Business flow processing method, business flow learning method, device and system

Abstract

The invention discloses a business flow processing method and a business flow learning method, device and system, which can be applied to the field of data security in data transmission, can efficiently intercept the business flow meeting the abnormal flow processing condition, and release the business flow under the available protocol number to prevent a normal business from being mistakenly killed. The method provided by the invention comprises the steps of preparing a template; when a target internet protocol IP address of the server is attacked, obtaining a protocol number baseline of theserver and the target protocol number corresponding to the attacked target IP address; if the target protocol number is inconsistent with the available protocol number in the protocol number base line, obtaining load characteristic statistical results of P data packets according to the business traffic corresponding to the target protocol number; and if the load characteristic statistical resultsmeet an abnormal flow processing condition, determining Q data packets from the P data packets, and intercepting the Q data packets.

Description

technical field [0001] The present application relates to the field of network security, in particular to a method for processing service flow, a method, a device and a system for learning service flow. Background technique [0002] In the fields of medical care, finance, credit information, banking, government affairs, games, and education, business services are often provided to users through servers, and attack technologies against servers have also developed. Among them, the distributed denial of service (Distributed Denial of Service, DDoS) attack refers to that hackers send a large amount of abnormal traffic to the server by controlling multiple machines distributed in various places, so that the server is busy processing abnormal traffic, resulting in the server being unable to process normal user requests. With the continuous development of attack technology, a new attack method has emerged, that is, protocol flood attack. The attacker controls the bot to forge the s...

AI Technical Summary

Problems solved by technology

[0004] However, if the protected server has business traffic using unused protocols, the speed limit will obviously cause accidental killing of normal traffic

This is because the rate limit can only drop packets indiscriminately until the traffic is below the threshold. If a protocol flood attack occurs, normal business traffic and attack traffic will be randomly discarded indiscriminately, resulting in the failure of normal business.

Images