Attack detection model training method and attack detection method and system

Abstract

The invention discloses an attack detection model training method and an attack detection method and system, and the method comprises the steps: obtaining feature information of network flow in a specified time period, wherein a part of the network flow in the specified time period is the flow detected as a DDoS attack and the feature information comprises a source IP address and a flow byte number, dividing the network flow in the specified time period by taking the set duration as a unit to obtain a detection sample set, wherein the detection sample set comprises a plurality of detection samples, one detection sample corresponds to the network flow in one set duration and one detection sample comprises feature information corresponding to the network flow in the set duration, and training a DDoS attack detection model by using at least part of the detection samples in the detection sample set, wherein the output information of the DDoS attack detection model is used for indicating whether the input network flow is the DDoS attack flow.

Description

technical field [0001] The present invention relates to the field of communication technology, in particular to a distributed denial of service (Distributed Denial of Service, DDoS) attack detection model training method, DDoS attack detection method and system. Background technique [0002] DDoS attack refers to the use of client or server technology to combine multiple computers as an attack platform to launch a distributed denial of service attack on one or more targets. There are many ways of distributed denial of service attack. The most basic distributed service attack is to use the target system network service function defects or use reasonable service requests to directly occupy too many service resources, so that the target system cannot provide normal services. According to Transmission Control Protocol / Internet Protocol (Transmission Control Protocol / Internet Protocol, TCP / IP) level, DDoS attacks can be divided into attacks based on Address Resolution Protocol (A...

AI Technical Summary

Problems solved by technology

There are many ways of distributed denial of service attack. The most basic distributed service attack is to use the target system network service function defect or use reasonable service requests to directly occupy too many service resources, so that the target system cannot provide normal services.

Images