Method for preventing server from being attacked, detection device and monitoring device

Abstract

The embodiment of the invention discloses a method for preventing a server from being attacked. The method comprises the following steps: determining a target URL in a data packet for an access request sent to a server as an URL to be verified; performing normalization on the URL in the data packet and counting the number of access times to the normalized URL in a time period corresponding to the arrival time of the data packet; judging whether the number of the access times of the normalized URL in the time period exceeds a threshold of the number of the access times of the normalized URL in the time period; and if yes, the access request of the data packet is blocked. The embodiment of the invention also provides monitoring equipment and a detection device. The monitoring equipment and the detection device limit the number of connection times of the accessed URL and make a judgment that the server is attacked when the number of the access times exceeds a threshold in the time period no matter the connection of the accessed URL is from an anonymous proxy, a dummy host or a normal proxy host, thereby preventing attack from the anonymous proxy or the dummy host without blocking access of the normal proxy host.

Description

technical field [0001] The embodiments of the present invention relate to the technical field of communications, and in particular, to a method for preventing a server from being attacked, a detection device, and a monitoring device. Background technique [0002] With the rapid development of the Internet, network security has attracted more and more attention. Under normal circumstances, network security issues mainly involve how to prevent servers in the network from being attacked, and general servers are attacked, which mainly manifests as occupying too many service resources of the server through service requests, causing the server to be overloaded and unable to respond to other services. requests, eventually causing the exhaustion of server resources, in order to achieve the purpose of denial of service. At the same time, more and more merchants obtain profits by providing services through servers. If the servers are continuously attacked, it will inevitably affect t...

AI Technical Summary

Problems solved by technology

[0004] In the process of realizing the present invention, the inventor finds that the prior art has at least the following disadvantages: the prior art can block normal agent access, and cannot defend against attacks from anonymous agents (without agent information fields) or puppet hosts

Images