Application cluster security protection system and method, electronic equipment and storage medium

Abstract

The invention provides an application cluster security protection system and method, electronic equipment and a storage medium. The system comprises a domain name server, a front access controller, a WAF gateway and a flow monitoring system, wherein the domain name server is used for receiving a domain name access request sent by a client, analyzing the domain name access request to obtain an IP address corresponding to the domain name access request, and guiding the IP address to the front access controller; the front access controller is used for carrying out first-layer filtering on the IP address based on the IP blacklist to obtain a first request, and the WAF gateway is used for receiving the first request, carrying out second-layer filtering on the first request based on an abnormal request identification rule to obtain a second request, and sending the second request to an application system in an application cluster for processing; and the flow monitoring system is used for collecting and analyzing log data of the WAF gateway and updating the IP blacklist according to the log data. A large amount of flow can be received, normal work is carried out, and protection efficiency and safety are improved.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to an application cluster security protection system, method, electronic equipment and storage medium. Background technique [0002] With the development of network technology, web-based applications are used by more and more companies and institutions around the world. When customers face business peaks or are attacked by DDOS (Distributed denial of service attack), A web application firewall (Web Application Firewall, WAF for short) plays a vital role as a gateway device connected in series in the user network. [0003] In the existing technology, WAF is deployed in front of the web application to detect and block abnormal traffic, and aggregate the traffic from the outside through proxy technology into request packets, and analyze the request packets, and further pass the attack rules of the security rule base Match the parsed request packet. If the rule in th...

AI Technical Summary

Problems solved by technology

[0004] However, the WAF throughput in the above method is limited. If the traffic increases sharply, the WAF cannot work normally after the traffic received by the WAF exceeds the performance limit. Moreover, the WAF protection method is passive, which is easy to be bypassed by repeated trials and errors, and the protection efficiency is low.

Images