CC attack defense method and system based on time and space

Abstract

The invention discloses a CC attack defense method and system based on time and space, and the method comprises the steps: collecting the real-time flow of an access request, dividing the real-time flow according to the current time period and the geographic position of the access request, and calling a corresponding independent defense unit model from a pre-constructed CC attack defense model; the CC attack defense model is composed of a plurality of independent defense unit models, and each independent defense unit model takes a geographic position and a time period as indexes and calculates a corresponding security request rate threshold through historical traffic of the corresponding geographic position and time period; and the independent defense unit model counts the request rate of the real-time flow in the corresponding geographic position and time period, and compares the request rate with the security request rate threshold value, and if the request rate exceeds the security request rate threshold value, the CC attack flow is judged, and defense measures are started. According to the application, the false operation rate of defense is improved, and the deployment mode is simple.

Description

Technical Field

[0001] The present application relates to the technical field of network information security, and in particular to a time-space based CC attack defense method, system, computer device and storage medium. Background Art

[0002] With the continuous development of Internet technology, computer network technology has been widely used in all walks of life. And network attacks are becoming more and more common. Through network attacks, computers will be attacked by viruses and hackers, which may lead to data loss, and in serious cases, user data loss or property loss. Therefore, Internet security protection is the focus of Internet technology.

[0003] Distributed Denial of Service (DDoS) attack is one of the most common network attacks. In a DDoS attack, the attacker coordinates a large number of malicious requests to overload the network service or website, causing it to fail to operate normally. CC attack is a form of DDoS attack. CC stands for "Connection Flood", which means flooding the target server with a large number of connection requests.

[0004] The principle of CC attack is to use a large number of malicious requests to occupy the resources of the target server. Attackers usually use "botnets" (also known as "zombie armies") to launch such attacks. Botnets are networks composed of a large number of infected computers, which attackers control to launch attacks. These infected computers can be victims of malware (such as zombie viruses), and attackers can remotely control these computers and make them execute attack instructions.

[0005] The existing technologies for resisting CC attacks generally include the following methods:

[0006] Method 1: Threshold setting based on network traffic. By setting the threshold of network traffic, the protection mechanism is triggered when the traffic exceeds a certain threshold. CC attacks are prevented by limiting the number of connections of a single IP address, setting the maximum number of requests, or using a speed limit policy. However, this threshold is usually set based on manual experience and is easily affected by subjective factors. Since business traffic has obvious tidal phenomena and sudden normal traffic, the setting of the threshold requires obvious redundancy, resulting in inaccurate attack detection and easy omission of CC attack traffic.

[0007] Method 2: Based on the token setting method, by deploying tokens for normal access traffic, based on the steps of token generation, verification and access frequency restriction, it ensures that legitimate users can access the server normally, while blocking malicious requests. However, this method requires users to transform the business system, the deployment method is cumbersome, and adding verification will also consume server performance. Moreover, some CC attackers can also meet the token verification method after modification, making this method invalid. Summary of the invention

[0008] Based on this, in order to solve the above technical problems, a time-space based CC attack defense method and system are provided to solve the problems of inaccurate attack detection and complex deployment methods in the prior art.

[0009] In a first aspect, a CC attack defense method based on time and space is applied to a server, and the method includes:

[0010] Collect the real-time traffic of access requests, divide the real-time traffic according to the current time period and the geographical location of the access request, and call the corresponding independent defense unit model from the pre-built CC attack defense model; the CC attack defense model is composed of multiple independent defense unit models, each of which is indexed by the geographical location and time period, and calculates the corresponding security request rate threshold through the historical traffic of the corresponding geographical location and time period;

[0011] The independent defense unit model counts the request rate of real-time traffic in the corresponding geographical location and time period, and compares it with the security request rate threshold. If it exceeds the security request rate threshold, it is determined to be CC attack traffic and defense measures are initiated.

[0012] In the above scheme, optionally, if the geographical location is domestic, the district and county are divided as a valid geographical location data point, and if the geographical location is foreign, the country is divided as a valid geographical location data point.

[0013] In the above scheme, optionally, the method for constructing the independent defense unit model includes the following steps:

[0014] Classify historical traffic by geographic location and time period, and determine CC attack traffic and normal business traffic in each category of historical traffic;

[0015] The maximum request rate of each type of normal business traffic is collected, and the normal maximum request rate threshold of each type of normal business traffic is determined by comparison;

[0016] Collect the attack rate, attack frequency, and attack duration of each type of CC attack traffic, and calculate the risk factor, attack rate penalty parameter, attack frequency penalty parameter, and attack duration penalty parameter of the corresponding geographic location. Specifically:

[0017] Determine the risk factor of the geographical location using each type of CC attack traffic and security experience; determine the attack rate penalty parameter based on the attack rate, determine the attack frequency penalty parameter based on the attack frequency, and determine the attack duration penalty parameter based on the attack duration;

[0018] The independent defense unit model is established by using the normal maximum request rate threshold of each type of historical traffic, the risk coefficient of the geographical location, the attack rate penalty parameter, the attack frequency penalty parameter, the attack duration penalty parameter and the normal access redundancy with the geographical location and time period as indexes.

[0019] In the above scheme, optionally, the independent defense unit model also provides a manual adjustment interface for adjusting the protection parameters of each independent defense unit model. The protection parameters of the independent defense unit model include: normal maximum request rate threshold, risk factor of geographical location, attack rate penalty parameter, attack frequency penalty parameter, attack duration penalty parameter, normal access redundancy, and defense action parameter.

[0020] In the above solution, further optionally, the security request rate threshold of the independent defense unit model is calculated; it is calculated by the following formula:

[0021]

[0022] Among them, A is the normal maximum request rate threshold, B is the normal access redundancy, C is the geographical location risk coefficient, D is the attack rate penalty parameter, E is the attack frequency penalty parameter, and F is the attack duration penalty parameter.

[0023] In the above scheme, optionally, after the independent defense unit model runs the defense measures, it also includes: calculating the number of independent defense units running defense measures in the current time period, and if it exceeds a certain threshold, starting the defense measures of all independent defense unit models in the current time period in the time-space based CC attack defense model.

[0024] In a second aspect, a CC attack defense system based on time and space is provided, the system comprising:

[0025] The independent defense unit model calling module is used to collect the real-time traffic of access requests, divide the real-time traffic according to the current time period and the geographical location of the access request, and call the corresponding independent defense unit model from the pre-built CC attack defense model; the CC attack defense model is composed of multiple independent defense unit models, each of which uses the geographical location and time period as an index, and calculates the corresponding security request rate threshold through historical traffic;

[0026] The defense measures module is used for the independent defense unit model to count the request rate in the corresponding geographical location and time period, and compare it with the security request rate threshold. If it exceeds the security request rate threshold, it is determined to be CC attack traffic and the defense measures are initiated.

[0027] In the above scheme, optionally, the system also includes: a linkage perception module, which is used to calculate the number of independent defense units running defense measures in the current time period. If it exceeds a certain threshold, the defense measures of all independent defense unit models in the current time period in the time-space based CC attack defense model are activated.

[0028] In a third aspect, a server includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the time-space based CC attack defense method described in the first aspect are implemented.

[0029] In a fourth aspect, a server-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the time-space-based CC attack defense method described in the first aspect.

[0030] This application has at least the following beneficial effects:

[0031] This application studies historical traffic and automatically establishes an independent defense unit model indexed by time period and geographical location according to the time tides of historical traffic and the imbalance of geographical location. It also analyzes the historical traffic corresponding to the geographical location and time period and calculates the security request rate threshold of the independent defense unit model. Therefore, the security request rate is obtained by analyzing the historical traffic, which avoids the arbitrariness and unreasonableness of manually specified thresholds and reduces the false operation rate of the defense. Moreover, through the application method, users do not need to modify the business system, and the deployment method is simple. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A basic flow chart of a time-space based CC attack defense method provided in one embodiment of the present application;

[0033] Figure 2A time-space based CC attack defense model diagram is provided for one embodiment of the present application;

[0034] Figure 3 A flow chart of a method for constructing an independent defense unit model provided in one embodiment of the present application;

[0035] Figure 4 A detailed flowchart of a time-space based CC attack defense method provided for one embodiment of the present application. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0037] In the description of this application: unless otherwise specified, the meaning of "plurality" is two or more. The terms "first", "second", "third", etc. in this application are intended to distinguish the objects referred to, and do not have special meanings in terms of technical connotations (for example, they should not be understood as emphasizing the importance or order, etc.). Expressions such as "including", "comprising", "having", etc. also mean "not limited to" (certain units, components, materials, steps, etc.).

[0038] In one embodiment, Figure 1 As shown, a CC attack defense method based on time and space is provided, and the method is applied to a server as an example for explanation, including the following steps:

[0039] Step S101: collect the real-time traffic of access requests, divide the real-time traffic according to the current time period and the geographical location of the access request, and call the corresponding independent defense unit model from the pre-built CC attack defense model; the CC attack defense model is composed of multiple independent defense unit models, each of which is indexed by the geographical location and time period, and calculates the corresponding security request rate threshold through the historical traffic of the corresponding geographical location and time period;

[0040] In step S101, Figure 2 As shown, the CC attack defense model includes multiple independent defense unit models indexed by geographic location and time period, and each independent defense unit model calculates the security request rate threshold according to the historical traffic of the corresponding geographic location and time period.

[0041] Step S102: The independent defense unit model collects statistics on the request rate of real-time traffic in the corresponding geographical location and time period, and compares it with the security request rate threshold. If it exceeds the security request rate threshold, it is determined to be CC attack traffic and defense measures are initiated.

[0042] In step S102, when an access request arrives, the corresponding CC attack defense model is selected according to the requested geographical location and current time period. The defense engine will count the request rate (req_v) in each geographical location and time period, and compare it with the safe request rate (safe_req_v) calculated by the corresponding CC attack defense unit model. By comparing these two values, it is possible to evaluate whether the request exceeds the normal range and take corresponding defense measures.

[0043] If the request rate is less than or equal to the safe request rate (req_v≤safe_req_v), the traffic is considered normal traffic. This means that the requests are within the normal range and have not triggered alarms or defensive measures of the defense system. The system can continue to process these requests without interrupting or interfering with the access of legitimate users.

[0044] If the request rate is greater than the safe request rate (req_v>safe_req_v), the request traffic is identified as CC attack traffic. The defense model will take corresponding protective measures based on the pre-configured defense action parameters, such as interception, request restriction, or challenge verification. These measures are designed to prevent the continuation of CC attacks and protect the server from malicious requests.

[0045] In the above-mentioned CC attack defense method based on time and space, an independent defense unit model indexed by time period and geographical location is automatically established according to the time tide of historical traffic and the imbalance of geographical location. The historical traffic corresponding to the geographical location and time period is analyzed, and the security request rate threshold of the independent defense unit model is calculated. Therefore, the security request rate is obtained by analyzing the historical traffic, avoiding the arbitrariness and unreasonableness of manually specified thresholds, reducing the false operation rate of the defense, and through this application method, there is no need for users to modify the business system, and the deployment method is simple.

[0046] In one embodiment, if the geographical location is domestic, the district or county is used as a valid geographical location data point; if the geographical location is foreign, the country is used as a valid geographical location data point.

[0047] In this embodiment, the domestic geographical location can be based on a district or county as a valid geographical location data point, such as Chang'an District and High-tech Zone in Shaanxi Province, etc. The foreign geographical location can be based on a country as a valid geographical location data point, such as the United States and the United Kingdom.

[0048] As for the time period, a day of 24 hours can be divided into 1 hour as a valid time period; for example, 12:00-13:00; however, for greater accuracy, every half hour can be used as a valid time period; or every two hours can be used as a valid time period. The specific selection can be adjusted based on the changing time of the traffic tidal phenomenon encountered by the server.

[0049] In one embodiment, Figure 3 As shown, the construction method of the independent defense unit model includes the following steps: classifying historical traffic according to geographical location and time period, and determining CC attack traffic and normal business traffic in each type of historical traffic;

[0050] The maximum request rate of each type of normal business traffic is collected, and the normal maximum request rate threshold of each type of normal business traffic is determined by comparison;

[0051] Collect the attack rate, attack frequency, and attack duration of each type of CC attack traffic, and calculate the risk factor, attack rate penalty parameter, attack frequency penalty parameter, and attack duration penalty parameter of the corresponding geographic location. Specifically:

[0052] Determine the risk factor of the geographical location using each type of CC attack traffic and security experience; determine the attack rate penalty parameter based on the attack rate, determine the attack frequency penalty parameter based on the attack frequency, and determine the attack duration penalty parameter based on the attack duration;

[0053] The independent defense unit model is established by using the normal maximum request rate threshold of each type of historical traffic, the risk coefficient of the geographical location, the attack rate penalty parameter, the attack frequency penalty parameter, the attack duration penalty parameter and the normal access redundancy with the geographical location and time period as indexes.

[0054] In this embodiment, historical traffic is collected through a traffic collection engine, including normal business traffic information and attack traffic information. The normal business traffic information includes: time period, geographical location, and maximum request rate; the attack traffic information includes: time period, geographical location, attack rate, attack duration, and attack frequency.

[0055] The specific calculation method of the parameters of the defense unit model is as follows:

[0056] Normal maximum request rate threshold (variant A): The normal traffic is learned by the traffic analysis engine, and the maximum request rate threshold is considered normal for each geographic location and time period.

[0057] Normal access redundancy (variable B, range 1-10): determined based on human experience, the default setting is 6; it prevents false alarms in CC attack detection and provides normal traffic redundancy multiples.

[0058] Geographic location risk factor (variable C, range 0-10): Based on the traffic analysis engine learning the historical attack traffic (range 0-10) and security experience (range 1-10) of each geographic location, the risk factor of the geographic location is determined to assess the attack probability and severity of the geographic location. Specifically, risk factor C = security experience a × 20% + historical attack traffic b × 80%;

[0059] Attack rate penalty parameter (variable D, range 0-10): The historical attack rate of each geographical location is learned through the traffic analysis engine to determine the attack rate penalty parameter of the geographical location. Specifically, the historical attack rate d is the average value within an hour (in qps). When d is less than 10,000, the attack rate penalty parameter D = (d / 10,000) × 10. When d is greater than or equal to 10,000, the attack rate penalty parameter D = 10.

[0060] Attack frequency penalty parameter (variable E, range 0-10): The attack frequency penalty parameter of each geographical location is determined by learning the historical attack frequency of each geographical location through the traffic analysis engine. Specifically, the attack frequency e is the number of attacks in one hour. When e is less than 60: E = (e / 10000) × 10, when E is less than 60: E = 10.

[0061] Attack duration penalty parameter (variable F, range 0-10): The attack duration penalty parameter for each geographic location is determined by learning the historical attack duration of each geographic location through the traffic analysis engine. Specifically, the attack duration refers to the attack time f (in seconds) within one hour, F = (f / 10000) × 10.

[0062] In one embodiment, the independent defense unit model also provides a manual adjustment interface for adjusting the protection parameters of each independent defense unit model. The protection parameters of the independent defense unit model include: normal maximum request rate threshold, risk factor of geographic location, attack rate penalty parameter, attack frequency penalty parameter, attack duration penalty parameter, normal access redundancy, and defense action parameter.

[0063] In this embodiment, the independent defense model also provides a manual adjustment interface. When the parameters of the independent defense model unit have obvious problems during the learning process and it is necessary to block access to certain time periods or certain areas, it can be adjusted through manual adjustment.

[0064] The defense action parameter is a method for handling CC attacks, which can be logging, intercepting access, and blocking IP. Users can choose according to their own protection needs.

[0065] In one embodiment, the security request rate threshold of the independent defense unit model is calculated by the following formula:

[0066]

[0067] Among them, A is the normal maximum request rate threshold, B is the normal access redundancy, C is the geographic location risk coefficient, D is the attack rate penalty parameter, E is the attack frequency penalty parameter, and F is the attack duration penalty parameter.

[0068] In one embodiment, Figure 4 As shown, after the independent defense unit model runs the defense measures, it also includes: calculating the number of independent defense units running the defense measures in the current time period, and if it exceeds a certain threshold, starting the defense measures of all independent defense unit models in the current time period in the time-space based CC attack defense model.

[0069] In this embodiment, in the current time period, CC attack defense units in different geographical locations have linkage perception function. When the number of defense units detecting CC attacks is N, which exceeds the pre-configured linkage threshold M, that is, N>M, all other defense units are linked to enter the defense mode to improve the overall detection and defense capabilities of CC attacks.

[0070] In one embodiment, a space-time based CC attack defense system is provided, comprising the following program modules: an independent defense unit model calling module, and a defense measure execution module, wherein:

[0071] The independent defense unit model calling module is used to collect the real-time traffic of access requests, divide the real-time traffic according to the current time period and the geographical location of the access request, and call the corresponding independent defense unit model from the pre-built CC attack defense model; the CC attack defense model is composed of multiple independent defense unit models, each of which uses the geographical location and time period as an index, and calculates the corresponding security request rate threshold through historical traffic;

[0072] The defense measures module is used for the independent defense unit model to count the request rate in the corresponding geographical location and time period, and compare it with the security request rate threshold. If it exceeds the security request rate threshold, it is determined to be CC attack traffic and the defense measures are initiated.

[0073] In one embodiment, the system also includes: the system also includes: a linkage perception module, which is used to calculate the number of independent defense units running defense measures in the current time period. If it exceeds a certain threshold, the defense measures of all independent defense unit models in the current time period in the time-space based CC attack defense model are initiated.

[0074] For the specific definition of the CC attack defense system based on time and space, please refer to the definition of the CC attack defense method based on time and space above, which will not be repeated here. Each module in the above-mentioned CC attack defense system based on time and space can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the server device in hardware form, or can be stored in the memory in the server device in software form, so that the processor can call and execute the operations corresponding to the above modules.

[0075] The present invention utilizes the time tide phenomenon of normal business traffic and the imbalance of geographical location, and constructs a CC attack defense unit model based on time and space through self-learning of historical traffic. Compared with other CC attack defense solutions, the present invention has the following significant advantages:

[0076] 1. Avoids the arbitrariness and irrationality of manually set thresholds: In traditional methods, setting thresholds requires relying on manual experience or trial and error adjustment, which is easily affected by subjective factors. However, the present invention automatically establishes a defense unit model based on the time tides and geographical imbalances of normal business traffic by self-learning historical traffic, thus avoiding the uncertainty and subjectivity of manually setting thresholds.

[0077] 2. Improved CC attack detection and defense capabilities: The CC attack defense unit model based on time and space can accurately identify and distinguish normal traffic from malicious attack traffic. Through the analysis and pattern recognition of time and space characteristics, CC attack behaviors can be effectively detected, and corresponding defense measures can be taken in time to improve the system's protection capabilities against CC attacks.

[0078] 3. Reduced false operation rate of defense: The present invention uses the self-learning mechanism of historical traffic to more accurately judge CC attack behavior and avoid misjudgment and misinterception of normal users. Through the optimization of the spatiotemporal model, the false operation rate of the defense system can be reduced, ensuring the normal access and service continuity of legitimate users.

[0079] In one embodiment, a server is provided, which includes a processor, a memory and a network interface connected through a system bus. The processor of the server is used to provide computing and control capabilities. The memory of the server includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the server is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the above-mentioned CC attack defense method based on time and space is implemented.

[0080] In one embodiment, a server-readable storage medium is further provided, on which a computer program is stored, which involves all or part of the processes in the above-mentioned embodiment method.

[0081] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0082] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0083] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A CC attack defense method based on time and space, characterized in that: Applied to a server, the method comprises: Collect the real-time traffic of access requests, divide the real-time traffic according to the current time period and the geographical location of the access request, and call the corresponding independent defense unit model from the pre-built CC attack defense model; the CC attack defense model is composed of multiple independent defense unit models, each of which is indexed by the geographical location and time period, and calculates the corresponding security request rate threshold through the historical traffic of the corresponding geographical location and time period; The independent defense unit model counts the request rate of real-time traffic in the corresponding geographical location and time period, and compares it with the security request rate threshold. If it exceeds the security request rate threshold, it is determined to be CC attack traffic and defense measures are initiated.

2. The method according to claim 1, characterized in that If the geographical location is domestic, the district or county is used as a valid geographical location data point. If the geographical location is foreign, the country is used as a valid geographical location data point.

3. The method according to claim 1, characterized in that The method for constructing the independent defense unit model comprises the following steps: Classify historical traffic by geographic location and time period, and determine CC attack traffic and normal business traffic in each category of historical traffic; The maximum request rate of each type of normal business traffic is collected, and the normal maximum request rate threshold of each type of normal business traffic is determined by comparison; Collect the attack rate, attack frequency, and attack duration of each type of CC attack traffic, and calculate the risk factor, attack rate penalty parameter, attack frequency penalty parameter, and attack duration penalty parameter of the corresponding geographic location. Specifically: Determine the risk factor of the geographical location using each type of CC attack traffic and security experience; determine the attack rate penalty parameter based on the attack rate, determine the attack frequency penalty parameter based on the attack frequency, and determine the attack duration penalty parameter based on the attack duration; The independent defense unit model is established by using the normal maximum request rate threshold of each type of historical traffic, the risk coefficient of the geographical location, the attack rate penalty parameter, the attack frequency penalty parameter, the attack duration penalty parameter and the normal access redundancy with the geographical location and time period as indexes.

4. The method according to claim 1, characterized in that: The independent defense unit model also provides a manual adjustment interface for adjusting the protection parameters of each independent defense unit model. The protection parameters of the independent defense unit model include: normal maximum request rate threshold, risk coefficient of geographic location, attack rate penalty parameter, attack frequency penalty parameter, attack duration penalty parameter, normal access redundancy, and defense action parameter.

5. The method according to claim 1, characterized in that Calculating a security request rate threshold of the independent defense unit model; Calculated by the following formula: Among them, A is the normal maximum request rate threshold, B is the normal access redundancy, C is the geographical location risk coefficient, D is the attack rate penalty parameter, E is the attack frequency penalty parameter, and F is the attack duration penalty parameter.

6. The method according to claim 1, characterized in that After the independent defense unit model runs the defense measures, it also includes: calculating the number of independent defense units running defense measures in the current time period, and if it exceeds a certain threshold, starting the defense measures of all independent defense unit models in the current time period in the time-space based CC attack defense model.

7. A CC attack defense system based on time and space, characterized in that: The system comprises: The independent defense unit model calling module is used to collect the real-time traffic of access requests, divide the real-time traffic according to the current time period and the geographical location of the access request, and call the corresponding independent defense unit model from the pre-built CC attack defense model; the CC attack defense model is composed of multiple independent defense unit models, each of which uses the geographical location and time period as an index, and calculates the corresponding security request rate threshold through historical traffic; The defense measures module is used for the independent defense unit model to count the request rate in the corresponding geographical location and time period, and compare it with the security request rate threshold. If it exceeds the security request rate threshold, it is determined to be CC attack traffic and the defense measures are initiated.

8. The time-space based CC attack defense system according to claim 7, characterized in that: The system also includes: a linkage perception module, which is used to calculate the number of independent defense units running defense measures in the current time period. If it exceeds a certain threshold, the defense measures of all independent defense unit models in the current time period in the time-space based CC attack defense model are activated.

9. A server, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images