Method and apparatus for identifying network attacks
AssigneeAlibaba Group Holding Limited
InventorXuejian Zheng
Life of this patent
Estimating the term…
Abstract
Embodiments of the present disclose provide a method and apparatus for identifying network attacks. The method can include: acquiring access data within at least two time periods of a target website server, wherein the access data include one or more fields; determining, for each of the at least two time periods, a quantity of access data having same content in at least two of the one or more fields; determining whether the quantities of access data for each of the at least two time periods are the same; and in response to the quantities of access data being the same, determining that at least two access requests of the access data are network attacks.
Claims27
A method for identifying network attacks, comprising:
- acquiring a plurality of access data sets for each of at least two time periods of a target website server, each of the plurality of access data sets including one or more fields;
- determining, for each of the at least two time periods, a quantity of access data sets having a same field of the one or more fields;
- and
- determining that at least two access requests of the plurality of access data sets are network attacks based on at least one of:
- a difference between a maximum value and a minimum value of quantities of access data sets having the same field in the at least two time periods, or
- a difference between the quantity of the access data sets in each of the at least two time periods and an average value of the quantities of the access data sets having the same field in the at least two time periods.
An apparatus for identifying network attacks, comprising:
- a memory device storing instructions;
- and
- a processor arranged to execute the instructions to cause the apparatus to:
- acquire a plurality of access data sets for at least two time periods of a target website server, each of the plurality of access data sets including one or more fields;
- determine, for each of the at least two time periods, a quantity of access data sets having a same field of the one or more fields;
- and
- determine that at least two access requests of the plurality of access data sets are network attacks based on at least one of:
- a difference between a maximum value and a minimum value of quantities of access data sets having the same field in the at least two time periods, or
- a difference between the quantity of the access data sets in each of the at least two time periods and an average value of the quantities of the access data sets having the same field in the at least two time periods.
A non-transitory computer readable medium that stores a set of instructions that is executable by at least one processor of an electronic device to cause the device to perform a method for identifying network attacks, the method comprising:
- acquiring a plurality of access data sets for each of at least two time periods of a target website server, each of the plurality of access data sets including one or more fields;
- determining, for each of the at least two time periods, a quantity of access data sets having a same field of the one or more fields;
- and
- determining that at least two access requests of the plurality of access data sets are network attacks based on at least one of:
- a difference between a maximum value and a minimum value of quantities of access data sets having the same field in the at least two time periods, or
- a difference between the quantity of the access data sets in each of the at least two time periods and an average value of the quantities of the access data sets having the same field in the at least two time periods.
Dependencies are inferred from the claim text.