WO2021023053A1

WO2021023053A1 - Data processing method and device, and storage medium

Info

Publication number: WO2021023053A1
Application number: PCT/CN2020/105033
Authority: WO
Inventors: 徐道晨
Original assignee: 阿里巴巴集团控股有限公司
Priority date: 2019-08-05
Filing date: 2020-07-28
Publication date: 2021-02-11
Also published as: CN112333130A; TW202107312A; CN112333130B

Abstract

Provided are a data processing method and device, and a storage medium. In some exemplary embodiments of the present application, the method comprises: acquiring traffic log data within a current period; performing abnormal behavior detection on the traffic log data within the current period; when it is determined that an abnormal behavior is present in network traffic within the current period, determining whether a generated first defense strategy is present in a defense strategy library; if the first defense strategy is present, using the present first defense strategy to perform data processing on network traffic in a subsequent period; and if the first defense strategy is not present, using a second defense strategy generated by known normal traffic to perform data processing on the network traffic within the subsequent period. In the present application, using a combination of a second defense strategy and a first defense strategy ensures that a source server is not broken by an attack at the first time, and also ensures that the influence on a current normal access request is minimal.

Description

Data processing method, equipment and storage medium

This application claims the priority of the Chinese patent application with the application number 201910717614.4 and the invention title of "data processing method, equipment and storage medium" filed on August 05, 2019, the entire content of which is incorporated into this application by reference.

Technical field

This application relates to the field of Internet technology, and in particular to a data processing method, device and storage medium.

Background technique

Distributed Denial of Service (DDoS: Distributed Denial of Service) attack is a form of network attack that consumes target resources to prevent users from normally accessing target services. It is the main threat in current network attacks. DDoS attacks rely on client/server technology to combine multiple computers as an attack platform to launch DDoS attacks against one or more targets, thereby exponentially increasing the power of denial-of-service attacks, causing normal users to fail to receive network responses. It poses a great threat to the Internet and Internet services.

Currently, in order to defend against DDoS attacks, a defense strategy against DDoS is generally preset on the target server, for example, source rate limiting of network traffic, and a defense strategy is preset in the case of no DDoS attacks or low frequency of attack sources. Will adversely affect the normal flow.

Summary of the invention

Various aspects of the present application provide a data processing method, device, and storage medium. On the one hand, it ensures that the source server is not overwhelmed by the attack at the first time of an attack, and on the other hand, it ensures that the defense strategy has less impact on normal traffic.

The embodiment of the application provides a data processing method, including:

Acquiring traffic log data in the current period, where the traffic log data reflects the characteristics of the network traffic in the current period;

If it is determined from the traffic log data in the current period that there is abnormal behavior in the network traffic in the current period, determine whether there is a first defense strategy, and the first defense strategy is generated for the abnormal traffic that has been identified before the current moment;

If it exists, perform data processing on the network traffic in the subsequent period according to the existing first defense strategy;

If it does not exist, data processing is performed on the network traffic in the subsequent period according to the second defense strategy, which is generated based on the normal traffic that has been identified before the current moment.

The embodiment of the present application also provides a data processing method, including:

According to the traffic log data in the current period, analyze the characteristics of the network traffic in the current period;

According to the characteristics of the network traffic in the current period and the baseline characteristics of the known normal traffic, identify the abnormal traffic in the current period, where the baseline characteristics of the known normal traffic are obtained from historical traffic log data;

According to the characteristics of the abnormal traffic existing in the current period, a first defense strategy for the abnormal traffic existing in the current period is generated to perform data processing on the network traffic in the subsequent period.

An embodiment of the present application also provides a data processing device, including: a memory and a processor;

The memory is used to store one or more computer instructions;

The processor is configured to execute the one or more computer instructions for:

The embodiments of the present application also provide a computer-readable storage medium storing a computer program. When the computer program is executed by one or more processors, the one or more processors are caused to perform actions including the following:

The memory is used to store one or more computer instructions;

According to the characteristics of the abnormal traffic existing in the current period, generate a first defense strategy against the abnormal traffic existing in the current period to perform data processing on the network traffic in the subsequent period;

The first defense strategy This embodiment of the application also provides a computer-readable storage medium storing a computer program. When the computer program is executed by one or more processors, causing the one or more processors to execute includes the following Actions:

The memory is used to store one or more computer instructions;

Acquiring database operation log data in the current period, where the database operation log data reflects the characteristics of the database operation traffic in the current period;

If it is determined based on the database operation log data in the current period that there is a data leakage behavior in the current period, determine whether there is a first defense strategy, which is generated for abnormal database operation traffic that has been identified before the current time ；

If it exists, perform data processing on the database operation traffic in the subsequent period according to the existing first defense strategy;

If it does not exist, perform data processing on the database operation traffic in the subsequent period according to the second defense strategy, which is generated based on the normal database operation traffic that has been identified before the current moment.

The memory is used to store one or more computer instructions;

If it exists, generate first visualization data for network traffic in the subsequent period according to the existing first defense strategy;

If it does not exist, generate second visualization data for the network traffic in the subsequent period according to the second defense strategy, which is generated based on the normal traffic that has been identified before the current moment.

In some exemplary embodiments of the present application, on the one hand, it can analyze whether there is abnormal traffic in the current period according to the traffic log data in the current period, and in the case of abnormal traffic, generate a first defense strategy for the abnormal traffic; On the one hand, it can perform abnormal behavior detection based on the traffic log data in the current period, and determine whether there is a first defense strategy that has been generated when it is determined that the network traffic in the current period has abnormal behavior; if it exists, use the existing one The first defense strategy for data processing in the subsequent period of time; if it does not exist, the second defense strategy generated by known normal traffic is used to perform data processing on the network traffic in the subsequent period, where the second defense strategy and the first One defense strategy is combined to conduct defensive processing on network traffic. On the one hand, it ensures that the source server will not be overwhelmed by the attack in the first time, and on the other hand, it ensures that the impact on normal traffic is small.

Description of the drawings

The drawings described here are used to provide a further understanding of the application and constitute a part of the application. The exemplary embodiments and descriptions of the application are used to explain the application and do not constitute an improper limitation of the application. In the attached picture:

FIG. 1a is a schematic structural diagram of a defense system provided by an embodiment of this application;

FIG. 1b is a schematic diagram of the working principle of the defense system according to another embodiment of the application;

FIG. 2a is a schematic flowchart of a data processing method provided by an exemplary embodiment of this application;

2b is a schematic flowchart of another data processing method provided by an exemplary embodiment of this application;

FIG. 2c is a schematic flowchart of another data processing method provided by an exemplary embodiment of this application;

FIG. 3 is a schematic flowchart of a data processing method provided by an exemplary embodiment of this application;

FIG. 4 is a schematic structural diagram of a data processing device provided by an exemplary embodiment of this application;

5 is a schematic structural diagram of a data processing device provided by an exemplary embodiment of this application;

FIG. 6 is a schematic structural diagram of a data processing device provided by an exemplary embodiment of this application;

Fig. 7 is a schematic structural diagram of a data processing device provided by an exemplary embodiment of this application.

detailed description

In order to make the purpose, technical solutions, and advantages of the present application clearer, the technical solutions of the present application will be described clearly and completely in conjunction with specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of this application.

For the defense of resource-exhausted DDoS attacks, the following defense methods are currently used:

Method one is to limit the source rate of network traffic. On the one hand, the number of devices behind the export IP is large, so the normal request frequency of the export IP is higher, and the rate limit will accidentally hurt the traffic of the export IP, and there is no defense when the attack source attack frequency is low; When it is higher, even if the request frequency of a single attack source is extremely low, the total amount of aggregated attacks is quite large, but it can pass the source rate limit smoothly. Therefore, the source rate limitation of network traffic will cause great damage to normal traffic and little effect on defense against DDoS attacks.

The second method is to limit the network traffic at a target rate. When the total attack frequency is high, the normal traffic passing probability is extremely low: suppose that the normal request frequency of the website is 10 requests/sec, and the rate limit threshold is 100 requests/sec. When the total attack frequency is high, such as 10W requests/sec, then the total The request frequency is 100010 requests/sec. Normal requests only pass 10/100010*100=0.009999 requests/sec, and the passing probability is extremely low. There is no defense when the total attack frequency is low: 100 search requests (high resource consumption)/sec cause static resource requests to the server that are likely to cost more than one million times/sec, and the rate limit is likely to limit normal requests with low resource consumption , And missed the high resource consumption attack request.

The third method is to block the historical blacklist of network traffic. There are many devices behind the export IP. If the attack source is behind the export IP, once these IPs are blacklisted as historical attack blacklists, the normal devices behind it will be accidentally injured on a large scale. At present, most of the attack sources of DDoS attacks are not the attacker's own, but exploit the vulnerabilities of normal equipment, or the normal equipment is installed with risky software to become the attack source. The ban on them is likely to cause misunderstanding of normal spontaneous traffic. Sealing; if the attack cannot be suppressed, the effect is extremely small. Due to the regular replacement of IP defense strategies of operators, frequent changes in the location of mobile attack sources and IP changes, historical blacklists often cover a low percentage of attack traffic, and the resource consumption caused by attack traffic often far exceeds that of the target server. Withstandability, blocking part of the attack traffic does not suppress the attack. Disadvantages: small effect, uncontrollable accidental injury.

Method four, manual intervention in packet capture analysis. From the discovery of an attack on the server, manual intervention to capture packets, to feature analysis, to excluding normal business features, and to adding defense strategies, the entire emergency process often takes more than half an hour, and half an hour of business interruption is for most websites Great influence. Disadvantages: slow response to manual intervention.

In view of the technical problems existing in the DDoS attack defense in the prior art, in some exemplary embodiments of this application, the traffic log data in the current period is acquired; the abnormal behavior detection is performed on the traffic log data in the current period, and when the current period is determined When there is abnormal behavior in the network traffic within the network, determine whether the generated first defense strategy exists in the defense strategy library; if it exists, use the existing first defense strategy to perform data processing on the network traffic in the subsequent period; if not, use It is known that the second defense strategy generated by normal traffic performs data processing on the network traffic in the subsequent period. The embodiment of this application adopts the combination of the second defense strategy set for normal traffic and the first defense strategy set for abnormal traffic. It guarantees that the source server will not be overwhelmed by the attack at the first time. On the other hand, the guarantee has a small impact on current normal traffic.

The technical solutions provided by the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

FIG. 1a is a schematic structural diagram of a defense system 10 provided by an embodiment of this application. As shown in FIG. 1a, the defense system 10 includes: a defense strategy calculation device 11 and a defense execution device 12. FIG. 1a also shows the request end device 30 and the data source end device 20 that cooperate with the defense system 10 in practical applications. In practical applications, the defense system 10 acts as an intermediate device between the requesting end device 30 and the data source end device 20 to detect whether the data source end device 20 is attacked by network traffic, and when the data source end device 20 is attacked by the network traffic The access request flow of the requesting end device 30 is flow controlled, so that the source end device can provide good defense performance when it suffers from a DDoS attack, and ensure the normal operation of the data source end device 20.

In this embodiment, the requesting device 30 may be a browser or other application program installed on a computer device or a handheld smart terminal device; the data source device 20 may be a server that provides data support, computing services, and some management services. In this embodiment, the implementation form of the data source device 20 is not limited. For example, the data source device 20 may be a server device such as a conventional server, a cloud server, a cloud host, and a virtual center. Among them, the composition of the server equipment mainly includes a processor, a hard disk, a memory, a system bus, etc., and a general computer architecture type. The data source device 20 may include one website server or multiple website servers. The user can access the network data of the data source device 20 through the requesting device 30.

In this embodiment, the communication connection mode between the defense strategy calculation device 11 and the defense execution device 12 depends on the actual deployment mode. In practice, the defense strategy calculation device 11 and the defense execution device 12 may be deployed on the same server, or may be deployed on different servers. The defense strategy calculation device 11 and the defense execution device 12 may be one computer or a computer cluster.

When the defense strategy calculation device 11 and the defense execution device 12 are deployed on the same server, the two can communicate through the corresponding hardware interface or software interface on the server. When the defense strategy calculation device 11 and the defense execution device 12 are deployed on different servers, the two can be connected through wired or wireless communication. For example, the communication connection is through the wireless/wired switch in the local area network, or the communication connection is through the mobile network. When connected through mobile network communication, the network standard of the mobile network can be 2G (GSM), 2.5G (GPRS), 3G (WCDMA, TD-SCDMA, CDMA2000, UTMS), 4G (LTE), 4G+ (LTE+), WiMax Any of these. Optionally, when the defense strategy calculation device 11 and the defense execution device 12 are deployed on different servers in the same computer room or cabinet, the two can also communicate through short-distance communication methods such as Bluetooth, ZigBee, and infrared. This is not limited.

It should be noted that this embodiment does not limit the implementation form of the server used to deploy the defense policy calculation device 11 and the defense execution device 12, and may be server devices such as conventional servers, cloud servers, cloud hosts, and virtual centers. Among them, the structure of the server device mainly includes a processor, a hard disk, a memory, a system bus, etc., and is similar to a general computer architecture.

In the defense system 10 of this embodiment, the protection execution device 12 performs data processing on the data access request of the requesting device 30 and generates traffic log data, and the protection execution device 12 sends the generated log data to the defense strategy calculation device 11 in time intervals. ; The defense strategy calculation device 11 receives the log data in each period sent by the defense execution device 12, and each time it receives the traffic log data in a period, it can analyze the received traffic log data in two aspects, on the one hand Abnormal traffic detection and analysis, on the other hand, attack detection and analysis.

For ease of description, this embodiment takes the traffic log data in the current period as an example to expand the description. After the defense strategy calculation device 11 receives the traffic log data in the current period sent by the protection execution device 12, on the one hand, it can perform abnormal traffic detection based on the traffic log data in the current period. If abnormal traffic is detected, it can be targeted at the current period. The abnormal traffic detected in the current period generates the first defense strategy; on the other hand, it can detect whether the network traffic in the current period has abnormal behaviors based on the traffic log data in the current period. If the network traffic in the current period is detected as abnormal behavior , The defense execution device 12 may be provided with a defense strategy, so that the defense execution device 12 can perform data processing on the network traffic in the subsequent period according to the defense strategy provided by the defense strategy calculation device 11. The data processing here mainly refers to defensive processing to ensure the security of the data source device 20.

The defense strategy provided by the defense strategy calculation device 11 to the defense execution device 12 may be the first defense strategy or the second defense strategy. The first defense strategy is generated for the abnormal traffic that has been identified before the current moment, which can be referred to as the real-time defense strategy; the second defense strategy is generated for the normal traffic that has been identified before the current moment, and can be called the default defense strategy . Among them, the second defense strategy may be generated in advance based on normal traffic log data in the historical period. Further optionally, when new normal traffic log data appears, the second defense strategy may be updated based on the newly appeared normal traffic log data. The current moment refers to the moment when the protection execution device 12 determines that the network traffic in the current period has abnormal behavior.

In this embodiment, the defense strategy calculation device 11 will analyze the abnormal traffic based on the traffic log data in each time period, and will generate a first defense strategy based on the abnormal traffic data identified in each time period. These first defense strategies can have certain timeliness, and the corresponding defense strategies can be deleted after the effective time is over. In addition, in this embodiment, it is not limited that the defense strategy calculation device 11 performs abnormal traffic detection based on the traffic log data in the current period, and the defense strategy calculation device 11 detects abnormal traffic based on the traffic log data in the current period. Whether the network traffic has abnormal behaviors in the order of execution between operations, the two operations can be executed in parallel, of course, can also be executed sequentially. When the two operations are executed in parallel, it is possible to detect abnormal behavior first. Based on the above analysis, the above-mentioned abnormal traffic that has been identified before the current time may include: the abnormal traffic identified according to the traffic log data in the current period (abbreviated as the abnormal traffic identified in the current period), or the abnormal traffic identified in the current period The abnormal traffic identified by the traffic log data in at least one period before (abbreviated as the abnormal traffic identified in at least one period before the current period), of course, may also be included in the current period and at least one period before the current period Identified abnormal traffic. Correspondingly, the aforementioned first defense strategy that has existed before the current time may include: a defense strategy generated for abnormal traffic identified in the current period, or may include a defense strategy for abnormal traffic identified at least one period before the current period. The generated defense strategy, of course, may also include a defense strategy generated for abnormal traffic identified in the current period and a defense strategy generated for abnormal traffic recognized at least one period before the current period.

This embodiment does not limit the time length of each time period, and the time length of each time period may be the same or different, and may be set adaptively according to application requirements. Among them, the smaller the time length of each period, the higher the real-time performance of generating the first defense strategy and determining whether the data source device 20 is attacked.

Optionally, in this embodiment, a strategy library can be used to manage each defense strategy, for example, the second defense strategy and the first defense strategy can be put into the strategy database. When detecting that the data source device 20 is under attack, the defense strategy calculation device 11 issues the first defense strategy and the second defense strategy in the strategy library to the defense execution device 12, so that the protection execution device 12 can use the received first defense strategy according to the received first defense strategy. The defense strategy or the second defense strategy performs data processing on the network traffic in the subsequent period.

In this embodiment, when the protection defense strategy calculation device 11 detects that the data source device 20 is attacked, if there is no first defense strategy in effect locally, the second defense strategy can be first issued to the protection execution device 12. After the new first defense strategy is generated, the new first defense strategy is issued to the protection execution device 12. At this time, the second defense strategy is automatically invalidated.

It should be noted that the detection of the defense strategy calculation device 11 has a delay. When the defense strategy calculation device 11 detects that the data source device 20 is attacked, it is possible that the data source device 20 has been attacked for a short time. Optionally, the second defense strategy can be set to always take effect. In this way, for the protection execution device 12, if there is no first defense strategy, the second defense strategy can always be used to defend network traffic. In the case of the first defense strategy, the first defense strategy is preferred. Defensive processing of network traffic, the second defense strategy automatically fails.

Optionally, considering that traffic attacks generally change dynamically, the effective time period can be set for the first defense strategy. Within the effective time period, the first defense strategy can play a role. After the effective time period ends, the first defense strategy can be delete. It is worth noting that the same effective duration may be set for different first defense strategies, or different effective durations may be set for different first defense strategies. Based on this, when the defense strategy calculation device 11 detects that the data source device 20 is attacked, it can combine the first defense strategy that exists and is in effect before the current moment and the first defense strategy that exists and is in effect before the current moment. The effective duration corresponding to the policy is issued to the protection execution device 12, so that the protection execution device 12 performs data processing on the network traffic in the subsequent period according to the received first defense strategy within the corresponding effective duration. Optionally, the effective duration of the first defense strategy can also be dynamically set according to the time period during which the data source device 20 is attacked; the first defense strategy can be set to detect that the data source device 20 is attacked by the protection defense strategy computing device 11 Failure during an attack, or failure in a set time period after the protection defense strategy calculation device 11 detects that the data source device 20 is attacked. Setting the effective duration of the first defense strategy is conducive to allowing the first defense strategy to function during traffic attacks, and it becomes invalid during non-traffic attacks, which helps reduce the adverse impact of the first defense strategy on normal traffic.

In the embodiments of the present application, the specific implementation of the second defense strategy is not limited. For example, one achievable way of the second defense strategy is: the target rate limit strategy, that is, the target rate limit is performed on the traffic other than the normal traffic, which can make the second defense strategy have as little impact on the normal traffic as possible, The abnormal traffic coverage is as large as possible. For another example, an achievable way of the second defense strategy is: source rate limiting, that is, after detecting abnormal behavior of network traffic in the current period, all subsequent network traffic is subjected to rate limiting processing. For another example, one achievable way of the second defense strategy is: historical black and white list rate limit, that is, after detecting abnormal behavior of network traffic in the current period, block the traffic in the blacklist in subsequent traffic deal with. For another example, an achievable way of the second defense strategy is: area control, that is, rate limiting or blocking the access request of the requesting device in a specific area. For another example, an achievable way of the second defense strategy is: precise access control and source count access control, that is, access permission setting and access frequency restriction are performed on the access request from the requesting end device. Obviously, the second defense strategy is not limited to the foregoing implementation manners, and the second defense strategy may be one or more of the foregoing implementation manners, or may be other forms of defense strategies.

Optionally, after receiving the traffic log data in the current period, the defense strategy calculation device 11 may also update the second defense strategy according to the traffic log data in the current period to minimize the impact on normal traffic as much as possible. Optionally, the update operation can be performed when it is detected that the data source device 20 has not been attacked. In this case, the traffic log data in the current period mainly contains log data of normal traffic, which is suitable for the second The defense strategy is updated; when it is detected that the data source device 20 is under attack, on the one hand, because the traffic log data in the current period contains a large amount of abnormal data, it interferes with the judgment of normal traffic and is not suitable for the second defense The strategy is updated. On the other hand, resources can also be prioritized for issuing corresponding defense strategies to the protection execution device 12. The efficiency of the defense strategy issuance is convenient for timely defense processing of subsequent network traffic.

In the foregoing or following embodiments of the present application, the first defense strategy is generated based on the identified abnormal traffic, and the first defense strategy is more targeted, which is conducive to more comprehensive coverage of abnormal traffic and ensures the security of the data source device. Different first defense strategies can be set for different abnormal traffic. For example, a first defense strategy is a blocking defense strategy, that is, blocking abnormal traffic. For another example, a first defense strategy is a rate limiting defense strategy, that is, rate limiting on abnormal traffic. Obviously, the second defense strategy and the first defense strategy are not limited to the above implementations.

FIG. 1b is a schematic diagram of the working principle of the defense system 10 provided by another embodiment of the application. As shown in Figure 1b, on the one hand, the protection execution device 12 adopts a locally in effect defense strategy to perform defense processing on the received network traffic, and sends the network traffic after the defense processing to the data source device 20; on the other hand, The log data in the current time period will be sent to the protection defense strategy calculation device 11 to provide a data basis for the protection defense strategy calculation device 11.

As shown in Figure 1b, the protection defense strategy calculation device 11 (stream computing cluster) can process the traffic log data in the current period in three aspects: On the one hand, it can update the second defense strategy based on the traffic log data in the current period; On the other hand, abnormal traffic detection can be performed based on the traffic log data in the current period. If abnormal traffic is detected, the first defense strategy can be generated for the abnormal traffic detected in the current period; on the other hand, it can be based on the current period The traffic log data in the current period of time detects whether there is abnormal behavior in the network traffic during the current period. If abnormal behavior is detected in the network traffic in the current period, the defense execution device 12 can be provided or issued a defense strategy for the protection execution device 12 to receive The obtained defense strategy performs data processing on the network traffic in the subsequent period. For the detailed description of the above-mentioned three aspects of processing, please refer to the detailed description in the foregoing embodiment or subsequent embodiments, which will not be repeated here. Specifically, you can collect micro-batch data from real-time log data, then perform data filtering, feature extraction, baseline training, and then perform anomaly detection based on baseline parameters, or directly perform feature extraction on the data collected by micro-batch data. Then perform anomaly detection. Further, it can be determined whether it is under attack, and if it is under attack, the strategy is pushed, where the pushed strategy can be determined from a set of backup strategies. The set of backup strategies includes a default defense strategy and a real-time defense strategy. The pushed policy may be a policy set, and the policy set may carry matching conditions, execution actions, and effective duration.

As shown in Figure 1b, the protection execution equipment of this application includes but is not limited to the following defense strategy execution modules: black and white list library module, area control module, precise access control and source count access control module, and speed limit module. Each defense strategy execution module is responsible for implementing a type of defense strategy. For real-time access requests, based on the black and white list library module, area control module, precise access control and source count access control module, and speed limit module, the black and white list library data processing can be performed on the data access request from the requesting device 30, respectively. Area control data processing, precise access control and source count access control data processing and source rate limit and destination rate limit data processing, that is, determine whether to release through these modules, if not released, discard, and send the final release request to the data Source device. After the protection execution device receives the corresponding defense strategy issued by the defense strategy calculation device, it selects the module corresponding to the defense strategy from the modules of the protection execution device to configure the parameters; to access the data of the requesting device in the subsequent period Request corresponding data processing.

In some embodiments of the present application, the second defense strategy is generated based on historical traffic log data. One possible way is to filter out abnormal log data in historical traffic log data to obtain log data of normal traffic; analyze the baseline characteristics of normal traffic based on the log data of normal traffic; and analyze the baseline characteristics of normal traffic based on the baseline characteristics of normal traffic. The target field characteristics in the generated second defense strategy. Among them, the amount of historical traffic log data can be adjusted according to the actual situation. For example, select the traffic log data of the past month or one year, or filter the traffic log data of certain days from the traffic log data of one year as the Historical traffic log data.

In the foregoing embodiment, the abnormal log data in the historical traffic log data is filtered to obtain the log data of the normal traffic, including but not limited to the following implementation methods:

Method 1: Obtain the response status code of the historical data request according to the historical traffic log data, obtain the log data corresponding to the abnormal response status code, and filter the log data. For example, when the response status code in a piece of log data is 4××, 5××, it means that the log data is abnormal log data.

Method 2: If the historical traffic log data in a certain period of time is within the period of time when the data source end device is attacked, all log data in this period of time will be filtered as abnormal log data.

Method 3: Obtain the response status code of the historical data request according to the historical traffic log data of a certain period, and calculate the proportion of abnormal response status code. When the proportion of abnormal response status code is greater than the set proportion threshold, the All log data in this period are filtered as abnormal log data.

It should be noted that the foregoing implementation manner may be a single setting or multiple combinations of settings; this application does not limit the foregoing set ratio threshold, and the foregoing set ratio threshold can be adjusted according to actual conditions.

In the foregoing or following embodiments of the present application, after the log data of the normal traffic is obtained, the baseline characteristics of the normal traffic can be analyzed based on the log data of the normal traffic. An achievable way is to extract field characteristics from the log data of normal traffic, and calculate the distribution baseline parameters of the field characteristics as the baseline characteristics of the normal traffic. Among them, the field characteristics include but are not limited to at least one of the following fields: HTTP protocol standard fields (such as uri, referer, etc.), website custom fields, field order, and fields obtained by secondary processing of fields (such as uri parsing) Query key etc.). The distribution baseline parameters of the field characteristics include but are not limited to at least one of the following: the proportion of the field characteristics, the frequency of the field characteristics request, and the correlation of the field characteristics combination.

In the foregoing embodiment, the second defense strategy is generated according to the target field characteristics in the baseline characteristics of normal traffic. An achievable way is to analyze the baseline characteristics of normal traffic, filter out the target field characteristics from the field characteristics included in the normal traffic, and generate a second defense strategy for the target field characteristics. For example, from the field features included in normal traffic, a field feature whose baseline feature is greater than the baseline feature threshold is identified as the target field feature. Combining the characteristics of the target field, an implementation manner of the second defense strategy is to limit the rate of traffic that does not contain the characteristics of the target field.

In the foregoing embodiment, after the protection strategy calculation device obtains the traffic log data in the current time period, it may also update the second defense strategy according to the traffic log data in the current time period. An achievable update method is to identify normal flow log data from the flow log data in the current period, and update the baseline characteristics of the normal flow based on the identified normal flow log data; analyze the updated baseline characteristics from The new target field characteristics are filtered out of the field characteristics contained in the new normal traffic identified; if the new target field characteristics are the same as the original target field characteristics, the original second defense strategy will not be updated; if it is new If the target field characteristics of is different from the original target field characteristics, a new second defense strategy is generated according to the new target field characteristics, and the new second defense strategy is used to supplement the original second defense strategy.

In some embodiments of the present application, after acquiring the traffic log data in the current period, the protection defense strategy calculation device analyzes the traffic log data in the current period to generate the first defense strategy. An achievable way is to analyze the characteristics of the network traffic in the current period based on the traffic log data in the current period; identify the current period memory based on the characteristics of the network traffic in the current period and the baseline characteristics of known normal traffic Existing abnormal traffic; According to the characteristics of the abnormal traffic in the current period, generate the first defense strategy against the abnormal traffic in the current period.

In the above embodiment, the characteristics of the network traffic in the current period are analyzed based on the traffic log data in the current period. An alternative embodiment is to extract the field characteristics from the traffic log data in the current period and calculate the field The characteristic distribution parameter is used as the characteristic of the network traffic in the current period. Among them, the field characteristics include but are not limited to at least one of the following fields: HTTP protocol standard fields (such as uri, referer, etc.), website custom fields, field order, and fields obtained by secondary processing of fields (such as uri parsing) Query key etc.). The distribution parameters of the field characteristics include but are not limited to at least one of: the proportion of the field characteristics, the frequency of field characteristics request, and the correlation of the combination of field characteristics.

In the foregoing embodiment, the abnormal traffic in the current period is identified based on the characteristics of the network traffic in the current period and the baseline characteristics of the known normal traffic. Including but not limited to at least one of the following implementations:

Method 1: Compare the distribution parameters of the field characteristics of the network traffic in the current period with the distribution baseline parameters of the existing field characteristics, and calculate the proportion change rate of the corresponding field characteristics, and the proportion change rate is greater than the set change rate threshold The network traffic corresponding to the field characteristics is regarded as the abnormal traffic in the current period.

Method 2: Compare the distribution parameters of the field characteristics of the network traffic in the current period with the distribution baseline parameters of the existing field characteristics, and calculate the request frequency growth rate of the corresponding field characteristics, and make the request frequency growth rate greater than the set growth rate The network traffic corresponding to the field characteristics of the threshold is regarded as the abnormal traffic existing in the current period.

It should be noted that this application does not limit the set rate of change threshold and the set growth rate threshold, and the set rate of change threshold and the set growth rate threshold can be adjusted according to actual conditions.

In the above embodiment, after identifying the abnormal traffic existing in the current period, the first defense strategy against the abnormal traffic existing in the current period is generated according to the characteristics of the abnormal traffic existing in the current period. Optionally, the new first defense strategy is a defense strategy for blocking traffic with characteristics of constant traffic.

In some embodiments of the present application, after obtaining the traffic log data in the current period, judging whether the network traffic in the current period has abnormal behavior according to the traffic log data in the current period includes at least one of the following methods:

Method 1: Obtain the request frequency of data requests in the current time period based on the log data in the current time period. When the request frequency is greater than the first threshold, it is determined that the network traffic in the current time period has abnormal behavior;

Method 2: According to the log data in the current period, obtain the abnormal proportion of the response status code of the data request in the current period. When the abnormal proportion of the response status code is greater than the second threshold, it is determined that the network traffic in the current period has abnormal behavior;

Method 3: Obtain the growth rate of the number of data requests in the current period relative to the previous period according to the log data in the current period. When the growth rate is greater than the third threshold, it is determined that the network traffic in the current period has abnormal behavior.

The above three methods can be used solely as the judgment condition for abnormal behavior of network traffic in the current period, or any two methods or three methods among the three methods can be used as the abnormal behavior of network traffic in the current period. Analyzing conditions. Among them, the present application does not limit the first threshold, the second threshold, and the third threshold, and the first threshold, the second threshold, and the third threshold can be adjusted according to actual conditions.

In an optional embodiment, after the second defense strategy is updated and the new first defense strategy is generated, the updated second defense strategy and the new first defense strategy are put into the strategy database and are Each first defense strategy is set with a corresponding effective duration, where the second defense strategy is always effective, but automatically becomes invalid when the first defense strategy appears. Based on this, after receiving the traffic log data in the current period, it can be determined from the traffic log data in the current period that there is abnormal behavior in the network traffic in the current period. If the result of the judgment is that there is abnormal behavior, then determine whether there is abnormal behavior in the policy database There is the first defense strategy in effect; if it exists, the network traffic in the subsequent period is processed according to the first defense strategy in effect in the strategy database; if it does not exist, the data processing is performed according to the second defense strategy in the strategy database. Data processing is performed on the network traffic in the subsequent period. Combined with the above system embodiment, the data processing of the network traffic in the subsequent period according to the first defense strategy or the second defense strategy in effect in the strategy database mainly means that the protection execution device 12 is in effect according to the strategy database. The first defense strategy or the second defense strategy in, performs data processing on the network traffic in the subsequent period. Of course, according to different application scenarios or system architectures, the devices that perform data processing on the network traffic in the subsequent period according to the first defense strategy or the second defense strategy in effect in the strategy library will also be different. The embodiment of the application adopts the combination of the second defense strategy and the first defense strategy. On the one hand, it ensures that the source server is not overwhelmed by the attack at the first time of the attack, and on the other hand, it ensures that the impact on the current normal access request is minimal.

The following is a further explanation of this application in combination with other application scenarios:

In some other application scenarios of this application, the protection execution device 12 obtains the database operation log data in the current period, and uploads the obtained database operation log data in the current period to the defense strategy computing device 11, and the database operation log data reflects The characteristics of the database operation traffic in the current period; the defense strategy calculation device 11 detects whether there is data leakage in the current period and whether there is abnormal database operation traffic in the current period according to the received database operation log data in the current period, and the defense strategy calculation device 11 When data leakage is detected in the current period, it is judged whether there is a first defense strategy. The first defense strategy is generated for abnormal database operation traffic that has been identified before the current time; if it exists, based on the existing first defense strategy. The first defense strategy performs data processing on the database operation traffic in the subsequent period; if it does not exist, the second defense strategy performs data processing on the database operation traffic in the subsequent period. The second defense strategy is based on the normality that has been identified before the current time. Generated by database operation traffic.

In the above-mentioned application scenario of the present application, the defense strategy calculation device 11 issues the existing first defense strategy to the defense execution device 12 on the database operation traffic channel, so that the defense execution device 12 can perform the protection according to the existing first defense strategy. Data processing is performed on the database operation traffic in the subsequent period. The defense strategy calculation device 11 sends the generated second defense strategy to the defense execution device 12 on the database operation traffic channel, so that the defense execution device 12 performs database operation traffic in the subsequent period according to the existing second defense strategy. data processing. Among them, the embodiment of the present application does not limit the data processing method of the database operation flow.

In the above application scenario of this application, the data leakage behavior in the current period is determined according to the database operation log data in the current period, including but not limited to the following methods:

Method 1: According to the database operation log data in the current period, obtain the number of query data entries in the current period. When the number of query data entries is greater than the first number threshold, the database operation log data in the current period determines that there is data in the current period Leaking behavior

Method 2: According to the database operation log data in the current period, the number of query data bytes in the current period is obtained. When the number of query data bytes is greater than the second number threshold, the database operation log data in the current period determines the current period memory The act of data breach.

In the above-mentioned application scenario of this application, the first defense strategy is generated for abnormal database operation traffic that has been identified before the current moment. The baseline characteristics of database operation log data include but are not limited to the following: query frequency, query interval, number of single query entries, single query result entries, single query result bytes, cumulative query entries, cumulative query The number of result entries and cumulative query result bytes.

In some other application scenarios of this application, the protection execution device 12 obtains the traffic log data in the current period, and uploads the obtained traffic log data in the current period to the defense strategy calculation device 11. The traffic log data reflects the network in the current period The characteristics of the traffic; the defense strategy calculation device 11 detects whether there is abnormal behavior in the current period and whether there is abnormal traffic according to the received traffic log data in the current period. If the defense strategy calculation device 11 determines that the network traffic in the current period has abnormal behavior based on the traffic log data in the current period, it determines whether there is a first defense strategy, and the first defense strategy is for the abnormal traffic that has been identified before the current time. Generated; if it exists, generate first visualization data for the network traffic in the subsequent period according to the existing first defense strategy; if not, generate second visualization data for the network traffic in the subsequent period according to the second defense strategy, first The second defense strategy is generated based on the normal traffic that has been identified before the current moment.

In the above application scenario of this application, the defense strategy calculation device 11 sends the first visualization data to the display terminal, so that the display terminal generates the first display interface according to the first visualization data. Among them, this application does not limit the display content of the first display interface. The display content of the first interface may include, but is not limited to, the following content: abnormal total indicator curve and normal indicator total fluctuation range, abnormal component corresponding indicator and normal fluctuation range comparison table.

In the above-mentioned application scenario of this application, after the defense strategy calculation device 11 generates the second visualization data for the network traffic in the subsequent period according to the second defense strategy, the second visualization data is sent to the display terminal for the display terminal to use The visualization data generates a second display interface. Among them, this application does not limit the display content of the second display interface. The display content of the second interface may include, but is not limited to, the following: current indicator total volume graph and normal indicator total fluctuation range, current indicator chain ratio curve and normal indicator Chain fluctuation range, distribution pie chart of each component, comparison table of current proportion of each component and normal fluctuation range, comparison table of absolute value of each component and normal fluctuation range.

In the above-mentioned application scenarios of this application, the baseline characteristics of traffic log data include but are not limited to the following: absolute value of total index, month-on-month ratio of index compared to the previous cycle, absolute value of each component, proportion of each component, and comparison of each component Chain comparison in the previous cycle.

In addition to the defense system provided above, some embodiments of this application also provide a data processing method. The data processing method provided in this application can be applied to the above defense system, but is not limited to the defense system provided in the above embodiment. Fig. 2a is a schematic flowchart of a data processing method provided by an exemplary embodiment of this application. As shown in Figure 2a, the method includes:

S201: Obtain traffic log data in the current period, where the traffic log data reflects the characteristics of the network traffic in the current period;

S202: Determine whether the network traffic in the current period has abnormal behavior according to the traffic log data in the current period; if there is abnormal behavior, execute step S203; if there is no abnormal behavior, end the attack detection;

S203: Determine whether there is a first defense strategy, the first defense strategy is generated for the abnormal traffic that has been identified before the current moment; if it exists, perform step S204, if not, perform step S205;

S204: Perform data processing on the network traffic in the subsequent period according to the existing first defense strategy;

S205: Perform data processing on the network traffic in the subsequent period according to the second defense strategy, and the second defense strategy is generated based on the normal traffic that has been identified before the current moment.

The method in this embodiment may be executed by a device with a defense function and a certain computing capability, or may be implemented by the protection strategy calculation device and the protection execution device in the foregoing system embodiment. In a scenario where the protection strategy calculation device and the protection execution device are implemented in cooperation, the protection execution device delivers the generated log data to the protection strategy calculation device, and the protection strategy calculation device receives the log data to obtain the log data. Among them, the frequency at which the protection strategy calculation device obtains the log data may be obtained every 1S, 2S, 5S, or 10S according to actual conditions.

In this embodiment, the second defense strategy is generated based on historical traffic log data. One possible way is to filter out abnormal log data in historical traffic log data to obtain log data of normal traffic; analyze the baseline characteristics of normal traffic based on the log data of normal traffic; and analyze the baseline characteristics of normal traffic based on the baseline characteristics of normal traffic. The target field characteristics in the generated second defense strategy. Among them, the amount of historical traffic log data can be adjusted according to the actual situation. For example, select the traffic log data of the past month or one year, or filter the traffic log data of certain days from the traffic log data of one year as the Historical traffic log data.

In the foregoing embodiment, after the log data is acquired, the log data in the current period is analyzed to update the second defense strategy. An achievable update method is to identify the normal flow log data from the flow log data in the current period, and update the baseline characteristics of the normal flow according to the identified normal flow log data; the distribution baseline parameters of the updated field characteristics Perform analysis and filter out the new target field characteristics from the field characteristics included in the identified new normal traffic; if the new target field characteristics are the same as the original target field characteristics, the original second defense strategy will not be used. Update; if the new target field characteristics are different from the original target field characteristics, a new second defense strategy is generated according to the new target field characteristics to update the original second defense strategy.

In the foregoing embodiment, after the traffic log data in the current period is acquired, the traffic log data in the current period can also be analyzed to generate the first defense strategy. An achievable way is to analyze the characteristics of the network traffic in the current period based on the traffic log data in the current period; identify the current period memory based on the characteristics of the network traffic in the current period and the baseline characteristics of known normal traffic Existing abnormal traffic; According to the characteristics of the abnormal traffic in the current period, generate the first defense strategy against the abnormal traffic in the current period.

In the above embodiment, after the abnormal traffic existing in the current period is identified, the first defense strategy against the abnormal traffic existing in the current period is generated according to the characteristics of the abnormal traffic existing in the current period. Optionally, the new first defense strategy is a defense strategy for blocking traffic with characteristics of constant traffic.

In the foregoing embodiment, after obtaining the traffic log data in the current period, judging whether the network traffic in the current period has abnormal behavior according to the traffic log data in the current period includes at least one of the following methods:

After updating the second defense strategy and generating a new first defense strategy, put the updated second defense strategy and the new first defense strategy into the defense strategy library, and set corresponding settings for each first defense strategy The effective duration of the second defense strategy is always effective, but automatically invalidates when the first defense strategy appears. Based on this, after receiving the traffic log data in the current period, it can be determined from the traffic log data in the current period that there is abnormal behavior in the network traffic in the current period. If the judgment result is that there is abnormal behavior, then it is judged whether there is a first Defense strategy; if it exists, perform data processing on the network traffic in the subsequent period according to the first defense strategy that is in effect; if it does not exist, perform data processing on the network traffic in the subsequent period according to the second defense strategy; embodiments of the application Using the combination of the second defense strategy and the first defense strategy, on the one hand, it ensures that the source server is not overwhelmed by the attack at the first time of the attack, and on the other hand, it ensures that the impact on current normal access requests is minimal.

FIG. 3 is a schematic flowchart of another data processing method provided by an exemplary embodiment of this application. As shown in Figure 3, the method includes:

S301: Analyze the characteristics of the network traffic in the current period according to the traffic log data in the current period;

S302: Identify the abnormal traffic in the current period according to the characteristics of the network traffic in the current period and the baseline characteristics of the known normal traffic, where the baseline characteristics of the known normal traffic are obtained from historical traffic log data;

S303: According to the characteristics of the abnormal traffic existing in the current period, generate a first defense strategy for the abnormal traffic existing in the current period to perform data processing on the network traffic in the subsequent period.

FIG. 2b is a schematic flowchart of another data processing method provided by an exemplary embodiment of this application. As shown in Figure 2b, the method includes:

S221: Acquire database operation log data in the current period, where the database operation log data reflects the characteristics of the database operation traffic in the current period;

S222: Determine whether there is a data leakage behavior in the current period according to the database operation log data in the current period; if it exists, perform step S223; if it does not exist, end the data leakage behavior detection;

S223: Determine whether there is a first defense strategy, the first defense strategy is generated for abnormal database operation traffic that has been identified before the current moment; if it exists, perform step S224, if not, perform step S225;

S224: Perform data processing on the database operation traffic in the subsequent period according to the existing first defense strategy;

S225: Perform data processing on the database operation traffic in the subsequent period according to the second defense strategy. The second defense strategy is generated based on the normal database operation traffic that has been identified before the current moment.

In the embodiment of this application, the existing first defense strategy is issued to the protection execution device on the database operation traffic channel, so that the protection execution device can perform the database operation traffic in the subsequent period according to the existing first defense strategy. data processing. The generated second defense strategy is issued to the defense execution device on the database operation traffic channel, so that the defense execution device performs data processing on the database operation traffic in the subsequent period according to the existing second defense strategy. Among them, the embodiment of the present application does not limit the data processing method of the database operation flow.

In the embodiment of the present application, the data leakage behavior in the current period is determined according to the database operation log data in the current period, including but not limited to the following methods:

FIG. 2c is a schematic flowchart of a data processing method provided by an exemplary embodiment of this application. As shown in Figure 2c, the method includes:

S231: Obtain traffic log data in the current time period, where the traffic log data reflects the characteristics of the network traffic in the current time period;

S232: Determine whether there is abnormal behavior in the network traffic in the current period according to the traffic log data in the current period; if there is abnormal behavior, perform step S233; if there is no abnormal behavior, end the abnormal behavior detection;

S233: Determine whether there is a first defense strategy, the first defense strategy is generated for the abnormal traffic that has been identified before the current moment; if it exists, execute step S234, if it does not exist, execute step S235;

S234: Generate first visualization data for network traffic in the subsequent period according to the existing first defense strategy;

S235: Generate second visual data for network traffic in the subsequent period according to the second defense strategy, where the second defense strategy is generated based on the normal traffic that has been identified before the current moment.

In the embodiment of the present application, the first visualization data is sent to the display terminal for the display terminal to generate the first display interface according to the first visualization data. Among them, this application does not limit the display content of the first display interface. The display content of the first interface may include, but is not limited to, the following content: abnormal total indicator curve and normal indicator total fluctuation range, abnormal component corresponding indicator and normal fluctuation range comparison table.

In the embodiment of the present application, after generating the second visualization data for the network traffic in the subsequent period according to the second defense strategy, the second visualization data is sent to the display terminal for the display terminal to generate the second display based on the second visualization data interface. Among them, this application does not limit the display content of the second display interface. The display content of the second interface may include, but is not limited to, the following: current indicator total volume graph and normal indicator total fluctuation range, current indicator chain ratio curve and normal indicator Chain fluctuation range, distribution pie chart of each component, comparison table of current proportion of each component and normal fluctuation range, comparison table of absolute value of each component and normal fluctuation range.

In the embodiments of this application, the baseline characteristics of the traffic log data include but are not limited to the following: absolute value of the total index, the month-on-month ratio of the index compared to the previous cycle, the absolute value of each component, the proportion of each component, and the comparison of each component. Cycle to cycle.

This embodiment is a data processing method described based on the generation of the first defense strategy. The steps in this embodiment are described in detail in the embodiments of the foregoing data processing method. According to the foregoing embodiments of the data processing method, the embodiment of the data processing method can be obtained and the corresponding beneficial effects can be obtained. This will not be repeated here.

Fig. 4 is a schematic structural diagram of a data processing device provided by an exemplary embodiment of this application. As shown in FIG. 4, the data processing device includes a memory 401 and a processor 402, and also includes necessary components of a communication component 403 and a power supply component 404.

The memory 401 is used to store computer programs and can be configured to store other various data to support operations on the data processing device. Examples of such data include instructions for any application or method operating on the data processing device.

The memory 401 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable Programmable read only memory (EPROM), programmable read only memory (PROM), read only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

The communication component 403 is used to establish a communication connection with other devices.

The processor 402 can execute the computer instructions stored in the memory 401 to obtain the traffic log data in the current period, the traffic log data reflects the characteristics of the network traffic in the current period; if based on the traffic log data in the current period Determine whether there is abnormal behavior in network traffic during the current period, and determine whether there is a first defense strategy. The first defense strategy is generated for abnormal traffic that has been identified before the current moment; if it exists, based on the existing first defense strategy Perform data processing on the network traffic in the subsequent period; if it does not exist, perform data processing on the network traffic in the subsequent period according to the second defense strategy, which is generated based on the normal traffic that has been identified before the current moment.

Optionally, the processor 402 may also be used to: analyze the characteristics of the network traffic in the current period according to the traffic log data in the current period; and to identify the characteristics of the network traffic in the current period and the baseline characteristics of known normal traffic The abnormal traffic existing in the current period is generated; according to the characteristics of the abnormal traffic existing in the current period, the first defense strategy against the abnormal traffic existing in the current period is generated.

Optionally, when the processor 402 performs data processing on the network traffic in the subsequent period according to the existing first defense strategy, it is specifically configured to: issue the existing first defense strategy to the protection execution on the network traffic channel The device is used for the protection execution device to perform data processing on the network traffic in the subsequent period according to the existing first defense strategy.

Optionally, the processor 402 may be further configured to: issue the effective duration corresponding to the existing first defense strategy to the protection execution device, so that the protection execution device can perform the following actions according to the existing first defense strategy within the effective duration. Data processing is performed on the network traffic during the period.

The first defense strategy The first defense strategy Optionally, the processor 402 can also be used to filter out abnormal log data in the traffic log data in the historical period to obtain log data of normal traffic; according to the log data of normal traffic, Analyze the baseline characteristics of normal traffic; generate a second defense strategy based on the target field characteristics in the baseline characteristics of normal traffic.

Optionally, when the processor 402 performs data processing on the network traffic in the subsequent period according to the second defense strategy, it is specifically configured to: issue the generated second defense strategy to the defense execution device on the network traffic channel to The protection execution device performs data processing on the network traffic in the subsequent period according to the generated second defense strategy.

Optionally, when the processor 402 determines that the network traffic in the current period has abnormal behavior based on the traffic log data in the current period, the processor 402 includes at least one of the following: according to the log data in the current period, the request for acquiring the data in the current period When the request frequency is greater than the first threshold, it is determined that the network traffic in the current period has abnormal behavior; according to the log data in the current period, the abnormal proportion of the response status code of the data request in the current period is obtained, and in the response state When the code abnormal ratio is greater than the second threshold, it is determined that the network traffic in the current period has abnormal behavior; according to the log data in the current period, the number of data requests in the current period is obtained relative to the growth rate of the previous period. When it is greater than the third threshold, it is determined that the network traffic in the current period has abnormal behavior.

Correspondingly, the embodiment of the present application also provides a computer-readable storage medium storing a computer program. When the computer-readable storage medium stores a computer program, and the computer program is executed by one or more processors, the one or more processors are caused to execute each step in the method embodiment of FIG. 2a.

In the above data processing device and storage medium embodiments, the traffic log data in the current period is acquired; the abnormal behavior detection is performed on the traffic log data in the current period, and when it is determined that the network traffic in the current period has abnormal behavior, the defense strategy is determined Whether there is a generated first defense strategy in the database; if it exists, use the existing first defense strategy to perform data processing on the network traffic in the subsequent period; if not, use the second defense strategy generated by known normal traffic to perform data processing on the subsequent period Data processing is performed on the network traffic within the time period. This application adopts the combination of the second defense strategy and the first defense strategy. On the one hand, it ensures that the source server is not overwhelmed by the attack at the first time, and on the other hand, it guarantees the impact on current normal access requests The smallest.

Fig. 5 is a schematic structural diagram of a data processing device provided by an exemplary embodiment of this application. As shown in FIG. 5, the data processing device includes a memory 501 and a processor 502, and also includes necessary components of a communication component 503 and a power supply component 504.

The memory 501 is used to store computer programs, and can be configured to store other various data to support operations on the data processing device. Examples of such data include instructions for any application or method operating on the data processing device.

The memory 501 can be implemented by any type of volatile or non-volatile storage device or their combination, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable Programmable read only memory (EPROM), programmable read only memory (PROM), read only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

The communication component 503 is used to establish a communication connection with other devices.

The processor 502 can execute the computer instructions stored in the memory 501 for: analyzing the characteristics of the network traffic in the current period according to the traffic log data in the current period; according to the characteristics of the network traffic in the current period and the known normal Baseline characteristics of traffic to identify abnormal traffic in the current period. Among them, the baseline characteristics of known normal traffic are obtained from historical traffic log data; according to the characteristics of abnormal traffic in the current period, generate memory for the current period The first defense strategy for abnormal traffic in the current period; the first defense strategy for data processing of network traffic in the subsequent period.

Correspondingly, the embodiment of the present application also provides a computer-readable storage medium storing a computer program. When the computer-readable storage medium stores a computer program, and the computer program is executed by one or more processors, the one or more processors are caused to execute each step in the method embodiment in FIG. 3.

Fig. 6 is a schematic structural diagram of a data processing device provided by an exemplary embodiment of this application. As shown in FIG. 6, the data processing device includes a memory 601 and a processor 602, and also includes necessary components of a communication component 603 and a power supply component 604.

The memory 601 is used to store computer programs and can be configured to store other various data to support operations on the data processing device. Examples of such data include instructions for any application or method operating on the data processing device.

The memory 601 can be implemented by any type of volatile or non-volatile storage devices or their combination, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable Programmable read only memory (EPROM), programmable read only memory (PROM), read only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

The communication component 603 is used to establish a communication connection with other devices.

The processor 602 can execute the computer instructions stored in the memory 601 to obtain the database operation log data in the current period. The database operation log data reflects the characteristics of the database operation flow in the current period; The database operation log data in the database determines that there is data leakage in the current period, and determines whether there is a first defense strategy, which is generated for abnormal database operation traffic that has been identified before the current time; if it exists, Perform data processing on the database operation traffic in the subsequent period according to the existing first defense strategy; if not, perform data processing on the database operation traffic in the subsequent period according to the second defense strategy, which is based on the current Generated by normal database operation traffic that has been identified before the time.

Optionally, when the processor 602 performs data processing on the database operation traffic in the subsequent period according to the existing first defense strategy, it is specifically configured to: issue the existing first defense strategy to the database operation traffic channel The protection execution device is used for the protection execution device to perform data processing on the database operation traffic in the subsequent period according to the existing first defense strategy.

Optionally, when the processor 602 performs data processing on the network traffic in the subsequent period according to the second defense strategy, it is specifically configured to: deliver the generated second defense strategy to the protection execution device on the database operation traffic channel, This allows the protection execution device to perform data processing on the database operation traffic in the subsequent period according to the existing second defense strategy.

Optionally, when the processor 602 determines that there is a data leakage behavior in the current period according to the database operation log data in the current period, the processor 602 includes at least one of the following: obtaining query data in the current period according to the database operation log data in the current period The number of entries. When the number of query data entries is greater than the first number threshold, the database operation log data in the current period determines that there is data leakage in the current period; according to the database operation log data in the current period, the query data in the current period is obtained The number of bytes, when the number of query data bytes is greater than the second number threshold, the database operation log data in the current period determines that there is a data leakage behavior in the current period.

In the above embodiments of the data processing device and storage medium, the database operation log data in the current period is acquired; the data leakage behavior detection is performed on the database operation log data in the current period. When it is determined that there is a data leakage behavior in the current period, the defense is determined Whether there is a generated first defense strategy in the strategy database; if it exists, use the existing first defense strategy to perform data processing on the database operation traffic in the subsequent period; if not, use the second defense strategy to perform data processing on the database operation traffic in the subsequent period Database operation traffic is used for data processing. This application adopts the combination of the second defense strategy and the first defense strategy to reduce the loss caused by data leakage.

Fig. 7 is a schematic structural diagram of a data processing device provided by an exemplary embodiment of this application. As shown in FIG. 7, the data processing device includes: a memory 701 and a processor 702, and also includes necessary components of a communication component 703 and a power supply component 704.

The memory 701 is used to store computer programs, and can be configured to store various other data to support operations on the data processing device. Examples of such data include instructions for any application or method operating on the data processing device.

The memory 701 can be implemented by any type of volatile or non-volatile storage devices or their combination, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable Programmable read only memory (EPROM), programmable read only memory (PROM), read only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

The communication component 703 is used to establish a communication connection with other devices.

The processor 702 can execute the computer instructions stored in the memory 701 to obtain traffic log data in the current period, and the traffic log data reflects the characteristics of the network traffic in the current period; if it is based on the traffic in the current period The log data determines that the network traffic in the current period of time has abnormal behavior, and determines whether there is a first defense strategy. The first defense strategy is generated for the abnormal traffic that has been identified before the current time; if it exists, based on the existing The first defense strategy generates first visualization data for the network traffic in the subsequent period; if not, the second defense strategy generates second visualization data for the network traffic in the subsequent period according to the second defense strategy. Generated by normal traffic that has been identified.

Optionally, after the processor 702 generates the first visualization data for the network traffic in the subsequent period according to the existing first defense strategy, it may also be used to: send the first visualization data to the display terminal for the display terminal A first display interface is generated according to the first visualization data.

Optionally, after the processor 702 generates the second visualization data for the network traffic in the subsequent period according to the second defense strategy, it may also be configured to: send the second visualization data to the display terminal, so that the display terminal can use the second visualization data according to the second The visualization data generates a second display interface.

In some exemplary embodiments of the present application, on the one hand, it can analyze whether there is abnormal traffic in the current period according to the traffic log data in the current period, and in the case of abnormal traffic, generate a first defense strategy for the abnormal traffic; On the one hand, it can perform abnormal behavior detection based on the traffic log data in the current period, and determine whether there is a first defense strategy that has been generated when it is determined that the network traffic in the current period has abnormal behavior; if it exists, use the existing one The first defense strategy generates first visualization data for the network traffic in the subsequent period; if it does not exist, the second defense strategy generated by known normal traffic is used to generate second visualization data for the network traffic in the subsequent period, where the second The defense strategy and the first defense strategy are combined to perform data processing on network traffic, so as to visually display various indicators of abnormal behavior and quickly take defense measures.

The communication components in FIGS. 4 to 7 described above are configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on communication standards, such as WiFi, 2G or 3G, or a combination of them. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component further includes near field communication (NFC) technology, radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, etc. To facilitate short-range communications.

The power supply components in Figures 4 to 7 above provide power for various components of the equipment where the power supply component is located. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the device where the power supply component is located.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

The present invention is described with reference to flowcharts and/or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and/or block in the flowchart and/or block diagram, and the combination of processes and/or blocks in the flowchart and/or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing equipment to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing equipment are generated It is a device that realizes the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device. The device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment. The instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.

In a typical configuration, the computing device includes one or more processors (CPU), input/output interfaces, network interfaces, and memory.

The memory may include non-permanent memory in computer readable media, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer readable media.

Computer-readable media include permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, Magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

It should also be noted that the terms "include", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, product or equipment including a series of elements not only includes those elements, but also includes Other elements that are not explicitly listed, or include elements inherent to this process, method, commodity, or equipment. If there are no more restrictions, the elements defined by the sentence "including a..." do not exclude the existence of other identical elements in the process, method, commodity or equipment that includes the element.

The above descriptions are only examples of this application and are not used to limit this application. For those skilled in the art, this application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included in the scope of the claims of this application.

Claims

A data processing method, including:

Acquiring traffic log data in the current period, where the traffic log data reflects the characteristics of the network traffic in the current period;

If it is determined from the traffic log data in the current period that there is abnormal behavior in the network traffic in the current period, determine whether there is a first defense strategy, and the first defense strategy is generated for the abnormal traffic that has been identified before the current moment;

If it exists, perform data processing on the network traffic in the subsequent period according to the existing first defense strategy;

If it does not exist, data processing is performed on the network traffic in the subsequent period according to the second defense strategy, which is generated based on the normal traffic that has been identified before the current moment.
The method according to claim 1, further comprising:

According to the traffic log data in the current period, analyze the characteristics of the network traffic in the current period;

According to the characteristics of the network traffic in the current period and the baseline characteristics of the known normal traffic, identify the abnormal traffic in the current period;

According to the characteristics of the abnormal traffic existing in the current period, a first defense strategy against the abnormal traffic existing in the current period is generated.
The method according to claim 1, wherein performing data processing on the network traffic in the subsequent period according to the existing first defense strategy comprises:

The existing first defense strategy is issued to the protection execution device on the network traffic channel, so that the protection execution device performs data processing on the network traffic in the subsequent period according to the existing first defense strategy.
The method according to claim 3, further comprising:

The effective duration corresponding to the existing first defense strategy is issued to the protection execution device, so that the protection execution device performs network traffic in the subsequent period according to the existing first defense strategy within the effective duration. data processing.
The method according to claim 1, further comprising:

Filter out abnormal log data in the traffic log data in the historical period to obtain log data of normal traffic;

According to the log data of the normal flow, analyze the baseline characteristics of the normal flow;

The second defense strategy is generated according to the target field characteristics in the baseline characteristics of the normal traffic.
The method according to claim 1, wherein performing data processing on the network traffic in the subsequent period according to the second defense strategy comprises:

The generated second defense strategy is issued to the defense execution device on the network traffic channel, so that the defense execution device performs data processing on the network traffic in the subsequent period according to the generated second defense strategy.
The method according to claim 1, wherein the determining that the network traffic in the current period has abnormal behavior according to the traffic log data in the current period includes at least one of the following:

According to the log data in the current period, obtain the request frequency of data requests in the current period, and when the request frequency is greater than the first threshold, it is determined that the network traffic in the current period has abnormal behavior;

According to the log data in the current period, obtain the abnormal proportion of the response status code of the data request in the current period. When the abnormal proportion of the response status code is greater than the second threshold, it is determined that the network traffic in the current period has abnormal behavior;

According to the log data in the current period, the growth rate of the number of data requests in the current period relative to the previous period is obtained. When the growth rate is greater than the third threshold, it is determined that the network traffic in the current period has abnormal behavior.
A data processing method, including:

According to the traffic log data in the current period, analyze the characteristics of the network traffic in the current period;

According to the characteristics of the network traffic in the current period and the baseline characteristics of the known normal traffic, identify the abnormal traffic in the current period, where the baseline characteristics of the known normal traffic are obtained from historical traffic log data;

According to the characteristics of the abnormal traffic existing in the current period, a first defense strategy for the abnormal traffic existing in the current period is generated to perform data processing on the network traffic in the subsequent period.
A data processing method, including:

Acquiring database operation log data in the current period, where the database operation log data reflects the characteristics of the database operation traffic in the current period;

If it is determined based on the database operation log data in the current period that there is a data leakage behavior in the current period, determine whether there is a first defense strategy, which is generated for abnormal database operation traffic that has been identified before the current time ；

If it exists, perform data processing on the database operation traffic in the subsequent period according to the existing first defense strategy;

If it does not exist, perform data processing on the database operation traffic in the subsequent period according to the second defense strategy, which is generated based on the normal database operation traffic that has been identified before the current moment.
The method according to claim 9, wherein the data processing of the database operation traffic in the subsequent period according to the existing first defense strategy comprises:

The existing first defense strategy is issued to the protection execution device on the database operation traffic channel, so that the protection execution device performs data processing on the database operation traffic in the subsequent period according to the existing first defense strategy.
The method according to claim 9, wherein performing data processing on the network traffic in the subsequent period according to the second defense strategy comprises:

The generated second defense strategy is issued to the defense execution device on the database operation traffic channel, so that the defense execution device performs data processing on the database operation traffic in the subsequent period according to the existing second defense strategy.
The method according to claim 9, wherein determining that there is a data leakage behavior in the current period according to the database operation log data in the current period includes at least one of the following:

According to the database operation log data in the current period, the number of query data entries in the current period is obtained. When the number of query data entries is greater than the first number threshold, the database operation log data in the current period determines that there is a data leakage behavior in the current period;

According to the database operation log data in the current period, the number of query data bytes in the current period is obtained. When the number of query data bytes is greater than the second number threshold, the database operation log data in the current period determines that there is a data leak in the current period behavior.
A data processing method, including:

Acquiring traffic log data in the current period, where the traffic log data reflects the characteristics of the network traffic in the current period;

If it is determined from the traffic log data in the current period that there is abnormal behavior in the network traffic in the current period, determine whether there is a first defense strategy, and the first defense strategy is generated for the abnormal traffic that has been identified before the current moment;

If it exists, generate first visualization data for network traffic in the subsequent period according to the existing first defense strategy;

If it does not exist, generate second visualization data for the network traffic in the subsequent period according to the second defense strategy, which is generated based on the normal traffic that has been identified before the current moment.
The method according to claim 13, wherein after generating the first visualization data for the network traffic in the subsequent period according to the existing first defense strategy, the method further comprises:

The first visualization data is sent to the display terminal, so that the display terminal generates a first display interface according to the first visualization data.
The method according to claim 13, wherein after generating the second visualization data for the network traffic in the subsequent period according to the second defense strategy, the method further comprises:

The second visualization data is sent to the display terminal for the display terminal to generate a second display interface according to the second visualization data.
A data processing device, including: a memory and a processor;

The memory is used to store one or more computer instructions;

The processor is configured to execute the one or more computer instructions for:

Acquiring traffic log data in the current period, where the traffic log data reflects the characteristics of the network traffic in the current period;

If it is determined from the traffic log data in the current period that there is abnormal behavior in the network traffic in the current period, determine whether there is a first defense strategy, and the first defense strategy is generated for the abnormal traffic that has been identified before the current moment;

If it exists, perform data processing on the network traffic in the subsequent period according to the existing first defense strategy;

If it does not exist, data processing is performed on the network traffic in the subsequent period according to the second defense strategy, which is generated based on the normal traffic that has been identified before the current moment.
A computer-readable storage medium storing a computer program. When the computer program is executed by one or more processors, the one or more processors are caused to perform actions including the following:

Acquiring traffic log data in the current period, where the traffic log data reflects the characteristics of the network traffic in the current period;

If it is determined from the traffic log data in the current period that there is abnormal behavior in the network traffic in the current period, determine whether there is a first defense strategy, and the first defense strategy is generated for the abnormal traffic that has been identified before the current moment;

If it exists, perform data processing on the network traffic in the subsequent period according to the existing first defense strategy;

If it does not exist, data processing is performed on the network traffic in the subsequent period according to the second defense strategy, which is generated based on the normal traffic that has been identified before the current moment.
A data processing device, including: a memory and a processor;

The memory is used to store one or more computer instructions;

The processor is configured to execute the one or more computer instructions for:

According to the traffic log data in the current period, analyze the characteristics of the network traffic in the current period;

According to the characteristics of the network traffic in the current period and the baseline characteristics of the known normal traffic, identify the abnormal traffic in the current period, where the baseline characteristics of the known normal traffic are obtained from historical traffic log data;

According to the characteristics of the abnormal traffic existing in the current period, a first defense strategy for the abnormal traffic existing in the current period is generated to perform data processing on the network traffic in the subsequent period.
A computer-readable storage medium storing a computer program. When the computer program is executed by one or more processors, the one or more processors are caused to perform actions including the following:

According to the traffic log data in the current period, analyze the characteristics of the network traffic in the current period;

According to the characteristics of the network traffic in the current period and the baseline characteristics of the known normal traffic, identify the abnormal traffic in the current period, where the baseline characteristics of the known normal traffic are obtained from historical traffic log data;

According to the characteristics of the abnormal traffic existing in the current period, a first defense strategy for the abnormal traffic existing in the current period is generated to perform data processing on the network traffic in the subsequent period.
A data processing device, including: a memory and a processor;

The memory is used to store one or more computer instructions;

The processor is configured to execute the one or more computer instructions for:

Acquiring database operation log data in the current period, where the database operation log data reflects the characteristics of the database operation traffic in the current period;

If it is determined based on the database operation log data in the current period that there is a data leakage behavior in the current period, determine whether there is a first defense strategy, which is generated for abnormal database operation traffic that has been identified before the current time ；

If it exists, perform data processing on the database operation traffic in the subsequent period according to the existing first defense strategy;

If it does not exist, perform data processing on the database operation traffic in the subsequent period according to the second defense strategy, which is generated based on the normal database operation traffic that has been identified before the current moment.
A computer-readable storage medium storing a computer program. When the computer program is executed by one or more processors, the one or more processors are caused to perform actions including the following:

Acquiring database operation log data in the current period, where the database operation log data reflects the characteristics of the database operation traffic in the current period;

If it is determined based on the database operation log data in the current period that there is a data leakage behavior in the current period, determine whether there is a first defense strategy, which is generated for abnormal database operation traffic that has been identified before the current time ；

If it exists, perform data processing on the database operation traffic in the subsequent period according to the existing first defense strategy;

If it does not exist, perform data processing on the database operation traffic in the subsequent period according to the second defense strategy, which is generated based on the normal database operation traffic that has been identified before the current moment.
A data processing device, including: a memory and a processor;

The memory is used to store one or more computer instructions;

The processor is configured to execute the one or more computer instructions for:

Acquiring traffic log data in the current period, where the traffic log data reflects the characteristics of the network traffic in the current period;

If it is determined from the traffic log data in the current period that there is abnormal behavior in the network traffic in the current period, determine whether there is a first defense strategy, and the first defense strategy is generated for the abnormal traffic that has been identified before the current moment;

If it exists, generate first visualization data for network traffic in the subsequent period according to the existing first defense strategy;

If it does not exist, generate second visualization data for the network traffic in the subsequent period according to the second defense strategy, which is generated based on the normal traffic that has been identified before the current moment.
A computer-readable storage medium storing a computer program. When the computer program is executed by one or more processors, the one or more processors are caused to perform actions including the following:

Acquiring traffic log data in the current period, where the traffic log data reflects the characteristics of the network traffic in the current period;

If it is determined from the traffic log data in the current period that there is abnormal behavior in the network traffic in the current period, determine whether there is a first defense strategy, and the first defense strategy is generated for the abnormal traffic that has been identified before the current moment;

If it exists, generate first visualization data for network traffic in the subsequent period according to the existing first defense strategy;

If it does not exist, generate second visualization data for the network traffic in the subsequent period according to the second defense strategy, which is generated based on the normal traffic that has been identified before the current moment.