Threshold recommendation method and device based on denial of service attack, medium and program product

Abstract

The embodiment of the invention provides a threshold recommendation method and device based on denial of service attack, a medium and a program product, and relates to the technical field of network security. The method comprises the following steps: determining that a preset threshold application triggering condition is met, and obtaining a plurality of historical threshold learning results corresponding to a current moment based on a preset flow change period; determining a target threshold learning result based on the plurality of historical threshold learning results; determining a recommendation threshold based on the target threshold learning result, and issuing the recommendation threshold to a denial of service attack defense system; wherein a plurality of threshold learning results obtained by statistics according to a preset learning cycle are recorded in the storage database. According to the embodiment of the invention, the threshold value learning result of the flow data is counted according to the preset learning period and stored, and when the threshold value needs to be adjusted, the plurality of historical threshold value learning results are obtained in combination with the flow change period to determine the final recommendation threshold value, so that the accuracy and flexibility of threshold value setting are effectively improved.

Images