Small-Traffic Network Attack Identification via Access Data Consistency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security methods fail to effectively identify small-traffic network attacks, which are characterized by long durations and low traffic volumes, often misclassifying them as normal access requests due to low access request counts within a preset time period.
Innovation Solution
A method and apparatus that acquire access data from a target website server over multiple time periods, count and compare the quantities of access data with the same content in each period, and determine if the differences are within a preset threshold to identify small-traffic network attacks by analyzing access logs for fields like IP, host, and useragent.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a predetermined threshold is set to identify network attacks based on access request quantity within a preset time period, then large-traffic network attacks can be identified, but small-traffic network attacks cannot be identified because their access request quantity is similar to normal access requests
Solution Approach 1:
The patent segments the attack identification process into two distinct methods: one for large-traffic attacks using threshold-based quantity comparison, and another for small-traffic attacks using time-period-based quantity consistency analysis. This segmentation allows each method to specialize in detecting specific attack types without interference, resolving the contradiction between identification accuracy and adaptability across different attack scenarios
Solution Approach 2:
The patent introduces dynamic time period selection for small-traffic attack detection, where the system determines an appropriate time period range based on the characteristics of access requests. This dynamic approach allows the system to adapt to varying attack patterns and normal traffic fluctuations, enabling accurate identification of small-traffic attacks while maintaining versatility across different network conditions
2Productivity
If the predetermined threshold is set too small to identify small-traffic network attacks, then more attacks can be detected, but normal access requests are easily misclassified as network attacks
Solution Approach 1:
The system dynamically determines the time period range based on access request characteristics, allowing flexible adjustment of the detection window. This dynamic time period selection enables the system to accumulate sufficient access request data for small-traffic attack detection while filtering out normal traffic variations, thereby improving detection rate without significantly increasing false positives
Solution Approach 2:
The system uses feedback from multiple time periods to determine whether access request quantities are substantially the same across different periods. This feedback mechanism allows the system to distinguish between consistent small-traffic attack patterns and variable normal traffic, improving detection reliability while maintaining high detection rate
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments of the present application disclose a method for identifying network attacks, including: acquiring access data within at least two time periods of a target website server according to preset fields; counting the quantity of access data having the same content in each of the preset fields within each of the time periods; judging whether the quantities of access data having the same preset fields within each of the time periods are the same; and determining that, if the quantities of access data having the same preset fields within each of the time periods are the same, access requests corresponding to access data having the same quantity are small-traffic network attacks. The present application further discloses an embodiment of an apparatus for identifying network attacks. Small-traffic network attacks can be identified by use of the embodiments of the present application.