Defense method and device for distributed denial of service attack

Abstract

The invention relates to the technical field of servers, and discloses a distributed denial of service attack defense method and device, and the method comprises the steps: obtaining an access traffic value of a target resource which is deployed with a plurality of defense components; when the access traffic value is within the access traffic value threshold range corresponding to the plurality of defense components, determining a target defense component corresponding to the access traffic value from the plurality of defense components; and a cleaning instruction is sent to the target defense component, and the target defense component cleans the access traffic according to the cleaning instruction. The access flow value of the target resource is acquired in real time, the target defense component corresponding to the access flow value is dynamically selected according to the access flow value, and the cleaning instruction is sent to the selected target defense component to instruct the target defense component to clean the access flow, so that the defense strategy can be adjusted in time according to different attack intensities, and the defense efficiency is improved. And calling different access components to clean the access traffic.

Description

Technical Field

[0001] The present invention relates to the technical field of servers, and in particular to a method and device for defending against distributed denial of service attacks. Background Art

[0002] DDoS (Distributed Denial of Service) attacks are a common network threat in which attackers attempt to flood the target server or network, occupy its resources, and cause service unavailability. There are already a variety of anti-DDoS products (defense components) that can detect and mitigate DDoS attacks, but due to localized multi-point deployment, they are usually scattered and cannot work together. Summary of the invention

[0003] In view of this, the present invention provides a method, apparatus, computer device, storage medium, and computer program product for defending against distributed denial of service attacks to solve the problem of how to coordinate multiple defense components to defend against DDoS attacks.

[0004] In a first aspect, the present invention provides a method for defending against a distributed denial of service attack, the method comprising:

[0005] Obtain the access traffic value of the target resource, where multiple defense components are deployed;

[0006] When the access flow value is within the access flow value threshold range corresponding to the multiple defense components, determining a target defense component corresponding to the access flow value from the multiple defense components;

[0007] A cleaning instruction is sent to the target defense component, wherein the target defense component cleans the access traffic according to the cleaning instruction.

[0008] The present invention provides a method for defending against distributed denial of service attacks, which has the following advantages:

[0009] By obtaining the access flow value of the target resource in real time and dynamically selecting the corresponding target defense component according to the access flow value, the system can send a cleaning instruction to the selected target defense component to instruct the target defense component to clean the access flow, thereby adjusting the defense strategy in time according to different attack intensities and calling different access components to clean the access flow. The system's adaptability to different attack modes is enhanced, and multiple defense components are coordinated to clean access flows within different threshold ranges, effectively improving the flexibility and response speed of defense.

[0010] In an optional implementation, when the access traffic value and the access traffic value thresholds corresponding to the plurality of defense components are within a range, determining a target defense component corresponding to the access traffic value from the plurality of defense components includes:

[0011] Match the access flow value with the access flow value threshold range corresponding to each defense component to determine the target access flow value threshold range corresponding to the access flow value;

[0012] Determine the defense component corresponding to the target access traffic value threshold range as the target defense component.

[0013] In an optional implementation, obtaining the access flow value of the target resource includes:

[0014] Establishing a first communication connection with a first defense component, where the first defense component is any one of the multiple defense components;

[0015] Based on the first communication connection, an access flow value detected by the first defense component is received.

[0016] In an optional embodiment, the method further includes:

[0017] Acquire the communication interface of the target cloud bank and establish a second communication connection with the communication interface;

[0018] When the access traffic value is greater than the maximum threshold of the access traffic value threshold range, a call request including the access traffic value is sent to the target cloud dike through the second communication connection, and the call request instructs the target cloud dike to clean the access traffic according to the access traffic value in the call request.

[0019] In an optional embodiment, the method further includes:

[0020] Aggregate the access traffic value with the historical access traffic value used to request the target resource to obtain an aggregation result;

[0021] Determine an expected value and an expected time of a future access traffic value for requesting a target resource based on the aggregation result;

[0022] According to the expected value, determining an expected defense component corresponding to the future access traffic value from multiple defense components;

[0023] An expected instruction is sent to the expected defense component, where the expected instruction includes an expected time and is used to instruct the expected defense component to clean access traffic at the expected time.

[0024] In an optional embodiment, the method further includes:

[0025] When the access flow value is within the access flow value threshold range corresponding to the plurality of defense components, a first alarm notification is generated, the first alarm notification including: resource information of the target resource, the access flow value and access information corresponding to the access flow value;

[0026] Sending the first alarm notification to the monitoring terminal;

[0027] When the access flow value is greater than the maximum threshold of the access flow value threshold range, a second alarm notification is generated, the second alarm notification including: resource information of the target resource, the access flow value and access information corresponding to the access flow value, and cloud bank information of the target cloud bank;

[0028] The second alarm notification is sent to the monitoring end.

[0029] In a second aspect, the present invention provides a distributed denial of service attack defense device, the device comprising:

[0030] The acquisition module is used to obtain the access traffic value of the target resource, and the target resource is deployed with multiple defense components;

[0031] A determination module, used to determine a target defense component corresponding to the access flow value from the multiple defense components when the access flow value is within the access flow value threshold range corresponding to the multiple defense components;

[0032] The sending module is used to send a cleaning instruction to the target defense component, wherein the target defense component cleans the access traffic according to the cleaning instruction.

[0033] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the distributed denial of service attack defense method of the above-mentioned first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0034] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to cause a computer to execute the method for defending against distributed denial of service attacks of the first aspect or any corresponding embodiment thereof.

[0035] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions for causing a computer to execute the method for defending against distributed denial of service attacks of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1A defense platform for distributed denial of service attacks according to an embodiment of the present invention;

[0038] Figure 2 is one of the flow charts of the method for defending against distributed denial of service attacks according to an embodiment of the present invention;

[0039] Figure 3 This is a second flowchart of a method for defending against a distributed denial of service attack according to an embodiment of the present invention;

[0040] Figure 4 is a schematic diagram of a defense device for a distributed denial of service attack according to an embodiment of the present invention;

[0041] Figure 5 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0043] According to an embodiment of the present invention, an embodiment of a method for defending against a distributed denial of service attack is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0044] Figure 1 A distributed denial of service attack defense platform according to an embodiment of the present invention is provided. Figure 1 As shown, the platform includes: an authentication module, an interface module, a data processing module, a data configuration module, a configuration delivery module, a registration center, a message bus, a data storage module (including an instance database, a configuration database, a cache database), and a front end.

[0045] The authentication module is used to log in to the defense components in multiple resources to configure defense strategies. The interface module is used to connect to the cloud barrier interface and call the cloud barrier to clean access traffic. The registration center is used to register user permissions. The data processing module is used to process user instructions or access traffic values. The data configuration module is used to configure the traffic threshold range of each defense component. The configuration delivery module is used to issue cleaning instructions to each defense component. The message bus is used to receive event logs corresponding to the access traffic values ​​detected by each defense component and store them in the instance database in the data storage module. The cache database is used to store frequently accessed data. The configuration database is used to store configuration data.

[0046] In this embodiment, a distributed denial of service attack defense method is provided, which can be used for the above-mentioned defense platform. Figure 2 : is a flow chart of a method for defending against a distributed denial of service attack according to an embodiment of the present invention. Figure 2 As shown, the above method includes:

[0047] Step S201, obtaining the access flow value of the target resource, where the target resource is deployed with multiple defense components.

[0048] In this embodiment, the target resource may be a resource that needs to be monitored among the above-mentioned multiple resources, and may be a server, a website, or other network service resource. The access flow value may be the number, frequency, size, etc. of flow data requesting the target resource. Multiple defense components may detect the access flow value of the target resource in real time and synchronize it to the defense platform.

[0049] Step S202: When the access traffic value is within the access traffic value threshold range corresponding to the multiple defense components, a target defense component corresponding to the access traffic value is determined from the multiple defense components.

[0050] In this embodiment, different access flow value threshold ranges are set for multiple defense components respectively. When the access flow value falls into the access flow value threshold range of a defense component, the defense component is used as a target defense component.

[0051] Step S203, sending a cleaning instruction to the above-mentioned target defense component.

[0052] In this embodiment, the target defense component cleans the access traffic according to the cleaning instruction. Each defense component has a detection function and a cleaning function. After determining the access traffic corresponding to the access traffic value, the cleaning function of the target component can be called to clean the access traffic.

[0053] The present invention provides a method for defending against distributed denial of service attacks, which has the following advantages:

[0054] By obtaining the access flow value of the target resource in real time and dynamically selecting the corresponding target defense component according to the access flow value, the system can send a cleaning instruction to the selected target defense component to instruct the target defense component to clean the access flow, thereby adjusting the defense strategy in time according to different attack intensities and calling different access components to clean the access flow. The system's adaptability to different attack modes is enhanced, and multiple defense components are coordinated to clean access flows within different threshold ranges, effectively improving the flexibility and response speed of defense.

[0055] In some optional implementations, when the access traffic value is within a threshold range of the access traffic value corresponding to the multiple defense components, determining a target defense component corresponding to the access traffic value from the multiple defense components includes:

[0056] Match the access traffic value with the access traffic value threshold range corresponding to each defense component, determine the target access traffic value threshold range corresponding to the access traffic value; determine that the defense component corresponding to the target access traffic value threshold range is the target defense component.

[0057] In this embodiment, the current access traffic value of the target resource is obtained, and the target traffic value is matched with the traffic value threshold range set by each defense component to determine which defense component's threshold range is suitable for processing the current traffic. After determining the matching threshold range, the defense component corresponding to the threshold range is determined as the target defense component, and the subsequent traffic cleaning task is handed over to the target defense component for processing.

[0058] The defense method for distributed denial of service attacks in this embodiment can avoid defense failure or reduced efficiency due to traffic overload by dynamically selecting appropriate defense components to deal with different traffic situations. Each defense component will only process the traffic range it is good at to maximize the use of resources. Based on precise threshold matching, the system can clean traffic more effectively, accurately identify and filter out attack traffic, while ensuring the rapid passage of normal traffic. Reasonable distribution of traffic to appropriate defense components avoids excessive load on a single defense component and improves the availability and reliability of the defense system.

[0059] In some optional implementations, obtaining the access traffic value of the target resource includes:

[0060] A first communication connection is established with a first defense component, where the first defense component is any one of the multiple defense components; based on the first communication connection, the access traffic value detected by the first defense component is received.

[0061] In this embodiment, the communication connection can be to connect the detection function of the first defense component with the above-mentioned defense platform through a message bus. Through the first communication connection, the system can obtain real-time data of traffic detection from the defense component. These data include access traffic values, that is, traffic information of the current target resource, which may include characteristics such as the number, frequency, and size of requests. Based on this information, the system can further evaluate the characteristics of the traffic and determine whether there is a risk of DDoS attack.

[0062] In the defense method for distributed denial of service attacks in this embodiment, the system can obtain access traffic data of target resources in real time by communicating with multiple defense components. This real-time performance provides an effective basis for subsequent attack identification and defense decisions, and can quickly respond and reduce the impact of attacks. Not only can data be obtained from one defense component, but one defense component can be selected from multiple defense components for real-time traffic monitoring, which makes the defense system more flexible.

[0063] In some optional embodiments, Figure 3 Flowchart 2 of the method for defending against a distributed denial of service attack according to an embodiment of the present invention, the method further includes:

[0064] Step S204, obtaining the communication interface of the target cloud bank, and establishing a second communication connection with the above communication interface;

[0065] Step S205, when the access traffic value is greater than the maximum threshold of the access traffic value threshold range, a call request including the access traffic value is sent to the target cloud embankment through the second communication connection.

[0066] The above-mentioned calling request instructs the above-mentioned target cloud embankment to clean the above-mentioned access traffic according to the above-mentioned access traffic value in the above-mentioned calling request.

[0067] In this embodiment, the target cloud bank can be the cloud bank of the upstream node corresponding to the target resource. By establishing a communication connection with the cloud bank, the traffic cleaning operation can be monitored and controlled in real time. The maximum threshold is the maximum value of the threshold range of all access traffic values. At this time, the defense component cannot clean the access traffic and the cloud bank of the upstream node is required to clean it.

[0068] The defense method for distributed denial of service attacks in this embodiment can quickly respond to traffic anomalies, start the traffic cleaning process in time, reduce the impact of DDoS attacks on the target system, and improve the real-time and automation of defense. Through the second communication connection with Yunti, the system can outsource the traffic cleaning task to Yunti, make full use of Yunti's distributed cleaning capabilities, and enhance the overall defense effect. With the synergy of Yunti, the overall defense system can resist larger-scale and more complex DDoS attacks and effectively protect the availability and stability of the target system.

[0069] In some optional implementations, the above method further includes:

[0070] Aggregate the above-mentioned access traffic value with the historical access traffic value of the historical access traffic used to request the above-mentioned target resource to obtain an aggregation result; determine the expected value and expected time of the future access traffic value of the future access traffic used to request the above-mentioned target resource based on the aggregation result; determine the expected defense component corresponding to the above-mentioned future access traffic value from the above-mentioned multiple defense components based on the above-mentioned expected value; send an expected instruction to the above-mentioned expected defense component, the above-mentioned expected instruction includes the above-mentioned expected time, and is used to instruct the above-mentioned expected defense component to clean the above-mentioned access traffic according to the above-mentioned expected time.

[0071] In this embodiment, the aggregation result can be based on the access traffic records for the target resources over a period of time, identifying the trend and pattern of the traffic, combining the current access traffic value with the historical access traffic data, and performing aggregation analysis. By analyzing the aggregation results, the system can predict the access traffic at a certain moment or time period in the future. Based on historical data and traffic trends, the system can determine the predicted time period, that is, at a certain moment in the future, the access traffic is expected to reach a peak. Based on the predicted future access traffic value and time, the system will select a most suitable expected defense component for protection. For example, if it is predicted that the traffic will surge in a certain period of time, the system can select a high-load, high-performance defense component in advance to undertake the upcoming traffic. The expected instruction is sent to the expected defense component, and the instruction includes the expected time, which is used to instruct the expected defense component to start the cleaning task at a specific time.

[0072] The defense method for distributed denial of service attacks in this embodiment can achieve more intelligent protection by analyzing historical traffic and predicting future traffic, and shift from passive response to attacks to active prediction and preparation, thereby improving the response time and accuracy of DDoS attacks. It can effectively reduce false alarms and misjudgments caused by sudden traffic fluctuations, avoid the mistaken cleaning of normal traffic, and improve the accuracy of the system. By aggregating historical traffic data, performing predictive analysis, and generating instructions, the entire defense process is more automated and intelligent, reducing manual intervention, and improving the system's response speed and anti-attack capabilities.

[0073] In some optional implementations, the above method further includes:

[0074] When the access traffic value is within the access traffic value threshold range corresponding to the multiple defense components, a first alarm notification is generated, and the first alarm notification includes: resource information of the target resource, the access traffic value and the access information corresponding to the access traffic value; the first alarm notification is sent to the monitoring end; when the access traffic value is greater than the maximum threshold of the access traffic value threshold range, a second alarm notification is generated, and the second alarm notification includes: resource information of the target resource, the access traffic value and the access information corresponding to the access traffic value, and cloud bank information of the target cloud bank; the second alarm notification is sent to the monitoring end.

[0075] In this embodiment, the resource information may be information about the target resource affected by the access traffic, such as the server address, the target service name, or the specific type of resource (e.g., a web server, a database, etc.). The access information may be detailed information about the source of the access traffic, the access mode, the access time, etc., to help analyze whether it is a normal access or a potential attack. When the above-mentioned access traffic value is greater than the maximum threshold of the access traffic value threshold range, the cloud bank information of the target cloud bank also needs to be added to the second alarm notification and sent to the monitoring end.

[0076] The defense method for distributed denial of service attacks in this embodiment generates a first alarm notification and a second alarm notification according to different threshold ranges of traffic, so that the system can carefully distinguish between normal fluctuations in traffic and potential attack behaviors. The first alarm notification is applicable when the traffic is within the threshold range, reminding the operation and maintenance personnel to pay attention to traffic anomalies and deal with them in a timely manner; while the second alarm notification is issued when the traffic exceeds the maximum threshold, indicating that there is serious abnormal traffic and that protective measures may need to be taken immediately. Each alarm notification contains detailed resource information (such as the address of the target server, service type) and access information (such as traffic source, access mode, time, etc.). This information helps to more accurately determine whether the traffic comes from legitimate users or possible attack traffic, greatly improving the accuracy of traffic analysis and response.

[0077] The present invention provides a defense device for distributed denial of service attacks. Figure 4 1 is a schematic diagram of a defense device for a distributed denial of service attack according to an embodiment of the present invention, the device comprising:

[0078] The acquisition module 401 is used to acquire the access flow value of the target resource, where multiple defense components are deployed.

[0079] A determination module 402, configured to determine a target defense component corresponding to the access flow value from the multiple defense components when the access flow value is within the access flow value threshold range corresponding to the multiple defense components;

[0080] The sending module 403 is used to send a cleaning instruction to the above-mentioned target defense component, wherein the above-mentioned target defense component cleans the access traffic according to the above-mentioned cleaning instruction.

[0081] The invention provides a distributed denial of service attack defense device, which has the following advantages:

[0082] By obtaining the access flow value of the target resource in real time and dynamically selecting the corresponding target defense component according to the access flow value, the system can send a cleaning instruction to the selected target defense component to instruct the target defense component to clean the access flow, thereby adjusting the defense strategy in time according to different attack intensities and calling different access components to clean the access flow. The system's adaptability to different attack modes is enhanced, and multiple defense components are coordinated to clean access flows within different threshold ranges, effectively improving the flexibility and response speed of defense.

[0083] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0084] The distributed denial of service attack defense device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0085] The embodiment of the present invention also provides a computer device having the above Figure 4 The defense device against distributed denial of service attacks is shown.

[0086] See also Figure 5 , Figure 5 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 5 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 5A processor 10 is taken as an example.

[0087] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include an integrated circuit. The integrated circuit may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0088] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0089] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0090] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0091] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0092] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0093] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0094] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for defending against distributed denial of service attacks, characterized in that: The method comprises: Obtaining an access flow value of a target resource, where a plurality of defense components are deployed; When the access flow value is within the access flow value threshold range corresponding to the multiple defense components, determining a target defense component corresponding to the access flow value from the multiple defense components; A cleaning instruction is sent to the target defense component, wherein the target defense component cleans access traffic according to the cleaning instruction.

2. The method according to claim 1, characterized in that The determining, when the access flow value and the access flow value thresholds corresponding to the plurality of defense components are within the range of the access flow value, a target defense component corresponding to the access flow value from the plurality of defense components comprises: Matching the access flow value with the access flow value threshold range corresponding to each defense component, and determining the target access flow value threshold range corresponding to the access flow value; Determine the defense component corresponding to the target access traffic value threshold range as the target defense component.

3. The method according to claim 1, characterized in that Get the access traffic value of the target resource, including: Establishing a first communication connection with a first defense component, where the first defense component is any one of the multiple defense components; Based on the first communication connection, the access traffic value detected by the first defense component is received.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Acquire a communication interface of a target cloud bank, and establish a second communication connection with the communication interface; When the access traffic value is greater than the maximum threshold of the access traffic value threshold range, a call request including the access traffic value is sent to the target cloud bank through the second communication connection, and the call request instructs the target cloud bank to clean the access traffic according to the access traffic value in the call request.

5. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Aggregating the access traffic value with the historical access traffic value for requesting the target resource to obtain an aggregation result; Determine, based on the aggregation result, an expected value and an expected time of a future access traffic value for requesting the future access traffic of the target resource; According to the expected value, determining an expected defense component corresponding to the future access traffic value from the multiple defense components; An expected instruction is sent to the expected defense component, where the expected instruction includes the expected time and is used to instruct the expected defense component to clean the access traffic according to the expected time.

6. The method according to claim 4, characterized in that The method further comprises: When the access flow value is within the access flow value threshold range corresponding to the multiple defense components, a first alarm notification is generated, wherein the first alarm notification includes: resource information of the target resource, the access flow value and access information corresponding to the access flow value; Sending the first alarm notification to the monitoring end; When the access traffic value is greater than a maximum threshold of the access traffic value threshold range, a second alarm notification is generated, wherein the second alarm notification includes: resource information of the target resource, the access traffic value and access information corresponding to the access traffic value, and cloud bank information of the target cloud bank; The second alarm notification is sent to the monitoring end.

7. A distributed denial of service attack defense device, characterized in that: The device comprises: An acquisition module, used to acquire an access flow value of a target resource, where a plurality of defense components are deployed; a determination module, configured to determine, when the access flow value is within a threshold range of access flow values ​​corresponding to the multiple defense components, a target defense component corresponding to the access flow value from the multiple defense components; A sending module is used to send a cleaning instruction to the target defense component, wherein the target defense component cleans the access traffic according to the cleaning instruction.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the distributed denial of service attack defense method described in any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method for defending against a distributed denial of service attack according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions for causing a computer to execute the method for defending against a distributed denial of service attack according to any one of claims 1 to 6.

Images