data. In addition, when applicable, such personal information is de-identified to protect the privacy of the user.

[0130] In the description of the aforementioned embodiments, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present disclosure. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0131] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of the present disclosure, "plurality" means at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0132] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present disclosure includes additional implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present disclosure belong.

[0133] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute the instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or otherwise processing in a suitable manner if necessary, and then stored in a computer memory.

[0134] It should be understood that the various parts of the present disclosure can be implemented in hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0135] A person skilled in the art may understand that all or part of the steps in the above-mentioned embodiment method may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0136] In addition, each functional unit in each embodiment of the present disclosure may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0137] The storage medium mentioned above may be a read-only memory, a disk or an optical disk, etc. Although the embodiments of the present disclosure have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations of the present disclosure. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present disclosure.

Claims

1. A DDoS attack detection method, characterized in that: Applied to terminal devices, the terminal devices are equipped with anti-DDoS plug-ins, including: Obtaining control instructions for the anti-DDoS plug-in, wherein the control instructions include traffic capture instructions and traffic log generation strategies; Control the anti-DDoS plug-in to capture traffic according to the traffic capture instruction, obtain traffic capture data, and generate a traffic log according to the traffic log generation strategy and the traffic capture data; DDoS attack detection is performed based on the traffic log.

2. The method according to claim 1, characterized in that The obtaining of the control instruction for the anti-DDoS plug-in includes: At first preset time intervals, the traffic log generated within the first preset time interval is sent to the cloud platform, so that the cloud platform optimizes the traffic log generation strategy and the traffic capture instruction according to the traffic log to obtain an optimized traffic log generation strategy and an optimized traffic capture instruction; Receive a control instruction for the anti-DDoS plug-in sent by the cloud platform, wherein the control instruction includes the optimized traffic capture instruction and the optimized traffic log generation strategy.

3. The method according to claim 2, characterized in that The sending the traffic log generated within the first preset time period to the cloud platform includes: Assembling the traffic logs generated within the first preset time period to obtain assembled traffic log messages; Encapsulating the assembled traffic log message to obtain a reporting message; The report message is sent to the cloud platform.

4. The method according to claim 2, characterized in that: The method further comprises: Every second preset time period, the terminal device information data and heartbeat data corresponding to the terminal device are sent to the cloud platform.

5. The method according to claim 1, characterized in that The traffic log generation strategy includes at least one of the following: The file size of the traffic log; The file generation format of traffic logs; The file generation frequency of traffic logs; Filter keywords for traffic capture data.

6. The method according to claim 1, characterized in that The traffic capture instruction includes at least one of the following contents: Traffic capture start time point; The time point when traffic capture stops.

7. The method according to claim 1, characterized in that The performing DDoS attack detection according to the traffic log includes: The traffic log is sent to a DDoS analysis device, so that the DDoS analysis device performs DDoS attack detection according to the traffic log.

8. A DDoS attack detection device, characterized in that: Applied to terminal devices, the terminal devices are equipped with anti-DDoS plug-ins, including: An instruction acquisition unit, used to acquire control instructions for the anti-DDoS plug-in, wherein the control instructions include traffic capture instructions and traffic log generation strategies; A log generating unit, used to control the anti-DDoS plug-in to capture traffic according to the traffic capturing instruction, obtain traffic capturing data, and generate a traffic log according to the traffic log generating strategy and the traffic capturing data; An attack detection unit is used to perform DDoS attack detection according to the traffic log.

9. A terminal device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

Images