A network node monitoring method and device

Abstract

The embodiment of the invention discloses a method for monitoring a network node. The method comprises the steps as follows: receiving an access request transmitted by the network node; obtaining a first identification of the network node different from other network node; calculating a Hash value corresponding to the first identification according to a Hash algorithm, wherein a first form is stored with the first identification and a corresponding relation of position of the first identification in a second form; judging whether an item of the first form corresponding to the Hash value has the first identification, searching the first identification in the second form according to the corresponding relation if the item of the first form corresponding to the Hash value has the first identification, and adding one on the basis of current access request quantity corresponding to the first identification; judging whether the added access request quantity is more than or equal to a preset request quantity, and confirming the network node is an abnormal network node if the added access request quantity is more than or equal to a preset request quantity. The embodiment of the invention further discloses a device for monitoring network node. The method and the device of the invention achieve the goal of monitoring abnormal network node used by a cracker to perform misapplication and attack of resources in real time.

Description

technical field [0001] The invention relates to the computer field, in particular to a network node monitoring method and device. Background technique [0002] At present, the most basic attack method of network hackers on network servers is resource abuse attack, that is, using network nodes (also known as "broilers" or "puppet machines" in the industry, referring to machines that can be remotely controlled by hackers) to send a large number of legitimate access requests To occupy too many server resources, so that the normal user's legitimate request fails, or the page loading speed becomes extremely slow, causing the user to be unable to use the website. Moreover, this kind of attack process is often very short. For an unprotected web server, this attack is almost unstoppable, and the web server will crash in a short time, causing huge losses to the enterprise. Therefore, finding out the network nodes controlled by hackers from the numerous network nodes sending access r...

AI Technical Summary

Problems solved by technology

However, once a hacker uses tens of thousands of network nodes to send a large number of access requests, since the number of access requests equally distributed to each network node is greatly reduced, the corresponding rate of deleting tokens is more than r per second. Low, because under normal circumstances, the rate of access requests sent by ordinary users is less than r per second, so it is often impossible to distinguish which are normal network nodes used by ordinary users and which are abnormal network nodes controlled by hackers

Images