Method and apparatus for defending against distributed denial of service attacks

Abstract

The application relates to the technical field of servers and discloses a defense method and device for a distributed denial of service attack, the method comprising the following steps: obtaining an access traffic value of a target resource, the target resource being deployed with multiple defense components; when the access traffic value is within the threshold range of the access traffic values corresponding to the multiple defense components, determining a target defense component corresponding to the access traffic value from the multiple defense components; and sending a cleaning instruction to the target defense component, wherein the target defense component cleans the access traffic according to the cleaning instruction. By obtaining the access traffic value of the target resource in real time, dynamically selecting the target defense component corresponding to the access traffic value according to the access traffic value, and sending the cleaning instruction to the selected target defense component to instruct the target defense component to clean the access traffic, the defense strategy can be adjusted in a timely manner according to different attack intensities, and different access components are called to clean the access traffic.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of server, in particular to a defense method and device of distributed denial of service attack. BACKGROUND

[0002] DDoS (Distributed Denial of Service) attack is a common network threat, attackers try to flood the target server or network, occupy its resources, resulting in service unavailable. There are a variety of anti- DDoS products (defense components) can detect and mitigate DDoS attacks, but due to the localization of multi-point deployment, they are usually scattered, unable to work together. SUMMARY

[0003] Therefore, the present application provides a defense method and device of distributed denial of service attack, computer equipment, storage medium and computer program product, to solve the problem of how to coordinate multiple defense components to defend DDoS attack.

[0004] In a first aspect, the present application provides a defense method of distributed denial of service attack, the method comprising:

[0005] obtaining an access traffic value of a target resource, the target resource being deployed with a plurality of defense components;

[0006] when the access traffic value is within a threshold range of access traffic value corresponding to the plurality of defense components, determining a target defense component corresponding to the access traffic value from the plurality of defense components;

[0007] sending a cleaning instruction to the target defense component, wherein the target defense component cleans the access traffic according to the cleaning instruction.

[0008] The defense method of distributed denial of service attack provided by the present application has the following advantages:

[0009] By obtaining the access traffic value of the target resource in real time, and dynamically selecting the target defense component corresponding to the access traffic value according to the access traffic value, and sending the cleaning instruction to the selected target defense component to instruct the target defense component to clean the access traffic, the defense strategy can be adjusted in time according to different attack intensities, and different access components are called to clean the access traffic. The adaptability of the system to different attack modes is enhanced, and the flexibility and response speed of the defense are effectively improved by coordinating multiple defense components to clean the access traffic of different threshold ranges.

[0010] In an optional embodiment, when the access traffic value is within the threshold range of access traffic value corresponding to the plurality of defense components, the target defense component corresponding to the access traffic value is determined from the plurality of defense components, comprising:

[0011] The access traffic value is matched with the access traffic value threshold range corresponding to each defense component to determine a target access traffic value threshold range corresponding to the access traffic value;

[0012] The defense component corresponding to the target access traffic value threshold range is determined as a target defense component.

[0013] In an optional implementation, the access traffic value of the target resource is obtained, including:

[0014] A first communication connection is established with a first defense component, and the first defense component is any one of the plurality of defense components;

[0015] Based on the first communication connection, the access traffic value detected by the first defense component is received.

[0016] In an optional implementation, the method further includes:

[0017] A communication interface of the target cloud dike is obtained, and a second communication connection is established with the communication interface;

[0018] When the access traffic value is greater than the maximum threshold value of the access traffic value threshold range, a call request including the access traffic value is sent to the target cloud dike through the second communication connection, and the call request indicates that the target cloud dike cleans the access traffic according to the access traffic value in the call request.

[0019] In an optional implementation, the method further includes:

[0020] The access traffic value is aggregated with the historical access traffic value of the historical access traffic for requesting the target resource to obtain an aggregation result;

[0021] According to the aggregation result, an expected value and an expected time of a future access traffic value of future access traffic for requesting the target resource are determined;

[0022] According to the expected value, an expected defense component corresponding to the future access traffic value is determined from the plurality of defense components;

[0023] An expected instruction including the expected time is sent to the expected defense component, for instructing the expected defense component to clean the access traffic according to the expected time.

[0024] In an optional implementation, the method further includes:

[0025] When the access traffic value is within the access traffic value threshold range corresponding to the plurality of defense components, a first alarm notification is generated, and the first alarm notification includes: resource information of the target resource, the access traffic value and access information corresponding to the access traffic value;

[0026] The first alarm notification is sent to a monitoring end.

[0027] when the access traffic value is greater than a maximum threshold value in a threshold value range of the access traffic value, generating a second alarm notification, the second alarm notification comprising: resource information of the target resource, the access traffic value and access information corresponding to the access traffic value, and cloud dike information of the target cloud dike;

[0028] sending the second alarm notification to the monitoring end.

[0029] In a second aspect, the present application provides a defense device for distributed denial of service attack, the device comprising:

[0030] an acquisition module configured to acquire an access traffic value of a target resource, the target resource being deployed with a plurality of defense components;

[0031] a determination module configured to determine a target defense component corresponding to the access traffic value from the plurality of defense components when the access traffic value is within a threshold value range of the access traffic value corresponding to the plurality of defense components;

[0032] a sending module configured to send a cleaning instruction to the target defense component, wherein the target defense component cleans the access traffic according to the cleaning instruction.

[0033] In a third aspect, the present application provides a computer device, comprising: a memory and a processor, the memory and the processor being in communication connection with each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the defense method for distributed denial of service attack according to the first aspect or any of the corresponding embodiments thereof.

[0034] In a fourth aspect, the present application provides a computer readable storage medium, the computer readable storage medium storing computer instructions, the computer instructions being used to make a computer execute the defense method for distributed denial of service attack according to the first aspect or any of the corresponding embodiments thereof.

[0035] In a fifth aspect, the present application provides a computer program product, comprising computer instructions, the computer instructions being used to make a computer execute the defense method for distributed denial of service attack according to the first aspect or any of the corresponding embodiments thereof. BRIEF DESCRIPTION OF DRAWINGS

[0036] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the drawings needed in the specific embodiments or the prior art description will be briefly introduced as follows. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0037] Figure 1It is a defense platform of distributed denial of service attack according to an embodiment of the present application.

[0038] Figure 2 It is one of flowcharts of defense method of distributed denial of service attack according to an embodiment of the present application.

[0039] Figure 3 It is the second flowchart of defense method of distributed denial of service attack according to an embodiment of the present application.

[0040] Figure 4 It is a schematic diagram of defense device of distributed denial of service attack according to an embodiment of the present application.

[0041] Figure 5 It is a schematic diagram of hardware structure of computer equipment according to an embodiment of the present application. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme of the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0043] According to an embodiment of the present application, a defense method embodiment of distributed denial of service attack is provided. It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from here.

[0044] Figure 1 It is a defense platform of distributed denial of service attack according to an embodiment of the present application, as shown in Figure 1 The platform includes an authentication module, an interface module, a data processing module, a data configuration module, a configuration issuing module, a registration center, a message bus, a data storage module (including an instance database, a configuration database, a cache database), and a front end.

[0045] The authentication module is used for logging into the defense components in the plurality of resources for defense strategy configuration. The interface module is used for connecting the cloud di interface and calling the cloud di to clean up access traffic. The registration center is used for registering user use permissions. The data processing module is used for processing user instructions or access traffic values. The data configuration module is used for configuring traffic threshold ranges of the respective defense components. The configuration delivery module is used for delivering cleaning instructions to the respective defense components. The message bus is used for receiving event logs corresponding to the access traffic values detected by the respective defense components and storing the event logs into an instance database in the data storage module. The cache database is used for storing frequently accessed data. The configuration database is used for storing configuration data.

[0046] A defense method against a distributed denial of service attack is provided in the embodiment, which can be used in the defense platform, Figure 2 is a flowchart of the defense method against the distributed denial of service attack according to the embodiment of the application, as Figure 2 shown, the method comprises the following steps.

[0047] In step S201, an access traffic value of a target resource is obtained, and the target resource is deployed with a plurality of defense components.

[0048] In the embodiment, the target resource can be a resource that needs to be monitored in the plurality of resources, which can be a server, a website or other network service resources. The access traffic value can be the number, frequency or size of traffic data requesting the target resource. The plurality of defense components can detect the access traffic value of the target resource in real time and synchronize to the defense platform.

[0049] In step S202, when the access traffic value is within the access traffic value threshold range corresponding to the plurality of defense components, a target defense component corresponding to the access traffic value is determined from the plurality of defense components.

[0050] In the embodiment, the plurality of defense components are respectively provided with different access traffic value threshold ranges, and when the access traffic value falls within the access traffic value threshold range of a defense component, the defense component is taken as the target defense component.

[0051] In step S203, a cleaning instruction is sent to the target defense component.

[0052] In the embodiment, the target defense component cleans the access traffic according to the cleaning instruction. Each defense component is respectively provided with a detection function and a cleaning function, and after the access traffic value corresponding to the access traffic is determined, the cleaning function of the target component can be called to clean the access traffic.

[0053] The defense method against the distributed denial of service attack provided by the application has the following advantages:

[0054] By acquiring the access traffic value of the target resource in real time, and dynamically selecting the target defense component corresponding to the access traffic value, and sending a cleaning instruction to the selected target defense component to instruct the target defense component to clean the access traffic, the defense strategy can be adjusted in a timely manner according to different attack intensities, and different access components are called to clean the access traffic. The adaptability of the system to different attack modes is enhanced, and multiple defense components are cooperated to clean access traffic in different threshold ranges, thereby effectively improving the flexibility and response speed of defense.

[0055] In some optional embodiments, when the access traffic value is within the access traffic value threshold range corresponding to the plurality of defense components, the target defense component corresponding to the access traffic value is determined from the plurality of defense components, including:

[0056] The access traffic value is matched with the access traffic value threshold range corresponding to each defense component to determine the target access traffic value threshold range corresponding to the access traffic value; and the defense component corresponding to the target access traffic value threshold range is determined as the target defense component.

[0057] In this embodiment, the current access traffic value of the target resource is acquired, the target traffic value is matched with the traffic value threshold range set by each defense component, and it is judged which threshold range of the defense component is suitable for processing the current traffic. After the matched threshold range is determined, the defense component corresponding to the threshold range is determined as the target defense component, and the subsequent traffic cleaning task is handed over to the target defense component for processing.

[0058] The defense method against distributed denial of service attacks in this embodiment can cope with different traffic conditions by dynamically selecting appropriate defense components, and can avoid defense failure or efficiency reduction caused by traffic overload. Each defense component will only process the traffic range that it is good at, maximizing the use of resources. Based on accurate threshold matching, the system can more effectively clean the traffic, accurately identify and filter out attack traffic, while ensuring the rapid passing of normal traffic. Reasonably distributing traffic to appropriate defense components avoids excessive load on a single defense component, and improves the availability and reliability of the defense system.

[0059] In some optional embodiments, the access traffic value of the target resource is acquired, including:

[0060] A first communication connection is established with a first defense component, and the first defense component is any one of the plurality of defense components; based on the first communication connection, the access traffic value detected by the first defense component is received.

[0061] In the embodiment, the communication connection can be a connection of the detection function of the first defense component and the defense platform through the message bus. Through the first communication connection, the system can obtain real-time data of traffic detection from the defense component. The data includes access traffic values, i.e., traffic information of the current target resource, which can include the number, frequency, size, and other characteristics of the request. Based on this information, the system can further evaluate the characteristics of the traffic and determine whether there is a risk of DDoS attack.

[0062] The defense method against distributed denial of service attacks in the embodiment can obtain access traffic data of the target resource in real time through communication with multiple defense components. This real-time nature provides an effective basis for subsequent attack identification and defense decision-making, enabling a quick response and reducing the impact of attacks. Not only can data be obtained from one defense component, but also a real-time traffic monitoring can be selected from multiple defense components, which makes the defense system more flexible.

[0063] In some optional embodiments, Figure 3 is a flowchart of a defense method against distributed denial of service attacks according to an embodiment of the application, the method further comprising:

[0064] Step S204, obtaining a communication interface of the target cloud dike and establishing a second communication connection with the communication interface;

[0065] Step S205, when the access traffic value is greater than the maximum threshold value of the access traffic value threshold range, sending a call request including the access traffic value to the target cloud dike through the second communication connection.

[0066] The call request instructs the target cloud dike to clean the access traffic according to the access traffic value in the call request.

[0067] In the embodiment, the target cloud dike can be a cloud dike of an upstream node corresponding to the target resource. By establishing a communication connection with the cloud dike, the traffic cleaning operation can be monitored and controlled in real time. The maximum threshold value is the maximum value of all access traffic value threshold ranges, at which time the defense component cannot clean the access traffic and the cloud dike of the upstream node needs to clean it.

[0068] The defense method against distributed denial of service attacks in the embodiment can quickly respond to traffic anomalies, timely start a traffic cleaning process, reduce the impact of DDoS attacks on the target system, and improve the real-time nature and automation level of defense. Through the second communication connection with the cloud dike, the system can outsource the traffic cleaning task to the cloud dike, fully utilize the distributed cleaning capability of the cloud dike, and enhance the overall defense effect. With the help of the synergy of the cloud dike, the overall defense system can resist larger-scale and more complex DDoS attacks, effectively protecting the availability and stability of the target system.

[0069] In some optional embodiments, the method further comprises:

[0070] aggregating the access traffic value with historical access traffic values of historical access traffic for requesting the target resource to obtain an aggregation result; determining an expected value and an expected time of a future access traffic value of future access traffic for requesting the target resource according to the aggregation result; determining an expected defense component corresponding to the future access traffic value from the plurality of defense components according to the expected value; and sending an expected instruction to the expected defense component, the expected instruction including the expected time, for instructing the expected defense component to clean the access traffic according to the expected time.

[0071] In this embodiment, the aggregation result can be obtained by analyzing the access traffic records of the target resource in a period of time, identifying the trend and pattern of the traffic, and combining the current access traffic value with the historical access traffic data for aggregation analysis. By analyzing the aggregation result, the system can predict the access traffic at a certain time or in a certain period of time in the future. According to the historical data and the traffic trend, the system can determine the predicted time period, i.e., at a certain time in the future, the access traffic is expected to reach a peak value. According to the predicted future access traffic value and time, the system selects a most suitable expected defense component for protection. For example, if it is predicted that the traffic will surge in a certain period of time, the system can select a high-load and high-performance defense component in advance to handle the upcoming traffic. The expected instruction is sent to the expected defense component, and the instruction includes the expected time, for instructing the expected defense component to start the cleaning task at the specific time.

[0072] The defense method against distributed denial of service attacks in this embodiment can achieve more intelligent protection through analysis of historical traffic and prediction of future traffic, and can change from passive response to attack to active prediction and preparation, thereby improving the response time and accuracy of responding to DDoS attacks. The false positives and false negatives caused by sudden traffic fluctuations can be effectively reduced, and the normal traffic can be avoided from being cleaned, thereby improving the accuracy of the system. Through aggregation of historical traffic data, prediction analysis, and generation of instructions, the entire defense process is more automated and intelligent, reduces manual intervention, and improves the response speed and anti-attack ability of the system.

[0073] In some optional embodiments, the method further comprises:

[0074] When the access traffic value is within the threshold range of the access traffic values corresponding to the plurality of defense components, a first alarm notification is generated, the first alarm notification including: resource information of the target resource, the access traffic value, and access information corresponding to the access traffic value; the first alarm notification is sent to the monitoring end; when the access traffic value is greater than the maximum threshold of the threshold range of the access traffic values, a second alarm notification is generated, the second alarm notification including: resource information of the target resource, the access traffic value, access information corresponding to the access traffic value, and cloud dike information of the target cloud dike; the second alarm notification is sent to the monitoring end.

[0075] In the embodiment, the resource information can be information of the target resource affected by the access traffic, such as a server address, a target service name, or a specific type of resource (for example, a web server, a database, etc.). The access information can be detailed information about the source of the access traffic, the access mode, the access time, etc., which is used to help analyze whether it is normal access or potential attack. When the access traffic value is greater than the maximum threshold of the threshold range of the access traffic values, the cloud dike information of the target cloud dike also needs to be added to the second alarm notification and sent to the monitoring end.

[0076] The defense method against distributed denial of service attacks in the embodiment can generate first alarm notifications and second alarm notifications according to different threshold ranges of traffic, so that the system can distinguish normal fluctuations of traffic and potential attack behaviors in detail. The first alarm notification is suitable for reminding the operation and maintenance personnel to pay attention to traffic anomalies and handle them in time when the traffic is within the threshold range; and the second alarm notification is issued when the traffic exceeds the maximum threshold, prompting that there is serious abnormal traffic and immediate protective measures may be needed. Each alarm notification contains detailed resource information (such as the address of the target server and the service type) and access information (such as the source of the traffic, the access mode, the time, etc.). These information helps to more accurately determine whether the traffic comes from a legitimate user or possible attack traffic, greatly improving the accuracy of traffic analysis and response.

[0077] The application provides a defense device against distributed denial of service attacks, Figure 4 The device according to the embodiment of the application is a schematic diagram of a defense device against distributed denial of service attacks, and the device includes:

[0078] The acquisition module 401 is configured to acquire an access traffic value of a target resource, and the target resource is deployed with a plurality of defense components.

[0079] The determination module 402 is configured to determine a target defense component corresponding to the access traffic value from the plurality of defense components when the access traffic value is within a threshold range of access traffic values corresponding to the plurality of defense components.

[0080] The sending module 403 is used to send a cleaning instruction to the target defense component, wherein the target defense component cleans the access traffic according to the cleaning instruction.

[0081] The present invention provides a defense device against distributed denial-of-service attacks, which has the following advantages:

[0082] By acquiring real-time access traffic values ​​for target resources and dynamically selecting corresponding target defense components based on these values, and sending cleaning commands to the selected defense components to instruct them to clean the access traffic, the system can adjust its defense strategy in a timely manner according to different attack intensities, invoking different access components to clean access traffic. This enhances the system's adaptability to different attack modes, coordinates multiple defense components to clean access traffic within different threshold ranges, and effectively improves the flexibility and response speed of the defense.

[0083] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0084] In this embodiment, the defense device against distributed denial-of-service attacks is presented in the form of functional units. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0085] This invention also provides a computer device having the above-described features. Figure 4 The diagram shows a defense mechanism against distributed denial-of-service attacks.

[0086] Please see Figure 5 , Figure 5 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 5 As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 5The processor 10 is taken as an example.

[0087] The processor 10 can be a central processor, a network processor or a combination thereof. The processor 10 can further include an integrated circuit. The integrated circuit can be an application specific integrated circuit, a programmable logic device or a combination thereof. The programmable logic device can be a complex programmable logic device, a field programmable logic device, a generic array logic or any combination thereof.

[0088] The memory 20 stores instructions executable by the at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiments.

[0089] The memory 20 can include a program storage area and a data storage area. The program storage area can store an operating system and application programs required by at least one function. The data storage area can store data created according to the use of the computer device, etc. In addition, the memory 20 can include a high-speed random access memory, and can further include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some optional embodiments, the memory 20 can optionally include a memory remotely arranged with respect to the processor 10, and these remote memories can be connected to the computer device through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network and a combination thereof.

[0090] The memory 20 can include a volatile memory, such as a random access memory; the memory can also include a non-volatile memory, such as a flash memory, a hard disk or a solid state disk; the memory 20 can further include a combination of the above kinds of memories.

[0091] The computer device further includes a communication interface 30 for communication of the computer device with other devices or communication networks.

[0092] The embodiments of the present application further provide a computer readable storage medium, and the method according to the embodiments of the present application can be implemented in hardware, firmware, or recorded in a storage medium, or stored in a remote storage medium or a non-transitory machine readable storage medium and downloaded to a local storage medium through network, so that the method described herein can be processed by such software on a storage medium using a general purpose computer, a special purpose processor, or programmable or special hardware. The storage medium can be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk, or a solid state disk, etc. Further, the storage medium can also include a combination of the above-mentioned memories. It can be understood that the computer, the processor, the microprocessor controller, or the programmable hardware includes a storage component that can store or receive software or computer code, when the software or computer code is accessed and executed by the computer, the processor, or the hardware, the method shown in the above embodiments is implemented.

[0093] Part of the present application can be applied as a computer program product, for example, computer program instructions, when executed by a computer, through the operation of the computer, the method and / or technical solutions according to the present application can be called or provided. Those skilled in the art should understand that the form of computer program instructions in a computer readable medium includes but is not limited to source files, executable files, installation package files, etc. Correspondingly, the way of executing computer program instructions by computer includes but is not limited to: the computer directly executes the instructions, or the computer compiles the instructions and then executes the corresponding compiled program, or the computer reads and executes the instructions, or the computer reads and installs the instructions and then executes the corresponding installed program. Here, the computer readable medium can be any available computer readable storage medium or communication medium accessible to the computer.

[0094] Although the embodiments of the present application are described in conjunction with the accompanying drawings, various modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present application, and such modifications and changes fall within the scope defined by the appended claims.

Claims

1. A method of defending against a distributed denial of service attack, characterized by, The method comprises: obtaining an access traffic value of a target resource, the target resource being deployed with a plurality of defense components; when the access traffic value is within a threshold range of access traffic values corresponding to the plurality of defense components, determining a target defense component corresponding to the access traffic value from the plurality of defense components; sending a cleaning instruction to the target defense component, wherein the target defense component cleans access traffic according to the cleaning instruction; aggregating the access traffic value and historical access traffic values of historical access traffic for requesting the target resource to obtain an aggregation result; determining an expected value and an expected time of a future access traffic value of future access traffic for requesting the target resource according to the aggregation result; determining an expected defense component corresponding to the future access traffic value from the plurality of defense components according to the expected value; sending an expected instruction to the expected defense component, the expected instruction including the expected time, for instructing the expected defense component to clean the access traffic at the expected time.

2. The method of claim 1, wherein, The method further comprises: matching the access traffic value with a threshold range of access traffic values corresponding to each defense component to determine a target threshold range of access traffic values corresponding to the access traffic value; determining the defense component corresponding to the target threshold range of access traffic values as the target defense component.

3. The method of claim 1, wherein, Obtaining an access traffic value of a target resource comprises: establishing a first communication connection with a first defense component, the first defense component being any one of the plurality of defense components; receiving the access traffic value detected by the first defense component based on the first communication connection.

4. The method according to any one of claims 1 to 3, characterized in that, The method further comprises: obtaining a communication interface of a target cloud dike and establishing a second communication connection with the communication interface; when the access traffic value is greater than a maximum threshold value of the threshold range of access traffic values, sending a calling request including the access traffic value to the target cloud dike through the second communication connection, the calling request instructing the target cloud dike to clean the access traffic according to the access traffic value in the calling request.

5. The method of claim 4, wherein, The method further comprises: when the access traffic value is within the threshold range of access traffic values corresponding to the plurality of defense components, generating a first alarm notification, the first alarm notification including resource information of the target resource, the access traffic value, and access information corresponding to the access traffic value; sending the first alarm notification to a monitoring end; when the access traffic value is greater than a maximum threshold value of the threshold range of access traffic values, generating a second alarm notification, the second alarm notification including resource information of the target resource, the access traffic value, access information corresponding to the access traffic value, and cloud dike information of the target cloud dike; sending the second alarm notification to the monitoring end.

6. A device for defending against a distributed denial of service attack, characterized in that, The device is used to execute the defense method against distributed denial of service attacks according to any one of the preceding claims 1-5, and the device comprises: An acquisition module is configured to acquire an access traffic value of a target resource, wherein the target resource is deployed with a plurality of defense components; A determination module is configured to determine a target defense component corresponding to the access traffic value from the plurality of defense components when the access traffic value is within a threshold range of access traffic values corresponding to the plurality of defense components; A sending module is configured to send a cleaning instruction to the target defense component, wherein the target defense component cleans access traffic according to the cleaning instruction.

7. A computer device, comprising: Comprise: A memory and a processor, which are in communication connection with each other, and the memory stores computer instructions, and the processor executes the computer instructions to perform the distributed denial of service attack defense method in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions, and the computer instructions are used to make the computer execute the distributed denial of service attack defense method in any one of claims 1 to 5.

9. A computer program product, characterised in that, The computer instructions are used to make the computer execute the distributed denial of service attack defense method in any one of claims 1 to 5.

Images