Network attack alarm threshold value configuration method and device, medium and computing device

Abstract

The present invention provides a network attack alarm threshold value configuration method. The method comprises the steps of: recording flow information of a target node according to a set period toobtain flow historical data of the target node; and obtaining an alarm threshold value of the target node according to the flow historical data of the target node and bandwidth configuration information of the target node, wherein the alarm threshold value is configured to the target node. The method matches the alarm threshold value according to the business flow so as to reduce the manual maintenance cost, better accurately fit and guarantee fluctuation of the business flow, reduce the protection response time, reduce the pressure influence at the attack moment and effectively reduce the false alarm rate and the missing report rate of the attack alarm. Besides, the embodiment of the invention provides a network attack alarm threshold value configuration device, a medium and a computing device.

Description

technical field [0001] The present invention relates to the field of information technology, and more specifically, the present invention relates to a network attack warning threshold configuration method, medium, device and computing equipment. Background technique [0002] The threats to the security of the network information system come from many aspects. These threats can be divided into man-made threats and natural threats. Among them, man-made threats are man-made attacks on network information systems. By finding the weaknesses of the system, they can achieve the purpose of destroying, deceiving and stealing data information in an unauthorized way. There are many types and large numbers of well-designed artificial attacks. For example, Distributed Denial of Service attack (Distributed Denial of Service, referred to as DDoS) with the help of client / server technology, the combination of multiple computers as an attack platform, a congestion attack on one or more ta...

AI Technical Summary

Problems solved by technology

When the number of IPs or the type of IP deployment increases, more groups need to be divided to configure fixed thresholds, which cannot be automatically matched and adjusted in real time according to business traffic fluctuations, protocol characteristics, etc.

The cost of manual operation and maintenance is high, and the accuracy of attack alarms is poor

Images