Threshold recommendation method, device, medium and program product based on denial of service attack

Abstract

Embodiments of the present application provide a threshold recommendation method and device based on denial of service attack, a medium and a program product, relating to the technical field of network security. The method comprises: determining that a preset threshold application trigger condition is met, obtaining a plurality of historical threshold learning results corresponding to the current time based on a preset traffic change period; determining a target threshold learning result based on the plurality of historical threshold learning results; determining a recommended threshold based on the target threshold learning result, and issuing the recommended threshold to a denial of service attack defense system; wherein a plurality of threshold learning results obtained by statistics according to a preset learning period are recorded in a storage database. The embodiments of the present application statistically obtain the threshold learning results of the traffic data according to the preset learning period and store them, and when the threshold needs to be adjusted, a plurality of historical threshold learning results are obtained according to the traffic change period to determine the final recommended threshold, thereby effectively improving the accuracy and flexibility of the threshold setting.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a threshold recommendation method, device, medium, and program product based on denial-of-service attacks. Background Technology

[0002] Denial of Service (DoS) attacks refer to attackers attempting to stop a target machine from providing services. It is one of the commonly used attack methods by hackers. For example, by using legitimate service requests to consume excessive service resources, legitimate users cannot receive service responses.

[0003] To combat denial-of-service attacks, enterprise network systems are typically configured with corresponding defense functions. The defense strategy essentially involves setting a reasonable threshold for the traffic volume of various protocol types, serving as the upper limit for normal traffic. When the actual traffic volume detected in the network exceeds the set threshold, it is considered an anomaly, triggering the corresponding attack defense function.

[0004] The accuracy of attack detection depends on the reasonableness of the defense threshold setting. If the threshold is set too low, normal access traffic will be blocked. If the threshold is set too high, the system will not be able to detect the occurrence of attacks in time and take defensive measures, resulting in a high risk of network security.

[0005] Currently, existing baseline learning techniques typically learn from historical network traffic data over a given period to obtain a fixed learning result, and then set a fixed defense threshold based on this result. However, in some application scenarios, access traffic varies regularly over time. If a fixed defense threshold is used, the threshold may be too high at some times and too low at others. In summary, existing solutions lack accuracy and flexibility in setting thresholds for denial-of-service attacks. Summary of the Invention

[0006] The purpose of this application is to provide a threshold recommendation method, device, medium, and program product based on denial-of-service attacks, so as to improve the accuracy and flexibility of threshold setting for denial-of-service attacks.

[0007] In a first aspect, embodiments of this application provide a threshold recommendation method based on denial-of-service attacks, including:

[0008] Determine if the current time meets the preset threshold application triggering conditions, and retrieve several historical threshold learning results corresponding to the current time from the storage database based on the preset traffic change cycle;

[0009] The target threshold learning result at the current moment is determined based on the aforementioned historical threshold learning results;

[0010] Based on the learning results of the target threshold, the recommended threshold for the current moment is determined, and the recommended threshold is sent to the denial-of-service attack defense system.

[0011] The storage database records multiple threshold learning results obtained by statistical analysis according to a preset learning period. Each threshold learning result is obtained by statistical analysis based on the traffic rate data collected within the corresponding learning period.

[0012] In this embodiment, by statistically analyzing and storing the threshold learning results of traffic data according to a preset learning cycle, and by combining multiple historical threshold learning results with the traffic change cycle when the threshold needs to be adjusted, the final recommended threshold is determined, thereby effectively improving the accuracy and flexibility of threshold setting.

[0013] In some possible embodiments, the threshold recommendation method based on denial-of-service attacks further includes:

[0014] Real-time acquisition and recording of flow rate data arriving at the target system; statistical analysis and recording of key flow rate indicators corresponding to each learning period according to a preset learning cycle; wherein, the key flow rate indicators include the maximum flow rate and the average flow rate.

[0015] Determine the moment when the preset learning cycle indicator is reached, and calculate the corresponding flow rate standard deviation based on the flow rate data in the previous learning cycle period;

[0016] Based on the flow rate standard deviation, the threshold learning result corresponding to the previous learning cycle period is determined and recorded in the storage database in conjunction with the key flow rate indicator.

[0017] In this embodiment of the application, by statistically analyzing the maximum and average values ​​of flow rate data according to a preset learning period, and determining the corresponding threshold learning results based on the flow rate standard deviation and flow rate indicators, the accuracy of the defense threshold recommendation is further improved.

[0018] In some possible embodiments, determining the threshold learning result corresponding to the previous learning period based on the flow rate standard deviation and the key flow rate indicator includes:

[0019] If the standard deviation of the flow velocity is less than the first standard deviation threshold, the maximum flow velocity is determined as the threshold learning result corresponding to the previous learning cycle period.

[0020] If the standard deviation of the flow velocity is greater than or equal to the first standard deviation threshold and less than the preset second standard deviation threshold, the smaller value between the maximum flow velocity and the first outlier threshold value is determined as the threshold learning result corresponding to the previous learning cycle period.

[0021] If the standard deviation of the flow velocity is greater than or equal to the second standard deviation threshold, the smaller value between the maximum flow velocity and the second outlier threshold is determined as the threshold learning result corresponding to the previous learning cycle period.

[0022] Wherein, the first standard deviation threshold is less than the second standard deviation threshold, the first outlier limit is the sum of the average flow velocity and twice the standard deviation of the flow velocity, and the second outlier limit is the sum of the average flow velocity and the standard deviation of the flow velocity.

[0023] In this embodiment, different learning result calculation strategies are adopted based on the magnitude of the flow rate standard deviation during each learning cycle, thereby further improving the accuracy of defense threshold recommendation.

[0024] In some possible embodiments, after determining the threshold learning result corresponding to the previous learning period based on the key traffic rate indicator and recording it in the storage database, the method further includes:

[0025] If the denial-of-service attack defense system detects an attack on the target system, the threshold learning results recorded during the learning period corresponding to the time when the attack occurred will be marked as invalid results.

[0026] In this embodiment of the application, the accuracy of the defense threshold recommendation is further improved by invalidating the threshold learning results corresponding to the existence of attack behavior.

[0027] In some possible embodiments, determining that the current time meets the preset threshold application triggering condition includes:

[0028] If it is determined that the current time has reached the preset threshold application cycle indication time, then it is determined that the current time meets the preset threshold application trigger condition.

[0029] Alternatively, if it is determined that the current time has reached the preset threshold application time node, then it is determined that the current time meets the preset threshold application triggering condition.

[0030] In this embodiment of the application, the flexibility of setting the defense threshold is further improved by triggering the threshold application process according to a preset application cycle or a preset time point.

[0031] In some possible embodiments, determining the recommended threshold at the current moment based on the target threshold learning result and issuing the recommended threshold to the denial-of-service attack defense system includes:

[0032] The recommendation threshold for the current moment is determined based on the learning results of the target threshold;

[0033] If the recommended threshold is determined to be within the preset allowed configuration range, the recommended threshold is sent to the denial-of-service attack defense system.

[0034] If it is determined that the recommended threshold exceeds the preset allowed configuration range, a preset fixed threshold is sent to the denial-of-service attack defense system, or a reminder message to disable the defense function is sent to the denial-of-service attack defense system.

[0035] In this embodiment of the application, the reliability of threshold recommendation is further improved by performing conditional judgment on the determined recommendation threshold according to the preset distribution rules and executing different distribution processes according to different judgment conditions.

[0036] In some possible embodiments, determining the target threshold learning result at the current moment based on the plurality of historical threshold learning results includes:

[0037] The target threshold learning result at the current moment is determined based on the maximum value among the aforementioned historical threshold learning results.

[0038] In this embodiment of the application, the accuracy of the defense threshold configuration is improved by taking the maximum value of multiple historical threshold learning results at the current moment as the final target threshold learning result.

[0039] Secondly, embodiments of this application provide a threshold recommendation device based on a denial-of-service attack, comprising:

[0040] The threshold application triggering module is used to determine whether the preset threshold application triggering conditions are met at the current time, and to retrieve several historical threshold learning results corresponding to the current time from the storage database based on the preset traffic change cycle.

[0041] The learning result determination module is used to determine the target threshold learning result at the current moment based on the several historical threshold learning results;

[0042] The recommended threshold distribution module is used to determine the recommended threshold at the current moment based on the target threshold learning result, and distribute the recommended threshold to the denial-of-service attack defense system;

[0043] The storage database records multiple threshold learning results obtained by statistical analysis according to a preset learning period. Each threshold learning result is obtained by statistical analysis based on the traffic rate data collected within the corresponding learning period.

[0044] Thirdly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement the method described in any embodiment of the first aspect.

[0045] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0046] Fifthly, embodiments of this application provide a computer program product, the computer program product including a computer program, wherein when the computer program is executed by a processor, it can implement the method described in any embodiment of the first aspect. Attached Figure Description

[0047] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 A flowchart illustrating a threshold recommendation method based on a denial-of-service attack, provided for an embodiment of this application;

[0049] Figure 2 Another flowchart illustrating a threshold recommendation method based on a denial-of-service attack provided in this application embodiment;

[0050] Figure 3 A schematic diagram of a threshold recommendation device based on a denial-of-service attack provided in an embodiment of this application;

[0051] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0052] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0053] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0054] It should be noted that the defense threshold of a denial-of-service attack system refers to a critical value used to distinguish between normal and abnormal traffic. When the actual network traffic exceeds this value, the traffic is considered abnormal (and a denial-of-service attack may be present).

[0055] In the field of attack and defense configuration, existing baseline learning techniques typically involve learning from network traffic data over a period of time to generate a fixed learning result, and then calculating a recommended threshold based on this learning result for use in the security protection system.

[0056] However, in certain network environments, such as university campus networks, network traffic may steadily increase during the morning of a normal school day, and then surge dramatically during non-study periods after class, continuing into the evening, reaching its lowest point after midnight. Therefore, if a security defense system uses a fixed anomaly detection threshold, it will be unable to detect and respond to DoS attacks in a timely manner during periods of low traffic, while false alarms may occur during peak traffic periods, affecting normal traffic access. Thus, existing threshold recommendation schemes based on fixed learning results are not suitable for network scenarios with such significant cyclical changes in network traffic.

[0057] To address the problems existing in the prior art, this application provides a threshold recommendation method based on denial-of-service attacks. By periodically learning and generating threshold learning results for different time periods, and triggering a threshold update process at different time periods, a recommended threshold suitable for the current moment is determined based on historically stored threshold learning results and distributed to the security protection system, thereby effectively improving the accuracy and flexibility of threshold setting in the security protection system.

[0058] like Figure 1 As shown in the figure, this application embodiment provides a threshold recommendation method based on denial-of-service attacks, which may include the following steps:

[0059] S1. Determine if the current time meets the preset threshold application triggering condition, and retrieve several historical threshold learning results corresponding to the current time from the storage database based on the preset traffic change cycle. The storage database records multiple threshold learning results obtained by statistical analysis according to the preset learning cycle. Each threshold learning result is obtained by statistical analysis based on traffic rate data collected within the corresponding learning cycle period.

[0060] It should be noted that the solution of this application embodiment can be mainly divided into two parts. The first part is to collect traffic data in real time and calculate and store the threshold learning results periodically. The second part is to obtain the recommended threshold based on the stored learning results periodically and distribute it to the security protection system.

[0061] Specifically, the system can statistically analyze the collected traffic rate data and obtain threshold learning results according to a preset learning cycle, where each learning cycle corresponds to one threshold learning result. For example, the learning cycle can be configured from 5 minutes to 12 hours. As an example, when the learning cycle is configured to 5 minutes, statistics are performed every 5 minutes, and the obtained threshold learning results are recorded in the storage database.

[0062] When the preset threshold application trigger condition is met at the current moment, the threshold application process is triggered. This can be understood as the process of generating recommended thresholds and distributing them to the security protection system, or as the process of updating the thresholds of the security protection system.

[0063] When the threshold application is triggered, several historical threshold learning results are first retrieved from the storage database based on a preset traffic change period. The traffic change period refers to the period during which traffic changes show a clear pattern, and can be configured according to the traffic change pattern of the specific business scenario, such as 1 hour, 1 day, or 1 week.

[0064] In this way, based on the traffic change cycle, multiple historical threshold learning results with the same traffic characteristics over the same period can be obtained from historical storage. For example, assuming the storage database records threshold learning results from the past week, and the traffic change cycle is configured to be 1 day, then 7 historical threshold learning results corresponding to the current moment can be obtained from the storage database.

[0065] S2. Determine the target threshold learning result at the current moment based on several historical threshold learning results.

[0066] Specifically, based on the currently acquired historical threshold learning results, the corresponding target threshold learning result can be determined according to the preset calculation rules.

[0067] In some possible embodiments, step S2 may include:

[0068] The target threshold learning result at the current moment is determined based on the maximum value among several historical threshold learning results.

[0069] For example, the maximum value among several historical threshold learning results can be determined as the target threshold learning result at the current moment. In this way, the recommended threshold finally determined based on the target threshold learning result covers the maximum normal traffic situation learned in the past, but is not set too leniently, thus avoiding the situation where the security protection system cannot detect attack behavior in time.

[0070] For example, the average, median, etc. of several historical threshold learning results can also be used as the target threshold learning result at the current moment.

[0071] S3. Determine the recommended threshold at the current moment based on the target threshold learning result, and issue the recommended threshold to the denial-of-service attack defense system;

[0072] Specifically, the recommended threshold for the current moment can be determined by combining the preset tolerance / tolerance rate and the target threshold learning result. For example, the tolerance / tolerance rate can be configured to fluctuate by a certain percentage above or below the target threshold learning result (usually configured to be upward, for example, upward by 20%). This can be understood as follows: configuring an upward tolerance based on the target threshold learning result can prevent the security protection system from mistakenly blocking normal traffic due to an excessively low recommended threshold; while configuring a downward tolerance based on the target threshold learning result can maximize the timely detection of attack behavior through a relatively conservative recommended threshold, suitable for scenarios requiring strict security protection.

[0073] Finally, the currently determined recommended thresholds are sent to the Denial-of-Service Attack Defense System (Security Protection System) for defense strategy configuration.

[0074] Based on this, by statistically analyzing and storing the threshold learning results of traffic data according to a preset learning cycle, and then obtaining multiple historical threshold learning results in conjunction with the traffic change cycle when the preset application cycle is reached, the current recommended threshold is determined. This enables dynamic learning and configuration of the defense threshold of the security protection system, thereby effectively improving the accuracy and flexibility of threshold setting.

[0075] In some possible embodiments, the threshold recommendation method based on denial-of-service attacks may further include the steps of:

[0076] S101. Collect and record the flow rate data arriving at the target system in real time, and statistically record the key flow rate indicators corresponding to each learning period according to the preset learning period; among which, the key flow rate indicators include the maximum flow rate and the average flow rate.

[0077] S102. Determine the time when the preset learning cycle indication is reached at the current time, and calculate the corresponding flow rate standard deviation based on the flow rate data in the previous learning cycle period.

[0078] S103. Based on the standard deviation of the flow velocity and combined with the key indicators of flow rate, determine the threshold learning results corresponding to the previous learning cycle period and record them in the storage database.

[0079] It is understandable that steps S101 to S103 are the process of collecting traffic data in real time, calculating the threshold learning results periodically, and storing them.

[0080] Specifically, the target system refers to the object that needs security protection (against denial-of-service attacks). By monitoring all access traffic reaching the target system (traffic rate data), relevant indicators can be calculated and defense thresholds can be learned. Traffic rate data refers to the amount of traffic flowing through the target system per unit time; the statistical unit of the data can be pps, bps, etc.

[0081] It should be noted that during the collection of traffic rate data and the learning of thresholds, data collection and statistical learning can be performed separately according to different packet types (different traffic types). For example, different traffic types can include TCP, UDP, and HTTP. Correspondingly, the security protection system can also monitor and protect against different traffic types separately.

[0082] For the collected traffic rate data, a threshold learning process is executed according to a preset learning cycle to obtain the corresponding threshold learning results.

[0083] Specifically, the statistical window is first set as a learning cycle period (the time between two threshold learning sessions), and the maximum and average flow rates of each learning cycle period are recorded and updated in real time.

[0084] Then, when the preset learning cycle indication time is reached (the end time of a learning cycle period), that is, when the time between the current time and the last time the threshold learning was performed reaches the preset learning cycle (e.g., 5 minutes), a definite value can be obtained for the maximum and average flow rate of the previous learning cycle period (the learning cycle period that has just ended).

[0085] At this point, the standard deviation of the flow rate for the previous learning cycle can be calculated using the following formula: Where μ is the average flow rate during the learning cycle, n is the number of data samples in a single learning cycle, and x i This represents the flow rate at each sampling point during the learning cycle.

[0086] Finally, by combining the standard deviation of flow velocity and the key indicator of flow rate, the threshold learning result corresponding to the previous learning cycle can be calculated and recorded in the storage database. For example, the maximum flow velocity can be directly used as the threshold learning result for the current learning cycle, or the value calculated from the standard deviation of flow velocity and the maximum flow velocity using preset rules can be used as the threshold learning result. The specific settings can be configured according to business needs.

[0087] It should be noted that the threshold learning results of the stored database records can be aged based on preset rules, and expired data can be cleared in a timely manner to ensure that the data in the stored database has high timeliness.

[0088] It should be noted that the threshold learning results stored in the database can also generate corresponding charts to display to users, allowing them to intuitively see traffic change trends. These charts can be displayed according to different traffic types, statistical units, and other dimensions.

[0089] In some possible embodiments, step S103, determining the threshold learning result corresponding to the previous learning cycle period based on the flow rate standard deviation and the key flow rate indicator, may include:

[0090] S1031. When the standard deviation of the flow velocity is less than the first standard deviation threshold, the maximum flow velocity is determined as the threshold learning result corresponding to the previous learning cycle period.

[0091] S1032. When the standard deviation of the flow velocity is greater than or equal to the first standard deviation threshold and less than the preset second standard deviation threshold, the smaller value between the maximum flow velocity and the first outlier threshold value is determined as the threshold learning result corresponding to the previous learning cycle period.

[0092] S1033. When the standard deviation of the flow velocity is greater than or equal to the second standard deviation threshold, the smaller value between the maximum flow velocity and the second outlier threshold is determined as the threshold learning result corresponding to the previous learning cycle period.

[0093] Among them, the first standard deviation threshold is less than the second standard deviation threshold, the first outlier limit is the sum of the average flow velocity and twice the standard deviation of the flow velocity, and the second outlier limit is the sum of the average flow velocity and the standard deviation of the flow velocity.

[0094] It is understandable that the flow rate data collected during each learning cycle period conforms to a normal distribution. The flow rate of most sampling points is close to the average flow rate, while there are a few fluctuations that differ significantly from the average flow rate.

[0095] It should be noted that by calculating the standard deviation of the flow rate for each learning cycle period, different learning result acquisition strategies can be adopted based on the flow rate fluctuations during each learning cycle period.

[0096] Specifically, when the standard deviation of the flow rate is less than the first standard deviation threshold, it indicates that the flow rate fluctuation is relatively stable during the learning period. At this time, the maximum flow rate can be directly determined as the threshold learning result corresponding to the learning period.

[0097] When the standard deviation of the flow velocity is greater than or equal to the first standard deviation threshold and less than the preset second standard deviation threshold (the first standard deviation threshold is less than the second standard deviation threshold), it indicates that the flow rate fluctuates during this learning period. The smaller value between the maximum flow velocity and the first outlier threshold can be used to determine the threshold learning result for this learning period. The first outlier threshold is the sum of the average flow velocity and twice the standard deviation of the flow velocity (μ+2σ).

[0098] When the standard deviation of the flow velocity is greater than the preset second standard deviation threshold (the first standard deviation threshold is less than the second standard deviation threshold), it indicates that there is a large fluctuation in the flow rate during this learning period. The smaller value between the maximum flow velocity and the second outlier threshold can be used to determine the threshold learning result for this learning period. The second outlier threshold is the sum of the average flow velocity and one standard deviation of the flow velocity (μ + σ).

[0099] Understandably, in a normal distribution, approximately 95.5% of the data lies between two standard deviations and the mean, and approximately 68.3% lies between one standard deviation and the mean. Therefore, when the standard deviation is small (between the first and second standard deviation thresholds), two standard deviations can be considered the boundary between normal values ​​and outliers. When the standard deviation is large (greater than the second standard deviation threshold), one standard deviation can be considered the boundary between normal values ​​and outliers.

[0100] It should be noted that the values ​​of the first standard deviation threshold and the second standard deviation threshold can be set according to the specific business scenario.

[0101] Based on this, by employing different learning result calculation strategies according to the magnitude of the flow rate standard deviation during the learning cycle, the accuracy of defense threshold recommendations can be further improved.

[0102] In some possible embodiments, after determining the threshold learning result corresponding to the previous learning period by combining the key traffic rate indicator and recording it in the storage database, the method further includes:

[0103] When the denial-of-service attack defense system detects an attack on the target system, the threshold learning results recorded during the learning period corresponding to the time when the attack occurred are marked as invalid results.

[0104] It should be noted that existing baseline learning techniques often lack consideration for screening the basic data. Even when attack behavior is detected, the corresponding abnormal data is still used for baseline learning, resulting in low accuracy of the learning results.

[0105] In this embodiment of the application, since baseline learning is supported while traffic attack detection is performed, when the denial-of-service attack defense system (security protection system) detects an attack, the threshold learning results recorded in one or more learning period periods corresponding to the time when the attack occurred (the time when the attack was detected) can be marked as invalid results.

[0106] In this way, when calculating the recommendation threshold later, we can first filter out the threshold learning results marked as invalid, and then obtain the historical threshold learning results and calculate the recommendation threshold.

[0107] Based on this, by invalidating the threshold learning results corresponding to the existence of attack behavior, the impact of abnormal learning results on the subsequent calculation of recommended thresholds is avoided, thereby further improving the accuracy of defense threshold recommendation.

[0108] In some possible embodiments, step S1, determining that the current time meets the preset threshold application triggering condition, may include:

[0109] If it is determined that the current time has reached the preset threshold application cycle indication time, then it is determined that the current time meets the preset threshold application trigger condition.

[0110] Alternatively, if it is determined that the current time has reached the preset threshold application time node, then it is determined that the current time meets the preset threshold application triggering condition.

[0111] Specifically, a fixed threshold application period can be set, and the threshold application process can be triggered according to the set threshold application period to periodically calculate recommended thresholds and distribute them to the security protection system. It should be noted that the threshold application period can be configured to be consistent with the learning period mentioned above, such as 5 minutes to 12 hours, or it can be configured to be a different period than the learning period.

[0112] It's worth noting that, in addition to calculating and issuing recommended thresholds according to the preset threshold application cycle, you can also set specific application times for updating defense thresholds based on your needs. For example, you can configure 9:00, 12:00, 18:00, and 23:00 daily as threshold application times. This not only allows you to promptly issue and apply recommended thresholds to the security system as needed, but also avoids wasting resources due to frequent calculations of recommended thresholds.

[0113] Based on this, the flexibility of defense threshold settings is further improved by triggering the threshold application process according to a preset application cycle or preset application time point.

[0114] In some possible embodiments, step S3, determining the recommended threshold at the current moment based on the target threshold learning result and issuing the recommended threshold to the denial-of-service attack defense system, may include:

[0115] S301. Determine the recommendation threshold for the current moment based on the learning results of the target threshold;

[0116] S302. If it is determined that the recommended threshold is within the preset allowed configuration range, issue the recommended threshold to the denial-of-service attack defense system.

[0117] S303. If it is determined that the recommended threshold exceeds the preset allowed configuration range, send a preset fixed threshold to the denial-of-service attack defense system, or send a reminder message to the denial-of-service attack defense system to disable the defense function.

[0118] It should be noted that after obtaining the recommendation threshold at the current moment, you can also configure the distribution rules to adaptively process the recommendation threshold.

[0119] Specifically, by configuring a preset allowable range, when the recommended threshold is within the allowable range, the recommended threshold is directly issued; when the recommended threshold exceeds the allowable range, it is issued to the denial-of-service attack defense system based on a preset fixed threshold, thereby preventing interference from miscellaneous packets; or, when the recommended threshold exceeds the allowable range, mainly when it exceeds the lower limit of the allowable range, a reminder message to disable the defense function can be issued to make the denial-of-service attack defense system disable its detection or defense function.

[0120] Based on this, the reliability of threshold recommendation is further improved by performing conditional judgments on the determined recommendation threshold according to preset distribution rules and executing different distribution processes according to different judgment situations.

[0121] The following specific examples illustrate the threshold recommendation method based on denial-of-service attacks proposed in this application in detail. Please refer to... Figure 2 The embodiments of this application mainly include the following steps:

[0122] M1, Data Traffic Statistics:

[0123] 1. Packets entering the firewall can support various types of traffic. This example uses the HTTP type for illustration.

[0124] 2. If the threshold self-learning function is enabled and no attack is detected at this time, proceed to the subsequent threshold learning process; if self-learning is disabled or an attack has been detected, the threshold learning process stops.

[0125] 3. Traffic identification: The denial-of-service attack defense system supports attack defense for multiple traffic types. Threshold learning supports learning for multiple traffic types separately. Here, data collection and threshold learning are performed for traffic identified as HTTP type.

[0126] 4. If the threshold learning function for HTTP type traffic is enabled, the subsequent learning process will begin; if the threshold learning function is disabled, this type of traffic will not be learned; the traffic type for baseline learning can be selected by the user.

[0127] 5. Record traffic data, including the maximum, minimum, and average values ​​of traffic flow rate according to different traffic types; the units for flow rate data support pps, bps, etc.

[0128] M2, learning data storage:

[0129] 1. Cache the traffic data recorded by the M1 module for subsequent analysis and processing by other modules;

[0130] 2. Store the threshold learning results calculated by the M3 module for display to users and for subsequent strategy applications.

[0131] M3, Learning Data Processing:

[0132] 1. At the end of each learning cycle or when learning stops, the collected and statistical data of the current learning cycle will be integrated.

[0133] 2. Remove spikes and integrate the data. Calculate the standard deviation and apply different strategies based on the magnitude of the standard deviation to calculate the threshold learning results.

[0134] 3. The integrated learning results are stored in the M2 storage module, and the integrated cached data is aged out in a timely manner.

[0135] M4, Application of Learning Strategies:

[0136] 1. Once the application status is enabled and the application cycle has been reached, the strategy is dynamically applied. The application cycle can be set to be consistent with the learning cycle mentioned above.

[0137] 2. Combine traffic change cycle to obtain corresponding learning results. Users can configure the traffic change cycle according to the traffic change pattern of the actual network environment. For example, it can be configured as 1 hour, 1 day, 1 week, etc. Assuming that the system has learned and recorded the threshold learning results for a total duration of 1 week, and the traffic change cycle is configured as 1 day, then when obtaining the threshold learning results at the current time (10:00), the 7 data points at 10:00 in the week will be retrieved respectively.

[0138] 3. Following the example above, the maximum value among the 7 overlapping data points can be taken as the target threshold learning result at the current time.

[0139] 4. Calculate the recommendation threshold by combining the preset tolerance or tolerance rate; for example, if the tolerance rate is configured to be increased by 60%, the target threshold learning result is multiplied by 160% to obtain the recommendation threshold.

[0140] 5. If the recommended threshold exceeds the preset maximum allowable threshold, the preset maximum allowable threshold will be issued; if the recommended threshold is lower than the preset minimum allowable threshold, the detection or defense function can be turned off and attack detection will no longer be performed; or, if the recommended threshold is lower than the set threshold (minimum allowable threshold), the set defense threshold will be issued to prevent interference from miscellaneous packets; otherwise, the recommended threshold will be issued directly.

[0141] Please refer to Figure 3 , Figure 3 The diagram illustrates a block diagram of a threshold recommendation apparatus based on denial-of-service attacks, provided in some embodiments of this application. It should be understood that this threshold recommendation apparatus based on denial-of-service attacks is similar to the one described above. Figure 1 Corresponding to the method embodiments, it is able to perform each step involved in the above method embodiments. The specific functions of the threshold recommendation device based on denial-of-service attacks can be found in the description above. To avoid repetition, detailed descriptions are appropriately omitted here.

[0142] Figure 3 The threshold recommendation device based on denial-of-service attacks includes at least one software functional module that can be stored in memory or embedded in the threshold recommendation device based on denial-of-service attacks in the form of software or firmware. The threshold recommendation device based on denial-of-service attacks includes:

[0143] The threshold application triggering module 310 is used to determine whether the current time meets the preset threshold application triggering conditions, and to obtain several historical threshold learning results corresponding to the current time from the storage database based on the preset traffic change cycle.

[0144] The learning result determination module 320 is used to determine the target threshold learning result at the current moment based on several historical threshold learning results.

[0145] The recommendation threshold distribution module 330 is used to determine the recommendation threshold at the current moment based on the target threshold learning result, and distribute the recommendation threshold to the denial-of-service attack defense system;

[0146] The storage database contains multiple threshold learning results obtained by statistical analysis according to a preset learning period. Each threshold learning result is obtained by statistical analysis based on the traffic rate data collected within the corresponding learning period.

[0147] It is understood that the above-described device embodiments correspond to the method embodiments of the present invention. The threshold recommendation device based on denial-of-service attacks provided by the embodiments of the present invention can implement the threshold recommendation method based on denial-of-service attacks provided by any one of the method embodiments of the present invention.

[0148] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the aforementioned method, and will not be elaborated further here.

[0149] like Figure 4 As shown, some embodiments of this application provide an electronic device 400, which includes: a memory 410, a processor 420, and a computer program stored on the memory 410 and executable on the processor 420, wherein when the processor 420 reads the program from the memory 410 via a bus 430 and executes the program, it can implement any of the methods included in the above-described threshold recommendation method based on denial-of-service attacks.

[0150] Processor 420 can process digital signals and may include various computing architectures. For example, it may be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 420 may be a microprocessor.

[0151] Memory 410 can be used to store instructions executed by processor 420 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all of the functions of one or more modules described in the embodiments of this application. The processor 420 of this disclosure embodiment can be used to execute instructions in memory 410 to implement the methods shown above. Memory 410 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0152] Some embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, describes the method described in the method embodiments.

[0153] Some embodiments of this application also provide a computer program product that, when run on a computer, causes the computer to perform the methods described in the method embodiments.

[0154] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For apparatus embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0155] It should be understood, in the several embodiments provided in this application, that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0156] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0157] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0158] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0159] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0160] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A threshold recommendation method based on denial-of-service attacks, characterized in that, include: Determine if the current time meets the preset threshold application triggering conditions, and retrieve several historical threshold learning results corresponding to the current time from the storage database based on the preset traffic change cycle; The target threshold learning result at the current moment is determined based on the aforementioned historical threshold learning results; Based on the learning results of the target threshold, the recommended threshold for the current moment is determined, and the recommended threshold is sent to the denial-of-service attack defense system. The storage database records multiple threshold learning results obtained by statistical analysis according to a preset learning period. Each threshold learning result is obtained by statistical analysis based on the traffic rate data collected within the corresponding learning period.

2. The threshold recommendation method based on denial-of-service attacks according to claim 1, characterized in that, Also includes: Real-time acquisition and recording of flow rate data arriving at the target system; statistical analysis and recording of key flow rate indicators corresponding to each learning period according to a preset learning cycle; wherein, the key flow rate indicators include the maximum flow rate and the average flow rate. Determine the moment when the preset learning cycle indicator is reached, and calculate the corresponding flow rate standard deviation based on the flow rate data in the previous learning cycle period; Based on the flow rate standard deviation, the threshold learning result corresponding to the previous learning cycle period is determined and recorded in the storage database in conjunction with the key flow rate indicator.

3. The threshold recommendation method based on denial-of-service attacks according to claim 1, characterized in that, The step of determining the threshold learning result corresponding to the previous learning cycle period based on the flow velocity standard deviation and the key flow rate indicator includes: If the standard deviation of the flow velocity is less than the first standard deviation threshold, the maximum flow velocity is determined as the threshold learning result corresponding to the previous learning cycle period. If the standard deviation of the flow velocity is greater than or equal to the first standard deviation threshold and less than the preset second standard deviation threshold, the smaller value between the maximum flow velocity and the first outlier threshold value is determined as the threshold learning result corresponding to the previous learning cycle period. If the standard deviation of the flow velocity is greater than or equal to the second standard deviation threshold, the smaller value between the maximum flow velocity and the second outlier threshold is determined as the threshold learning result corresponding to the previous learning cycle period. Wherein, the first standard deviation threshold is less than the second standard deviation threshold, the first outlier limit is the sum of the average flow velocity and twice the standard deviation of the flow velocity, and the second outlier limit is the sum of the average flow velocity and the standard deviation of the flow velocity.

4. The threshold recommendation method based on denial-of-service attacks according to claim 2, characterized in that, After determining the threshold learning result corresponding to the previous learning cycle period by combining the key traffic rate indicators and recording it in the storage database, the method further includes: If the denial-of-service attack defense system detects an attack on the target system, the threshold learning results recorded during the learning period corresponding to the time when the attack occurred will be marked as invalid results.

5. The threshold recommendation method based on denial-of-service attacks according to claim 1, characterized in that, The determination of whether the preset threshold application triggering condition is met at the current time includes: If it is determined that the current time has reached the preset threshold application cycle indication time, then it is determined that the current time meets the preset threshold application trigger condition. Alternatively, if it is determined that the current time has reached the preset threshold application time node, then it is determined that the current time meets the preset threshold application triggering condition.

6. The threshold recommendation method based on denial-of-service attacks according to claim 1, characterized in that, The step of determining the recommended threshold at the current moment based on the learning result of the target threshold and issuing the recommended threshold to the denial-of-service attack defense system includes: The recommendation threshold for the current moment is determined based on the learning results of the target threshold; If the recommended threshold is determined to be within the preset allowed configuration range, the recommended threshold is sent to the denial-of-service attack defense system. If it is determined that the recommended threshold exceeds the preset allowed configuration range, a preset fixed threshold is sent to the denial-of-service attack defense system, or a reminder message to disable the defense function is sent to the denial-of-service attack defense system.

7. The threshold recommendation method based on denial-of-service attacks according to claim 1, characterized in that, The step of determining the target threshold learning result at the current moment based on the plurality of historical threshold learning results includes: The target threshold learning result at the current moment is determined based on the maximum value among the aforementioned historical threshold learning results.

8. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the program, it can implement the threshold recommendation method based on any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the threshold recommendation method based on a denial-of-service attack as described in any one of claims 1-7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the threshold recommendation method based on denial-of-service attacks as described in any one of claims 1-7.

Images