Method for intelligently intercepting threat IP based on cloud protection

Abstract

The invention relates to the field of Internet security, and aims to provide a method for intelligently intercepting a threat IP based on cloud protection. The method for intelligently intercepting athreat IP based on cloud protection comprises the steps that: after receiving a cloud protection log, a big data log analysis server performs analysis according to a preset analysis rule, and stores the analyzed field information to an hbase cluster; a machine learning cluster establishes an analytic statistics model, the analytic statistics model can identify the behavior characteristics of an IPafter training, the machine learning cluster pushes the threat IP and corresponding domain name information to a cloud protection platform engine in real time, and the cloud protection platform engine dynamically adds the threat IP and the corresponding domain name information to a blacklist after receiving and implements corresponding interruption based on the attack threat level. The IP blacklist has high real-time property, and the configuration can be dynamically added and changed according to the log analysis result to effectively reduce the problem that the rule is bypassed and falselyreported.

Description

technical field [0001] The invention relates to the field of Internet security, in particular to a method for intelligently intercepting threat IP based on cloud protection. Background technique [0002] In recent years, cyber attacks against Internet websites have emerged in an endless stream, and the attack methods are changing with each passing day, which poses great challenges to the cloud protection platform. Traditional cloud protection mostly uses static blacklist libraries and rules (static rules and custom condition rules) to match user Http requests, so as to judge whether the request is a threat or attack, and then block or allow it. [0003] Existing interception methods based on static blacklist database and rules have several problems: 1) static blacklist database is not easy to accumulate, difficult to update and maintain, high cost and low accuracy; 2) rule matching is relatively fixed, easy to be Bypass, it is difficult to update and maintain; 3) It is diff...

AI Technical Summary

Problems solved by technology

[0003] Existing interception methods based on static blacklist database and rules have several problems: 1) static blacklist database is not easy to accumulate, difficult to update and maintain, high cost and low accuracy; 2) rule matching is relatively fixed, easy to be Bypass, it is difficult to update and maintain; 3) It is difficult for rule matching to adapt to different web application environments and logics, and it is easy to cause false positives

Images