Security attack detection method, device, computer equipment and storage medium

Abstract

The invention discloses a security attack detection method, device, computer equipment and storage medium. The security attack detection method includes: acquiring mirrored traffic; and creating the source according to the mirrored traffic for a source terminal requesting to connect to the destination terminal. The session between the end and the destination end; discarding the first specific message corresponding to the session in the mirrored traffic, waiting for the source end to retransmit the first specific message; The first specific message retransmitted by the source end is forwarded to the destination end, and by tracking the session, it is detected whether the source end has entered the connection establishment state; if it is detected that the source end has not entered the If the above connection establishment status is established, it is confirmed that the destination end is subjected to a TCP reflection attack from the source end, and the flow corresponding to the session in the flow to be transmitted to the destination end is intercepted. The invention solves the problem of high false detection rate in security attack detection in the prior art.

Description

technical field [0001] The present invention relates to the field of computer technology, and in particular, to a security attack detection method, device, computer equipment and storage medium. Background technique [0002] DDOS is the abbreviation of Distributed Denial of Service in English, which is "distributed denial of service". DDOS type security attack means that the attacker initiates a large number of seemingly legitimate and malicious business requests to the attack target (such as a server) by controlling botnets distributed all over the Internet, in order to consume or occupy a large amount of resources of the attack target for a long time. As a result, the attack target cannot respond to normal business requests, thereby achieving the purpose of denial of service for the attack target. [0003] At present, DDOS-type security attacks mainly include: synack forgery attack, UDP (User Datagram Protocol, User Datagram Protocol) reflection attack, TCP (Transmission ...

AI Technical Summary

Problems solved by technology

[0005] In order to solve the problem of high false detection rate in security attack detection in related technologies, each embodiment of the present invention provides a security attack detection method, device, computer equipment and storage medium

Images