Data processing method and device, equipment and medium

Abstract

The invention discloses a data processing method and device, equipment and a medium. The method comprises the steps that a detection threshold value is determined based on a first access traffic log; determining an access behavior for the service domain name based on the number of domain name requests determined by the access traffic indicated by the second access traffic log and a detection threshold; when the access behavior aiming at the service domain name belongs to the abnormal access behavior, taking a behavior determination time point corresponding to the abnormal access behavior as a critical time point, and taking a third access traffic log obtained based on the critical time point as an abnormal access traffic log; when a normal traffic feature determined based on the first access traffic log is obtained, determining an abnormal traffic feature of the service domain name based on the abnormal access traffic log, and performing feature comparison on the abnormal traffic feature and the normal traffic feature to obtain an attack feature of the service domain name; a protection policy for the service domain name is determined based on the attack feature. According to the invention, the security and stability of the business server can be maintained.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a data processing method and device, equipment and medium. BACKGROUND

[0002] CC attack (Challenge Collapsar) is a denial of service (DoS) / distributed denial of service (DDoS) attack method for web services. Attackers simulate a large number of normal user access requests to make the business server of the deployed website continuously generate high load, thereby affecting the stable operation of the website.

[0003] In order to alleviate the pressure of CC attack on the website, currently, log analysis can be performed manually, and a protection strategy is issued based on the analyzed attack characteristics. Since the attack level of CC attack is too large in a short time, and each manual analysis needs to consume a long time, the protection strategy is often obtained after the attack ends, at which time it is useless for the previous attack. Thus, when the attacker launches multiple attacks with different characteristics, continuous attack transmission can be caused, thereby endangering the security and stability of the source station (i.e., the business server). SUMMARY

[0004] The embodiments of the present application provide a data processing method, device, equipment and medium, which can maintain the security and stability of the business server in the case of network attack.

[0005] The embodiments of the present application provide a data processing method, device, equipment and medium, which can maintain the security and stability of the business server in the case of network attack.

[0006] The first access traffic log associated with the service domain name is obtained, and a detection threshold corresponding to the service domain name is determined based on the first access traffic log;

[0007] The second access traffic log associated with the service domain name is obtained, the domain name request quantity of the service domain name is determined based on the access traffic indicated by the second access traffic log, and the access behavior for the service domain name is determined based on the domain name request quantity and the detection threshold. The timestamp of the second access traffic log is later than the timestamp of the first access traffic log, and there are some access traffic logs in the second access traffic log that are the same as those in the first access traffic log;

[0008] the behavior determination time point corresponding to the abnormal access behavior is taken as a critical time point for dividing abnormal traffic, and third access traffic logs obtained based on the critical time point are taken as abnormal access traffic logs; the acquisition time stamp of the third access traffic logs is later than the acquisition time stamp of the second access traffic logs, and the third access traffic logs are different from the second access traffic logs;

[0009] When the normal traffic features determined based on the first access traffic logs are obtained, abnormal traffic features of the service domain name are determined based on the abnormal access traffic logs, feature comparison is performed on the abnormal traffic features and the normal traffic features, and attack features of the service domain name are obtained;

[0010] The attack features are used to determine a protection strategy for the service domain name.

[0011] Embodiments of the present application provide a data processing apparatus, including:

[0012] The threshold determination module is configured to obtain first access traffic logs associated with the service domain name, and determine a detection threshold corresponding to the service domain name based on the first access traffic logs.

[0013] The behavior determination module is configured to obtain second access traffic logs associated with the service domain name, determine a domain name request quantity of the service domain name based on access traffic indicated by the second access traffic logs, and determine an access behavior for the service domain name based on the domain name request quantity and the detection threshold; the acquisition time stamp of the second access traffic logs is later than the acquisition time stamp of the first access traffic logs, and there are some access traffic logs in the second access traffic logs that are the same as those in the first access traffic logs.

[0014] The traffic division module is configured to, when the access behavior for the service domain name is an abnormal access behavior, take a behavior determination time point corresponding to the abnormal access behavior as a critical time point for dividing abnormal traffic, and take third access traffic logs obtained based on the critical time point as abnormal access traffic logs; the acquisition time stamp of the third access traffic logs is later than the acquisition time stamp of the second access traffic logs, and the third access traffic logs are different from the second access traffic logs.

[0015] The feature comparison module is configured to, when the normal traffic features determined based on the first access traffic logs are obtained, determine abnormal traffic features of the service domain name based on the abnormal access traffic logs, and perform feature comparison on the abnormal traffic features and the normal traffic features to obtain attack features of the service domain name.

[0016] The strategy determination module is configured to determine a protection strategy for the service domain name based on the attack features.

[0017] In an implementation, the threshold determination module is further configured to perform the following operations:

[0018] After obtaining the first detection threshold corresponding to the service domain name, the second detection threshold is determined based on the first access traffic log; the first detection threshold is determined based on a historical access traffic log associated with the service domain name; and a time stamp of the historical access traffic log is earlier than a time stamp of the first access traffic log;

[0019] Based on the first detection threshold and the second detection threshold, the detection threshold corresponding to the service domain name is determined; the detection threshold is the maximum threshold in the first detection threshold and the second detection threshold.

[0020] In an implementation, the first access traffic log is determined based on traffic log data in a plurality of threshold detection periods; the plurality of threshold detection periods include a first threshold detection period and a second threshold detection period; the first threshold detection period and the second threshold detection period are any two adjacent threshold detection periods, and the second threshold detection period is the next threshold detection period of the first threshold detection period;

[0021] The threshold determination module is further configured to perform the following operations:

[0022] The traffic log data located in the first threshold detection period is obtained from the first access traffic log as first traffic log data, and the traffic log data located in the second threshold detection period is obtained from the first access traffic log as second traffic log data;

[0023] After obtaining the third detection threshold determined based on the first traffic log data, the third detection threshold is updated based on the second traffic log data to obtain a fourth detection threshold, and the detection threshold corresponding to the service domain name is determined based on the fourth detection threshold.

[0024] In an implementation, the behavior determination module is further configured to perform the following operations:

[0025] From the access traffic indicated based on the second access traffic log, the access request carrying the service domain name is obtained, and the number of the obtained access requests is taken as the domain name request quantity of the service domain name;

[0026] When the domain name request quantity is greater than the detection threshold, the ratio data of the domain name request quantity and the detection threshold is obtained, and the detection strategy for the service domain name is determined based on the ratio data;

[0027] The access behavior for the service domain name is determined based on the detection strategy.

[0028] In an implementation, the behavior determination module is further configured to perform the following operations:

[0029] When the ratio data is located in the first ratio range, a first request surge rate between the domain name request quantity and the detection threshold is obtained, if the first request surge rate is greater than a first increment threshold, a first detection strategy is configured for the service domain name;

[0030] When the ratio data is located in the second ratio range, a second request surge rate between the domain name request quantity and the detection threshold is obtained, if the second request surge rate is greater than a second increment threshold, a second detection strategy is configured for the service domain name; the second ratio range is smaller than the first ratio range; the second increment threshold is smaller than the first increment threshold;

[0031] When the ratio data is located in the third ratio range, a third detection strategy is configured for the service domain name; the third ratio range is smaller than the second ratio range;

[0032] The first detection strategy or the second detection strategy or the third detection strategy is taken as the detection strategy for the service domain name.

[0033] In an implementation mode, the behavior determination module is further configured to perform the following operation:

[0034] When the detection strategy is the first detection strategy, first cleaning information associated with the service domain name is obtained based on the first detection strategy;

[0035] If the first cleaning information indicates that the request state of the access request in the access traffic contains a cleaning state, it is determined that the access behavior for the service domain name belongs to the abnormal access behavior.

[0036] In an implementation mode, the behavior determination module is further configured to perform the following operation:

[0037] When the detection strategy is the second detection strategy, first service response information and second cleaning information associated with the service domain name are obtained within continuous N detection periods based on the second detection strategy; N is a positive integer;

[0038] The access behavior for the service domain name is determined based on the first service response information and the second cleaning information.

[0039] In an implementation mode, the behavior determination module is further configured to perform the following operation:

[0040] When the detection strategy is the third detection strategy, second service response information associated with the service domain name is obtained within continuous M detection periods based on the third detection strategy; M is a positive integer;

[0041] The access behavior for the service domain name is determined based on the second service response information.

[0042] In an implementation mode, the abnormal traffic feature includes a target feature;

[0043] The feature comparison module is further configured to perform the following operations:

[0044] obtain a first feature proportion of the target feature in the abnormal traffic feature, and obtain a second feature proportion of the target feature in the normal traffic feature;

[0045] when the first feature proportion is greater than a first proportion threshold and the second feature proportion is less than a second proportion threshold, take the target feature as an attack feature of the service domain name; the second proportion threshold is less than or equal to the first proportion threshold.

[0046] In an implementation, the policy determination module is further configured to perform the following operations:

[0047] obtain policy data associated with the attack feature and protection configuration association information associated with the service domain name, obtain first policy data associated with a first attack feature for policy issuing from the policy data based on the protection configuration association information;

[0048] generate a protection policy for the service domain name based on the first policy data.

[0049] In an implementation, the policy determination module is further configured to perform the following operations:

[0050] obtain a performance consumption level and a policy priority level of the protection policy, perform policy arrangement on the protection policy based on the performance consumption level and the policy priority level, and issue the protection policy after the policy arrangement to the protection device, so that the protection device protects the service server indicated by the service domain name.

[0051] In an implementation, the policy determination module is further configured to perform the following operations:

[0052] obtain third service response information associated with the service domain name, and based on the third service response information, obtain a first cleaning request proportion corresponding to an access request in an access traffic indicated based on the abnormal access traffic log and having a cleaning state, and a first abnormal response proportion corresponding to an access request having an abnormal response state; the third service response information is obtained after the protection policy is issued;

[0053] when the first cleaning request proportion is less than a third proportion threshold and the first abnormal response proportion is greater than a fourth proportion threshold, obtain second policy data associated with a second attack feature from the policy data based on a protection level configured for the service domain name; the feature level of the second attack feature is higher than that of the first attack feature;

[0054] update the protection policy based on the second policy data.

[0055] In an implementation, the policy determination module is further configured to perform the following operations:

[0056] When the fourth access traffic log associated with the service domain name is acquired, a second cleaning request proportion corresponding to an access request whose request state is a cleaning state and a second abnormal response proportion corresponding to an access request whose response state is an abnormal response state in access traffic indicated based on the fourth access traffic log are acquired; an acquisition time stamp of the fourth access traffic log is later than an acquisition time stamp of the third access traffic log;

[0057] When the second cleaning request proportion is greater than a fifth proportion threshold value and the second abnormal response proportion is greater than a sixth proportion threshold value, an abnormal interception feature is acquired from the first attack feature; the fifth proportion threshold value and the sixth proportion threshold value are determined based on the first access traffic log;

[0058] The strategy associated with the abnormal interception feature in the protection strategy is shielded.

[0059] In an implementation manner, the behavior determination module is further configured to perform the following operation:

[0060] When the access behavior for the service domain name belongs to the normal access behavior, the detection threshold value and the normal traffic feature are updated based on the second access traffic log.

[0061] Embodiments of the present application provide a computer device, including: a processor and a memory.

[0062] The processor is connected with the memory, and the memory is configured to store a computer program, and the computer program is executed by the processor, so that the computer device executes the method provided by the embodiments of the present application.

[0063] Embodiments of the present application provide a computer readable storage medium, and the computer readable storage medium stores a computer program. The computer program is suitable for being loaded and executed by a processor, so that a computer device with the processor executes the method provided by the embodiments of the present application.

[0064] Embodiments of the present application provide a computer program product (or computer program), which includes computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method provided by the embodiments of the present application.

[0065] The embodiment of the application can acquire a first access traffic log associated with a service domain name, determine a detection threshold corresponding to the service domain name based on the first access traffic log, acquire a second access traffic log associated with the service domain name, determine a domain name request quantity of the service domain name based on access traffic indicated by the second access traffic log, and further determine an access behavior for the service domain name based on the domain name request quantity and the detection threshold. The acquisition timestamp of the second access traffic log is later than the acquisition timestamp of the first access traffic log, and there are some access traffic logs in the second access traffic log that are the same as those in the first access traffic log. Further, when the access behavior for the service domain name is an abnormal access behavior, a behavior determination time point corresponding to the abnormal access behavior can be determined as a critical time point for dividing abnormal traffic, and a third access traffic log acquired based on the critical time point can be determined as an abnormal access traffic log. The acquisition timestamp of the third access traffic log is later than the acquisition timestamp of the second access traffic log, and the third access traffic log is different from the second access traffic log. When a normal traffic feature determined based on the first access traffic log is acquired, an abnormal traffic feature of the service domain name can be determined based on the abnormal access traffic log, the abnormal traffic feature and the normal traffic feature are compared, and an attack feature of the service domain name is obtained. Further, a protection strategy for the service domain name can be determined based on the attack feature. As can be seen, the embodiment of the application provides an intelligent protection method based on attack feature analysis, which plays a key role in protecting network attacks (such as CC attacks). By combining the detection threshold and the normal traffic feature obtained by analyzing the related access traffic log (such as the first access traffic log), the normal traffic pattern of the service domain name indicated by the business server can be modeled from the historical normal access traffic (such as the access traffic indicated by the first access traffic log). Further, the access behavior for the service domain name can be benchmarked based on the detection threshold. When an abnormal access behavior is detected, abnormal access traffic (such as the access traffic indicated by the abnormal access traffic log) that deviates seriously from the normal traffic pattern can be divided, and the attack feature can be described by comparing the abnormal traffic feature and the normal traffic feature. Thus, based on different attack features, a protection strategy for intercepting abnormal access traffic without affecting normal access traffic can be formulated. In this way, through automatic comparison and analysis, the problem that the protection strategy is invalid due to short attack duration, long manual intervention time, and frequent attack changes in the attack scenario is effectively solved, so that abnormal access traffic can be quickly cleaned up when a network attack occurs, and the security and stability of the business server are maintained. BRIEF DESCRIPTION OF DRAWINGS

[0066] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced. Obviously, the accompanying drawings in the following description only constitute some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0067] Figure 1 is a system architecture schematic diagram provided by an embodiment of the present application;

[0068] Figure 2 is a data interaction scene schematic diagram provided by an embodiment of the present application;

[0069] Figure 3 is a flowchart of a data processing method provided by an embodiment of the present application;

[0070] Figure 4 is an attack protection schematic diagram under feature protection provided by an embodiment of the present application;

[0071] Figure 5 is a schematic diagram of an intelligent protection method and system based on attack feature analysis provided by an embodiment of the present application;

[0072] Figure 6 is a structural schematic diagram of a data processing apparatus provided by an embodiment of the present application;

[0073] Figure 7 is a structural schematic diagram of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0074] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments only constitute some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0075] Artificial intelligence (AI) is to use digital computers or digital computer controlled machines to simulate, extend and expand human intelligence, perceive environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology of computer science, which tries to understand the essence of intelligence and produce a new intelligent machine that can react in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines, so that the machine has the functions of perception, reasoning and decision-making.

[0076] Artificial intelligence technology is a comprehensive discipline, involving a wide range of fields, both hardware and software level technology. Artificial intelligence basic technology generally includes, such as sensors, special artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction system, mechatronics and other technologies. Artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning, automatic driving, intelligent transportation and other major directions.

[0077] The scheme provided by the embodiments of the present application relates to machine learning technology in the field of artificial intelligence. It can be understood that machine learning (Machine Learning, ML) is a multi-disciplinary subject, involving probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines. It is a special study on how computers simulate or implement human learning behavior to acquire new knowledge or skills, reorganize existing knowledge structure to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental approach to making computers intelligent, and its applications are widespread in various fields of artificial intelligence. Machine learning and deep learning usually include artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and rule-based learning. The pre-trained model is the latest development of deep learning, which integrates the above technologies. In the embodiments of the present application, the threshold learning model, the feature learning model and the offline analysis model are all AI models based on machine learning technology. The threshold learning model can be used to obtain the detection threshold corresponding to the service domain name, the feature learning model can be used to obtain the normal traffic features of the service domain name, and the offline analysis model can be used to obtain the features that only exist in attacks.

[0078] Please refer to Figure 1 , Figure 1 is a system architecture diagram provided by the embodiments of the present application. As Figure 1 indicated, the system architecture can include an access device cluster and a business server cluster. Wherein, the access device cluster can include one or more access devices, which will not be limited to the number of access devices in the access device cluster, as Figure 1 indicated, the plurality of access devices in the access device cluster can include: access device 200a, access device 200b, access device 200c, …, access device 200n, where the access device refers to a device used for network service access, and there can be a communication connection between different access devices, for example, a communication connection exists between access device 200a and access device 200b. The business server cluster can include one or more business servers, which will not be limited to the number of business servers in the business server cluster, as Figure 1As shown, the plurality of service servers in the service server cluster can specifically include: service server 100a, service server 100b, …, service server 100m, where the service server refers to a server that provides a specific service (such as various website services).

[0079] Any access device in the access device cluster can be in communication connection with any service server in the service server cluster, so that each access device in the access device cluster can interact with the service server through the communication connection, for example, the access device 200a and the service server 100a are in communication connection, any access device (such as the access device 200a) can initiate an access request to the service server (such as the service server 100a) through the corresponding communication connection to obtain the service provided by the service server. Wherein the above communication connection is not limited to the connection mode, which can be connected directly or indirectly through wired communication mode, or directly or indirectly through wireless communication mode, or through other ways, which are not limited in the present application.

[0080] Wherein the access device in the above access device cluster can be a terminal device, a server, a routing device, and various forms of devices, and the specific form of the access device will not be limited in the embodiments of the present application. The terminal device here can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a palm computer, a mobile internet device (MID), a wearable device (such as a smart watch, a smart helmet, smart glasses, etc.), a smart computer, a smart home appliance, a smart vehicle, and the like. Wherein the access device and the service server can be directly or indirectly connected through wired or wireless mode, which is not limited in the embodiments of the present application.

[0081] Wherein the service server in the above service server cluster can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content distribution networks (CDN), and big data and artificial intelligence platforms, and the like. Wherein one access device can be connected with one or more service servers, and each service server can interact with the access device connected thereto.

[0082] It should be understood that Figure 1 As shown, each access device in the access device cluster can be installed with a client, when the client runs in each access device, it can respectively interact with the above Figure 1The business servers in the illustrated business server cluster interact with each other in data. Among them, the client here can be an entertainment client (for example, a game client), a social client, an instant messaging client, a multimedia client (for example, a video client), a shopping client, an information client, a tool client, a browser, and the like. Application with network access function. Among them, the client can be a standalone client, or an embedded sub-client integrated in a certain client (such as a video client), which is not limited here. Taking access to a website as an example, assuming that the business server 100a is a set of one or more servers (such as data processing servers, data storage servers, etc.) for deploying a website, each access device can transmit data with the business server 100a through the client installed on the access device, for example, a certain client (such as a browser) running on the access device 200a can send an access request to the business server 100a, and the business server 100a is mainly responsible for processing business logic and data according to the access request sent by the client. In this way, the business server 100a can respond to the access request and return the business resource requested by the client to the client, wherein the business resource can include but is not limited to text, image, video, audio and various types of resources, and the type of business resource is not limited here.

[0083] It can be understood that as the network environment becomes increasingly complex, the business server is vulnerable to various network attacks. Taking the CC attack as an example, usually, the attacker will use a large number of real source IP (Internet Protocol) addresses to send a large number of access requests to the business server, which is several times the normal access, the purpose is to cause network congestion or server resource exhaustion, so as to cause the business server to refuse to provide services for normal users, and abnormal response conditions such as timeout and response delay. The present application relates to the field of network security passive defense, and particularly relates to an attack detection and protection method and system based on attack feature analysis, in order to effectively defend against network attacks, such as Figure 1The system architecture shown can also include a protection device 300a and an analysis server 300b. Among them, the protection device 300a refers to a device for defending network attacks (such as CC attacks), which is mainly responsible for performing corresponding rate limiting operations on the access traffic of the access device in the access device cluster that initiates the attack, so as to protect the business server from network attacks. The protection device is a set of devices deployed before the business service, which can integrate software and hardware. In actual application, one or more protection devices can be deployed according to business needs to form a protection device cluster (or attack processing cluster), thereby maintaining network security. The specific form and number of the protection device 300a will not be limited in the embodiments of the present application. Among them, the analysis server 300b refers to a server corresponding to the protection device 300a for back-end analysis and calculation, which is mainly responsible for attack detection, abnormal traffic analysis and policy issuing, and issues protection policies to the protection device 300a to assist the protection device 300a to discover and block network attacks in time. The analysis server 300b can be a separate physical server, a server cluster (which can be called an analysis server cluster or a back-end calculation cluster) composed of multiple physical servers or a distributed system. It can also be a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs, and big data and artificial intelligence platforms. The specific form and number of the analysis server 300b will not be limited in the embodiments of the present application. Among them, the protection device 300a and the analysis server 300b can be directly or indirectly connected through wired or wireless means to facilitate data interaction between the two, which will not be limited in the embodiments of the present application.

[0084] It can be understood that the present application provides a network attack detection and protection method and system, which can effectively defend against attacks (such as CC attacks) against the top application layer in the network protocol proposed by the International Organization for Standardization (International Organization for Standardization, ISO). For the convenience of subsequent understanding and explanation, some concepts related to the present application are explained here:

[0085] (1) Service domain name: refers to the domain name of the service server (Domain Name), which can be simply understood as the name of the service server. In fact, the service server itself also has its own corresponding IP address (which can be referred to as a service network address). The service domain name is an alias of the service network address. The form is composed of several English letters, which is divided into several parts by “.”. It is more convenient to remember than the IP address. The service domain name and the service network address are mapped to each other through the domain name system (Domain Name System, DNS). When the service domain name is used to access the service server in the future, the service domain name can be resolved into the service network address, and then the corresponding service server on the Internet or local network can be found according to the service network address for access.

[0086] (2) Device network address: the identifier of any networked access device, referred to as a device network address, through which the corresponding access device can be found. For example, for an access device 200a connected to a network (such as the Internet or a local network), the device network address can be an IP address, which is composed of several numbers separated by “.”. The IP address is a unique address that can be used to identify an access device on the Internet or a local network. In addition to the IP address, the device network address can also be a media access control (Media Access Control, MAC) address or other forms of address, which is not limited in the present application.

[0087] In some cases, different normal users can also share the same egress IP address (which can be referred to as an egress network address). The egress IP address refers to the IP address used when connecting to the public Internet from the local network. This IP address is allocated by an Internet service provider (Internet Service Provider, ISP) and can be used to identify the source of network traffic. If the network address translation (Network Address Translation, NAT) technology is used, address translation will be performed inside the NAT device, so that multiple access devices can share the same public IP address (i.e. the egress IP address). Therefore, the egress IP address can be different from the IP address inside the local network. For example, in an office network, a school, a supermarket, or a public WIFI environment, different access devices can use the same egress IP address. The device network address in the present application can be a unique IP address of the access device inside the local network, a unique IP address of the access device in the Internet, or a shared egress IP address. It can also be other forms of address (such as a MAC address), which is not limited in the present application.

[0088] It can be understood that the access request sent by the access device to the service server carries the service domain name of the service server and the device network address of the access device.

[0089] (3) Access traffic: a collection of access requests sent by an access device to a business server, also referred to as traffic, which can be used to access the business services provided by the business server. The access traffic in this application can be divided into normal access traffic and abnormal access traffic, wherein normal access traffic refers to access traffic composed of normal and legal access requests (also referred to as normal access requests), which can be used for normal business access to instruct the business server to return the corresponding business resources; abnormal access traffic refers to access traffic composed of abnormal and illegal access requests (also referred to as abnormal access requests), which is aggressive. Attackers use the access devices they hold to send a huge amount of abnormal access traffic to the business server in a short period of time, which can cause server resources to be exhausted or even cause the server to crash.

[0090] (4) Resource address: This is used to identify the location of the business resource being accessed. The resource address can be a Uniform Resource Locator (URL), which indicates the specific location and access method of the business resource on the Internet or local network.

[0091] (5) Access traffic log: refers to a log file used to record the access traffic of the business server indicated by the service domain name. It can record all request and response information associated with the business server, such as the service domain name of the business server, the device network address of the access device, the requested resource address, access time, request method, status code, response time, etc. The access traffic log is of great significance to the management and maintenance of the business server. Subsequent embodiments of this application may use prefixes such as "first" and "second" to distinguish access traffic logs obtained at different times.

[0092] Based on this, Figure 1 As shown, any access device in the access device cluster can send an access request to the protection device 300a. The access requests sent to different business servers can constitute the access traffic of the corresponding service domain name. The analysis server 300b can obtain the attack characteristics of the service domain name by analyzing the relevant access traffic logs, and can issue personalized protection strategies to the protection device 300a based on the attack characteristics to intercept / clean abnormal access traffic, thereby greatly reducing the frequency control pass-through amount of the business server when it is attacked by the network; at the same time, the protection device 300a can release the normal access traffic, that is, send the access request in the normal access traffic to the corresponding business server in the business server cluster to avoid affecting normal business access. The business server can subsequently obtain the corresponding business resources based on the received access request and send it to the corresponding access device.

[0093] Specific, combinedFigure 1 The service servers 100a, 100b, …, 100m can be servers that provide different service services to service objects (which can be users such as individuals, enterprises, institutions, organizations, etc.), that is, the service objects can access the service servers (such as service servers 100a, 100b, …, 100m) through relevant access devices (such as access devices 200a, 200b, 200c, …, 200n) at any time to obtain corresponding services, and in this process, the corresponding access traffic logs can be recorded in the granularity of service domain names. Based on this, taking the service domain name of any service server as an example, the analysis server 300b can obtain a first access traffic log (such as log A1) associated with the service domain name, determine a detection threshold corresponding to the service domain name based on the first access traffic log, obtain a second access traffic log (such as log A2) associated with the service domain name, determine the number of domain name requests of the service domain name based on the access traffic indicated by the second access traffic log, and then determine the access behavior for the service domain name based on the number of domain name requests and the detection threshold. The timestamp of the second access traffic log is later than the timestamp of the first access traffic log, and there are some access traffic logs in the second access traffic log that are the same as those in the first access traffic log. Further, when the access behavior for the service domain name is an abnormal access behavior, the behavior determination time point corresponding to the abnormal access behavior can be taken as a critical time point for dividing abnormal traffic, and the third access traffic log (such as log A3) obtained based on the critical time point can be taken as an abnormal access traffic log. The timestamp of the third access traffic log is later than the timestamp of the second access traffic log, and the third access traffic log is different from the second access traffic log. Further, when the normal traffic characteristics determined based on the first access traffic log are obtained, the abnormal traffic characteristics of the service domain name can be determined based on the abnormal access traffic log, the abnormal traffic characteristics and the normal traffic characteristics are compared, and the attack characteristics of the service domain name are obtained. Finally, the protection strategy for the service domain name can be determined based on the attack characteristics.

[0094] It can be seen that the embodiment of the application provides an intelligent protection method based on attack feature analysis, which plays a key role in protecting network attacks (such as CC attacks). By combining the detection threshold and normal traffic characteristics obtained by analyzing the relevant access traffic log (such as the first access traffic log), the normal traffic pattern of the service domain name indicated by the service server can be modeled from the historical normal access traffic (such as the access traffic indicated by the first access traffic log), and then the detection threshold can be used to determine the access behavior to the service domain name. When abnormal access behavior is detected, abnormal access traffic (such as the access traffic indicated by the abnormal access traffic log) that deviates from the normal traffic pattern can be divided, and the attack feature can be described by comparing the abnormal traffic characteristics and the normal traffic characteristics. Therefore, based on different attack features, a protection strategy for intercepting abnormal access traffic without affecting normal access traffic can be developed. In this way, through automatic comparison and analysis, the problem of invalid protection strategy caused by short attack duration, long manual intervention time and frequent attack changes in the attack scenario is effectively solved, so that the abnormal access traffic can be quickly cleaned up when the network attack comes, and the security and stability of the service server are maintained.

[0095] It should be noted that when the analysis server or the protection device in the embodiment of the application obtains the access traffic log (which involves data such as service domain name, device network address, detection threshold, abnormal traffic feature, normal traffic feature, etc.), a prompt interface or a pop-up window can be displayed. The prompt interface or the pop-up window is used to prompt that the business object is currently collecting access traffic log data. Only after obtaining the confirmation operation of the business object to the prompt interface or the pop-up window, the related steps of data acquisition are started, otherwise it is ended.

[0096] It can be understood that in the specific embodiments of the application, data related to the access traffic log and the business object are involved. When the embodiments in the application are applied to specific products or technologies, the permission or consent of the business object is required, and the collection, use and processing of related data need to comply with relevant regulations and standards in relevant regions.

[0097] For ease of understanding, further see Figure 2 , Figure 2 is a data interaction scenario provided by the embodiment of the application. The scenario can be realized by the protection device 20a and the analysis server 20b together. As Figure 2As shown, the embodiments of the present application are related to the interaction between a plurality of access devices and a plurality of service servers, the plurality of access devices can specifically include access device 21a, access device 21b and access device 21c, which can be devices belonging to the same enterprise or institution, such as devices used by users within enterprise A, and the embodiments of the present application do not limit the form of the access devices; the plurality of service servers can specifically include service server 22a, service server 22b and service server 22c; any access device can request to access any service server to perform data interaction.

[0098] Wherein, any access device can be identified by a corresponding device network address, for example, device network address B1 is used to identify access device 21a, device network address B2 is used to identify access device 21b, and device network address B3 is used to identify access device 21c. Any service server can be identified by a corresponding service domain name, for example, service domain name C1 is used to identify service server 22a, service domain name C2 is used to identify service server 22b, and service domain name C3 is used to identify service server 22c. In order to realize data interaction, the access request sent by any access device to any service server will carry the service domain name corresponding to the service server and the device network address corresponding to the access device, for example, the access request sent by access device 21a to service server 22a can carry the corresponding service domain name C1 and device network address B1, which is used to indicate the destination and source of the access request; correspondingly, the access traffic log associated with service domain name C1 will also record the relevant information of the access request.

[0099] It can be understood that in order to implement the personalized protection strategy for different service servers, the embodiments of the present application can analyze the corresponding access traffic log at the domain name granularity, so as to determine the protection strategy for the service domain name based on the attack characteristics of the service domain name obtained by analysis. Based on this, the embodiments of the present application take service domain name C1 as an example to introduce the formulation process of the protection strategy for service domain name C1.

[0100] As Figure 2As shown, the protection device 20a can report the access traffic log associated with the service domain name C1 to the analysis server 20b, and thus the analysis server 20b can obtain the access traffic log 23a associated with the service domain name C1 at the time stamp T1. Assuming that the service state corresponding to the service domain name C1 is a normal state (i.e., a non-attack state) at this time, the access traffic log 23a can be used as the first access traffic log. That is, the access traffic log 23a belongs to a normal access traffic log at this time. The analysis server 20b can determine a detection threshold 23b corresponding to the service domain name C1 based on the access traffic log 23a. For example, the analysis server 20b can pull traffic log data within a threshold detection time length (e.g., one hour from 8:45 on March 1 to 9:45) from the access traffic log 23a starting from the time stamp T1 (e.g., 8:45 on March 1), and the service state corresponding to the service domain name C1 remains normal within the threshold detection time length. The latest detection threshold 23b can be obtained by continuously learning the pulled traffic log data. The detection threshold 23b can be understood as an attack detection baseline for subsequent protection, and is a representation of the normal traffic pattern corresponding to the service domain name C1. The detection threshold 23b is continuously updated and iterated in the threshold learning process, and is used to determine whether the access behavior to the service domain name C1 at this time is an abnormal access behavior or a normal access behavior. The threshold detection time length can be set according to actual needs.

[0101] Further, the analysis server 20b can acquire the access traffic log 23c associated with the service domain name C1 at the time stamp T2, where the acquisition time stamp of the access traffic log 23c (i.e., the time stamp T2, such as 9:00 on March 1) is later than the acquisition time stamp of the access traffic log 23a (i.e., the time stamp T1, such as 8:45 on March 1), and there is a part of the access traffic log 23c that is the same as the access traffic log 23a, and the acquisition duration of the access traffic log 23c and the acquisition duration of the access traffic log 23a are not limited here; that is, the access traffic log 23c and the access traffic log 23a are logs acquired at different times, and they are not completely the same, but there is a same part, for example, in combination with the example in the foregoing, the traffic log data in the two logs from 9:00 to 9:45 on March 1 is the same. At this time, the access traffic log 23c can be taken as the aforementioned second access traffic log, and the analysis server 20b can determine the domain name request quantity 23d of the service domain name C1 based on the access traffic indicated by the access traffic log 23c, where the domain name request quantity 23d refers to the number of access requests contained in the access traffic indicated by the access traffic log 23c, and essentially it is a process of statistically requesting the quantity of the domain name granularity in real time, for example, the domain name request quantity of the service domain name C1 at the time point can be obtained according to the access traffic at 9:03 on March 1 indicated by the access traffic log 23c; based on the domain name request quantity 23d and the detection threshold 23b, the access behavior 23e to the service domain name C1 can be determined, which is equivalent to continuously comparing the current detection threshold by statistically requesting the domain name request quantity in real time to determine whether the current access behavior to the service domain name C1 is an abnormal access behavior; for example, optionally, when the domain name request quantity 23d is greater than the detection threshold 23b, it indicates that the access behavior 23e to the service domain name C1 deviates from the normal traffic pattern, at this time, the access behavior 23e may belong to an abnormal access behavior or a normal access behavior, and needs to select a detection strategy for further determination; optionally, when the domain name request quantity 23d is less than or equal to the detection threshold 23b, it indicates that the access behavior 23e to the service domain name C1 does not deviate from the normal traffic pattern, at this time, the access behavior 23e belongs to a normal access behavior.

[0102] It can be understood that when the access behavior 23e to the service domain name C1 belongs to an abnormal access behavior, the behavior determination time point 23f corresponding to the abnormal access behavior can be taken as a critical time point 23g for dividing abnormal traffic, and the access traffic log 23h obtained based on the critical time point 23g can be taken as an abnormal access traffic log, and at this time, the service state corresponding to the service domain name C1 is an abnormal state (i.e., an attack state); for example, it is assumed that the abnormal access behavior is detected at the time stamp T3 (such as 10:00 on March 1), and a corresponding attack detection signal is generated, and the time point (i.e., the time stamp T3) when the abnormal access behavior is detected can be referred to as a behavior determination time point, and at this time, the time stamp corresponding to the behavior determination time point 23f is the time stamp T3, that is, the time stamp corresponding to the critical time point 23g is the time stamp T3, and then the access traffic log 23h associated with the service domain name C1 obtained at the time stamp T3 can be taken as a third access traffic log, that is, an abnormal access traffic log at this time; wherein the acquisition time stamp (i.e., the time stamp T3) of the access traffic log 23h is later than the acquisition time stamp (i.e., the time stamp T2, such as 9:00 on March 1) of the access traffic log 23c, and the access traffic log 23h is different from the access traffic log 23c; that is, based on the critical time point 23g (corresponding to the time stamp T3), normal access traffic (i.e., the access traffic indicated by the access traffic log 23c, such as the access traffic within 9:00-10:00 on March 1) and abnormal access traffic (i.e., the access traffic indicated by the access traffic log 23h, such as the access traffic from 10:00 on March 1 to the end of the detection of the abnormal access behavior (which can be referred to as a behavior end time point, and can be marked as a time stamp T4, such as 10:05 on March 1)) can be divided. It can be understood that after the foregoing critical time point 23g, the domain name request quantity can still be counted in real time through the access traffic log 23h, and continuously compared with the current latest detection threshold, and when it is detected that the access behavior to the service domain name C1 does not belong to an abnormal access behavior (i.e., belongs to a normal access behavior), the time point corresponding to the normal access behavior can be taken as a behavior end time point, at this time, the attack detection signal is released, and a first baseline update instruction is generated, for instructing to update the detection threshold and the normal traffic characteristics; correspondingly, the log between the critical time point and the behavior end time point is an abnormal access traffic log, that is, the acquisition duration of the abnormal access traffic log is determined by the critical time point and the behavior end time point.

[0103] It should be noted that when the first baseline update instruction is obtained, the fifth access traffic log obtained based on the behavior end time point can be taken as a normal access traffic log, and the detection threshold and the normal traffic feature can be updated based on the normal access traffic log. The acquisition timestamp of the fifth access traffic log is later than the acquisition timestamp of the third access traffic log, and the fifth access traffic log is different from the third access traffic log.

[0104] It can be understood that the analysis server 20b can determine the normal traffic feature 23i of the service domain name C1 based on the access traffic log 23a. For example, the traffic log data within a feature detection duration (e.g., one hour from 8:45 on March 1 to 9:45 on March 1) can be pulled from the access traffic log 23a starting from the timestamp T1 (e.g., 8:45 on March 1), and during the feature detection duration, the service state corresponding to the service domain name C1 remains in the normal state. Then, by continuously learning the features of the pulled traffic log data, the latest normal traffic feature 23i can be obtained. The normal traffic feature 23i can be understood as a normal traffic pattern baseline, which is continuously updated during the feature learning process and can be used to describe the main feature distribution of the normal access traffic of the service domain name C1 at the moment. It should be noted that the feature detection duration can be set according to actual needs. The normal traffic feature 23i can include one or more features, and the number of features of the normal traffic feature 23i is not limited here. For example, as shown in Figure 2 The normal traffic feature 23i can specifically include the feature D1, the feature D2, the feature D3, …, and the feature DH.

[0105] Based on this, when the normal traffic feature 23i determined based on the access traffic log 23a is obtained, the analysis server 20b can determine the abnormal traffic feature 23j of the service domain name C1 based on the access traffic log 23h. The abnormal traffic feature 23j can include one or more features, and the number of features of the abnormal traffic feature 23j is not limited here. For example, as shown in Figure 2 The abnormal traffic feature 23j can specifically include the feature E1, the feature E2, the feature E3, …, and the feature EK. It should be noted that there are some features in the abnormal traffic feature 23j that are the same as the normal traffic feature 23i, such as the feature E1 and the feature D1, which can be the same feature. Further, the abnormal traffic feature 23j and the normal traffic feature 23i can be compared to obtain the attack feature 23k of the service domain name C1; wherein whether a feature is an attack feature that needs to be issued can be determined according to the proportion of the feature in the abnormal traffic feature 23j and the proportion of the feature in the normal traffic feature 23i. For example, as shown in Figure 2As shown, taking feature E1 as an example, assuming that feature E1 accounts for a high proportion in abnormal traffic feature 23j (for example, 80%), and a low proportion in normal traffic feature 23i (for example, 10%), feature E1 can be used as an attack feature of service domain C1; through a similar process, other features other than feature E1 can be judged, and ultimately one or more attack features of service domain C1 can be obtained. Among them, the embodiment of the present application does not limit the number of features of attack feature 23k. For example, attack feature 23k can specifically include feature E1 (such as a client identifier) ​​and feature E2 (such as a request resource type).

[0106] Furthermore, the analysis server 20b can determine a protection policy 231 for the service domain C1 based on the obtained attack signature 23k, and can, based on user needs, send the protection policy 231 to the protection device 20a to initiate protection. Thus, when the protection device 20a receives access traffic sent by an access device (including one or more of the access device 21a, the access device 21b, and the access device 21c) to the business server 22a indicated by the service domain C1, it can, based on the protection policy 231, classify access requests that match the attack signature 23k (such as the aforementioned signature E1 and signature E2) as abnormal access traffic and clean the abnormal access traffic. It can also classify access requests that do not match the attack signature 23k as normal access traffic and allow the normal access traffic to pass, i.e., forward the normal access traffic to the business server 22a for processing. This allows the abnormal access traffic to be intercepted without affecting the normal access traffic, thus ensuring the normal operation of the business service.

[0107] It is understandable that the process of formulating protection strategies for other service domain names (such as service domain name C2 and service domain name C3) is similar to the above process and will not be repeated here.

[0108] It can be seen that the embodiments of the present application can formulate different protection strategies according to different attack characteristics, that is, formulate differentiated protection strategies for different service domain names. In this way, when a network attack occurs, a higher speed limit capability can be achieved for abnormal access traffic, thereby improving the protection effect against network attacks and maintaining the security and stability of the business server.

[0109] Among them, the attack characteristics of the service domain name are obtained based on the analysis of relevant access traffic logs, and the specific implementation method of the protection strategy for the service domain name is determined based on the attack characteristics. Please refer to the following Figures 3-5 Description in the corresponding embodiment.

[0110] For further information, see Figure 3 , Figure 3 This is a flow chart of a data processing method provided by an embodiment of the present application.Figure 3 As shown, the method can be performed by an analysis server, such as the analysis server 300b exemplified in the above-mentioned Figure 1 The method can specifically include the following steps S101-S105.

[0111] At step S101, a first access traffic log associated with a service domain name is obtained, and a detection threshold corresponding to the service domain name is determined based on the first access traffic log;

[0112] It can be understood that the attack features for policy issuing can be obtained by the embodiments of the present application in combination with access traffic log analysis. The access traffic log is obtained by one or more protection devices, i.e., the protection devices can be used to record one or more access traffic logs associated with any service domain name. The reporting manner can be real-time reporting or timing reporting, which is not limited by the present application. The access traffic log can also be referred to as an access log or a protection log. There can be different types of access traffic logs in different scenarios. For example, in the scenario of protecting against CC attacks, the access traffic log can be a CC protection log.

[0113] In an implementation, since the attack sources of network attacks (such as CC attacks) are relatively dispersed, the corresponding access traffic logs are also relatively dispersed. Therefore, all access traffic logs reported by the protection devices can be integrated in real time by a high-performance middleware. For convenience of distinction, the access traffic logs recorded by the protection devices can be referred to as original traffic logs. Specifically, G original traffic logs associated with a service domain name reported by a protection device can be obtained by a log integration component associated with the protection device, and the G original traffic logs can be integrated to obtain an access traffic log associated with the service domain name. G is a positive integer. All access traffic logs involved in the present application can be obtained in this way.

[0114] The log integration component is a high-performance message middleware deployed between the protection device and the analysis server. The protection device can report all the original traffic logs recorded to the log integration component for analysis. For example, a distributed message system with large bandwidth (such as Kafka) can be used as the log integration component for centralized collection and transfer of logs. Kafka is a high-throughput distributed publish / subscribe message system that can handle all action stream data of consumers in a website. These data are usually solved by processing logs and log aggregation due to throughput requirements. It can be understood that when integrating logs, the log integration component can select a suitable compression algorithm according to actual needs to compress the received original traffic logs, so as to save transmission bandwidth. For example, a lossless compression algorithm (such as Zstd compression algorithm), a high-speed compression algorithm (such as snappy compression algorithm), etc. can be selected. For example, in the case of snappy compression algorithm in the actual network, 1G bandwidth of Kafka can guarantee 100w qps (qps is the abbreviation of query per second, the number of requests per second, a unit of request rate) traffic transfer without problems. For another example, the Zstd compression algorithm can increase resource consumption to obtain a larger compression ratio. In actual application, the compression algorithm can be selected according to the load of the actual network, and the embodiments of the present application do not limit this.

[0115] In addition, the log integration component can monitor the load of the entire protection system in real time. Optionally, when the magnitude of the attack is likely to or has exceeded the upper limit of the analysis capacity of the protection system (including the protection device, the analysis server, and the log integration component), the log integration component can issue relevant instructions to sample and report the logs, and subsequent analysis is switched to the model in the sampling scenario. Specifically, when it is detected that the data volume of the original traffic logs reported by the protection device is greater than the analysis capacity threshold (that is, the aforementioned upper limit of the analysis capacity) configured for the protection system, the log integration component can send a log sampling instruction to the protection device. The log sampling instruction is used to instruct the protection device to sample and process the original traffic logs, and then send the original traffic logs after sampling and processing (that is, the first sampled traffic logs) to the log integration component. Optionally, if it is detected that the data volume of the original traffic logs after sampling and processing is still greater than the analysis capacity threshold, the log integration component can continue to sample and process the received logs twice, so that the data volume of the logs after sampling and processing (that is, the second sampled traffic logs) is less than or equal to the analysis capacity threshold, and then integrate and send these logs to the analysis server for analysis. The analysis capacity threshold is determined by the actual configuration of the protection system, and the embodiments of the present application do not limit this.

[0116] It can be understood that, in the normal scenario, the access traffic log used by the analysis server for analysis contains accurate traffic log data, but in the sampling scenario, the access traffic log used by the analysis server for analysis is obtained by data restoration on the sampled traffic log (i.e., the first sampled traffic log or the second sampled traffic log described above). For example, assuming that the original traffic log is sampled at a certain sampling ratio (such as 50%), a corresponding sampled traffic log is obtained, and the analysis server can restore the sampled traffic log based on the sampling ratio, thereby restoring the full amount (i.e., 100%) of the access traffic log. Therefore, the access traffic log in the sampling scenario is similar to the access traffic log in the normal scenario, that is, in the sampling scenario, the data restoration of the sampled traffic log needs to be added in the subsequent steps to obtain the access traffic log for analysis. For ease of illustration, the subsequent embodiments of the present application will take the log analysis in the normal scenario as an example for illustration, and the process of log analysis in the sampling scenario is similar, only the data restoration step of the sampled traffic log needs to be added, which will not be repeated here.

[0117] It can be understood that, in the embodiments of the present application, the protection device can be used to protect one or more service domain names indicated by the service domain name. The number of service domain names is not limited here. For ease of illustration, the subsequent embodiments of the present application will take any service domain name (such as the service domain name C1 in the foregoing Figure 2 In order to obtain the detection threshold of the service domain name in the normal state (i.e., the non-attack state), the analysis server can obtain the first access traffic log associated with the service domain name, and can determine the detection threshold corresponding to the service domain name based on the first access traffic log. The first access traffic log here is obtained when the service state of the service domain name is in the normal state, and the time length for obtaining the first access traffic log is not limited here. The embodiments of the present application provide multiple ways to determine the detection threshold corresponding to the service domain name.

[0118] Optionally, for the service domain name existing in the offline baseline, a hybrid learning can be adopted, that is, the baseline learned offline is introduced to assist in judgment. Specifically, when the first detection threshold corresponding to the service domain name is obtained, the second detection threshold can be determined based on the first access traffic log; wherein the first detection threshold is determined based on the historical access traffic log associated with the service domain name; the acquisition timestamp of the historical access traffic log is earlier than the acquisition timestamp of the first access traffic log, and the historical access traffic log belongs to normal access traffic log, and there can be part of the same access traffic log in the historical access traffic log and the first access traffic log, or the historical access traffic log can be different from the first access traffic log. That is, the historical access traffic log is a historical access traffic log, and the offline server learns the threshold value offline for the historical access traffic log to obtain the first detection threshold, which can be used as an offline baseline. The offline server is a server independent of the analysis server; and the first access traffic log is the latest access traffic log pulled in real time at present, and the service state of the service domain name is normal, so the analysis server learns the threshold value in real time for the first access traffic log to obtain the second detection threshold, which can be used as a real-time baseline. Further, the detection threshold corresponding to the service domain name can be determined based on the first detection threshold and the second detection threshold; wherein the detection threshold is the maximum threshold in the first detection threshold and the second detection threshold; that is, the larger one of the first detection threshold obtained by offline threshold learning and the second detection threshold obtained by real-time threshold learning can be taken as the real-time attack detection baseline for subsequent protection (i.e. the detection threshold corresponding to the service domain name). For example, assuming that a certain business server has been connected to the protection system for one month, and there is new access traffic at the current time, the hybrid learning described above can be used to determine the detection threshold for the service domain name of the business server. By analyzing the offline baseline learning and the real-time baseline learning, the computing pressure of the analysis server can be relieved, and further learning in the case of historical data can improve the adaptability of the detection threshold.

[0119] Optionally, for the service domain name without offline baseline, a heuristic learning can be used to learn its real-time attack detection baseline. Specifically, the first access traffic log is determined based on traffic log data in a plurality of threshold detection periods; here, the threshold detection period can be determined according to actual needs, for example, if the threshold needs to be updated at a minute level, the threshold detection period can be set to F minutes (F is a positive integer); the plurality of threshold detection periods can include a first threshold detection period and a second threshold detection period; here, the first threshold detection period and the second threshold detection period are any two adjacent threshold detection periods, and the second threshold detection period is the next threshold detection period of the first threshold detection period; at this time, the service domain name is in a normal state, therefore, the analysis server can perform real-time threshold learning on the first access traffic log; specifically, the analysis server can obtain traffic log data located in the first threshold detection period from the first access traffic log as first traffic log data, and can obtain traffic log data located in the second threshold detection period from the first access traffic log as second traffic log data; when the third detection threshold determined based on the first traffic log data is obtained, the third detection threshold can be updated based on the second traffic log data to obtain a fourth detection threshold, and then the detection threshold corresponding to the service domain name can be determined based on the fourth detection threshold. For example, assuming that the threshold detection period is set to 5 minutes (i.e. F = 5), and the latest access traffic log (i.e. the first access traffic log) is pulled at 8:45 on March 1, the analysis server can perform real-time threshold learning on the first access traffic log, for example, 5 minutes from 8:45 to 9:50 on March 1 can be used as the first threshold detection period, and 5 minutes from 9:50 to 9:55 on March 1 can be used as the second threshold detection period. Correspondingly, the traffic log data located from 8:45 to 9:50 on March 1 can be used as the first traffic log data, real-time threshold learning is performed on the traffic log data, and a detection threshold at 9:50 on March 1 (i.e. the third detection threshold) can be obtained. The traffic log data located from 9:50 to 9:55 on March 1 can be used as the second traffic log data, real-time threshold learning is performed on the traffic log data, and the detection threshold at 9:50 on March 1 can be updated (equivalent to using the baseline at 9:50 on March 1 as a reference (i.e. merging it into the historical baseline) to iteratively learn to obtain the detection threshold at 9:55 on March 1 (i.e. the fourth detection threshold)). Through a similar process, when the traffic log data in the last threshold detection period of the plurality of threshold detection periods is iteratively learned, the latest detection threshold of the service domain name can be obtained as a real-time attack detection baseline for subsequent protection. For example, assuming that a business server is first connected to the protection system, and there is no offline baseline, for the service domain name of the business server, the above heuristic learning can be used to determine its detection threshold.The heuristic learning can be used to learn from zero without historical data, that is, the latest access traffic log is pulled in real time to make heuristic to determine which form at which moment is normal traffic form and record the corresponding real-time request quantity as the attack detection baseline, and the detection threshold is updated through continuous iteration of the system to improve the adaptability and rationality of the detection threshold.

[0120] It can be understood that the embodiments of the present application can support the use of an AI model based on machine learning technology to perform real-time threshold learning on the first access traffic log to obtain a real-time detection threshold. The threshold learning model can be obtained by pre-training an AI model, and the specific network structure of the threshold learning model is not limited here. Based on this, when the service domain name is in a normal state, the latest access traffic log associated with the service domain name (i.e., the first access traffic log described above) can be pulled in real time, that is, at the time of the acquisition timestamp of the first access traffic log, the access traffic of the service domain name is stable (i.e., the number of requests per unit time fluctuates less), and therefore the first access traffic log pulled can be input to the threshold learning model. The threshold learning model is used to perform threshold learning on the traffic log data in the first access traffic log within the threshold detection duration, and the learned data can be used as an attack detection baseline for domain name protection (i.e., a detection threshold corresponding to the service domain name), such as the second detection threshold, the third detection threshold, and the fourth detection threshold described above, which can be obtained by iterative learning of the threshold learning model. The threshold detection duration can be set according to actual needs, and the service domain name corresponding to the business state remains normal within the threshold detection duration, such as setting the threshold detection duration to one hour, which means that the normal traffic form can be learned for one hour to obtain the corresponding detection threshold. It can be understood that the threshold detection duration is determined by the above-mentioned multiple threshold detection periods, that is, the threshold detection duration can be divided into multiple threshold detection periods, and the threshold is updated iteratively in each threshold detection period.

[0121] Optionally, the offline server can also call the threshold learning model to perform offline threshold learning on the historical access traffic log to obtain the first detection threshold.

[0122] For service domain names that do not have an offline baseline, threshold learning can be performed for a threshold detection duration in the initial case to obtain an initial detection threshold (similar to an offline baseline), and then the initial detection threshold is used as a basis for iterative updates in each threshold detection period.

[0123] Optionally, in the process of threshold learning, when it is detected that the service state corresponding to the service domain name may be an abnormal state (such as sudden increase of access traffic), first suspend learning, and use the latest learned detection threshold to determine whether the current access behavior to the service domain name belongs to abnormal access behavior or normal access behavior; if it belongs to normal access behavior, the service state corresponding to the service domain name is still in a normal state, and threshold learning can continue; otherwise, if it belongs to abnormal access behavior, the service state corresponding to the service domain name is configured as an abnormal state, and threshold learning is not performed, and it is necessary to wait until the service state corresponding to the service domain name changes from an abnormal state to a normal state (i.e., after detecting that the attack is over, the access traffic of the service domain name is stable), and then continue learning for a threshold detection duration.

[0124] Optionally, the embodiments of the application can also support baseline generation by manual intervention. For example, after determining that the service state corresponding to the service domain name is an abnormal state through the above-mentioned automatic steps, threshold learning is not performed, but if it is manually judged that the current service state should be a normal state, the service state corresponding to the service domain name can be forcibly updated to a normal state by manual intervention, and then threshold learning can be performed.

[0125] When the service server indicated by the service domain name is attacked or subjected to stress testing, the service state corresponding to the service domain name is configured as an abnormal state / attack state; when the service server indicated by the service domain name is subjected to capacity cutting, the service state corresponding to the service domain name is configured as a normal state / non-attack state; that is, the abnormal access behavior in the embodiments of the application can include attack behavior (which can be referred to as attack for short), stress testing behavior (which can be referred to as stress testing for short), and the like in an abnormal attack scenario, and the normal access behavior can include capacity cutting behavior (which can be referred to as capacity cutting for short) and the like in a normal traffic surge scenario. The attack behavior here can be CC attack or other types of network attacks; the stress testing behavior refers to behavior for stress testing, which applies "pressure" to the service server by continuously sending a large number of access requests to it, to test the performance of the service server under pressure, to estimate the carrying capacity of the service server, and is usually internal human testing. The stress testing behavior generally has corresponding report information, but if no report information is detected, it is determined as abnormal access behavior; the capacity cutting behavior refers to behavior for controlling traffic direction when access traffic increases, such as a shopping website with an access traffic of 100 qps normally, and an access traffic of 10,000 qps on shopping day, which belongs to normal access behavior.

[0126] In step S102, a second access traffic log associated with the service domain name is obtained, the number of domain name requests of the service domain name is determined based on the access traffic indicated by the second access traffic log, and the access behavior to the service domain name is determined based on the number of domain name requests and the detection threshold.

[0127] It can be understood that whether the detection threshold is obtained through mixed learning or heuristic learning, the current attack state of the service domain name can be determined through the number of requests, the interception ratio, etc. In an embodiment, all domain name access traffic can be read in real time, the request quantity of the domain name granularity is counted in real time, and when the domain name request quantity exceeds the learned attack detection baseline, different attack detection schemes can be selected according to the ratio of the current access traffic to the attack detection baseline (i.e., the aforementioned interception ratio), and by judging whether it is a network attack (such as a CC attack) or a business surge, a suitable solution process can be selected according to the standard operating procedure (SOP).

[0128] Specifically, the analysis server can obtain a second access traffic log associated with the service domain name, based on the access traffic indicated by the second access traffic log, the domain name request quantity of the service domain name can be determined, and then based on the domain name request quantity and the detection threshold, the access behavior for the service domain name can be determined; wherein the second access traffic log refers to the latest access traffic log pulled in real time, and correspondingly, the access traffic indicated by the second access traffic log refers to the access traffic of the service domain name read in real time; the acquisition timestamp of the second access traffic log is later than the acquisition timestamp of the first access traffic log, and there are some access traffic logs in the second access traffic log that are the same as those in the first access traffic log. For example, assuming that the acquisition timestamp of the first access traffic log is March 1, 8:45, a certain real-time detection threshold corresponding to the service domain name is learned based on the first access traffic log, and then the second access traffic log is obtained in real time, such as the acquisition timestamp of the second access traffic log is March 1, 9:00, therefore the second access traffic log and the first access traffic log have the same part; the application embodiment does not limit the acquisition time length of the second access traffic log, within the acquisition time length, the request quantity of the domain name granularity (i.e., the domain name request quantity) can be counted in real time through the access traffic indicated by the second access traffic log, for example, assuming that the current time is March 1, 9:00, the access traffic read in real time at this time is the access traffic indicated by the second access traffic log at March 1, 9:00, and thus the current domain name request quantity can be counted in real time.

[0129] The analysis server can obtain an access request carrying a service domain name from the access traffic indicated based on the second access traffic log, and the number of obtained access requests is taken as the domain name request quantity of the service domain name, that is, the number of requests currently statistically obtained in real time for the service domain name. Further, the domain name request quantity and the detection threshold value can be used for judgment. Optionally, when the domain name request quantity is greater than the detection threshold value, the ratio data of the domain name request quantity and the detection threshold value can be obtained, and the detection strategy for the service domain name is determined based on the ratio data. Further, the access behavior for the service domain name can be determined based on the detection strategy. The ratio data herein can be understood as the ratio of the real-time access traffic for the service domain name to the attack detection baseline. The detection strategy refers to an attack detection scheme used to determine the access behavior. When the domain name request quantity is greater than the detection threshold value, it means that the current real-time access traffic deviates from the normal traffic pattern to a certain extent. At this time, it is not possible to directly determine whether the access behavior for the service domain name is abnormal access behavior or normal access behavior. Therefore, the ratio data of the domain name request quantity and the detection threshold value is needed to describe the deviation degree of the real-time access traffic from the normal traffic pattern. According to different ratio data, different detection strategies can be selected to further determine the access behavior for the service domain name.

[0130] The judgment of the access behavior based on the ratio data of the domain name request quantity and the detection threshold value mainly includes three judgment logics, that is, the detection strategy determined based on different ratio data can include three kinds, which are described as follows.

[0131] Optionally, when the ratio data is in the first ratio range, a first request surge rate between the domain name request quantity and the detection threshold value can be obtained. If the first request surge rate is greater than a first increment threshold value, a first detection strategy can be configured for the service domain name. Subsequently, the access behavior for the service domain name can be determined based on the first detection strategy. The specific value range of the first ratio range is not limited in the embodiment of the application, and can be set according to actual needs, for example, it can be set to 8 times or more. The first request surge rate refers to the surge amount of the real-time access traffic for the service domain name in a unit of time compared with the detection threshold value (that is, the attack detection baseline), and the unit can be set to qps. The specific value of the first increment threshold value is not limited in the embodiment of the application, and can be set according to actual needs, for example, it can be set to 5000 qps. It can be understood that in the case that the ratio data is in the first ratio range and the first request surge rate is greater than the first increment threshold value, it means that the current real-time access traffic has deviated from the normal traffic pattern to a serious extent. At this time, the access behavior is abnormal access behavior (such as attack behavior) with high confidence, and therefore the first detection strategy needs to be selected for further judgment.

[0132] Optionally, when the ratio data is in a second ratio range, a second request surge rate between the domain name request quantity and the detection threshold can be obtained, and if the second request surge rate is greater than a second increment threshold, a second detection strategy can be configured for the service domain name, and the access behavior for the service domain name can be determined based on the second detection strategy subsequently. The second ratio range is smaller than the first ratio range, and the second increment threshold is smaller than the first increment threshold. In the embodiments of the present application, the specific value range of the second ratio range is not limited, and can be set according to actual needs, for example, can be set to 4-8 times. The second request surge rate refers to the surge of real-time access traffic for the service domain name in a unit of time compared with the detection threshold (i.e., the attack detection baseline), and the unit can be set to qps. In the embodiments of the present application, the specific value of the second increment threshold is not limited, and can be set according to actual needs, for example, can be set to 2000 qps. It can be understood that in the case that the ratio data is in the second ratio range and the second request surge rate is greater than the second increment threshold, it indicates that the current real-time access traffic has slightly seriously deviated from the normal traffic pattern, and the confidence of the access behavior at this time belonging to abnormal access behavior is relatively lower than the previous case, and therefore the second detection strategy needs to be selected for further determination.

[0133] Optionally, when the ratio data is in a third ratio range, a third detection strategy can be configured for the service domain name, and the access behavior for the service domain name can be determined based on the third detection strategy subsequently. The third ratio range is smaller than the second ratio range. In the embodiments of the present application, the specific value range of the third ratio range is not limited, and can be set according to actual needs, for example, can be set to 1-4 times. It can be understood that in the case that the ratio data is in the third ratio range, it indicates that the current real-time access traffic has slightly deviated from the normal traffic pattern, and the confidence of the access behavior at this time belonging to abnormal access behavior is very low, and therefore the third detection strategy needs to be selected for further determination.

[0134] Based on this, the first detection strategy or the second detection strategy or the third detection strategy can be used as the detection strategy for the service domain name. Further, the specific process of determining the access behavior for the service domain name based on the detection strategy can be as follows:

[0135] Optionally, when the detection strategy is the first detection strategy, first cleaning information associated with the service domain name can be acquired based on the first detection strategy; if the first cleaning information indicates that the request state of the access request in the access traffic contains a cleaning state, it can be determined that the access behavior for the service domain name belongs to abnormal access behavior. The first cleaning information refers to information related to the cleaning of the current access traffic for the service domain name, and can be used to indicate the access request that has been cleaned by the protection device in the current access traffic. In the embodiments of the present application, when the protection device receives the access traffic for the service domain name, the access request in the access traffic can be configured with a corresponding request state to indicate the operation performed on the access request, wherein when the access request is cleaned / intercepted, the request state thereof can be configured as a cleaning state; when the access request is released, the request state thereof can be configured as a release state. That is, in the case of using the first detection strategy, when the first cleaning information indicates that the request state of the access request in the access traffic contains the cleaning state, it indicates that the cleaning has been generated at present, and therefore it can be directly determined that the access behavior belongs to the abnormal access behavior.

[0136] Optionally, when the detection strategy is the second detection strategy, the first service response information and the second cleaning information associated with the service domain name can be acquired in the continuous N detection periods based on the second detection strategy; N is a positive integer; and then the access behavior for the service domain name can be determined based on the first service response information and the second cleaning information. The detection period refers to a time period configured for detecting the access behavior, and the specific value of the detection period will not be limited in the embodiments of the present application, and can be set according to actual needs, for example, it can be set to 10 seconds, that is, detection is performed once every 10 seconds; the value of N can also be set according to actual needs, for example, when the detection period is 10 seconds, N can be set to 3, indicating that detection needs to be performed for 3 detection periods (that is, 30 seconds). The first service response information refers to the service response to the current access traffic, and can be used to indicate the processing result of the access request in the current access traffic by the business server. The first service response information can specifically include the status code returned by the business server for the access request, for example, when the status code is 1xx (that is, 100-199, which can be referred to as an informative status code), it indicates that the received access request is being processed; when the status code is 2xx (that is, 200-299, which can be referred to as a successful status code), it indicates that the access request is normally processed; when the status code is 3xx (that is, 300-399, which can be referred to as a redirection status code), it indicates that additional operations need to be performed to complete the access request; when the status code is 4xx (that is, 400-499, which can be referred to as a client error status code), it indicates that the business server cannot process the access request; and when the status code is 5xx (that is, 500-599, which can be referred to as a server error status code), it indicates that the business server processing the access request has an error. The second cleaning information refers to the information about the cleaning situation of the current access traffic of the service domain name, and can be used to indicate the access request in the current access traffic that has been cleaned by the protection device. That is, in the case of using the second detection strategy, the access behavior for the service domain name can be determined by continuously detecting for N detection periods based on the service response and the cleaning situation, for example, if the first service response information detects that the business server continuously responds to the status code of 5xx, and the second cleaning information detects that the abnormal access traffic is not completely cleaned, it can be determined that the access behavior for the service domain name is abnormal access behavior.

[0137] Optionally, when the detection strategy is the third detection strategy, the second service response information associated with the service domain name can be acquired based on the third detection strategy in the continuous M detection periods, M is a positive integer, and then the access behavior for the service domain name can be determined based on the second service response information. The specific meaning of the detection period can be referred to the foregoing, which will not be described here. The value of M can be set according to actual needs, for example, when the detection period is 10 seconds, in order to realize continuous detection, M can be set to a large value. The second service response information refers to the service response to the current access traffic, which can be used to indicate the processing result of the access request in the current access traffic by the business server. The second service response information can specifically include the status code returned by the business server for the access request, and the specific meaning of the status code can be referred to the foregoing, which will not be described here. That is, in the case of the third detection strategy, the access behavior for the service domain name can be determined according to the continuous determination of the service response.

[0138] Based on this, in some specific embodiments, the real-time access traffic for the service domain name is determined with the attack detection baseline, and the main determination logic can include the following three points:

[0139] (1) When the real-time access traffic exceeds 8 times the attack detection baseline and increases by more than 5000 qps, and cleaning has been generated, it is directly determined as an attack;

[0140] (2) When the real-time access traffic exceeds 4-8 times the attack detection baseline and increases by more than 2000 qps, the continuous detection is performed for 3 time periods, and the determination is performed according to the service response and the cleaning.

[0141] (3) When the real-time access traffic exceeds 1-4 times the attack detection baseline, the continuous determination is performed according to the service response.

[0142] Optionally, when the number of domain name requests is less than or equal to the detection threshold, it can be determined that the access behavior for the service domain name belongs to normal access behavior.

[0143] It can be understood that when the access behavior for the service domain name belongs to abnormal access behavior, a detection attack signal (which can be specifically a detection CC attack signal) can be generated, which is used to indicate that an attack is detected for the service domain name, and the business server can be further instructed to analyze the attack characteristics. When the access behavior for the service domain name belongs to normal access behavior, it indicates that the detection for the service domain name is normal surge, and a second baseline update instruction can be generated, which is used to instruct to update the related baseline data (i.e., the detection threshold and the normal traffic characteristics) of the service domain name based on the current access traffic.

[0144] Step S103, when the access behavior for the service domain name belongs to the abnormal access behavior, taking the behavior determination time point corresponding to the abnormal access behavior as a critical time point for dividing the abnormal traffic, and taking the third access traffic log obtained based on the critical time point as an abnormal access traffic log;

[0145] It can be understood that when the access behavior for the service domain name belongs to the abnormal access behavior, the behavior determination time point corresponding to the abnormal access behavior can be taken as a critical time point for dividing the abnormal traffic, and the third access traffic log obtained based on the critical time point can be taken as an abnormal access traffic log; wherein the acquisition timestamp of the third access traffic log is later than the acquisition timestamp of the second access traffic log, and the third access traffic log is different from the second access traffic log. Wherein, the behavior determination time point refers to the time point when the abnormal access behavior is detected, and the critical time point refers to the dividing point for dividing the abnormal traffic. For example, assuming that the behavior determination time point corresponding to the abnormal access behavior is March 1, 10:00, then March 1, 10:00 can be taken as the critical time point, and the third access traffic log is obtained based on the critical time point, at this time the acquisition timestamp of the third access traffic log is March 1, 10:00; assuming that the behavior end time point when the abnormal access behavior is detected is March 1, 10:05, then the acquisition duration of the third access traffic log is 5 minutes from March 1, 10:00 to 10:05, and the third access traffic log can be taken as the abnormal access traffic log, and the acquisition duration of the abnormal access traffic log is determined by the critical time point and the behavior end time point; accordingly, the second access traffic log before the critical time point belongs to the normal access traffic log. That is, when the attack detection signal is received, the time point of attack detection can be taken as the dividing point to divide the normal traffic pattern data (i.e. the data contained in the second access traffic log) and the abnormal traffic pattern data (i.e. the data contained in the abnormal access traffic log).

[0146] Step S104, when the normal traffic feature determined based on the first access traffic log is obtained, determining the abnormal traffic feature of the service domain name based on the abnormal access traffic log, comparing the abnormal traffic feature and the normal traffic feature to obtain the attack feature of the service domain name;

[0147] It can be understood that after the abnormal access traffic log is obtained, the feature of the traffic that does not conform to the normal traffic pattern can be analyzed, and the aggregation index is given, which is compared with the feature of the traffic conforming to the normal traffic pattern, and the attack feature of the service domain name can be determined. Specifically, when the normal traffic feature determined based on the first access traffic log is obtained, the abnormal traffic feature of the service domain name can be determined based on the abnormal access traffic log, and then the abnormal traffic feature and the normal traffic feature can be compared to obtain the attack feature of the service domain name.

[0148] The first access traffic log is a log obtained when the service domain name is in a normal state. In order to obtain normal traffic characteristics of the service domain name in the normal state (i.e., in a non-attack state), the analysis server can determine the normal traffic characteristics based on the first access traffic log. The normal traffic characteristics can be used to represent a traffic pattern baseline of the service domain name in the normal state. For a service domain name that can be learned (i.e., a service domain name in a normal state), the analysis server can perform real-time feature learning on the first access traffic log, i.e., continuously learn the main feature distribution in the corresponding normal access traffic, to obtain the normal traffic characteristics. The number of features of the normal traffic characteristics is not limited.

[0149] For example, through continuous feature learning, a series of statistical data associated with normal access traffic can be learned, including but not limited to whether there is a certain feature in history, what percentage of a certain feature is, how long a certain feature lasts, what is the maximum / minimum peak value, and the like, to describe the normal traffic pattern. For example, by learning 1000 qps of normal access traffic of a website, it can be analyzed that the main user is a windows user, the main region where the user is located is region B, the main requested resource type is an image, and the like, as the normal traffic characteristics of the website.

[0150] It can be understood that the embodiments of the present application can support using an AI model based on machine learning technology to perform real-time feature learning on the first access traffic log to obtain a real-time traffic pattern baseline. The feature learning model can be obtained by pre-training an AI model, and the specific network structure of the feature learning model is not limited. Based on this, when the service domain name is in a normal state, the latest access traffic log (i.e., the first access traffic log) associated with the service domain name can be pulled in real time, that is, at the time stamp of the first access traffic log, the access traffic of the service domain name is stable (i.e., the number of requests per unit time fluctuates less), and therefore the first access traffic log pulled in can be input into the feature learning model. The feature learning model performs feature learning on the traffic log data in the feature detection time length in the first access traffic log. The learned data can be used as a traffic pattern baseline for domain name protection (i.e., normal traffic characteristics of the service domain name). The feature detection time length can be set according to actual needs, and the service domain name corresponding to the business state remains in a normal state within the feature detection time length. For example, the feature detection time length can be set to one hour, indicating that the normal traffic pattern can be continuously learned for one hour to obtain the corresponding normal traffic characteristics.

[0151] Optionally, in the process of feature learning, when it is detected that the service domain name corresponds to a business state that may be an abnormal state (such as sudden increase in access traffic), first suspend learning, and use the latest learned detection threshold to determine whether the current access behavior for the service domain name belongs to abnormal access behavior or normal access behavior; if it belongs to normal access behavior, the service domain name corresponds to a business state that is still in a normal state, and feature learning can continue; otherwise, if it belongs to abnormal access behavior, the service domain name corresponds to a business state that is configured to be an abnormal state, and feature learning is not performed, and it is necessary to wait until the service domain name corresponds to a business state that changes from an abnormal state to a normal state (i.e., after detecting that the attack is over, the access traffic of the service domain name is stable), and then continue learning for a feature detection duration.

[0152] Optionally, the embodiments of the present application can also support baseline generation by human intervention. For example, after determining that the service domain name corresponds to a business state that is an abnormal state through the above-mentioned automatic steps, feature learning is not performed, but if it is judged by a human that the current business state should be a normal state, the service domain name corresponding to the business state can be forcibly updated to a normal state by human intervention, and then feature learning can be performed.

[0153] Among them, the features (including normal traffic features and abnormal traffic features) involved in the present application can be divided into primary features (i.e., first type of features) and advanced features (i.e., second type of features), the feature level of the primary features is lower than that of the advanced features, and the same type of features can also have different feature levels.

[0154] The primary features are mainly used to resist relatively low-level attack methods, and the change of the features of such methods is usually small. The primary features can specifically include a client identifier, a request source identifier, identity signature information, a request resource type, a request compression type, a fingerprint identifier, a cache identifier, and the like. The client identifier can be used to indicate configuration information associated with an application client carried in an access request, the application client being a client running on an access device and initiating the access request, and the client identifier can be specifically indicated by a user agent field (i.e., User Agent, UA). In a scenario where the application client is a browser, the UA can also be referred to as a browser identifier or a browser card. The UA is a specific field sent to a business server by the application client (such as a browser) when the application client accesses the business server, and can be used to represent relevant information of a user identifier, so that the business server can identify information of an operating system and a version used by the application client, a central processing unit (CPU) type, a browser and a version, a browser rendering engine, a browser language, a browser plug-in, and the like (i.e., configuration information associated with the application client). The request source identifier can be used to indicate source information carried in the access request, and the request source identifier can be specifically indicated by a page source field (i.e., Referer). The Referer can be used to identify a source page of a request, and provides referral information to tell the business server that the current request comes from which page link. The identity signature information refers to signature information used to identify the application client, and the identity signature information can be specifically a JA3-based identity signature (also referred to as a JA3 fingerprint). The JA3 is a method for creating a client fingerprint based on a secure socket layer protocol (SSL) / transport layer security protocol (TLS), and can generate corresponding identity signature information based on information such as an SSL / TLS version, a browser extension list, and a number of cipher suites. The request resource type refers to a resource type indicated by the access request to be acquired by the business server. The resource type can be specifically indicated by a request resource type field (i.e., ACCEPT), and can be used to inform (the business server) a resource type desired by the application client or a resource type that can be parsed and identified. The resource type requested by the application client can include, but is not limited to, any one or more of a text type, a picture type, a video type, an audio type, a script file type, and the like.The request compression type refers to an access request indicating a compression type configured by a service server. The compression type can be indicated by a request compression type field (i.e., ACCEPT-ENCODING) and can be used to inform an application client of a content encoding method (usually a compression algorithm, i.e., a compression type) that the client can understand. That is, Accept-Encoding can indicate whether a service resource of the current request expects compression when responding. Generally, a browser adds this to the request header by default when accessing a webpage, which can reduce the amount of network transmission data and save network bandwidth. The fingerprint flag refers to fingerprint information used to identify an application client. The fingerprint flag can be indicated by a fingerprint flag field (i.e., tls_CIPHER). tls_CIPHER can be referred to as a TLS fingerprint. During TLS handshake, the application client sends a ClientHello feature that can include information such as a list of encryption suites supported by the application client and their arrangement order, a TLS version supported by the application client, a compression method, a list of TLS extensions and their arrangement order, and the like. The cache flag refers to a cache instruction carried in an access request. The cache flag can be indicated by a cache flag field (i.e., Cache-Control). Cache-Control is a general message header field used in HTTP (i.e., Hyper Text Transfer Protocol) requests and responses to implement a cache mechanism by specifying a cache instruction.

[0155] The advanced features are mainly used to resist relatively advanced attack methods. Such attack methods often generate random UAs, add different random parameters or parameter names to bypass the cache mechanism of the CDN, thereby causing greater harm to the source station (i.e., service server). The advanced features can specifically include UA length (also referred to as client identifier length), URL length (also referred to as resource address length), parameter presence, parameter length, and the like. The parameter presence refers to a parameter that does not exist in a normal access request but exists in an abnormal access request. When the access request is an HTTP request, the parameter specifically refers to an HTTP request parameter, such as a GET parameter or a POST parameter. It can be understood that if the parameter carried in the current access request is the same as the parameter carried in the previous access request, the historical cache data can be obtained from the nearby server. If other different parameters are added or the parameters carried are inconsistent with the parameters carried in the previous access request, the data needs to be obtained from the source station, which can cause greater harm to the source station.

[0156] It can be understood that since the attacker often issues the same attack instruction to a batch of chickens (i.e., a puppet machine remotely controlled by the attacker, which can be an access device based on various operating systems), and the access request initiated by the chicken during the attack period often has certain differences from the access request of the normal user to the website, even if the attacker copies the field attributes after capturing the normal traffic, it cannot change some unique attributes of the chicken, such as TLS fingerprint, JA3 fingerprint, etc. Therefore, by comparing the normal traffic characteristics and the abnormal traffic characteristics, effective attack characteristics can be analyzed.

[0157] Based on this, when the normal traffic characteristics are obtained, the analysis server can determine the abnormal traffic characteristics of the service domain name based on the abnormal access traffic log. The abnormal traffic characteristics here refer to the characteristics analyzed from the abnormal access traffic indicated by the abnormal access traffic log. The number of characteristics of the abnormal traffic characteristics is not limited here. It can be understood that part or all of the abnormal traffic characteristics will have the same characteristics as the normal traffic characteristics. Further, the proportion can be compared from top to bottom. According to the proportion of a certain characteristic in the normal traffic and the proportion in the abnormal traffic, it can be determined whether this characteristic is an attack characteristic that needs to be issued to the live network. Subsequently, the policy data associated with the attack characteristics that need to be issued can be obtained, so that the corresponding protection strategy can be generated based on the policy data.

[0158] Among them, assuming that the abnormal traffic characteristics include a target characteristic, the target characteristic can be any one of the abnormal traffic characteristics; the specific process of comparing the abnormal traffic characteristics and the normal traffic characteristics to obtain the attack characteristics of the service domain name can be: obtaining a first feature proportion of the target characteristic in the abnormal traffic characteristics, and obtaining a second feature proportion of the target characteristic in the normal traffic characteristics. The first feature proportion can be used to represent the proportion of the target characteristic in the abnormal traffic, and the second feature proportion can be used to represent the proportion of the target characteristic in the normal traffic; when the first feature proportion is greater than a first proportion threshold, and the second feature proportion is less than a second proportion threshold, the target characteristic can be taken as an attack characteristic of the service domain name; wherein the second proportion threshold is less than or equal to the first proportion threshold. The specific values of the first proportion threshold and the second proportion threshold are not limited here and can be set according to actual needs. For example, assuming that the first proportion threshold is set to 80%, and the second proportion threshold is set to 10%, for a certain characteristic X1 (which can be the aforementioned target characteristic, such as a certain UA), assuming that its feature proportion in the abnormal traffic characteristics is 98% (which can be the aforementioned first feature proportion), which is greater than 80%; and its feature proportion in the normal traffic characteristics is 5% (which can be the aforementioned second feature proportion), which is less than 10%, indicating that the characteristic X1 has a high proportion in the abnormal traffic and a low proportion in the normal traffic. At this time, the characteristic X1 can be taken as an attack characteristic that needs to be issued.

[0159] In the feature comparison, the features in the abnormal traffic features can be compared from high to low according to the feature proportion, and the higher the feature proportion in the abnormal traffic features, the greater the possibility that the feature is an effective attack feature. For example, assuming that the abnormal traffic features include 100 features, but 2 features (such as feature X2 and feature X3) are particularly abnormal, and the feature proportions are 99% and 95% respectively, and the feature proportion of the feature with the highest proportion in the remaining 98 features is only 3%. According to the comparison from high to low according to the feature proportion, the feature X2 can be compared first to determine whether it is an attack feature, and then the feature X3 is compared from the feature X2, and all attack features are analyzed until all attack features are analyzed. In this way, the feature analysis efficiency can be improved.

[0160] In step S105, a protection strategy for the service domain name is determined based on the attack features.

[0161] It can be understood that after the attack features are analyzed, the analysis server can determine the protection policy for the service domain name based on the attack features. Specifically, the policy data associated with the attack features and the protection configuration association information associated with the service domain name can be obtained, and then the first policy data associated with the first attack feature for policy issuance can be obtained from the policy data based on the protection configuration association information; based on the first policy data, the protection policy for the service domain name can be generated. Wherein, the attack features can be one or more, the number of attack features is not limited by the embodiments of the present application, the policy data here can also be referred to as policy core data, which refers to the core data for policy interception of access requests matching the attack features. Similarly, the first attack feature can be one or more, the number of first attack features is not limited by the embodiments of the present application, and the first policy data refers to the data associated with the first attack feature in the policy data. The protection configuration association information refers to the protection configuration, stability and other information associated with the service domain name, which can specifically include the protection level configured for the service domain name, the stability degree of the related platform, the protection value corresponding to the service domain name, etc., wherein the protection level can be configured by the user as needed, such as the protection level can be divided into first protection level (i.e. no protection), second protection level (i.e. low protection level), third protection level (i.e. medium protection level) and fourth protection level (i.e. high protection level) from low to high, different protection levels can affect the selection of the feature level of the attack features issued, such as when the high protection level is configured, high-level features can be issued; the stability degree of the related platform includes the stability degree of the protection platform (i.e. protection system) and the stability degree of the access side platform (i.e. business server), such as when the stability degree is low, it means that the related platform is unstable, at this time the protection is the main; the protection value refers to the value of protecting the business server, if the protection value is high, the protection is the main, and strict protection policy can be issued to clean all abnormal access traffic as much as possible, and if the protection value is low, the protection policy can be relaxed, and a certain amount of abnormal access traffic can be allowed to pass through the protection. That is, the embodiments of the present application can determine the attack features (i.e. the first attack features mentioned above, such as a certain UA) to be issued at present based on the current protection configuration association information, and generate the corresponding protection policy based on the related policy data (i.e. the first policy data mentioned above), which is used for issuing to the protection device for protection (such as issuing interception to a certain UA).

[0162] The protection strategies can be one or more, and the number of protection strategies is not limited by the embodiments of the present application. The analysis server can reasonably distribute the protection strategies to the protection device through strategy assembly, strategy arrangement, strategy verification, etc., so that the protection device starts protection based on the received protection strategies. The strategy assembly refers to an operation of assembling the distributed strategy data (such as the first strategy data described above) into a protection strategy recognizable by the protection device. For example, the related strategy data can be packaged into a corresponding protection instruction, and the protection instruction can obtain a recognizable protection strategy. The strategy arrangement refers to an operation of sorting different protection strategies based on the performance consumption, strategy priority, protection situation of the existing network, etc. of different protection strategies before the protection strategies are distributed, so as to enhance the protection capability of the protection device. The strategy verification refers to an operation of verifying the protection strategy after the protection strategy is distributed, so as to check whether the protection strategy is correct and the influence range is controllable.

[0163] In an embodiment, before the protection strategy is distributed, the analysis server can obtain the performance consumption level and the strategy priority level of the protection strategy. The performance consumption level can be used to indicate the high or low degree of performance consumed by the protection strategy. The higher the performance consumption level, the higher the performance consumed by the protection strategy. The lower the performance consumption level, the lower the performance consumed by the protection strategy. The strategy priority level can be used to indicate the priority of the execution of the protection strategy. The higher the strategy priority level, the higher the priority of the execution of the protection strategy. Further, the protection strategy can be arranged based on the performance consumption level and the strategy priority level. For example, for the performance consumption level, the protection strategy with a lower performance consumption level can be arranged in a front position, and the protection strategy with a higher performance consumption level can be arranged in a rear position. For example, for the strategy priority level, the protection strategy with a higher strategy priority level can be arranged in a front position, and the protection strategy with a lower strategy priority level can be arranged in a rear position. The comprehensive consideration of the two can achieve reasonable arrangement of the protection strategy. Then, the protection strategy arranged can be distributed to the protection device, so that the protection device protects the service domain name indicated by the service server. In addition, the protection strategy can also be arranged in combination with the protection situation of the existing network. For example, it is assumed that the interception strategy based on the frequency control value is also distributed to the protection device. The interception strategy based on the frequency control value can be arranged in a front position, and the protection strategy based on the attack feature obtained by the embodiments of the present application can be arranged in a rear position. That is, the access traffic is cleaned once by using the interception strategy based on the frequency control value, and the access traffic cleaned is cleaned twice by using the protection strategy based on the attack feature, so that the protection effect can be improved.

[0164] As can be known from the above, the embodiment of the application uses historical service information (i.e., the first access traffic log) to model the access mode of a website from historical normal access, to make a benchmark judgment on the access time of an attack, and to issue an interception instruction for traffic that does not conform to the normal traffic mode when it seriously deviates from the normal traffic mode, so that the abnormal access request can be intercepted in a short time when the attack comes, and the safety of users and the platform can be protected. In addition, the method provided by the embodiment of the application realizes the real-time and accuracy of attack protection,

[0165] In addition, in an embodiment, the analysis server can also monitor and analyze the issued protection strategy in real time. When it is found that the protection strategy is insufficient in interception, a negative feedback mechanism can be started according to the user setting to improve the feature analysis level; when it is perceived that the protection strategy may exist false positives, the false positive protection strategy is determined, and the subsequent attack protection of the service domain name is shielded from issuing the strategy.

[0166] The analysis server can obtain third service response information associated with the service domain name, obtain, based on the third service response information, a first cleaning request proportion corresponding to an access request in a cleaning state and a first abnormal response proportion corresponding to an access request in an abnormal response state in access traffic (i.e., abnormal access traffic) indicated based on the abnormal access traffic log; the third service response information is obtained after the protection policy is issued; the third service response information refers to the service response of the business server to the current access traffic; the first cleaning request proportion refers to the proportion of the access request that has been cleaned in the abnormal access traffic, and can be used to represent the mitigation of attack transparent transmission after the protection policy is issued; the first abnormal response proportion refers to the proportion of the access request that appears abnormal response in the abnormal access traffic, and can be used to represent the service response exception of the business server after the protection policy is issued; the response state of the access request can be represented by the status code returned by the business server for the access request, and can be divided into an abnormal response state and a normal response state; the abnormal response state can be indicated by a client error status code or a server error status code; the normal response state can be indicated by an informative status code, a success status code or a redirection status code; that is, when the status code returned by the business server is a client error status code or a server error status code, the response state of the access request is an abnormal response state; when the status code returned by the business server is an informative status code or a success status code or a redirection status code, the response state of the access request is a normal response state. Further, when the first cleaning request proportion is less than a third proportion threshold, and the first abnormal response proportion is greater than a fourth proportion threshold, it indicates that the attack feature (such as the first attack feature described above) that has been issued fails to timely mitigate the transparent transmission in the attack, and the user backend service exception proportion is continuously high, that is, there is a situation of insufficient interception of the protection policy; at this time, based on the protection level configured for the service domain name, the measure of improving the analysis feature level can be taken, and the second policy data associated with the second attack feature is obtained from the policy data; the protection level here can be pre-configured by the user, indicating the user's subscription; the feature level of the second attack feature is higher than that of the first attack feature; compared with the first attack feature, the second attack feature is more effective in facing attack protection; and the foregoing protection policy can be updated based on the second policy data. The specific values of the third proportion threshold and the fourth proportion threshold are not limited in the embodiments of the application, and can be set according to actual needs.

[0167] It can be seen that when the discovery strategy interception is insufficient, the analysis server can issue measures to improve the analysis feature level, improve the false positive tolerance, etc. to analyze more effective attack features. For example, assuming that the user's subscribed protection level is high protection level, initially to avoid false positives, the corresponding strategy based on low protection level (such as the protection strategy associated with the primary feature UA) can be issued first, if the current issued strategy cannot prevent the attack, the protection level can be gradually improved; with the protection level improved to high protection level, the corresponding strategy based on high protection level (such as the protection strategy associated with the senior feature UA length) can be issued. It can be understood that configuring a high protection level means that the user can accept high protection and high false positives, configuring a medium protection level means that the user can moderately tolerate protection and false positives, and configuring a low protection level means that the user can accept low protection and low false positives.

[0168] It can be known from the foregoing that the feature level of the primary feature is lower than that of the senior feature, and the same type of feature can also have different feature levels. Taking the senior feature as an example, the feature level of the UA length and the URL length can be lower than that of the parameter existence and the parameter length. For the measure to improve the analysis feature level, it can be understood as follows: assuming that the user's subscribed protection level is medium protection level, and the protection strategy for intercepting the low-level feature UA and ACCEPT has been issued, but it is found that the protection effect is not good, at this time, the analysis feature level can be improved to analyze the UA length, URL length, etc. features with higher feature levels, and issue protection strategies for intercepting these senior features, if it is still impossible to achieve effective protection, considering that the user only requires the protection level to be up to medium protection level, then there is no need to continue to analyze the parameter existence, parameter length, etc. features with higher feature levels.

[0169] Further, the analysis server can acquire, when the fourth access traffic log associated with the service domain name is acquired, a second cleaning request proportion corresponding to the access request in the cleaning state and a second abnormal response proportion corresponding to the access request in the abnormal response state in the access traffic indicated based on the fourth access traffic log; the fourth access traffic log refers to the latest access traffic log pulled in real time after the foregoing protection policy is issued, and the access traffic indicated by the fourth access traffic log is the real-time access traffic currently for the service domain name, and the acquisition timestamp of the fourth access traffic log is later than the acquisition timestamp of the third access traffic log; the second cleaning request proportion refers to the proportion of the access request that has been cleaned in the detected real-time access traffic, and can be used to represent the pass-through traffic form corresponding to the service domain name after the protection policy is issued; and the second abnormal response proportion refers to the proportion of the access request that appears abnormal response in the detected real-time access traffic, and can be used to represent the service response abnormality of the business server after the protection policy is issued. Further, when the second cleaning request proportion is greater than a fifth proportion threshold, and the second abnormal response proportion is greater than a sixth proportion threshold, it indicates that the magnitude of the pass-through and the proportion of the service response abnormality are increased compared with the normal scene, that is, the current protection policy may exist false positives, and the abnormal interception feature can be acquired from the first attack feature, wherein the abnormal interception feature refers to the feature of false positives for normal access requests; the fifth proportion threshold and the sixth proportion threshold are determined based on the first access traffic log, that is, the fifth proportion threshold and the sixth proportion threshold are determined when the business state corresponding to the service domain name is in the normal state, and can be used to represent the historical normal traffic form; and further, the policy associated with the abnormal interception feature in the protection policy can be shielded, that is, the policy associated with the abnormal interception feature is no longer issued in the subsequent attack protection for the service domain name.

[0170] Therefore, it can be seen that the embodiment of the application monitors the pass-through traffic form of the user service through the bypass, and when it is found that the magnitude of the pass-through and the proportion of the service response abnormality are increased compared with the normal scene, it indicates that the pass-through traffic form is not consistent with the historical normal traffic form, and therefore the current protection policy may exist false positives, and the false positive analysis needs to be started to find the feature of false positives for normal access requests, and the feature can be shielded. Through continuous monitoring, it can be ensured that the normal business of the customer is not affected.

[0171] It can be understood that, optionally, when the access behavior to the service domain name is normal, the analysis server can update the detection threshold and the normal traffic characteristics based on the second access traffic log. That is, the analysis server can generate a second baseline update instruction, and update the attack detection baseline and the traffic pattern baseline of the service domain name according to the current pulled access traffic (i.e., the access traffic indicated by the second access traffic log) based on the second baseline update instruction. The baseline updating process can refer to the threshold learning process described in step S101 and the characteristic learning process described in step S104, which will not be described here.

[0172] Therefore, the embodiment of the application provides an intelligent protection method based on attack characteristic analysis, which plays a key role in protecting network attacks (such as CC attacks). By combining the detection threshold and the normal traffic characteristics obtained by analyzing the related access traffic log, the normal traffic pattern of the service domain name indicated by the business server can be modeled from the historical normal access traffic, and then the access behavior to the service domain name can be judged based on the detection threshold. When abnormal access behavior is detected, abnormal access traffic that deviates from the normal traffic pattern can be divided, and the attack characteristics can be described by comparing the abnormal traffic characteristics and the normal traffic characteristics. Therefore, based on different attack characteristics, a protection strategy for intercepting abnormal access traffic without affecting normal access traffic can be developed. In this way, through automatic comparison and analysis, the problem that the protection strategy is invalid due to short attack duration, long manual intervention time, and frequent attack changes in the attack scenario is effectively solved, so that the abnormal access traffic can be quickly cleaned up when a network attack occurs, and the security and stability of the business server are maintained.

[0173] For ease of understanding, please see Figure 4 , Figure 4 is an attack protection schematic diagram under the feature protection provided by the embodiment of the application. As shown in Figure 4 , the horizontal coordinate represents the access time, and the vertical coordinate represents the request rate. In a CC attack of about 45wqps, the attack traffic (i.e., abnormal access traffic) is represented by a dashed line, and the normal business traffic (i.e., normal access traffic) is represented by a solid line. The ratio of the two is about 30,000 to 100,000 times. After the attack characteristics are recognized and issued by using the feature protection provided by the embodiment of the application, the attack traffic is completely cleaned up, the user normal traffic is not affected, and the user website (i.e., business server) back-end service indicators are very stable.

[0174] From the above, the embodiment of the application provides a CC defense method based on attack feature analysis, modeling of historical normal access traffic is performed through attack detection and traffic form comparison technology, a normal traffic portrait of a service server is obtained through analysis, and attack features can be described according to attack behaviors. In the case that the service server is attacked, a protection strategy for attack traffic interception without affecting normal traffic can be effectively generated, and normal operation of the service server is ensured. In addition, the embodiment of the application completes modeling of a website normal traffic portrait and an abnormal traffic portrait through big data, stream computing and the like, and through automatic comparison and analysis, the problem that a protection strategy is invalid due to short attack duration, long time consumption of manual intervention and frequent attack changes in an attack scenario is effectively solved, a dynamic, high timeliness and good protection effect persistent attack and defense iteration protection method and system are established through multi-dimensional feedback, and the reliability and effectiveness of a CC protection service are effectively improved.

[0175] Further, please refer to Figure 5 , Figure 5 is a schematic diagram of an intelligent protection method and system based on attack feature analysis provided by the embodiment of the application. As shown in Figure 5 , the system mainly includes a protection device and an analysis server (not shown in the figure), and can be applied to protection against CC attacks or other similar network attacks; wherein the protection device can be the protection device 20a in the embodiment corresponding to the above Figure 2 , and the analysis server can be the analysis server 20b in the embodiment corresponding to the above Figure 2 . The method can specifically include the following steps:

[0176] Step S1: Real-time integration of access logs (i.e. access traffic logs) reported by all protection devices through a high-performance middleware (i.e. the aforementioned log integration component).

[0177] This step can be performed by a data integration module; the specific implementation manner of this step can be referred to the related description of step S101 in the embodiment corresponding to the above Figure 3 , and will not be described here in detail.

[0178] Step S2: The analysis server pulls the latest access traffic log in real time, continuously learns the traffic pattern of each service domain name for one hour (i.e., the threshold detection time length and the feature detection time length described above, which can also be set to other time lengths), and for the service domain name in an abnormal state, such as under attack, under stress testing, etc., needs to wait for the access traffic of the service domain name in an abnormal state to be stable and then continuously learn for one hour, and the learned data is used as the baseline for domain name protection. At the same time, the baseline learned offline (i.e., the first detection threshold described above) is introduced for auxiliary judgment. The baseline is divided into two parts: an attack detection baseline (i.e., the detection threshold corresponding to the service domain name) and a traffic pattern baseline (i.e., the normal traffic feature).

[0179] This step can be performed by the baseline learning module; the specific implementation of this step can be seen in the above Figure 3 corresponding embodiments of steps S101 and S104, which will not be repeated here.

[0180] Step S3: The analysis server reads all domain name access traffic in real time, and for the domain name granularity, it statistically counts the request quantity (i.e., the number of domain name requests) in real time. When the domain name request quantity exceeds the learned attack detection baseline, different attack detection schemes (i.e., the detection strategy described above) are selected according to the ratio of the current traffic to the attack detection baseline (i.e., the ratio data described above), by judging whether it is a CC attack (i.e., abnormal access behavior) or a business surge (i.e., normal access behavior), and then selecting the appropriate solution process according to the SOP.

[0181] This step can be performed by the attack detection module; the specific implementation of this step can be seen in the above Figure 3 corresponding embodiments of step S102, which will not be repeated here.

[0182] Step S4: When a CC attack detection signal (i.e., the detection attack signal described above) is received, the analysis server can send the service domain name detected to attack to the abnormal traffic analysis module, analyze the features of the traffic that do not conform to the normal traffic pattern (i.e., abnormal traffic features), and give the aggregation index, and send the result to the strategy issuing module; when a business surge signal (i.e., the baseline update instruction described above) is received, the current traffic baseline can be learned to update the related baseline data of the service domain name.

[0183] This step can be performed by the abnormal traffic analysis module; the specific implementation of this step can be seen in the above Figure 3 corresponding embodiments of steps S103-S105, which will not be repeated here.

[0184] Step S5: After the policy core data (i.e., the aforementioned policy data) is received by the policy issuing module in the analysis server, the protection policy can be reasonably issued in stages according to the needs of the user, and the related message (i.e., the interception analysis instruction) is sent to the interception analysis module.

[0185] This step can be performed by the policy issuing module; the specific implementation of this step can be seen in the above Figure 3 The related description of step S105 in the corresponding embodiment will not be repeated here.

[0186] Step S6: The interception analysis module in the analysis server can perform real-time detection and analysis on the issued protection policy. When it is found that the policy interception is insufficient, the abnormal flow analysis module is notified to improve the analysis level (i.e., the feature level) according to the user setting, and the negative feedback mechanism is started. When it is perceived that the protection policy may exist false positives, the false positive policy is sent to the policy issuing module, and the subsequent attack protection of the domain name is shielded from issuing the policy.

[0187] This step can be performed by the interception analysis module; the specific implementation of this step can be seen in the above Figure 3 The related description of step S105 in the corresponding embodiment will not be repeated here.

[0188] Step S7: The data intercepted by the attack feature analysis is periodically offline trained in the background, which is used to calculate and find the features (i.e., target attack features) that only exist in attacks, and is used for subsequent black feature analysis.

[0189] Among them, the features that are completely inconsistent between attackers and normal users can be analyzed offline to operate as target attack features, i.e., malicious features (or called black features) that are commonly used by attackers but do not exist in normal users. Such features can be enabled by default after being reviewed by technical personnel, thereby more effectively defending attacks. It can be understood that the target attack features can be analyzed periodically subsequently. If it is found that a normal user uses the target attack feature, the target attack feature can be removed from the black features after being reviewed by technical personnel. In addition, the IP address of the target attack feature can be mined through offline analysis, so that the attack can be better recognized, detected and protected. The offline analysis of this step can be performed by the analysis server, or by an offline server independent of the analysis server.

[0190] Specifically, a sixth access traffic log associated with the service domain name can be acquired, where the sixth access traffic log can be used to record access requests intercepted based on the protection policy (i.e., abnormal access requests matching the attack features issued), which can be understood as data intercepted by attack feature analysis, so that the target attack feature can be determined in the attack features based on the sixth access traffic log. Wherein, the embodiments of the present application can support using an AI model based on machine learning technology to periodically train the above-mentioned sixth access traffic log, specifically, an offline analysis model can be obtained by pre-training the AI model, and the specific network structure of the offline analysis model is not limited here; the offline analysis model is used to analyze the sixth access traffic log, that is, whether a certain attack feature will appear in the access requests of normal users, if not, the attack feature can be used as the target attack feature. In addition, the offline analysis model can also be used to further acquire the illegal network address associated with the target attack feature, where the illegal network address refers to the device network address (such as IP address) of the access device whose access request matches the target attack feature, that is, the target access device indicated by the illegal network address is the device that initiates abnormal access requests to the business server, therefore, the subsequent protection device can intercept the access requests sent by the target access device. As can be seen, through offline analysis, the protection effect can be improved.

[0191] The step can be performed by an offline analysis module.

[0192] Wherein, optionally, each module involved above can be understood as each component in the analysis server, different modules can be distributed on different or same analysis servers, and the same module can also be distributed on different analysis servers. Optionally, the data integration module can also be deployed on the log integration component, which can be independent of the protection device and the analysis server. Optionally, the offline analysis module can also be deployed on an offline server, that is, the offline server can periodically train the data intercepted by attack feature analysis. The deployment mode of these modules is not limited in the embodiments of the present application.

[0193] Therefore, the intelligent protection system based on attack feature analysis provided in the embodiments of the present application plays an important role in the cloud defense system. When the protection system is deployed in the cloud, the protection cleaning rate of the cloud customer (i.e., the business server is the cloud server) subjected to attacks is averagely 99.9% in the embodiments of the present application, which effectively improves the protection cleaning rate, solves the problem of poor protection effect when the business server is subjected to attacks without manual customized protection strategy, and the protection false positive rate is less than one ten-thousandth, which solves the problem of normal business damage due to too strict protection strategy when the business server is subjected to attacks. In addition, the protection response time of the business server after being subjected to attacks is improved from minutes to seconds in the embodiments of the present application, which effectively protects the business server from being subjected to attacks for too long before manual intervention.

[0194] Please refer to Figure 6 , Figure 6 is a structural schematic diagram of a data processing apparatus provided in the embodiments of the present application. As shown in Figure 6 , the data processing apparatus 1 can be applied to an analysis server, for example, the analysis server can be the analysis server 20b in the embodiments corresponding to the above Figure 2 . It should be understood that the data processing apparatus 1 can be a computer program (including program code) running in the analysis server, for example, the data processing apparatus 1 can be an application software; the data processing apparatus 1 can be used to execute the corresponding steps in the data processing method provided in the embodiments of the present application. As shown in Figure 6 , the data processing apparatus 1 can include: a threshold determination module 11, a behavior determination module 12, a traffic division module 13, a feature comparison module 14, and a strategy determination module 15;

[0195] The threshold determination module 11 is configured to obtain a first access traffic log associated with a service domain name, and determine a detection threshold corresponding to the service domain name based on the first access traffic log.

[0196] The behavior determination module 12 is configured to obtain a second access traffic log associated with the service domain name, determine a domain name request quantity of the service domain name based on access traffic indicated by the second access traffic log, and determine an access behavior for the service domain name based on the domain name request quantity and the detection threshold. The timestamp of the second access traffic log is later than the timestamp of the first access traffic log, and there are some access traffic logs in the second access traffic log that are the same as those in the first access traffic log.

[0197] The traffic division module 13 is configured to, when the access behavior for the service domain name is abnormal access behavior, determine a behavior determination time point corresponding to the abnormal access behavior as a critical time point for dividing abnormal traffic, and acquire a third access traffic log based on the critical time point as an abnormal access traffic log; the acquisition time stamp of the third access traffic log is later than the acquisition time stamp of the second access traffic log, and the third access traffic log is different from the second access traffic log;

[0198] The feature comparison module 14 is configured to, when the normal traffic feature determined based on the first access traffic log is acquired, determine an abnormal traffic feature of the service domain name based on the abnormal access traffic log, and perform feature comparison on the abnormal traffic feature and the normal traffic feature to obtain an attack feature of the service domain name.

[0199] The policy determination module 15 is configured to determine a protection policy for the service domain name based on the attack feature.

[0200] In an embodiment, the threshold determination module 11 is further configured to perform the following operations:

[0201] When the first detection threshold corresponding to the service domain name is acquired, the second detection threshold is determined based on the first access traffic log; the first detection threshold is determined based on a historical access traffic log associated with the service domain name; the acquisition time stamp of the historical access traffic log is earlier than the acquisition time stamp of the first access traffic log.

[0202] The detection threshold corresponding to the service domain name is determined based on the first detection threshold and the second detection threshold; the detection threshold is the maximum threshold in the first detection threshold and the second detection threshold.

[0203] In an embodiment, the first access traffic log is determined based on traffic log data in a plurality of threshold detection periods; the plurality of threshold detection periods include a first threshold detection period and a second threshold detection period; the first threshold detection period and the second threshold detection period are any two adjacent threshold detection periods, and the second threshold detection period is the next threshold detection period of the first threshold detection period.

[0204] The threshold determination module 11 is further configured to perform the following operations:

[0205] The traffic division module 13 is configured to, when the access behavior for the service domain name is abnormal access behavior, determine a behavior determination time point corresponding to the abnormal access behavior as a critical time point for dividing abnormal traffic, and acquire a third access traffic log based on the critical time point as an abnormal access traffic log; the acquisition time stamp of the third access traffic log is later than the acquisition time stamp of the second access traffic log, and the third access traffic log is different from the second access traffic log;

[0206] When the third detection threshold determined based on the first traffic log data is obtained, the third detection threshold is threshold updated based on the second traffic log data to obtain a fourth detection threshold, and the detection threshold corresponding to the service domain name is determined based on the fourth detection threshold.

[0207] In an implementation, the behavior determination module 12 is further configured to perform the following operations:

[0208] From the access traffic indicated based on the second access traffic log, an access request carrying the service domain name is obtained, and the number of the obtained access request is taken as the domain name request quantity of the service domain name.

[0209] When the domain name request quantity is greater than the detection threshold, a ratio data of the domain name request quantity and the detection threshold is obtained, and the detection strategy for the service domain name is determined based on the ratio data.

[0210] The access behavior for the service domain name is determined based on the detection strategy.

[0211] In an implementation, the behavior determination module 12 is further configured to perform the following operations:

[0212] When the ratio data is located in a first ratio range, a first request surge rate between the domain name request quantity and the detection threshold is obtained, and if the first request surge rate is greater than a first increment threshold, a first detection strategy is configured for the service domain name.

[0213] When the ratio data is located in a second ratio range, a second request surge rate between the domain name request quantity and the detection threshold is obtained, and if the second request surge rate is greater than a second increment threshold, a second detection strategy is configured for the service domain name; the second ratio range is smaller than the first ratio range; and the second increment threshold is smaller than the first increment threshold.

[0214] When the ratio data is located in a third ratio range, a third detection strategy is configured for the service domain name; the third ratio range is smaller than the second ratio range.

[0215] The first detection strategy or the second detection strategy or the third detection strategy is taken as the detection strategy for the service domain name.

[0216] In an implementation, the behavior determination module 12 is further configured to perform the following operations:

[0217] When the detection strategy is the first detection strategy, first cleaning information associated with the service domain name is obtained based on the first detection strategy.

[0218] If the first cleaning information indicates that the request state of the access request in the access traffic contains a cleaning state, it is determined that the access behavior for the service domain name belongs to an abnormal access behavior.

[0219] In an implementation, the behavior determining module 12 is further configured to perform the following operations:

[0220] When the detection strategy is the second detection strategy, based on the second detection strategy, the first service response information and the second cleaning information associated with the service domain name are obtained in the continuous N detection periods; N is a positive integer;

[0221] Based on the first service response information and the second cleaning information, the access behavior for the service domain name is determined.

[0222] In an implementation, the behavior determining module 12 is further configured to perform the following operations:

[0223] When the detection strategy is the third detection strategy, based on the third detection strategy, the second service response information associated with the service domain name is obtained in the continuous M detection periods; M is a positive integer;

[0224] Based on the second service response information, the access behavior for the service domain name is determined.

[0225] In an implementation, the abnormal traffic feature includes a target feature;

[0226] The feature comparison module 14 is further configured to perform the following operations:

[0227] The first feature proportion of the target feature in the abnormal traffic feature is obtained, and the second feature proportion of the target feature in the normal traffic feature is obtained;

[0228] When the first feature proportion is greater than the first proportion threshold, and the second feature proportion is less than the second proportion threshold, the target feature is taken as the attack feature of the service domain name; the second proportion threshold is less than or equal to the first proportion threshold.

[0229] In an implementation, the policy determining module 15 is further configured to perform the following operations:

[0230] The policy data associated with the attack feature and the protection configuration association information associated with the service domain name are obtained, based on the protection configuration association information, the first policy data associated with the first attack feature for policy issuing is obtained from the policy data;

[0231] Based on the first policy data, the protection policy for the service domain name is generated.

[0232] In an implementation, the policy determining module 15 is further configured to perform the following operations:

[0233] The performance consumption level and the policy priority level of the protection policy are acquired, the protection policy is arranged based on the performance consumption level and the policy priority level, and the protection policy after the arrangement is sent to the protection device, so that the protection device protects the service server indicated by the service domain name.

[0234] In an implementation, the policy determination module 15 is further configured to perform the following operations:

[0235] The third service response information associated with the service domain name is acquired, and based on the third service response information, a first cleaning request proportion corresponding to the access request with the cleaning state as the request state and a first abnormal response proportion corresponding to the access request with the abnormal response state as the response state in the access traffic indicated based on the abnormal access traffic log are acquired; the third service response information is acquired after the protection policy is sent;

[0236] When the first cleaning request proportion is less than a third proportion threshold and the first abnormal response proportion is greater than a fourth proportion threshold, the second policy data associated with the second attack feature is acquired from the policy data based on the protection level configured for the service domain name; the feature level of the second attack feature is higher than the feature level of the first attack feature;

[0237] The protection policy is updated based on the second policy data.

[0238] In an implementation, the policy determination module 15 is further configured to perform the following operations:

[0239] When the fourth access traffic log associated with the service domain name is acquired, a second cleaning request proportion corresponding to the access request with the cleaning state as the request state and a second abnormal response proportion corresponding to the access request with the abnormal response state as the response state in the access traffic indicated based on the fourth access traffic log are acquired; the acquisition timestamp of the fourth access traffic log is later than the acquisition timestamp of the third access traffic log;

[0240] When the second cleaning request proportion is greater than a fifth proportion threshold and the second abnormal response proportion is greater than a sixth proportion threshold, the abnormal interception feature is acquired from the first attack feature; the fifth proportion threshold and the sixth proportion threshold are determined based on the first access traffic log;

[0241] The policy associated with the abnormal interception feature in the protection policy is shielded.

[0242] In an implementation, the behavior determination module 12 is further configured to perform the following operations:

[0243] When the access behavior for the service domain name belongs to the normal access behavior, the detection threshold and the normal traffic feature are updated based on the second access traffic log.

[0244] The specific function implementation of the threshold determination module 11, the behavior determination module 12, the traffic division module 13, the feature comparison module 14, and the strategy determination module 15 can refer to the description of the above Figure 3 The description of steps S101-S105 in the corresponding embodiment will not be repeated here. It should be understood that the beneficial effects of using the same method will not be described again.

[0245] Please refer to Figure 7 , Figure 7 is a structural schematic diagram of a computer device provided by an embodiment of the present application. As Figure 7 shown, the computer device 1000 can include a processor 1001, a network interface 1004, and a memory 1005. In addition, the computer device 1000 can also include a user interface 1003 and at least one communication bus 1002. The communication bus 1002 is used to realize the connection and communication between the components. The optional user interface 1003 can include a standard wired interface, a wireless interface. The network interface 1004 can optionally include a standard wired interface, a wireless interface (such as a WI-FI interface). The memory 1005 can be a high-speed RAM memory or a non-volatile memory such as at least one disk memory. The memory 1005 can also be at least one storage device located away from the aforementioned processor 1001. As Figure 7 shown, the memory 1005 as a computer readable storage medium can include an operating system, a network communication module, a user interface module, and a computer program.

[0246] In the computer device 1000 as Figure 7 shown, the network interface 1004 can provide network communication functions; the user interface 1003 is mainly used to provide an input interface for the user; and the processor 1001 can be used to call the computer program stored in the memory 1005 to execute the description of the data processing method in the foregoing Figure 3 corresponding embodiment, which will not be repeated here. In addition, the beneficial effects of using the same method will not be described again.

[0247] In addition, it should be noted that the present application also provides a computer readable storage medium, and the computer readable storage medium stores the computer program executed by the data processing device 1 mentioned above, and the computer program includes computer instructions. When the processor executes the computer instructions, the computer program can execute the description of the data processing method in the foregoing Figure 3The data processing method is described in the corresponding embodiments, and thus, the description will not be repeated here. In addition, the beneficial effects of using the same method are also not repeated. For technical details not disclosed in the computer-readable storage medium embodiments involved in the present application, please refer to the description of the method embodiments of the present application.

[0248] The computer-readable storage medium can be an internal storage unit of the computer device, such as a hard disk or a memory of the computer device, or a data processing apparatus provided by any of the preceding embodiments. The computer-readable storage medium can also be an external storage device of the computer device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Further, the computer-readable storage medium can include both the internal storage unit and the external storage device of the computer device. The computer-readable storage medium is used to store the computer program and other programs and data required by the computer device. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0249] In addition, it should be noted that the embodiments of the present application also provide a computer program product (or computer program) including computer instructions stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions to make the computer device execute the method provided by the corresponding embodiments. In addition, the beneficial effects of using the same method are also not repeated. For technical details not disclosed in the computer program product (or computer program) embodiments involved in the present application, please refer to the description of the method embodiments of the present application. Figure 3 The method provided by the corresponding embodiments. In addition, the beneficial effects of using the same method are also not repeated. For technical details not disclosed in the computer program product (or computer program) embodiments involved in the present application, please refer to the description of the method embodiments of the present application.

[0250] The terms "first", "second", etc. in the description, claims and drawings of the embodiments of the present application are used to distinguish different objects, and are not used to describe a specific order. In addition, the term "comprises" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, device, product or equipment including a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed, or can optionally include other steps or units inherent to the process, method, device, product or equipment.

[0251] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined target, and can be implemented entirely or partially by using software, hardware (such as a processing circuit or a memory) or a combination thereof. Similarly, one processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of an integral module or unit that includes the functions of the module or unit.

[0252] Those of ordinary skill in the art can understand that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of the examples have been described in the above description in a general manner. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0253] It should be noted that, for each of the above method embodiments, in order to simply describe, it is expressed as a combination of a series of actions, but those skilled in the art should know that the present application is not limited by the order of the described actions, because according to the present application, some steps can be performed in other order or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0254] The steps in the method embodiments of the present application can be adjusted in sequence, combined and deleted according to actual needs.

[0255] The modules in the device embodiments of the present application can be combined, divided and deleted according to actual needs.

[0256] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware. The computer program can be stored in a computer readable storage medium, and the program can include the processes of the above-mentioned embodiments when executed.

[0257] The above descriptions are only the preferred embodiment of the application, of course, cannot be used to limit the scope of the application, thus the equivalent variations made by the claims of the application, still belongs to the scope of the application covered.

Claims

1. A data processing method, characterized by, The method comprises: obtaining a first access traffic log associated with a service domain name, determining a detection threshold corresponding to the service domain name based on the first access traffic log; obtaining a second access traffic log associated with the service domain name, determining a domain name request quantity of the service domain name based on access traffic indicated by the second access traffic log, and determining an access behavior for the service domain name based on the domain name request quantity and the detection threshold; the acquisition timestamp of the second access traffic log is later than the acquisition timestamp of the first access traffic log, and there are some access traffic logs in the second access traffic log that are the same as those in the first access traffic log; when the access behavior for the service domain name belongs to an abnormal access behavior, determining a behavior determination time point corresponding to the abnormal access behavior as a critical time point for dividing abnormal traffic, and obtaining a third access traffic log based on the critical time point as an abnormal access traffic log; the acquisition timestamp of the third access traffic log is later than the acquisition timestamp of the second access traffic log, and the third access traffic log is different from the second access traffic log; when a normal traffic feature determined based on the first access traffic log is obtained, determining an abnormal traffic feature of the service domain name based on the abnormal access traffic log, performing feature comparison on the abnormal traffic feature and the normal traffic feature, and obtaining an attack feature of the service domain name; determining a protection strategy for the service domain name based on the attack feature.

2. The method of claim 1, wherein, The method comprises: when a first detection threshold corresponding to the service domain name is obtained, determining a second detection threshold based on the first access traffic log; the first detection threshold is determined based on a historical access traffic log associated with the service domain name; the acquisition timestamp of the historical access traffic log is earlier than the acquisition timestamp of the first access traffic log; determining a detection threshold corresponding to the service domain name based on the first detection threshold and the second detection threshold; the detection threshold is the maximum threshold of the first detection threshold and the second detection threshold.

3. The method of claim 1, wherein, The first access traffic log is determined based on traffic log data in a plurality of threshold detection periods; the plurality of threshold detection periods comprise a first threshold detection period and a second threshold detection period; the first threshold detection period and the second threshold detection period are any two adjacent threshold detection periods, and the second threshold detection period is the next threshold detection period of the first threshold detection period; The method comprises: obtaining traffic log data located in the first threshold detection period from the first access traffic log as first traffic log data, and obtaining traffic log data located in the second threshold detection period from the first access traffic log as second traffic log data; When the third detection threshold determined based on the first traffic log data is obtained, the third detection threshold is threshold updated based on the second traffic log data to obtain a fourth detection threshold, and the detection threshold corresponding to the service domain name is determined based on the fourth detection threshold.

4. The method of claim 1, wherein, The domain name request quantity of the service domain name is determined based on the access traffic indicated by the second access traffic log, and the access behavior for the service domain name is determined based on the domain name request quantity and the detection threshold, including: The access request carrying the service domain name is obtained from the access traffic indicated by the second access traffic log, and the quantity of the obtained access request is taken as the domain name request quantity of the service domain name; When the domain name request quantity is greater than the detection threshold, the ratio data of the domain name request quantity to the detection threshold is obtained, and the detection strategy for the service domain name is determined based on the ratio data; The access behavior for the service domain name is determined based on the detection strategy.

5. The method of claim 4, wherein, The detection strategy for the service domain name is determined based on the ratio data, including: When the ratio data is in a first ratio range, a first request surge rate between the domain name request quantity and the detection threshold is obtained, and if the first request surge rate is greater than a first increment threshold, a first detection strategy is configured for the service domain name; When the ratio data is in a second ratio range, a second request surge rate between the domain name request quantity and the detection threshold is obtained, and if the second request surge rate is greater than a second increment threshold, a second detection strategy is configured for the service domain name; the second ratio range is smaller than the first ratio range; and the second increment threshold is smaller than the first increment threshold; When the ratio data is in a third ratio range, a third detection strategy is configured for the service domain name; the third ratio range is smaller than the second ratio range; The first detection strategy or the second detection strategy or the third detection strategy is taken as the detection strategy for the service domain name.

6. The method of claim 4, wherein, The access behavior for the service domain name is determined based on the detection strategy, including: When the detection strategy is the first detection strategy, first cleaning information associated with the service domain name is obtained based on the first detection strategy; If the request state of the access request in the access traffic contains a cleaning state indicated by the first cleaning information, it is determined that the access behavior for the service domain name belongs to an abnormal access behavior.

7. The method of claim 4, wherein, The access behavior for the service domain name is determined based on the detection strategy, including: When the detection strategy is the second detection strategy, first service response information and second cleaning information associated with the service domain name are obtained within continuous N detection periods based on the second detection strategy; N is a positive integer; The access behavior for the service domain name is determined based on the first service response information and the second cleaning information.

8. The method of claim 4, wherein, The access behavior for the service domain name is determined based on the detection strategy, including: When the detection strategy is the third detection strategy, based on the third detection strategy, second service response information associated with the service domain name is acquired in continuous M detection periods; M is a positive integer; The access behavior for the service domain name is determined based on the second service response information.

9. The method of claim 1, wherein, The abnormal traffic feature includes a target feature; The feature comparison between the abnormal traffic feature and the normal traffic feature is performed to obtain an attack feature of the service domain name, including: A first feature proportion of the target feature in the abnormal traffic feature is acquired, and a second feature proportion of the target feature in the normal traffic feature is acquired; When the first feature proportion is greater than a first proportion threshold and the second feature proportion is less than a second proportion threshold, the target feature is taken as the attack feature of the service domain name; the second proportion threshold is less than or equal to the first proportion threshold.

10. The method of claim 1, wherein, The determination of the protection strategy for the service domain name based on the attack feature includes: Policy data associated with the attack feature and protection configuration association information associated with the service domain name are acquired, and first policy data associated with a first attack feature for policy issuance is acquired from the policy data based on the protection configuration association information; The protection strategy for the service domain name is generated based on the first policy data.

11. The method of claim 10, wherein, Further comprising: The performance consumption level and the policy priority level of the protection strategy are acquired, the protection strategy is arranged based on the performance consumption level and the policy priority level, and the protection strategy after the arrangement is issued to a protection device, so that the protection device protects a service server indicated by the service domain name.

12. The method of claim 10, wherein, Further comprising: Third service response information associated with the service domain name is acquired, and based on the third service response information, a first cleaning request proportion corresponding to an access request with a cleaning state of a request state and a first abnormal response proportion corresponding to an access request with an abnormal response state of a response state in access traffic indicated based on the abnormal access traffic log are acquired; The third service response information is acquired after the protection strategy is issued; When the first cleaning request proportion is less than a third proportion threshold and the first abnormal response proportion is greater than a fourth proportion threshold, second policy data associated with a second attack feature is acquired from the policy data based on a protection level configured for the service domain name; the feature level of the second attack feature is higher than the feature level of the first attack feature; The protection strategy is updated based on the second policy data.

13. The method of claim 10, wherein, Further comprising: When fourth access traffic log associated with the service domain name is acquired, a second cleaning request proportion corresponding to an access request with a cleaning state of a request state and a second abnormal response proportion corresponding to an access request with an abnormal response state of a response state in access traffic indicated based on the fourth access traffic log are acquired; The acquisition time stamp of the fourth access traffic log is later than the acquisition time stamp of the third access traffic log; acquire an abnormal interception feature from the first attack feature when the second cleaning request proportion is greater than a fifth proportion threshold and the second abnormal response proportion is greater than a sixth proportion threshold; the fifth proportion threshold and the sixth proportion threshold are determined based on the first access traffic log; shield a policy associated with the abnormal interception feature in the protection policy.

14. The method of claim 1, wherein, Further comprising: when the access behavior for the service domain name belongs to normal access behavior, updating the detection threshold and the normal traffic feature based on the second access traffic log.

15. A data processing apparatus, characterized by Comprising: a threshold determination module configured to acquire a first access traffic log associated with a service domain name, and determine a detection threshold corresponding to the service domain name based on the first access traffic log; a behavior determination module configured to acquire a second access traffic log associated with the service domain name, determine a domain name request quantity of the service domain name based on access traffic indicated by the second access traffic log, and determine an access behavior for the service domain name based on the domain name request quantity and the detection threshold; the acquisition time stamp of the second access traffic log is later than the acquisition time stamp of the first access traffic log, and there are some access traffic logs in the second access traffic log that are the same as those in the first access traffic log; a traffic division module configured to, when the access behavior for the service domain name belongs to abnormal access behavior, take a behavior determination time point corresponding to the abnormal access behavior as a critical time point for dividing abnormal traffic, and acquire a third access traffic log based on the critical time point as an abnormal access traffic log; the acquisition time stamp of the third access traffic log is later than the acquisition time stamp of the second access traffic log, and the third access traffic log is different from the second access traffic log; a feature comparison module configured to, when a normal traffic feature determined based on the first access traffic log is acquired, determine an abnormal traffic feature of the service domain name based on the abnormal access traffic log, and perform feature comparison on the abnormal traffic feature and the normal traffic feature to obtain an attack feature of the service domain name; a policy determination module configured to determine a protection policy for the service domain name based on the attack feature.

16. A computer device, comprising: Comprising: a processor and a memory; the processor is connected with the memory, wherein the memory is configured to store a computer program, and the processor is configured to call the computer program to enable the computer device to execute the method in any one of claims 1-14.

17. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, which is adapted to be loaded and executed by the processor to enable the computer device with the processor to execute the method in any one of claims 1-14.

18. A computer program product, characterised in that, The computer program product comprises computer instructions stored in a computer readable storage medium, which are adapted to be read and executed by the processor to enable the computer device with the processor to execute the method in any one of claims 1-14.

Images