WO2019148714A1

WO2019148714A1 - Ddos attack detection method and apparatus, and computer device and storage medium

Info

Publication number: WO2019148714A1
Application number: PCT/CN2018/088975
Authority: WO
Inventors: 谭杰
Original assignee: 平安科技（深圳）有限公司
Priority date: 2018-01-31
Filing date: 2018-05-30
Publication date: 2019-08-08
Also published as: CN108322463A

Abstract

A DDoS attack detection method, comprising: acquiring data access requests during a current time period; counting an access request number of the acquired data access requests; when the counted access request number is higher than a preset request number threshold value, extracting a feature field from the acquired data access requests; generating, according to the extracted feature field, an access request feature vector corresponding to the acquired data access request; and inputting the generated access request feature vector into a pre-trained DDoS attack detection model to acquire a detection result output by the pre-trained DDoS.

Description

DDoS attack detection method, device, computer device and storage medium

Cross-reference to related applications

This application claims the priority of the Chinese Patent Application entitled "DDoS Attack Detection Method, Apparatus, Computer Equipment and Storage Media" by the Chinese Patent Office on January 31, 2018, the application number is 2018100960786, the entire contents of which are incorporated by reference. Combined in this application.

Technical field

The present application relates to a DDoS attack detection method, apparatus, computer device and storage medium.

Background technique

With the development of network technology, various network security issues have also been highlighted. Some websites are vulnerable to DDoS attacks, and DDoS attacks can easily lead to website awkwardness. Especially for some of the more important websites, if the website is embarrassed by DDoS attacks, it is easy to cause unpredictable losses.

However, the inventors have realized that there are also some network security detections for DDoS attacks. These tests generally detect the access request as a DDoS attack access request by manual preset detection. As the demand for network security becomes higher and higher, DDoS attacks access requests are more and more, and the detection accuracy of the manual preset detection method for DDoS attack access requests is low.

Summary of the invention

According to various embodiments disclosed herein, a DDoS attack detection method, apparatus, computer device, and storage medium are provided.

A DDoS attack detection method includes:

Obtain a data access request during the current time period;

Count the number of access requests for obtaining data access requests;

When the number of statistical access requests is higher than the preset request quantity threshold, the feature field is extracted from the obtained data access request;

Generating an access request feature vector corresponding to the acquired data access request according to the extracted feature field; and

The generated access request feature vector is input into the pre-trained DDoS attack detection model, and the detection result of the pre-trained DDoS output is obtained.

A DDoS attack detection device includes:

An access request obtaining module, configured to acquire a data access request in a current time period;

A request quantity statistics module, configured to count the number of access requests for obtaining a data access request;

a feature field extraction module, configured to: when the number of statistical access requests is higher than a preset number of request thresholds, extract a feature field from the obtained data access request;

a feature vector generating module, configured to generate, according to the extracted feature field, an access request feature vector corresponding to the acquired data access request; and

The detection result obtaining module is configured to input the generated access request feature vector into the pre-trained DDoS attack detection model, and obtain the detection result of the pre-trained DDoS output.

A computer device comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executable by the processor to cause the one or more processors to execute The following steps:

Obtain a data access request during the current time period;

Count the number of access requests for obtaining data access requests;

One or more non-volatile storage media storing computer readable instructions, when executed by one or more processors, cause one or more processors to perform the following steps:

Obtain a data access request during the current time period;

Count the number of access requests for obtaining data access requests;

Details of one or more embodiments of the present application are set forth in the accompanying drawings and description below. Other features and advantages of the present invention will be apparent from the description, drawings and claims.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings to be used in the embodiments will be briefly described below. Obviously, the drawings in the following description are only some embodiments of the present application, Those skilled in the art can obtain other drawings according to these drawings without any creative work.

FIG. 1 is an application scenario diagram of a DDoS attack detection method according to one or more embodiments.

2 is a flow diagram of a DDoS attack detection method in accordance with one or more embodiments.

3 is a flow diagram of the steps of determining an access request feature vector in accordance with one or more embodiments.

4 is a flow diagram of the steps of replacing a DDoS attack detection model in accordance with one or more embodiments.

5 is a flow diagram of the steps of generating a DDoS attack detection model in accordance with one or more embodiments.

6 is a flow diagram of the steps of a classified DDoS attack access request training model in accordance with one or more embodiments.

7 is a block diagram of a DDoS attack detection device in accordance with one or more embodiments.

FIG. 8 is a block diagram of a DDoS attack detecting apparatus in another embodiment.

Figure 9 is a block diagram of a DDoS attack detecting apparatus in still another embodiment.

Figure 10 is a block diagram of a computer device in accordance with one or more embodiments.

Detailed ways

In order to make the technical solutions and advantages of the present application more clear, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the application and are not intended to be limiting.

The DDoS attack detection method provided by the present application can be applied to an application environment as shown in FIG. 1. Terminal 102 communicates with server 104 over a network over a network. The terminal 102 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablets, and portable wearable devices, and the server 104 can be implemented with a stand-alone server or a server cluster composed of a plurality of servers.

In one embodiment, as shown in FIG. 2, a DDoS attack detection method is provided. The method is applied to the server in FIG. 1 as an example, and includes the following steps:

S202. Acquire a data access request in a current time period.

Specifically, the terminal is connected to the server through the network, and the terminal sends a data access request to the server through the network to access the data in the server. The server receives the data access request sent by each terminal according to the preset time period. The server receives the data access request sent by each terminal in the current time period.

S204. Count the number of access requests for obtaining a data access request.

Specifically, after obtaining the data access request sent by each terminal in the current time period, the server collects the number of access requests for the data access request sent by each terminal in the current time period.

In one of the embodiments, the server begins counting the received data access requests at the beginning of the current time period, and the number of access requests is the number of access requests at the end time point of the current time period.

S206. When the number of the statistical access requests is higher than the preset request quantity threshold, the feature field is extracted from the obtained data access request.

Specifically, the server compares the counted number of access requests with the preset number of thresholds, and compares and determines that the number of access requests is higher than the preset number of requests, and parses the obtained data access request, and extracts the data through the parsing. The feature field in the data access request.

In one embodiment, S206 specifically includes: acquiring a feature field table when the number of statistical access requests is higher than a preset request number threshold; and extracting and obtaining the field in the feature field table in the obtained data access request Identify the corresponding feature field.

The feature field table includes the feature field identifier of the message in the data access request, the data type and the feature field of the feature field, and the feature field identifier in the feature field table, the data type of the feature field, and the feature field are correspondingly stored.

Specifically, the server parses each data access request in the acquired data access request, and extracts the access data in the data access request by parsing. The server reads the feature field identifier in the feature field table, and extracts a feature field corresponding to the read feature field identifier from the access data.

S208. Generate an access request feature vector corresponding to the acquired data access request according to the extracted feature field.

Specifically, the server extracts the feature field, and maps the extracted feature field into a numerical value according to the mapping relationship between the feature field and the numerical value, and adds the value corresponding to the extracted feature field to the feature field mentioned in the preset feature vector. The location, generates an access request feature vector corresponding to the obtained data access request.

S210. The generated access request feature vector is input into the pre-trained DDoS attack detection model, and the detection result of the pre-trained DDoS output is obtained.

DDoS attacks, which are distributed denial of service (DDoS) attacks, refer to the use of client/server technology to combine multiple terminals as an attack platform to launch DDoS attacks on one or more targets, thereby multiplying Increase the power of denial of service attacks. The attacker uses a theft account to install the DDoS master program on a terminal. At a set time, the terminal with the host program installed will communicate with a large number of terminals with the agent installed. The agent has been installed on the network. On many computers. The terminal with the agent installed sends an access request to the target to receive an attack when it receives the instruction. With client/server technology, the main control program can activate hundreds or thousands of agents in a matter of seconds.

The types of DDoS attacks include SYN flood attacks, ICMP flood attacks, UDP flood attacks, and LAND attacks.

The SYN flood attack uses the three-way handshake mechanism of TCP. The attacker sends a request to the attacked end by using the forged IP address. The response packet sent by the attacker will never be sent to the destination. The attacker consumes resources while waiting to close the connection. If there are thousands of such connections, the host resources will be exhausted, thus achieving the purpose of the attack.

An ICMP flood attack is a method of attacking with ICMP packets. If an attacker sends a large number of ICMP ECHO packets to the target host, ICMP flooding will occur. The target host will use a large amount of time and resources to process ICMP ECHO packets, and cannot process normal requests or responses. Host attack.

The UDP flooding (UDP flood) is similar to the ICMP flooding. The attacker sends a large number of UDP packets to the target host. The target host is busy processing the UDP packets and cannot process normal packet requests or responses. .

The LAND attack utilizes the three-way handshake process established by the TCP connection to attack the target host by sending a TCP SYN packet to establish a request connection to a target host. The difference between the source IP address and the destination IP address of the LAND attack packet is the same as the IP address of the target host. After receiving the SYN packet, the target host sends an ACK packet to the source address of the packet and establishes a TCP connection control structure, and the source address of the packet is itself. Since the destination IP address and the source IP address are the same and are the IP addresses of the target host, the ACK packet is sent to the target host itself.

Specifically, the server inputs the generated access request feature vector into the pre-trained DDoS attack detection model, and processes the generated access request feature vector by using the pre-trained DDoS attack detection model to obtain the pre-trained DDoS attack detection model output. Test results.

In one embodiment, after S210, the method further includes: if the detection result is that the data access request is a DDoS attack access request, discarding the data access request; if the detection result is that the data access request is a normal access request, allowing the Data access request.

In this embodiment, the number of access requests for the data access request in the current time period is compared with the preset request number threshold, and the first detection is performed. When the number of the received access requests is higher than the preset number of requests, the pre-judgment may be subjected to a DDoS attack, and a second detection is required, that is, the feature field in the obtained data access request is extracted, and the acquired domain is generated according to the feature field. The feature vector corresponding to the data access request is input to the pre-trained DDoS attack detection model for detection, and the detection result is obtained. In the second detection, the pre-trained DDoS attack detection model is used to detect the access request, which improves the accuracy of the second detection. Through the cooperation of the two tests, the detection accuracy of the DDoS attack access request is improved as a whole.

In one embodiment, as shown in FIG. 3, S208 specifically includes the step of determining an access request feature vector, and the step specifically includes the following:

S302. Identify a field type of the extracted feature field.

Specifically, after extracting the feature field, the server identifies whether the extracted feature field is a number or a character string, and if the extracted feature field is identified as a number, determining that the extracted feature field is a numeric type; if the extracted If the feature field is a string, it is determined that the extracted feature field is a Boolean type.

S304. Determine a value corresponding to the extracted feature field according to the value determining manner corresponding to the identified field type.

Specifically, the value corresponding to different field types is determined differently. If the server recognizes that the field type of the extracted feature field is a numeric type, directly use the identified number as the value corresponding to the identified feature field; if the server recognizes that the extracted feature field has a field type of Boolean type, Querying the correspondence between the character string and the numerical value of the feature field corresponding to the extracted feature field, and mapping the recognized character string to the corresponding value according to the corresponding correspondence.

S306. Determine an access request feature vector corresponding to the obtained data access request according to the value corresponding to the extracted feature field.

Specifically, the server stores a preset feature vector, and each of the preset feature vectors has a one-to-one correspondence with the feature field in the feature field table. The server adds the value corresponding to the extracted feature field to the corresponding location in the preset feature vector to obtain the access request feature vector corresponding to the obtained data access request.

In this embodiment, according to the value determining manner corresponding to the field type of the feature field, the extracted feature field is converted into an access request feature vector corresponding to the data access request, and the data access request is detected by the access request feature vector, thereby improving the data. The detection accuracy of the access request.

In one embodiment, as shown in FIG. 4, after S210, the method further includes the step of replacing the DDoS attack detection model, and the step specifically includes the following content:

S402. Determine, according to the detection result, a data access request corresponding to the DDoS attack type.

Specifically, the detection result includes detecting a DDoS attack type corresponding to each data access request. The data detection request identifies the DDoS attack type corresponding to each data access request identifier in the server detection result, classifies the data access request, and determines data access requests corresponding to various DDoS attack types.

In one embodiment, S402 specifically includes the following: counting the number of attack requests for DDoS attack access requests according to the detection result; and when the number of statistical attack requests is greater than the preset attack request threshold, according to the detection result, according to the DDoS attack request type DDoS attack access requests are classified.

Specifically, the server obtains a data access request that is determined to be a DDoS attack access request according to the detection result, collects the number of DDoS attack access requests, obtains the number of attack requests, and compares the counted number of attack requests with a preset attack request threshold. The DDoS attack access request is classified according to the type of the DDoS attack request corresponding to each DDoS attack request in the detection result, and the DDoS corresponding to the DDoS attack request type is obtained. Attack access request.

S404. The data access request corresponding to the determined DDoS attack request type is used as training sample data to retrain the DDoS attack detection model.

Specifically, after the server classifies the data access request according to the DDoS attack type, the data access request corresponding to each DDoS attack type is taken as an input, and the DDoS attack detection model is re-trained by using the DDoS attack type as an output, and the retrained DDoS attack detection model is obtained. .

S406, replacing the pre-trained DDoS attack detection model with the retrained DDoS attack detection model.

Specifically, the server replaces the pre-trained DDoS attack access request with the retrained DDoS attack detection model. The server obtains the data access request of the terminal again, inputs the obtained data access request into the retrained DDoS attack detection model, and uses the retrained DDoS attack detection model to detect the obtained data access request, and obtains the detection result.

In one embodiment, the server discards the data access request when the data access request is a DDoS attack access request according to the detection result, and allows the access of the data access request when the data access request is not a DDoS attack access request according to the detection result.

In this embodiment, the DDoS attack access request is classified according to various DDoS attack types in the detection result, and the DDoS attack detection model is retrained according to the classified DDoS attack access request, and the pre-trained DDoS attack detection model is replaced with retraining. The DDoS attack detection model updates the DDoS attack detection model and improves the detection accuracy of the DDoS attack detection model.

In one embodiment, as shown in FIG. 5, the DDoS attack detection method specifically includes the step of generating a DDoS attack detection model, and the step specifically includes the following content:

S502. Acquire a model training instruction.

Specifically, when the terminal detects that the model training button in the model training page is clicked, the terminal triggers the model training instruction, and sends the model training instruction to the server. The server receives the model training instruction sent by the terminal. The model training instruction is used to instruct the server to start training the DDoS attack detection model.

S504. Call the DDoS attack program to generate a DDoS attack access request in batch according to the model training instruction.

The DDoS attacker runs on the server and is used to batch generate simulated DDoS attack access requests.

Specifically, after receiving the model training instruction, the server triggers a call instruction of the DDoS attack program, and invokes the DDoS attack program to generate a DDoS attack access request in batch according to the calling instruction. The generated DDoS attack access request may include DDoS attack access requests of various DDoS attack types.

S506: The DDoS attack detection model is trained as a training sample data by using a DDoS attack access request generated in batches, and a pre-trained DDoS attack detection model is obtained.

Specifically, the server uses the DDoS attack access request generated in batches as the training sample data. For each DDoS attack access request in the training sample data, extract a feature field from the DDoS attack access request according to the feature field table, and construct an access request feature vector corresponding to the DDoS attack access request according to the extracted feature field, to obtain each The access request feature vector corresponding to the DDoS attack access request. The server takes as input the corresponding access request feature vector for each DDoS attack access request, and uses the DDoS attack access request identifier as an output to train the DDoS attack detection model.

In this embodiment, the DDoS attack access request is generated in batches by calling the DDoS attack program, which saves the time taken for collecting the DDoS attack access request, and the DDoS attack access request is generated in batches as the training sample data by the DDoS attack program, and the DDoS can be directly trained. The attack detection model improves the speed of generating DDoS attack detection models.

In one embodiment, as shown in FIG. 6, S506 specifically includes the step of training the model according to the classified DDoS attack access request, and the step specifically includes the following content:

S602. The DDoS attack access request generated by the batch is classified according to the DDoS attack request type, and the DDoS attack access request corresponding to each DDoS attack request type is obtained.

Specifically, the DDoS attack access request generated in batches includes DDoS attack access requests of various DDoS attack types. The server classifies the DDoS attack access requests generated in batches according to the DDoS attack type, and obtains DDoS attack access requests corresponding to various DDoS attack types.

S604, using the classified DDoS attack access request as an input, and using the DDoS attack request type corresponding to the classified DDoS attack access request as an output, performing training to obtain a pre-trained DDoS attack detection model.

Specifically, the server classifies the corresponding DDoS attack access request by using each DDoS attack type as an input, and uses the DDoS attack type corresponding to the input DDoS attack access request as an output to perform training, and obtains a pre-trained DDoS attack detection model through training.

The detection result output by the pre-trained DDoS attack detection model may include a DDoS attack type corresponding to the data access request.

In this embodiment, the pre-trained DDoS attack detection model may be used to detect whether the data access request is a DDoS attack access request. If the data access request is detected as a DDoS attack access request, the data access request may also be detected. The DDoS attack type can detect data access requests more accurately.

It should be understood that although the various steps in the flowcharts of FIGS. 1-6 are sequentially displayed as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Except as explicitly stated herein, the execution of these steps is not strictly limited, and the steps may be performed in other orders. Moreover, at least some of the steps in FIGS. 1-6 may include a plurality of sub-steps or stages, which are not necessarily performed at the same time, but may be executed at different times, these sub-steps or stages The order of execution is not necessarily performed sequentially, but may be performed alternately or alternately with at least a portion of other steps or sub-steps or stages of other steps.

In one embodiment, as shown in FIG. 7, a DDoS attack detection apparatus 700 is provided, including: an access request acquisition module 702, a request quantity statistics module 704, a feature field extraction module 706, a feature vector generation module 708, and detection. Result acquisition module 710:

The access request obtaining module 702 is configured to acquire a data access request in a current time period.

The request quantity statistics module 704 is configured to count the number of access requests for obtaining the data access request.

The feature field extraction module 706 is configured to extract a feature field from the obtained data access request when the number of the statistical access requests is higher than the preset request number threshold.

The feature vector generation module 708 is configured to generate an access request feature vector corresponding to the acquired data access request according to the extracted feature field.

The detection result obtaining module 710 is configured to input the generated access request feature vector into the pre-trained DDoS attack detection model, and obtain the detection result of the pre-trained DDoS output.

In one embodiment, the feature field extraction module 706 is further configured to: when the number of the statistical access requests is higher than the preset request number threshold, acquire the feature field table; and extract and acquire the feature in the obtained data access request. The field in the field table identifies the corresponding feature field.

In one embodiment, the feature vector generation module 708 is further configured to identify a field type of the extracted feature field; determine a value corresponding to the extracted feature field according to a numerical determination manner corresponding to the identified field type; The value corresponding to the feature field is determined, and the access request feature vector corresponding to the obtained data access request is determined.

In one embodiment, as shown in FIG. 8, the DDoS attack detection apparatus 700 specifically includes the following contents: an access request classification module 712, a model retraining module 714, and a detection model replacement module 716:

The access request classification module 712 is configured to determine, according to the detection result, a data access request corresponding to the DDoS attack type.

The model retraining module 714 re-trains the DDoS attack detection model by using the data access request corresponding to the determined DDoS attack request type as the training sample data.

The detection model replacement module 716 replaces the pre-trained DDoS attack detection model with the retrained DDoS attack detection model.

In one embodiment, the access request classification module 712 is further configured to count the number of attack requests for the DDoS attack access request according to the detection result; and when the number of the collected attack requests is greater than the preset attack request threshold, according to the detection result, according to the DDoS attack request. Types classify DDoS attack access requests.

In one embodiment, as shown in FIG. 9, the DDoS attack detection apparatus 700 specifically includes the following: a training instruction acquisition module 718, a request batch generation module 720, and a detection model training module 722:

The training instruction acquisition module 718 is configured to acquire a model training instruction.

The request batch generation module 720 is configured to invoke the DDoS attack program to generate a DDoS attack access request in batch according to the model training instruction.

The detection model training module 722 is configured to train the DDoS attack detection model by using the DDoS attack access request generated in batches as the training sample data, and obtain a pre-trained DDoS attack detection model.

In one embodiment, the detection model training module 722 is further configured to classify the DDoS attack access request generated by the batch according to the DDoS attack request type, and obtain a DDoS attack access request corresponding to each DDoS attack request type; and use the classified DDoS attack. The access request is used as an input, and the DDoS attack request type corresponding to the classified DDoS attack access request is output as an output, and the pre-trained DDoS attack detection model is obtained.

For the specific definition of the DDoS attack detection device, refer to the above definition of the DDoS attack detection method, and details are not described herein again. Each of the above modules in the DDoS attack detection apparatus may be implemented in whole or in part by software, hardware, and a combination thereof. Each of the above modules may be embedded in or independent of the processor in the computer device, or may be stored in a memory in the computer device in a software form, so that the processor invokes the operations corresponding to the above modules.

In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as shown in FIG. The computer device includes a processor, memory, network interface, and database connected by a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium, an internal memory. The non-volatile storage medium stores an operating system, computer readable instructions, and a database. The internal memory provides an environment for operation of an operating system and computer readable instructions in a non-volatile storage medium. The database of the computer device is used to store a feature field table. The network interface of the computer device is used to communicate with an external terminal via a network connection. The computer readable instructions are executed by the processor to implement a DDoS attack detection method.

It will be understood by those skilled in the art that the structure shown in FIG. 10 is only a block diagram of a part of the structure related to the solution of the present application, and does not generate a limitation on the computer device to which the present application is applied. The specific computer device may It includes more or fewer components than those shown in the figures, or some components are combined, or have different component arrangements.

In one embodiment, a computer apparatus is provided comprising a memory and one or more processors having stored therein computer readable instructions that, when executed by a processor, cause one or more processors The following steps are performed: obtaining a data access request in the current time period; counting the number of access requests for obtaining the data access request; and extracting the data access request from the obtained data access request when the number of the statistical access requests is higher than the preset request number threshold a feature field; generating an access request feature vector corresponding to the acquired data access request according to the extracted feature field; inputting the generated access request feature vector into the pre-trained DDoS attack detection model, and acquiring the detection result of the pre-trained DDoS output .

In one embodiment, when the number of the statistic access requests is higher than the preset request number threshold, the feature field is extracted from the obtained data access request, including: when the number of statistic access requests is higher than the preset request number threshold And acquiring a feature field table; and extracting, in the obtained data access request, a feature field corresponding to the field identifier in the acquired feature field table.

In one embodiment, the generating an access request feature vector corresponding to the acquired data access request according to the extracted feature field includes: identifying a field type of the extracted feature field; determining according to the value corresponding to the identified field type The method determines a value corresponding to the extracted feature field, and determines an access request feature vector corresponding to the acquired data access request according to the value corresponding to the extracted feature field.

In one embodiment, after the generated access request feature vector is input into the pre-trained DDoS attack detection model to obtain the detection result of the pre-trained DDOS output, the processor further implements the following steps when executing the computer readable instruction: The detection result determines a data access request corresponding to the DDoS attack type; the data access request corresponding to the determined DDoS attack request type is used as the training sample data, and the DDoS attack detection model is retrained; and the pre-trained DDoS attack detection model is replaced with the retrained DDoS attack detection model.

In one embodiment, the data access request corresponding to the DDoS attack type is determined according to the detection result, including: counting the number of attack requests for the DDoS attack access request according to the detection result; and when the number of the collected attack requests is greater than the preset attack request threshold, According to the detection result, the DDoS attack access request is classified according to the DDoS attack request type.

In one embodiment, during the pre-trained DDoS attack detection model generation process, when the processor executes the computer readable instructions, the processor further implements the following steps: acquiring the model training instruction; and invoking the DDoS attack program according to the model training instruction to generate the DDoS attack access in batches. The DDoS attack detection model is trained as a training sample data by using a batch generated DDoS attack access request, and a pre-trained DDoS attack detection model is obtained.

In one embodiment, the DDoS attack detection request is generated by using the batch-generated DDoS attack access request as the training sample data, and the pre-trained DDoS attack detection model is obtained, including: the DDoS attack access request generated in batch according to the DDoS attack request type. The DDoS attack access request corresponding to each DDoS attack request type is obtained, and the DDoS attack access request is used as an input, and the DDoS attack request type corresponding to the DDoS attack access request is output as an output, and the training is pre-trained. Good DDoS attack detection model.

In one embodiment, there is provided one or more non-volatile storage media having computer readable instructions that, when executed by one or more processors, cause one or more processors to perform the following Step: obtaining a data access request in the current time period; counting the number of access requests for obtaining the data access request; and extracting the feature field from the obtained data access request when the number of the statistical access requests is higher than the preset request number threshold And generating an access request feature vector corresponding to the acquired data access request according to the extracted feature field; inputting the generated access request feature vector into the pre-trained DDoS attack detection model, and acquiring the detection result of the pre-trained DDoS output.

In one of the embodiments, the generated access request feature vector is input into the pre-trained DDoS attack detection model, and after the detection result of the pre-trained DDOS output is obtained, the computer readable instructions are executed by the processor to implement the following steps: Determining a data access request corresponding to the DDoS attack type according to the detection result; determining a data access request corresponding to the DDoS attack request type as training sample data, retraining the DDoS attack detection model; and replacing the pre-trained DDoS attack detection model with retraining DDoS attack detection model.

In one embodiment, during the pre-trained DDoS attack detection model generation process, when the computer readable instructions are executed by the processor, the following steps are further performed: acquiring the model training instruction; and invoking the DDoS attack program according to the model training instruction to generate the DDoS attack in batches. Access request; DDoS attack detection model is trained as a training sample data by batch-generated DDoS attack access request, and a pre-trained DDoS attack detection model is obtained.

One of ordinary skill in the art can understand that all or part of the process of implementing the above embodiments can be completed by computer readable instructions, which can be stored in a non-volatile computer. The readable storage medium, which when executed, may include the flow of an embodiment of the methods as described above. Any reference to a memory, storage, database or other medium used in the various embodiments provided herein can include non-volatile and/or volatile memory. Non-volatile memory can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of formats, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronization chain. Synchlink DRAM (SLDRAM), Memory Bus (Rambus) Direct RAM (RDRAM), Direct Memory Bus Dynamic RAM (DRDRAM), and Memory Bus Dynamic RAM (RDRAM).

The technical features of the above embodiments may be arbitrarily combined. For the sake of brevity of description, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, It is considered to be the range described in this specification.

The above-mentioned embodiments are merely illustrative of several embodiments of the present application, and the description thereof is more specific and detailed, but is not to be construed as limiting the scope of the invention. It should be noted that a number of variations and modifications may be made by those skilled in the art without departing from the spirit and scope of the present application. Therefore, the scope of the invention should be determined by the appended claims.

Claims

A DDoS attack detection method includes:

Obtain a data access request during the current time period;

Count the number of access requests for obtaining data access requests;

When the number of statistical access requests is higher than the preset request quantity threshold, the feature field is extracted from the obtained data access request;

Generating an access request feature vector corresponding to the acquired data access request according to the extracted feature field; and

The generated access request feature vector is input into the pre-trained DDoS attack detection model, and the detection result of the pre-trained DDoS output is obtained.
The method according to claim 1, wherein when the number of the statistical access requests is higher than the preset number of requests, the feature fields are extracted from the obtained data access request, including:

Obtaining a feature field table when the number of statistical access requests is higher than a preset request number threshold; and

In the obtained data access request, the feature field corresponding to the field identifier in the acquired feature field table is extracted.
The method according to claim 2, wherein the generating the access request feature vector corresponding to the acquired data access request according to the extracted feature field comprises:

Identify the field type of the extracted feature field;

Determining a value corresponding to the extracted feature field according to a method for determining a value corresponding to the identified field type; and

Determining, according to the value corresponding to the extracted feature field, an access request feature vector corresponding to the acquired data access request.
The method according to claim 1, wherein after the generated access request feature vector is input into a pre-trained DDoS attack detection model to obtain the detection result of the pre-trained DDOS output, the method Also includes:

Determining, according to the detection result, a data access request corresponding to the DDoS attack type;

Re-training the DDoS attack detection model by using the data access request corresponding to the determined DDoS attack request type as training sample data; and

Replace the pre-trained DDoS attack detection model with the retrained DDoS attack detection model.
The method according to claim 4, wherein the determining, according to the detection result, a data access request corresponding to a DDoS attack type, comprising:

Counting the number of attack requests for DDoS attack access requests according to the detection result; and

When the number of the detected attack requests is greater than the preset attack request threshold, the DDoS attack access request is classified according to the DDoS attack request type according to the detection result.
The method according to claim 1, wherein the pre-trained DDoS attack detection model generation process comprises:

Obtain model training instructions;

Generating a DDoS attack access request in batches according to the model training instruction by calling a DDoS attack program; and

The DDoS attack detection model is trained as a training sample data by using DDoS attack access requests generated in batches to obtain a pre-trained DDoS attack detection model.
The method according to claim 6, wherein the DDoS attack access request generated by the batch is used as training sample data to train the DDoS attack detection model, and the pre-trained DDoS attack detection model is obtained, including:

The DDoS attack access request generated by the batch is classified according to the DDoS attack request type, and the DDoS attack access request corresponding to each DDoS attack request type is obtained;

The DDoS attack access request is used as an input, and the DDoS attack request type corresponding to the DDoS attack access request is used as an output to perform training to obtain a pre-trained DDoS attack detection model.
A DDoS attack detection device includes:

An access request obtaining module, configured to acquire a data access request in a current time period;

A request quantity statistics module, configured to count the number of access requests for obtaining a data access request;

a feature field extraction module, configured to: when the number of statistical access requests is higher than a preset number of request thresholds, extract a feature field from the obtained data access request;

a feature vector generating module, configured to generate, according to the extracted feature field, an access request feature vector corresponding to the acquired data access request; and

The detection result obtaining module is configured to input the generated access request feature vector into the pre-trained DDoS attack detection model, and obtain the detection result of the pre-trained DDoS output.
The device according to claim 8, wherein the feature field extraction module is further configured to: when the number of statistical access requests is higher than a preset number of request thresholds, obtain a feature field table;

The feature field extraction module is further configured to extract, in the obtained data access request, a feature field corresponding to the field identifier in the acquired feature field table.
The device according to claim 9, wherein the feature vector generating module is further configured to identify a field type of the extracted feature field;

The feature vector generating module is further configured to determine a value corresponding to the extracted feature field according to a method for determining a value corresponding to the identified field type; and

The feature vector generating module is further configured to determine, according to the value corresponding to the extracted feature field, an access request feature vector corresponding to the acquired data access request.
A computer device comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executed by the one or more processors to cause the one or more The processors perform the following steps:

Obtain a data access request during the current time period;

Count the number of access requests for obtaining data access requests;

When the number of statistical access requests is higher than the preset request quantity threshold, the feature field is extracted from the obtained data access request;

Generating an access request feature vector corresponding to the acquired data access request according to the extracted feature field; and

The generated access request feature vector is input into the pre-trained DDoS attack detection model, and the detection result of the pre-trained DDoS output is obtained.
The computer apparatus according to claim 11, wherein said processor further performs the following steps when said computer readable instructions are executed:

Obtaining a feature field table when the number of statistical access requests is higher than a preset request number threshold; and

In the obtained data access request, the feature field corresponding to the field identifier in the acquired feature field table is extracted.
The computer apparatus according to claim 12, wherein said processor further performs the following steps when said computer readable instructions are executed:

Identify the field type of the extracted feature field;

Determining a value corresponding to the extracted feature field according to a method for determining a value corresponding to the identified field type; and

Determining, according to the value corresponding to the extracted feature field, an access request feature vector corresponding to the acquired data access request.
The computer apparatus according to claim 11, wherein said processor further performs the following steps when said computer readable instructions are executed:

Determining, according to the detection result, a data access request corresponding to the DDoS attack type;

Re-training the DDoS attack detection model by using the data access request corresponding to the determined DDoS attack request type as training sample data; and

Replace the pre-trained DDoS attack detection model with the retrained DDoS attack detection model.
The computer apparatus according to claim 14, wherein said processor further performs the following steps when said computer readable instructions are executed:

Counting the number of attack requests for DDoS attack access requests according to the detection result; and

When the number of the received attack requests is greater than the preset attack request threshold, the DDoS attack access request is classified according to the DDoS attack request type according to the detection result.
One or more non-transitory computer readable storage mediums storing computer readable instructions, when executed by one or more processors, cause the one or more processors to perform the following steps:

Obtain a data access request during the current time period;

Count the number of access requests for obtaining data access requests;

When the number of statistical access requests is higher than the preset request quantity threshold, the feature field is extracted from the obtained data access request;

Generating an access request feature vector corresponding to the acquired data access request according to the extracted feature field; and

The generated access request feature vector is input into the pre-trained DDoS attack detection model, and the detection result of the pre-trained DDoS output is obtained.
The storage medium of claim 16 wherein said computer readable instructions are further executed by said processor to perform the following steps:

Obtaining a feature field table when the number of statistical access requests is higher than a preset request number threshold; and

In the obtained data access request, the feature field corresponding to the field identifier in the acquired feature field table is extracted.
A storage medium according to claim 17, wherein said computer readable instructions are further executed by said processor to perform the following steps:

Identify the field type of the extracted feature field;

Determining a value corresponding to the extracted feature field according to a method for determining a value corresponding to the identified field type; and

Determining, according to the value corresponding to the extracted feature field, an access request feature vector corresponding to the acquired data access request.
The storage medium of claim 16 wherein said computer readable instructions are further executed by said processor to perform the following steps:

Determining, according to the detection result, a data access request corresponding to the DDoS attack type;

Re-training the DDoS attack detection model by using the data access request corresponding to the determined DDoS attack request type as training sample data; and

Replace the pre-trained DDoS attack detection model with the retrained DDoS attack detection model.
A storage medium according to claim 19, wherein said computer readable instructions are further executed by said processor to perform the following steps:

Counting the number of attack requests for DDoS attack access requests according to the detection result; and

When the number of the received attack requests is greater than the preset attack request threshold, the DDoS attack access request is classified according to the DDoS attack request type according to the detection result.