Flooding scanning attack detection method and device and processing equipment

Abstract

The invention provides a flooding scanning attack detection method and device and processing equipment, and is used for designing a set of double-layer detection architecture comprising fast detection processing and slow detection processing for a flooding scanning attack and a scanning attack, and compared with a traditional token bucket algorithm, the memory resource consumption can be greatly reduced, and the processing efficiency is improved. According to the method, high detection precision can be guaranteed while efficient detection is carried out, and a series of optimization settings are further configured from the aspect of details, so that lightweight high-quality detection services can be provided for flood attack and scanning attack, and the network security of a company is better guaranteed in practical application.

Description

Technical Field

[0001] This application relates to the field of cybersecurity, specifically to a flood scanning attack detection method, apparatus, and processing equipment. Background Technology

[0002] A flood attack is a malicious cyberattack where the attacker sends a large number of false requests to the target. The victim continuously responds to these useless messages, while legitimate users are unable to receive normal services, resulting in a denial-of-service (DoS) attack. Based on the different network layers and resources utilized, flood attacks are mainly divided into the following three categories:

[0003] 1) Traffic attack

[0004] Objective: To exhaust the target server's network bandwidth. Principle: To clog the target server's upstream bandwidth with massive amounts of junk traffic, preventing normal traffic from passing through. Common subtypes: UDP Flood: Sending a large number of UDP packets to a random port on the target server, causing the target server to continuously respond and consuming upstream bandwidth; ICMP Flood: Overwhelming the target with ICMP echo request (Ping) packets.

[0005] 2) Protocol-based attacks

[0006] Objective: To exhaust the computing resources (CPU, memory) of the server itself or intermediate network devices (such as firewalls and routers). Principle: Exploiting vulnerabilities or interactions in the network protocol stack by sending malformed or half-open connection requests, causing excessive server resource consumption. Common subtypes: SYN Flood Attack: The most classic protocol attack. The attacker sends a large number of TCP connection requests (SYN packets) but does not complete the three-way handshake. The server allocates resources for each half-open connection and waits for a response until resources are exhausted and it cannot handle new connections; Ping of Death: Sending excessively large, invalid IP packets, causing the target system to crash or freeze.

[0007] 3) Application layer attacks

[0008] Objective: To exhaust the resources of a web application (such as HTTP, HTTPS). Principle: Mimicking normal user behavior, a large number of seemingly legitimate requests are sent, but the purpose is to consume the target server's application-layer resources such as CPU, memory, or database connections. This type of attack is more covert because the traffic is low but the "efficiency" is extremely high. Common subtypes: HTTP Flood Attack: Like a normal user, frequently sending HTTP GET or POST requests to request web pages, images, API interfaces, etc. Dynamic requests (such as search, login) consume even more server resources; CC Attack (Challenge Collapsar): Essentially a simulated HTTP flood attack targeting a web application by multiple users, often referring to continuously requesting resource-intensive pages (such as database queries, video loading).

[0009] Scanning attacks are the early reconnaissance phase of a cyberattack. Simply put, attackers don't launch a full-scale assault right away; instead, they act like scouts, first gathering information about the target and creating an "attack map." This process is called a scanning attack, and its core objective is:

[0010] 1) Discover live hosts (IP scan): Determine which devices in the target network are online and responsive;

[0011] 2) Port scanning: Determine which network ports are open on these online devices to infer the services or programs running on the devices;

[0012] 3) Identify services and systems (fingerprint recognition): Further determine the type of service, version number, and type of operating system running on the open port.

[0013] Based on the information above, attackers can search for known vulnerabilities (e.g., a high-risk vulnerability in a specific version of a web server) and formulate precise attack plans. Therefore, scanning attacks themselves usually do not cause direct damage, but they are the cornerstone of subsequent cyberattacks.

[0014] Currently, the main detection techniques for flood attacks and scanning attacks include the following:

[0015] One approach is based on the token bucket algorithm, a commonly used rate limiting algorithm. It maintains a token bucket that stores a certain number of tokens. Each time a request is made, a token is taken from the bucket. If there are not enough tokens in the bucket, the request is rejected. At the same time, the token bucket replenishes tokens at a fixed rate. This method is relatively accurate in its statistics, but it consumes a lot of resources and requires connection tracking. It is suitable for monitoring small-scale targets.

[0016] The second method is based on a counting Bloom filter algorithm, which stores the count for each request, but each request requires multiple bits to store, resulting in high memory resource consumption.

[0017] Therefore, there is an urgent need to propose a detection method for flooding attacks and scanning attacks to improve efficiency and resource efficiency. Summary of the Invention

[0018] This application provides a flooding and scanning attack detection method, apparatus, and processing device. It designs a two-layer detection architecture that includes fast and slow detection processing to target flooding and scanning attacks. Compared to the traditional token bucket algorithm, it can significantly reduce memory resource consumption, efficiently perform detection while ensuring high detection accuracy. Furthermore, it includes a series of optimization settings in detail. Thus, it can provide lightweight, high-quality detection services for flooding and scanning attacks, better protecting company network security in practical applications.

[0019] Firstly, this application provides a method for detecting flood scanning attacks, the method comprising:

[0020] Obtain the traffic to be processed that needs to be detected by the detection nodes. The detection nodes refer to the network nodes in the network architecture that are responsible for performing flood scanning attack detection services.

[0021] In the fast detection process, the first target feature information of the traffic to be processed under the first preset feature index is extracted, and the current cumulative occurrence of the first target feature information is compared with the cumulative occurrence threshold corresponding to the first preset feature index. If the current cumulative occurrence reaches the cumulative occurrence threshold, the traffic to be processed is marked as a suspicious attack and the slow detection process is triggered.

[0022] In the slow detection process, the second target feature information of the traffic to be processed is extracted under the second preset feature index. If it is determined that there is a need for deep detection based on the second target feature information, the traffic to be processed is subjected to hash token bucket processing. If the tokens are exhausted, the traffic to be processed is marked as a flood attack or a scanning attack.

[0023] Secondly, this application provides a flood scanning attack detection device, the device comprising:

[0024] The acquisition unit is used to acquire the traffic to be processed that needs to be attacked and processed by the detection node. The detection node refers to the network node in the network architecture that is responsible for performing flood scanning attack detection services.

[0025] The fast detection unit is used to extract the first target feature information of the traffic to be processed under the first preset feature index in the fast detection process, and compare the current cumulative occurrence of the first target feature information with the cumulative occurrence threshold corresponding to the first preset feature index. If the current cumulative occurrence reaches the cumulative occurrence threshold, the traffic to be processed is marked as a suspicious attack and slow detection processing is triggered.

[0026] The slow detection unit is used to extract the second target feature information of the traffic to be processed under the second preset feature index during slow detection processing. If it is determined that there is a need for deep detection based on the second target feature information, the traffic to be processed is subjected to hash token bucket processing. If the tokens are exhausted, the traffic to be processed is marked as a flood attack or a scanning attack.

[0027] Thirdly, this application provides a processing device, including a processor and a memory, wherein a computer program is stored in the memory, and the processor executes the method provided in the first aspect of this application when it invokes the computer program in the memory.

[0028] Fourthly, this application provides a computer-readable storage medium storing a plurality of instructions adapted for loading by a processor to execute the method provided in the first aspect of this application.

[0029] From the above, it can be concluded that this application has the following beneficial effects:

[0030] To address flood and scanning attacks, this application designs a two-layer detection architecture that includes fast and slow detection processing. Compared to the traditional token bucket algorithm, it can significantly reduce memory resource consumption, perform detection efficiently while ensuring high detection accuracy, and further optimizes the settings in detail. This provides a lightweight, high-quality detection service against flood and scanning attacks, better protecting the company's network security in practical applications. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 This is a flowchart illustrating one of the flood scanning attack detection methods of this application;

[0033] Figure 2 This is a schematic diagram illustrating an example of the practical application of this application;

[0034] Figure 3 This is an example diagram illustrating the attack detection results of this application;

[0035] Figure 4 This is a schematic diagram illustrating an example of comparing the fast and slow detection performance of this application;

[0036] Figure 5 A schematic diagram illustrating an example of configuring the threshold values ​​corresponding to the basic feature indicators in the first preset feature indicators for this application;

[0037] Figure 6 A schematic diagram illustrating an example of configuring the threshold corresponding to the extended feature index in the first preset feature index for this application;

[0038] Figure 7 This is a schematic diagram of one structure of the flood scanning attack detection device of this application;

[0039] Figure 8 This is a schematic diagram of one type of processing equipment used in this application. Detailed Implementation

[0040] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0041] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or modules is not necessarily limited to those explicitly listed, but may include other steps or modules not explicitly listed or inherent to such processes, methods, products, or devices. The naming or numbering of steps appearing in this application does not imply that the steps in the method flow must be performed in the chronological / logical order indicated by the naming or numbering. The execution order of named or numbered process steps can be changed according to the desired technical purpose, as long as the same or similar technical effect is achieved.

[0042] The module division described in this application is a logical division. In practical applications, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the coupling or direct coupling or communication connection between modules shown or discussed may be through some interfaces, and the indirect coupling or communication connection between modules may be electrical or other similar forms, none of which are limited in this application. Furthermore, the modules or sub-modules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed in multiple circuit modules. Some or all of the modules may be selected to achieve the purpose of the solution in this application according to actual needs.

[0043] Before introducing the flood scanning attack detection method provided in this application, we will first introduce the background content involved in this application.

[0044] The flooding and scanning attack detection method, apparatus, and computer-readable storage medium provided in this application can be applied to processing devices. For flooding and scanning attacks, a two-layer detection architecture incorporating fast and slow detection processing is designed. Compared to the traditional token bucket algorithm, it can significantly reduce memory resource consumption, efficiently perform detection while ensuring high detection accuracy. Furthermore, a series of optimization settings are configured in detail. Thus, it can provide lightweight, high-quality detection services for flooding and scanning attacks, better protecting company network security in practical applications.

[0045] The flooding attack detection method mentioned in this application can be implemented by a flooding attack detection device, or by different types of processing devices such as servers, physical hosts, or user equipment (UE) that integrate the flooding attack detection device. The flooding attack detection device can be implemented in hardware or software. The UE can be a terminal device such as a smartphone, tablet, laptop, desktop computer, or personal digital assistant (PDA). The processing devices can be configured in a device cluster.

[0046] It is understandable that the ultimate goal of this application is to ensure the company's network security. Therefore, the processing device that executes the flood scanning attack detection method of this application or that carries the application service corresponding to the flood scanning attack detection method of this application is usually a relevant network device / node in the company's network architecture. Of course, it is also possible that in some cases, relevant device nodes outside the company's network architecture may be used.

[0047] In addition, the processing equipment can be equipment specifically responsible for network security services, such as security gateway equipment, firewall equipment, intrusion prevention system or intrusion detection system, or it can be equipment that is responsible for network security services in addition to providing the original functional services. For example, in some cases, the personal equipment of the staff can be used temporarily to execute the solution in this application.

[0048] Furthermore, if the solution involves displaying the processing progress (such as displaying results), it is obvious that further adaptive configurations can be made to the processing equipment from both hardware and software perspectives, which is quite flexible.

[0049] Taking result display as an example, the processing device can achieve the corresponding content display requirements through its own display screen (including touch screen), external display devices, or other devices with display screens.

[0050] The flood scanning attack detection method provided in this application will now be introduced.

[0051] First, refer to Figure 1 , Figure 1 This paper illustrates a flowchart of the flooding attack detection method of this application. The flooding attack detection method provided by this application may specifically include the following steps S101 to S103:

[0052] Step S101: Obtain the traffic to be processed that needs to be attacked by the detection node. Here, the detection node refers to the network node in the network architecture that is responsible for performing flood scanning attack detection services.

[0053] Understandably, given that this application's solution is specifically designed to detect flood attacks and scanning attacks, the primary task during the implementation of the solution is to obtain the pending traffic that needs to be processed by the detection nodes for attack detection.

[0054] It should be noted that although the detection node is the main body of the application scheme, i.e. the processing device, it is not excluded that in some cases the application scheme may be implemented by devices other than the detection node. In this case, the detection node needs to actively provide the corresponding traffic to be processed, or actively extract the corresponding traffic to be processed from the detection node side.

[0055] In practice, the traffic to be processed can be either incoming network traffic or outgoing network traffic.

[0056] As a practical implementation solution, refer to Figure 2The diagram shown illustrates an example of the practical application of this application. In this application's solution, on the one hand, the traffic to be processed can be the full traffic obtained through mirroring, and on the other hand, the detection node can be a border switch in the network architecture.

[0057] Among them, attack detection based on full traffic,

[0058] In addition, from Figure 2 It can also be seen that the traffic to be processed specifically refers to the network traffic involved in relevant network assets that the company has preset / identified and divided into different asset groups.

[0059] As an example, technologies such as DPDK, PF-Ring, or AF-Packet can be used to receive packets at high speed from the physical network card to meet the data acquisition needs of the traffic to be processed.

[0060] In addition, during the process of acquiring traffic to be processed, specific acquisition and processing can be carried out by units such as request, session, time period, user, and region.

[0061] Step S102: In the fast detection process, the first target feature information of the traffic to be processed under the first preset feature index is extracted, and the current cumulative occurrence of the first target feature information is compared with the cumulative occurrence threshold corresponding to the first preset feature index. If the current cumulative occurrence reaches the cumulative occurrence threshold, the traffic to be processed is marked as a suspicious attack and slow detection process is triggered.

[0062] Understandably, compared to the direct implementation of token bucket processing in existing technologies, this application treats token bucket processing as a specific process in the slow detection process of a two-layer detection architecture. In practice, the slow detection process relies on the processing result of the previous layer, namely the fast detection process, to trigger it. In this way, in practical applications, the fast detection process can quickly ignore high-trust traffic that does not require token bucket processing.

[0063] Regarding this fast detection process, it can be noted that this application does not directly configure a relevant behavior detection algorithm based on relevant features (such as a machine learning algorithm with black box characteristics or a processing algorithm involving complex feature combination comparison to characterize specific behaviors), but instead adopts a comparison processing method that combines the cumulative occurrence frequency of feature indicators with corresponding thresholds.

[0064] Specifically, for the fast detection processing here, this application pre-designs corresponding first preset feature indicators. In this way, the cumulative occurrence of these feature indicators can be monitored in real time. If the cumulative occurrence threshold is reached or exceeded, the triggering condition is obviously met, and slow detection processing can be triggered to further detect and process the pending traffic that is currently marked as initially marked as a suspicious attack.

[0065] The first preset indicator can be understood as being configurable from different dimensions in specific operations, and specifically reflected through the threshold number of times it needs to be emphasized.

[0066] As an example, in terms of basic characteristic indicators, the first preset characteristic indicator may specifically include at least one of source IP, destination IP, source port, and destination port.

[0067] Understandably, the first preset characteristic indicators are usually considered to be relevant characteristic indicators that can be extracted from the normal traffic involved by the company (whether they are conventional indicators or self-built customized indicators). Under some special designs, they may also involve some risk characteristic indicators that the company has specially announced to the public. In this way, it is possible to capture flood attacks or scanning attacks that attackers have specifically launched based on the content of the information released by the company to the public.

[0068] These risk characteristics can be disclosed to the public through various channels, such as the company's official accounts, relevant media accounts, employee personal accounts, and third-party personal accounts, either directly or implicitly. This is done to mislead attackers into launching flood or scanning attacks based on these risk characteristics, thus enabling the fast detection process to be more accurate.

[0069] In step S103, during slow detection processing, the second target feature information of the traffic to be processed under the second preset feature index is extracted. If it is determined that there is a need for deep detection based on the second target feature information, the traffic to be processed is subjected to hash token bucket processing. If the tokens are exhausted, the traffic to be processed is marked as a flood attack or a scanning attack.

[0070] It is understandable that hash token bucket processing is token bucket processing that combines hash processing. Considering that the detailed operation of hash token bucket processing itself is within the scope of existing technology, this application has not elaborated on it in detail.

[0071] In short, hash token bucket processing can include the following:

[0072] Call the preset hash function to calculate the hash object corresponding to the second target feature information, and check whether the hash object is empty;

[0073] If empty, reset the hash object's token bucket;

[0074] If not empty, check if the hash bucket reset period has arrived. If so, reset the hash bucket of the hash object. Otherwise, consume one token from the hash object's token bucket. If the hash object's token bucket is exhausted, mark the pending traffic as a flood attack or a scan attack.

[0075] It is understandable that the hash functions / algorithms involved can be flexibly configured according to actual needs, such as jhash2, murmurhash3, or CityHash64.

[0076] For a token bucket configured with multiple tokens, it can be reset / initialized through a configured reset cycle to restore the previous token consumption state.

[0077] At the same time, it can be seen that the hash token bucket processing here is specifically obtained by performing hash operations based on the second target feature information determined by the preset second target feature indicator. In the specific implementation, the second target feature indicator can also be configured according to actual needs. It can be the same as, partially the same as, or different from the first target feature indicator mentioned above. These are all possible in actual situations.

[0078] Furthermore, regarding the application of hash token bucket processing, it can be seen that this application does not directly promote hash token bucket processing when slow detection is triggered, but also involves a judgment step on whether there is a need for deep detection. In this way, combined with a flexible deep detection need judgment strategy configuration, the call to hash token bucket processing can be better adjusted, and traffic that does not need to be processed by hash token bucket for deep detection, i.e., low-trust traffic, can be directly filtered out.

[0079] The determination of the need for deep detection is based on the second target feature information under the second target feature indicator, such as at least one of the source IP, destination IP, source port and destination port mentioned in the first feature indicator information above.

[0080] For specific detection performance, it can also be combined with Figure 3 The diagram shown is an example of the attack detection results of this application. Figure 4 The diagram shown is an example of a comparison of the fast and slow detection performance of this application, for a more intuitive understanding.

[0081] Among them, from Figure 4 It is evident that the average detection latency per packet for fast detection processing is several times higher than that for deep detection processing.

[0082] As can be seen from the above solution, this application designs a two-layer detection architecture that includes fast detection processing and slow detection processing to target flood attacks and scanning attacks. Compared with the traditional token bucket algorithm, it can greatly reduce memory resource consumption, perform detection efficiently while ensuring high detection accuracy, and further configure a series of optimization settings in detail. In this way, it can provide lightweight and high-quality detection services for flood attacks and scanning attacks, and better protect the company's network security in practical applications.

[0083] For further practical applications, in terms of software implementation, for the first preset feature index involved in fast detection processing, in the specific scheme design, the cumulative occurrence of the first preset feature index can be counted by the CMS unit (CMS is just a unit setting name, and there can be other names). The CMS unit can specifically include a basic CMS unit and an extended CMS unit. The first preset feature index includes a fixed basic feature index and an extended feature index that is adaptively adjusted according to real-time requirements. The basic CMS unit is responsible for counting the basic feature index, and the extended CMS is responsible for counting the extended feature index.

[0084] It is understood that in this setting, this application further differentiates the technical operations involved in fast detection processing. This differentiated setting for fixed indicators and indicators that can be flexibly adjusted according to actual conditions enables efficient management and corresponding counting processing.

[0085] Furthermore, it can also be combined with Figure 5 The diagram shown illustrates an example of configuring the threshold values ​​corresponding to the basic feature indicators in the first preset feature indicators of this application. Figure 6 The diagram shown is an example of the threshold corresponding to the extended feature index in the first preset feature index configuration of this application, to provide a more intuitive understanding of this setting.

[0086] in, Figure 5 and Figure 6 Specifically, this involves the corresponding thresholds for the source IP as a specific indicator in different dimensions. In other words, for different dimensions / aspects of consideration, even for the same primary target feature indicator, there will be different corresponding thresholds for comparison to determine whether the current traffic to be processed should be marked as suspicious traffic and trigger fast detection processing.

[0087] Furthermore, for the aforementioned differentiated settings, the basic CMS unit and the extended CMS unit can each be configured with corresponding decay timers and reset timers. The reset timer is used to reset the count under a customized triggering mechanism, and the decay timer is used to decay the corresponding cumulative occurrence threshold. The corresponding quantization formulas involved in the decay process are as follows:

[0088] λ=-(lnγ / T),

[0089] Where λ is the attenuation amplitude; ln is the natural logarithm function; γ is the attenuation factor; and T is the attenuation period.

[0090] Understandably, for basic or extended CMS units, the dual timer settings for decay and reset of the counting threshold can help achieve dynamic threshold adjustment in practical applications, causing the processing performance of fast detection to fluctuate to a certain extent, increasing its complexity, avoiding detection, and enabling targeted avoidance, thereby improving fast detection performance.

[0091] As an example, the attenuation factor γ can be set to 0.95, and the attenuation period T can be set to 1 second.

[0092] Meanwhile, for another optimization setting, in the fast detection process, the dynamic entropy value can also be updated by the traffic to be processed. If the current cumulative occurrence count reaches the cumulative occurrence count threshold and the dynamic entropy value is less than the dynamic entropy value threshold, the traffic to be processed will be marked as a suspicious attack and slow detection processing will be triggered.

[0093] Understandably, network traffic is unstable to a certain extent in real-world situations. Therefore, this application treats the traffic queue, including the current traffic to be processed, as a type of time-series data to calculate the corresponding dynamic entropy value, in order to quantify the randomness or disorder of the traffic queue. If the real-time monitored dynamic entropy value is less than the dynamic entropy value threshold, this can also be considered as decision evidence that the current traffic to be processed is low-reliability traffic.

[0094] The specific formula for quantifying the dynamic entropy value can be:

[0095]

[0096] Given that the dynamic entropy quantification formula itself is existing technology, the focus of this solution is to introduce the dynamic entropy value as an additional reference factor in fast detection processing to make a more accurate and less perceptible decision on whether the current traffic to be processed needs to trigger slow detection processing.

[0097] As can be understood from the above scheme settings, the actual application of this application scheme may also involve related configuration processing in the early stages.

[0098] In this regard, the following set of application examples can also be provided:

[0099] 1) Initialize the CMS structure. The corresponding parameters include: threshold, extended threshold, entropy threshold, decay factor, reset timer, and decay timer.

[0100]

[0101] 2) Mount two timers;

[0102] 3) Reset the timer execution body timer_reset_fun;

[0103] 4) Update last_update_jiff;

[0104] 5) Clear the basic CMS (ddos_flood_sk_stat_t->cms) counters to zero;

[0105] 6) Clear the extended CMS (ddos_flood_sk_stat_t->ext_cms) count;

[0106] 7) The main body of the decay timer, timer_decay_fun;

[0107] 8) Calculate the attenuation rate (involving the quantization formula mentioned earlier);

[0108] 9) Basic CMS count metrics decay and update;

[0109] 10) Extended CMS count metric decay update.

[0110] Once the slow detection process identifies the current traffic as low-trust traffic and marks it as a flood attack or scanning attack (i.e., a network attack), the corresponding response can be taken.

[0111] For example, discarding / ignoring the current pending traffic, tracking and monitoring the initiator of the current pending traffic, providing a false response / a certain degree of normal response to the current pending traffic to observe the subsequent situation, or issuing an alarm (such as issuing an alarm for flood attack / scanning attack through pop-ups, system messages, emails, SMS or voice calls).

[0112] Understandably, for the response and processing of network traffic determined to be a network attack, considering that this processing step falls within the scope of existing technology, existing technology can be directly adopted. Therefore, this application has not elaborated on it in detail here.

[0113] Of course, it is understandable that in specific applications, further optimization and improvement can be made based on existing solutions, or even novel self-developed response solutions can be adopted.

[0114] The above is an introduction to the flood scanning attack detection method provided in this application. To facilitate better implementation of the flood scanning attack detection method provided in this application, this application also provides a flood scanning attack detection device from the perspective of functional modules.

[0115] See Figure 7 , Figure 7 This is a schematic diagram of one structure of the flooding scan attack detection device of this application. In this application, the flooding scan attack detection device 700 may specifically include the following structure:

[0116] The acquisition unit 701 is used to acquire the traffic to be processed that needs to be attacked and processed by the detection node. The detection node refers to the network node in the network architecture that is responsible for performing flood scanning attack detection services.

[0117] The fast detection unit 702 is used to extract the first target feature information of the traffic to be processed under the first preset feature index in the fast detection process, and compare the current cumulative occurrence of the first target feature information with the cumulative occurrence threshold corresponding to the first preset feature index. If the current cumulative occurrence reaches the cumulative occurrence threshold, the traffic to be processed is marked as a suspicious attack and slow detection processing is triggered.

[0118] The slow detection unit 703 is used to extract the second target feature information of the traffic to be processed under the second preset feature index during slow detection processing, and to perform hash token bucket processing on the traffic to be processed if it is determined that there is a need for deep detection based on the second target feature information. If the tokens are exhausted, the traffic to be processed is marked as a flood attack or a scanning attack.

[0119] In one exemplary embodiment, the traffic to be processed is specifically the full traffic obtained through mirroring, and the detection node is specifically a border switch in the network architecture.

[0120] In yet another exemplary embodiment, the first preset characteristic indicator specifically includes at least one of source IP, destination IP, source port, and destination port.

[0121] In another exemplary embodiment, in terms of software implementation, the cumulative occurrence count corresponding to the first preset feature indicator is specifically counted by a CMS unit. The CMS unit includes a basic CMS unit and an extended CMS unit. The first preset feature indicator includes a fixed basic feature indicator and an extended feature indicator that is adaptively adjusted according to real-time requirements. The basic CMS unit is responsible for counting the basic feature indicator, and the extended CMS unit is responsible for counting the extended feature indicator.

[0122] In another exemplary embodiment, the basic CMS unit and the extended CMS unit are each configured with a corresponding decay timer and a reset timer. The reset timer is used to reset the count under a customized triggering mechanism, and the decay timer is used to decay the corresponding cumulative occurrence threshold. The corresponding quantization formulas involved in the decay process are as follows:

[0123] λ=-(lnγ / T),

[0124] Where λ is the attenuation amplitude; ln is the natural logarithm function; γ is the attenuation factor; and T is the attenuation period.

[0125] In another exemplary embodiment, during the fast detection process, the dynamic entropy value is also updated through the traffic to be processed. If the current cumulative occurrence count reaches the cumulative occurrence count threshold and the dynamic entropy value is less than the dynamic entropy value threshold, the traffic to be processed is marked as a suspicious attack and the slow detection process is triggered.

[0126] In yet another exemplary embodiment, the hash token bucket processing includes the following processing:

[0127] Call the preset hash function to calculate the hash object corresponding to the second target feature information, and check whether the hash object is empty;

[0128] If empty, reset the hash object's token bucket;

[0129] If not empty, check if the hash bucket reset period has arrived. If so, reset the hash bucket of the hash object. Otherwise, consume one token from the hash object's token bucket. If the hash object's token bucket is exhausted, mark the pending traffic as a flood attack or a scan attack.

[0130] This application also provides a processing device from a hardware architecture perspective, see [link / reference]. Figure 8 , Figure 8 This diagram illustrates a structural schematic of the processing device of this application. Specifically, the processing device may include a processor 801, a memory 802, and an input / output device 803. The processor 801 executes the computer program stored in the memory 802 to implement, for example... Figure 1 The steps of the flooding scan attack detection method in the corresponding embodiment; or, when the processor 801 executes the computer program stored in the memory 802, it implements as follows: Figure 7 Corresponding to the functions of each unit in the embodiment, the memory 802 is used to store the functions executed by the processor 801 as described above. Figure 1 The computer program required for the flood scanning attack detection method in the corresponding embodiment.

[0131] For example, a computer program may be divided into one or more modules / units, one or more of which are stored in memory 802 and executed by processor 801 to complete this application. One or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in a computer device.

[0132] The processing device may include, but is not limited to, processor 801, memory 802, and input / output device 803. Those skilled in the art will understand that the illustrations are merely examples of the processing device and do not constitute a limitation on the processing device. It may include more or fewer components than illustrated, or combine certain components, or different components. For example, the processing device may also include network access devices, buses, etc., and processor 801, memory 802, input / output device 803, etc., are connected via a bus.

[0133] The processor 801 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the processing device, connecting various parts of the device through various interfaces and lines.

[0134] The memory 802 can be used to store computer programs and / or modules. The processor 801 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 802 and by calling data stored in the memory 802. The memory 802 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function, etc.; the data storage area may store data created according to the use of the processing device, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0135] When processor 801 executes a computer program stored in memory 802, it can specifically perform the following functions:

[0136] Obtain the traffic to be processed that needs to be detected by the detection nodes. The detection nodes refer to the network nodes in the network architecture that are responsible for performing flood scanning attack detection services.

[0137] In the fast detection process, the first target feature information of the traffic to be processed under the first preset feature index is extracted, and the current cumulative occurrence of the first target feature information is compared with the cumulative occurrence threshold corresponding to the first preset feature index. If the current cumulative occurrence reaches the cumulative occurrence threshold, the traffic to be processed is marked as a suspicious attack and the slow detection process is triggered.

[0138] In the slow detection process, the second target feature information of the traffic to be processed is extracted under the second preset feature index. If it is determined that there is a need for deep detection based on the second target feature information, the traffic to be processed is subjected to hash token bucket processing. If the tokens are exhausted, the traffic to be processed is marked as a flood attack or a scanning attack.

[0139] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the flood scanning attack detection device, processing equipment, and its corresponding units described above can be found in the following reference: Figure 1 The description of the flooding scan attack detection method in the corresponding embodiment will not be repeated here.

[0140] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0141] Therefore, this application provides a computer-readable storage medium storing a plurality of instructions that can be loaded by a processor to execute the present application. Figure 1 The steps of the flooding scan attack detection method in the corresponding embodiment can be referred to as follows for specific operations. Figure 1 The description of the flooding scan attack detection method in the corresponding embodiment will not be repeated here.

[0142] The computer-readable storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0143] Because of the instructions stored in the computer-readable storage medium, the present application can be executed as described above. Figure 1The steps of the flooding scan attack detection method in the corresponding embodiment can therefore achieve the results of this application. Figure 1 The beneficial effects that the flooding scanning attack detection method can achieve in the corresponding embodiments are detailed in the preceding description and will not be repeated here.

[0144] The flood scanning attack detection method, apparatus, processing device, and computer-readable storage medium provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for detecting flooding scanning attacks, characterized in that, The method includes: Obtain the traffic to be processed that needs to be attacked and detected by the detection node, wherein the detection node refers to the network node in the network architecture responsible for performing flood scanning attack detection services. In the fast detection process, the first target feature information of the traffic to be processed under the first preset feature index is extracted, and the current cumulative occurrence number of the first target feature information is compared with the cumulative occurrence number threshold corresponding to the first preset feature index. If the current cumulative occurrence number reaches the cumulative occurrence number threshold, the traffic to be processed is marked as a suspicious attack and slow detection process is triggered. In the slow detection process, the second target feature information of the traffic to be processed under the second preset feature index is extracted. If it is determined that there is a need for deep detection based on the second target feature information, the traffic to be processed is subjected to hash token bucket processing. If the tokens are exhausted, the traffic to be processed is marked as a flood attack or a scanning attack.

2. The method according to claim 1, characterized in that, The traffic to be processed is specifically the full traffic obtained through mirroring, and the detection node is specifically the border switch in the network architecture.

3. The method according to claim 1, characterized in that, The first preset feature index specifically includes at least one of source IP, destination IP, source port, and destination port.

4. The method according to claim 1, characterized in that, In terms of software implementation, the cumulative occurrence count corresponding to the first preset feature indicator is specifically counted by a CMS unit. The CMS unit includes a basic CMS unit and an extended CMS unit. The first preset feature indicator includes a fixed basic feature indicator and an extended feature indicator that is adaptively adjusted according to real-time requirements. The basic CMS unit is responsible for counting the basic feature indicator, and the extended CMS unit is responsible for counting the extended feature indicator.

5. The method according to claim 4, characterized in that, The basic CMS unit and the extended CMS unit are each configured with a corresponding decay timer and a reset timer. The reset timer is used to reset the count under a customized triggering mechanism. The decay timer is used to decay the corresponding cumulative occurrence threshold. The corresponding quantization formulas involved in the decay process are as follows: λ=-(lnγ / T), Where λ is the attenuation amplitude; ln is the natural logarithm function; γ is the attenuation factor; and T is the attenuation period.

6. The method according to claim 4, characterized in that, In the fast detection process, the dynamic entropy value is also updated through the traffic to be processed. If the current cumulative occurrence count reaches the cumulative occurrence count threshold and the dynamic entropy value is less than the dynamic entropy value threshold, then the traffic to be processed is marked as the suspicious attack and the slow detection process is triggered.

7. The method according to claim 1, characterized in that, The hash token bucket processing includes the following processing steps: Call the preset hash function to calculate the hash object corresponding to the second target feature information, and check whether the hash object is empty; If empty, reset the token bucket of the hash object; If not empty, check if the hash bucket reset period has arrived. If so, reset the token bucket of the hash object. Otherwise, consume one token from the token bucket of the hash object. If the token bucket of the hash object is exhausted, mark the traffic to be processed as either the flooding attack or the scanning attack.

8. A flood scanning attack detection device, characterized in that, The device includes: The acquisition unit is used to acquire the traffic to be processed that needs to be attacked and processed by the detection node, wherein the detection node refers to the network node in the network architecture that is responsible for performing flood scanning attack detection services. The fast detection unit is used to extract the first target feature information of the traffic to be processed under the first preset feature index in the fast detection process, and compare the current cumulative occurrence of the first target feature information with the cumulative occurrence threshold corresponding to the first preset feature index. If the current cumulative occurrence reaches the cumulative occurrence threshold, the traffic to be processed is marked as a suspicious attack and slow detection processing is triggered. The slow detection unit is used to extract the second target feature information of the traffic to be processed under the second preset feature index during the slow detection process, and to perform hash token bucket processing on the traffic to be processed if it is determined that there is a need for deep detection based on the second target feature information. If the tokens are exhausted, the traffic to be processed is marked as a flood attack or a scanning attack.

9. A processing device, characterized in that, The method includes a processor and a memory, wherein the memory stores a computer program, and the processor executes the method as described in any one of claims 1 to 7 when it invokes the computer program in the memory.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a plurality of instructions adapted for loading by a processor to perform the method of any one of claims 1 to 7.

Images