CN107360196B - Attack detection method, device and terminal device - Google Patents

Abstract

The invention provides an attack detection method, an attack detection device and terminal equipment, and relates to the technical field of computers. The attack detection method comprises the following steps: judging whether a first ratio of UDP incoming flow and total incoming flow corresponding to the terminal equipment in the current preset time period is larger than a first preset value or not; if so, judging whether a second ratio of the UDP input flow corresponding to the terminal equipment in the current preset time period to the current maximum input flow is larger than a second preset value or not, and whether a third ratio of the UDP input flow corresponding to the terminal equipment in the current preset time period to the UDP output flow is larger than a current historical ratio or not; and if so, judging that the terminal equipment is attacked by the UDP. The attack detection method can better realize the detection of UDP attacks.

Description

Attack detection method, device and terminal device

technical field

The present invention relates to the field of computer technology, and in particular, to an attack detection method, an apparatus and a terminal device.

Background technique

UDP Flood is one of the current popular DOS and DDOS methods, and its attack principle is very simple. This kind of attack uses the fact that the UDP protocol is a connectionless transmission protocol, so that during the data transmission process, there is no need to establish a connection and perform authentication, and the attacker can send a large number of abnormally high On the one hand, the network resources where the attacked host is located will be exhausted, and the attacked host will be busy processing UDP packets, which will cause the system to crash.

Currently, the commonly used protection methods for UDP flood attacks require the establishment of professional firewalls or other protection devices, resulting in high costs.

SUMMARY OF THE INVENTION

In view of this, embodiments of the present invention provide an attack detection method, apparatus, and terminal device to solve the above problems.

In order to achieve the above object, the technical scheme adopted in the present invention is as follows:

An attack detection method, the method comprising: judging whether a first ratio of UDP inbound traffic corresponding to a terminal device in a current preset time period to an overall ingress traffic is greater than a first preset value; if so, judging whether the terminal device is in Whether the second ratio of the UDP incoming traffic corresponding to the current preset time period to the current maximum incoming traffic is greater than the second preset value, and whether the third ratio of the UDP incoming traffic and the UDP outgoing traffic corresponding to the current preset time period of the terminal device Whether the ratio is greater than the current historical ratio; if so, it is determined that the terminal device is under UDP attack.

An attack detection device, the device includes a first judging module, a second judging module and a judging module, wherein the first judging module is used for judging the UDP ingress and the overall ingress corresponding to the terminal device in the current preset time period. Whether the first ratio of the traffic is greater than the first preset value; if so, the second judgment module is used to judge whether the second ratio of the UDP ingress corresponding to the current preset time period to the current maximum ingress of the terminal device is not greater than the second preset value, and whether the third ratio of the UDP incoming traffic to the UDP outgoing traffic corresponding to the terminal device in the current preset time period is greater than the current historical ratio; if so, the determining module is used to determine the terminal The device is under UDP attack.

A terminal device comprising a memory coupled to the processor and a processor, the memory storing instructions that, when executed by the processor, cause the processor to perform the following Operation: determine whether the first ratio of the UDP inbound traffic corresponding to the terminal device in the current preset time period to the overall inbound traffic is greater than the first preset value; if so, determine whether the terminal device corresponds to the current preset time period. Whether the second ratio of the UDP incoming traffic to the current maximum incoming traffic is greater than the second preset value, and whether the third ratio of the UDP incoming traffic to the UDP outgoing traffic corresponding to the terminal device in the current preset time period is greater than the current historical ratio; If so, it is determined that the terminal device is under UDP attack.

The attack detection method, device, and terminal device provided by the embodiments of the present invention determine whether the first ratio of the UDP inbound traffic corresponding to the terminal device in the current preset time period to the overall inbound traffic is greater than the first preset value; Determine whether the second ratio of the UDP inbound traffic corresponding to the current preset time period to the current maximum inbound traffic of the terminal device is greater than the second preset value, and the difference between the UDP inbound traffic and the UDP outbound traffic corresponding to the terminal device in the current preset time period Whether the third ratio is greater than the current historical ratio; if so, it is determined that the terminal device is under UDP attack. Therefore, the detection of the UDP attack can be realized according to the traffic information, and the problem of the high cost of the detection method of the UDP attack in the prior art is solved.

In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below, and are described in detail as follows in conjunction with the accompanying drawings.

Description of drawings

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments These are some embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

1 shows a schematic block diagram of a terminal device provided by an embodiment of the present invention;

FIG. 2 shows a flowchart of an attack detection method provided by an embodiment of the present invention;

FIG. 3 shows another flowchart of the attack detection method provided by an embodiment of the present invention;

FIG. 4 shows a functional block diagram of an attack detection apparatus provided by an embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. The components of the embodiments of the invention generally described and illustrated in the drawings herein may be arranged and designed in a variety of different configurations. Thus, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the invention as claimed, but is merely representative of selected embodiments of the invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present invention.

It should be noted that like numerals and letters refer to like items in the following figures, so once an item is defined in one figure, it does not require further definition and explanation in subsequent figures. Meanwhile, in the description of the present invention, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

FIG. 1 shows a structural block diagram of a terminal device applicable to an embodiment of the present invention. As shown in FIG. 1 , the terminal device 100 includes a memory 102 , a storage controller 104 , one or more (only one is shown in the figure) processor 106 , a peripheral interface 108 , a radio frequency module 110 , an audio module 112 , and a display unit 114 Wait. These components communicate with each other via one or more communication bus/signal lines 116 .

The memory 102 can be used to store software programs and modules, such as program instructions/modules corresponding to the attack detection method and apparatus in the embodiment of the present invention, and the processor 106 executes various functions by running the software programs and modules stored in the memory 102. Application and data processing, such as the attack detection device provided by the embodiment of the present invention.

The memory 102 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. Access to memory 102 by processor 106 and possibly other components may be under the control of memory controller 104 .

Peripherals interface 108 couples various input/output devices to processor 106 and memory 102 . In some embodiments, peripheral interface 108, processor 106, and memory controller 104 may be implemented in a single chip. In other instances, they may be implemented by separate chips.

The radio frequency module 110 is used for receiving and sending electromagnetic waves, realizing mutual conversion between electromagnetic waves and electrical signals, so as to communicate with a communication network or other devices.

The audio module 112 provides an audio interface to the user, which may include one or more microphones, one or more speakers, and audio circuitry.

PA17035797HZ

The display unit 114 provides a display interface between the terminal device 100 and the user. Specifically, the display unit 114 displays video output to the user, and the content of the video output may include text, graphics, video, and any combination thereof.

It can be understood that the structure shown in FIG. 1 is only for illustration, and the terminal device 100 may further include more or less components than those shown in FIG. 1 , or have different configurations from those shown in FIG. 1 . Each component shown in FIG. 1 may be implemented in hardware, software, or a combination thereof.

first embodiment

FIG. 2 shows a flowchart of an attack detection method provided by an embodiment of the present invention. Referring to Figure 2, the method includes:

Step S110: Determine whether the first ratio of the UDP inbound traffic corresponding to the current preset time period to the overall inbound traffic of the terminal device is greater than the first preset value.

In this embodiment of the present invention, in order to quickly determine whether a UDP flood attack exists, network traffic information corresponding to a terminal device needs to be acquired, and a DPI for collecting network traffic information corresponding to the terminal device can be set in the network environment where the terminal device is located. equipment. DPI equipment has the capabilities of service data flow identification and service data flow control. It works from the OSI model transmission layer to the application layer, has high data collection capabilities, and can identify and manage the traffic carried by the network.

Before detecting a UDP flood attack, it is necessary to obtain network traffic information of the terminal device, so as to realize the subsequent judgment of the UDP flood attack. Therefore, before step S110, the attack detection method further includes: acquiring network traffic information collected by the DPI device for a plurality of preset time periods before the current time of the terminal device, where the network traffic information includes a plurality of sessions corresponding to network traffic information.

Among them, the network traffic information of multiple preset time periods before the current time can be understood as: the network traffic information of a period of time before the current time, and the period of time is divided into multiple segments, and the size of each period of time is related to the preset time. The size of the segment corresponds, that is, multiple preset time segments are obtained, so that the network traffic information of each preset time segment can be obtained.

In addition, the network traffic information includes network traffic information corresponding to multiple sessions respectively. The specific network traffic information may be the network layer inbound and outbound traffic of each session, the start and end time of the session, the adopted network layer protocol, source IP address information and destination IP address information.

After obtaining the network traffic information of the terminal device in a plurality of preset time periods before the current time, the subsequent data needed to judge the UDP flood attack can be obtained based on the network traffic information.

Usually, after a terminal device is attacked by UDP flood, the total traffic in the current time period usually reaches a maximum value, while the total traffic in a time period during normal operation is in a state of random fluctuation. And the ratio of the ingress traffic corresponding to the UDP protocol in the current time period to the overall ingress traffic is higher than the ratio in normal operation, and the ratio of the ingress traffic corresponding to the UDP protocol in the current time period to the current maximum inflow is relatively high. The ratio of the incoming traffic corresponding to the UDP protocol to the outgoing traffic corresponding to the UDP protocol in the current time period is higher than the recorded historical ratio. Among them, the incoming traffic and the outgoing traffic are the traffic sizes.

Therefore, the attack detection method further includes: acquiring, based on the network traffic information of the multiple preset time periods, the UDP inbound traffic and the overall inbound traffic corresponding to the terminal device in the current preset time period.

The UDP incoming traffic corresponding to the current preset time period is the size of the incoming traffic corresponding to the UDP protocol in the preset time period before the current time of the terminal device. The overall inbound traffic corresponding to the current preset time period is the size of the inbound traffic corresponding to all network protocols in the terminal device in the preset time period before the current time.

The attack detection method further includes: obtaining, based on the network traffic information of the multiple preset time periods, the maximum value of the total inbound traffic corresponding to the multiple preset time periods as the current maximum inbound traffic; based on the multiple preset time periods The network traffic information of the preset time periods is obtained, and the UDP outbound traffic corresponding to the terminal device in the current preset time period is obtained; based on the network traffic information of the preset time periods, the multiple preset time periods are obtained. The maximum value of the ratios between the UDP incoming traffic and the UDP outgoing traffic corresponding to the preset time periods other than the current preset time period is used as the current historical ratio.

It can be understood that the above-mentioned current historical ratio is obtained from a plurality of preset time periods before the current time period, and the maximum value among the ratios of the corresponding UDP incoming traffic and UDP outgoing traffic is obtained as the current historical ratio.

After obtaining the current maximum inbound traffic, it is also possible to obtain, based on the network traffic information of the plurality of preset time periods, the maximum value of the total outgoing traffic corresponding to the plurality of preset time periods as the current maximum outgoing traffic; The maximum value of the current maximum incoming flow and the maximum outgoing flow is taken as the current flow peak.

Certainly, the overall outgoing traffic corresponding to each preset time period may also be acquired based on the network traffic information of the multiple preset time periods. Among them, the overall outgoing traffic corresponding to the current time period is obtained.

In this embodiment of the present invention, traffic data of a session corresponding to each UDP protocol in a time period formed by multiple preset time periods may also be counted. Therefore, the attack detection method further includes: based on the network traffic information of the multiple preset time periods, acquiring the incoming traffic of all the UDP sessions in the time period formed by the multiple preset time periods; Average data of incoming traffic to obtain the average incoming traffic of UDP sessions.

After the above-mentioned data is obtained according to the obtained network traffic information, the relevant data is judged. First, it should be determined whether the ratio of the overall inflow corresponding to the current time period to the current peak flow is greater than a certain value. Therefore, before step S110, it further includes: judging whether the fourth ratio of the total inflow corresponding to the terminal device in the current time period to the current peak value is greater than the third preset value; if so, executing the judging that the terminal device is currently Whether the first ratio of the UDP inbound traffic corresponding to the preset time period to the overall inbound traffic is greater than the first preset value.

In this embodiment of the present invention, the third preset value may be a value in the range of 0.7˜0.9. Preferably, the third preset value may be 0.8. Certainly, the specific value of the third preset value is not limited in the embodiment of the present invention. When specifically acquiring the fourth ratio of the total inflow corresponding to the terminal device in the current time period to the current peak value of the current flow, the value of the overall inflow corresponding to the current time period obtained above should be divided by the current peak value obtained above to obtain the fourth ratio. Four ratios.

When it is determined that the fourth ratio of the total inbound traffic corresponding to the current time period to the current peak value is greater than the preset ratio, step S110 is performed again, that is, it is determined that the UDP ingress corresponding to the current preset time period of the terminal device and the overall inbound traffic Whether the first ratio is greater than the first preset value.

In addition, it is judged whether the total inbound traffic corresponding to the current time period is greater than the current peak traffic value. If so, the current traffic peak value is updated to the total inbound traffic corresponding to the current time period, so as to accurately detect UDP flood attacks in the future.

When step S110 is specifically executed, the first preset value may be a value within the range of 0.7˜0.9. Preferably, the first preset value may be 0.8. Certainly, the specific value of the first preset value is not limited in the embodiment of the present invention. A first ratio is obtained by dividing the obtained UDP inbound traffic corresponding to the current time period and the overall inbound traffic, and then the magnitudes of the first ratio and the first preset value are compared.

Step S120: If yes, then determine whether the second ratio of the UDP inbound traffic corresponding to the current preset time period to the current maximum inbound traffic of the terminal device is greater than the second preset value, and the terminal device is in the current preset time period. Whether the third ratio of the corresponding UDP incoming traffic to the UDP outgoing traffic is greater than the current historical ratio.

When it is determined in step S110 that the first ratio of the UDP inbound traffic corresponding to the current preset time period to the overall inbound traffic of the terminal device is greater than the first preset value, in order to more accurately determine whether it is a UDP flood attack, then Perform a judgment on whether the second ratio of the UDP inbound traffic corresponding to the current preset time period to the current maximum ingress flow of the terminal device is greater than the second preset value, and the UDP ingress traffic corresponding to the terminal device in the current preset time period Whether the third ratio to UDP outgoing traffic is greater than the current historical ratio.

Specifically, the second preset value may be a value in the range of 0.7˜0.9. Preferably, the second preset value may be 0.8. Certainly, the specific value of the second preset value is not limited in the embodiment of the present invention. The second ratio can be obtained by dividing the above-obtained UDP incoming traffic by the above-obtained current maximum incoming traffic. The third ratio can be obtained by comparing the UDP inbound traffic corresponding to the current preset time period obtained above and the UDP outbound traffic corresponding to the current preset time period obtained above. The second ratio is then compared with the second preset value, and the third ratio is compared with the current historical ratio. Obtain whether the second ratio of the UDP incoming traffic corresponding to the current preset time period to the current maximum incoming traffic of the terminal device is greater than the second preset value, and whether the UDP incoming traffic and the UDP outgoing traffic corresponding to the terminal device in the current preset time period are The judgment result of whether the third ratio is greater than the current historical ratio.

Step S130: If yes, it is determined that the terminal device is under UDP attack.

If it is determined in step S120 that the second ratio of the UDP incoming traffic corresponding to the current preset time period to the current maximum incoming traffic of the terminal device is greater than the second preset value, and the UDP incoming traffic corresponding to the current preset time period of the terminal device If the third ratio to UDP outgoing traffic is greater than the historical ratio, it can be determined that the terminal device has received a UDP flood attack.

When it is determined in step S120 that the second ratio between the UDP incoming traffic corresponding to the current preset time period of the terminal device and the current maximum incoming traffic is less than or equal to the second preset value, but the UDP incoming traffic corresponding to the terminal device in the current preset time period When the third ratio of traffic to UDP outbound traffic is greater than the current historical ratio, it means that the terminal device has received a UDP flood attack. To ensure accurate detection of future UDP flood attacks, the current historical ratio is updated to the UDP corresponding to the current time period. The third ratio of incoming traffic to UDP outgoing traffic.

Thus, the detection result of UDP Flood can be obtained. In addition, after detecting that the terminal device is attacked by UDP flood, it can also give a prompt and obtain the source address of the UDP attack. Therefore, referring to FIG. 3 , after step S130 , step S140 is further included: obtaining the source address of the UDP attack received by the terminal device.

Specifically, acquiring the source address of the UDP attack received by the terminal device may include: acquiring a UDP session whose inflow is greater than the average inbound traffic of all UDP sessions corresponding to the terminal device in the current time period; Whether the outgoing traffic of the UDP session is 0; if so, obtain the IP address of the UDP session as the source address of the UDP attack received by the terminal device.

Specifically, according to the above obtained comparison of the ingress traffic corresponding to all UDP sessions corresponding to the current time period and the average ingress traffic of all UDP sessions, the UDP session with the ingress traffic of the UDP session greater than the average ingress traffic can be obtained. There may be one or more UDP sessions. Then, it is judged whether the outgoing traffic is 0 in the UDP session with the obtained ingress traffic greater than the average ingress traffic. If it is 0, the IP address of the UDP session is used as the source address of the UDP attack.

Therefore, a simple and highly reliable UDP flood attack detection can be realized by using the traffic information, and only a device that can analyze the traffic at the network layer needs to be arranged. Trace its source IP address.

Second Embodiment

The second embodiment of the present invention provides an attack detection apparatus 200 . Please refer to FIG. 4 . The attack detection apparatus includes a first judgment module 210 , a second judgment module 220 , and a judgment module 230 . The first judging module 210 is used to judge whether the first ratio of the UDP inbound traffic corresponding to the terminal device in the current preset time period to the overall inbound traffic is greater than the first preset value; if so, the second judging module 220 is used to determine whether the second ratio between the UDP inbound traffic corresponding to the current preset time period and the current maximum inbound traffic of the terminal device is greater than the second preset value, and the UDP corresponding to the terminal device in the current preset time period Whether the third ratio of incoming traffic to UDP outgoing traffic is greater than the current historical ratio; if so, the determining module 230 is configured to determine that the terminal device is attacked by UDP.

In the embodiment of the present invention, the attack detection apparatus further includes an address acquisition module. The address obtaining module is used to obtain the source address of the UDP attack received by the terminal device.

Third Embodiment

A third embodiment of the present invention provides a terminal device 100, please refer to FIG. 1, the terminal device 100 includes a memory 102 and a processor 106, the memory 102 is coupled to the processor 106, and the memory 102 stores instruction, when the instruction is executed by the processor 106, the processor 106 is made to perform the following operations: determine whether the first ratio of the UDP inbound traffic to the overall inbound traffic corresponding to the terminal device in the current preset time period is greater than or equal to The first preset value; if yes, then determine whether the second ratio of the UDP ingress corresponding to the current preset time period to the current maximum ingress of the terminal device is greater than the second preset value, and the terminal device is currently preset. Set whether the third ratio of the UDP incoming traffic to the UDP outgoing traffic corresponding to the time period is greater than the current historical ratio; if so, it is determined that the terminal device is under UDP attack.

To sum up, the attack detection method, device, and terminal device provided by the embodiments of the present invention determine whether the first ratio of the UDP inbound traffic corresponding to the terminal device in the current preset time period to the overall inbound traffic is greater than the first preset value. If yes, then judge whether the second ratio of the UDP inbound flow corresponding to the current preset time period to the current maximum ingress flow of the terminal device is greater than the second preset value, and the UDP ingress flow corresponding to the terminal device in the current preset time period Whether the third ratio to UDP outgoing traffic is greater than the current historical ratio; if so, it is determined that the terminal device is under UDP attack. Therefore, the detection of the UDP attack can be realized according to the traffic information, and the problem of the high cost of the detection method of the UDP attack in the prior art is solved.

It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. For the same and similar parts among the various embodiments, refer to each other Can. As for the apparatus type embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for the relevant part, please refer to the partial description of the method embodiment.

In the several embodiments provided in this application, it should be understood that the disclosed apparatus and method may also be implemented in other manners. The apparatus embodiments described above are merely illustrative, for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality and possible implementations of apparatuses, methods and computer program products according to various embodiments of the present invention. operate. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code that contains one or more functions for implementing the specified logical function(s) executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It is also noted that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented in dedicated hardware-based systems that perform the specified functions or actions , or can be implemented in a combination of dedicated hardware and computer instructions.

In addition, each functional module in each embodiment of the present invention may be integrated to form an independent part, or each module may exist independently, or two or more modules may be integrated to form an independent part.

If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes . It should be noted that, in this document, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any relationship between these entities or operations. any such actual relationship or sequence exists. Moreover, the terms "comprising", "comprising" or any other variation thereof are intended to encompass a non-exclusive inclusion such that a process, method, article or device that includes a list of elements includes not only those elements, but also includes not explicitly listed or other elements inherent to such a process, method, article or apparatus. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in a process, method, article or apparatus that includes the element.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention. It should be noted that like numerals and letters refer to like items in the following figures, so once an item is defined in one figure, it does not require further definition and explanation in subsequent figures.

The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention. should be included within the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (10)

1. An attack detection method, characterized in that the method comprises:

judging whether a first ratio of UDP incoming flow and total incoming flow corresponding to the terminal equipment in the current preset time period is larger than a first preset value or not;

if so, judging whether a second ratio of the UDP input flow corresponding to the terminal equipment in the current preset time period to the current maximum input flow is larger than a second preset value or not, and whether a third ratio of the UDP input flow corresponding to the terminal equipment in the current preset time period to the UDP output flow is larger than a current historical ratio or not;

and if so, judging that the terminal equipment is attacked by the UDP.

2. The method of claim 1, wherein after determining that the end device is subject to a UDP attack, the method further comprises:

and acquiring a source address of the UDP attack on the terminal equipment.

3. The method of claim 2, wherein the obtaining the source address of the UDP attack on the terminal device comprises:

acquiring UDP sessions of which the incoming flows of all UDP sessions corresponding to the current time period are larger than the average incoming flow of the UDP sessions by the terminal equipment;

if yes, judging whether the output flow of the UDP session is 0;

and if so, acquiring the IP address of the UDP session as the source address of the UDP attack on the terminal equipment.

4. The method according to claim 1, wherein before determining whether a first ratio of UDP incoming traffic to total incoming traffic corresponding to the terminal device in a current preset time period is greater than a first preset value, the method further comprises:

acquiring network traffic information of a plurality of preset time periods before the current time of the terminal equipment, which is acquired by DPI equipment, wherein the network traffic information comprises network traffic information corresponding to a plurality of sessions respectively;

and acquiring UDP incoming flow and total incoming flow corresponding to the terminal equipment in the current preset time period based on the network flow information of the preset time periods.

5. The method according to claim 4, wherein before determining whether a second ratio of UDP incoming traffic to current maximum incoming traffic corresponding to the terminal device in a current preset time period is greater than a second preset value and whether a third ratio of UDP incoming traffic to UDP outgoing traffic corresponding to the terminal device in the current preset time period is greater than a current historical ratio, the method further comprises:

acquiring the maximum value of total incoming flow corresponding to the preset time periods respectively as the current maximum incoming flow based on the network flow information of the preset time periods;

acquiring UDP (user Datagram protocol) outgoing flow corresponding to the terminal equipment in the current preset time period based on the network flow information of the preset time periods;

and acquiring the maximum value of the ratios between the UDP in-flow and the UDP out-flow respectively corresponding to the preset time periods except the current preset time period in the preset time periods as the current historical ratio based on the network flow information of the preset time periods.

6. The method according to claim 5, wherein after obtaining a maximum value of total incoming flows corresponding to the plurality of preset time periods as a current maximum incoming flow based on the network traffic information of the plurality of preset time periods, the method further comprises:

acquiring the maximum value of the total output flow corresponding to the preset time periods respectively as the current maximum output flow based on the network flow information of the preset time periods;

and acquiring the maximum value of the current maximum inflow and the maximum outflow as a current flow peak value.

7. The method according to claim 6, wherein before determining whether a first ratio of UDP incoming traffic to total incoming traffic corresponding to the terminal device in a current preset time period is greater than a first preset value, the method further comprises:

judging whether a fourth ratio of the total incoming flow corresponding to the current time period of the terminal equipment to the current flow peak value is larger than a third preset value or not;

and if so, executing the step of judging whether the first ratio of the UDP incoming flow and the total incoming flow corresponding to the current preset time period of the terminal equipment is greater than a first preset value.

8. An attack detection device, comprising a first judgment module, a second judgment module and a judgment module, wherein,

the first judging module is used for judging whether a first ratio of UDP incoming flow and total incoming flow corresponding to the terminal equipment in the current preset time period is larger than a first preset value;

if so, the second judging module is configured to judge whether a second ratio of UDP incoming traffic to current maximum incoming traffic corresponding to the terminal device in a current preset time period is greater than a second preset value, and whether a third ratio of UDP incoming traffic to UDP outgoing traffic corresponding to the terminal device in the current preset time period is greater than a current historical ratio;

and if so, the judging module is used for judging that the terminal equipment is attacked by the UDP attack.

9. The apparatus according to claim 8, wherein the apparatus further comprises an address obtaining module, and the address obtaining module is configured to obtain a source address of a UDP attack on the terminal device.

10. A terminal device, comprising a memory and a processor, the memory coupled to the processor, the memory storing instructions that, when executed by the processor, cause the processor to:

judging whether a first ratio of UDP incoming flow and total incoming flow corresponding to the terminal equipment in a current preset time period is larger than a first preset value or not;

if so, judging whether a second ratio of the UDP input flow corresponding to the terminal equipment in the current preset time period to the current maximum input flow is larger than a second preset value or not, and whether a third ratio of the UDP input flow corresponding to the terminal equipment in the current preset time period to the UDP output flow is larger than a current historical ratio or not;

and if so, judging that the terminal equipment is attacked by the UDP.

Images