Back to results
US 8,429,747 B2Granted
Method and device for detecting flood attacks
AssigneeHuawei Technologies Co., Ltd.
InventorWu Jiang
Life of this patent
Estimating the term…
Abstract
Disclosed is a flood attack detection method, wherein the total number of keywords of a source packet is acquired, and the number of feature parameters corresponding to the source packet is acquired. A ratio of the number of feature parameters to the total number of keywords is compared with a preset threshold, and if the ratio is greater than or equal to the preset threshold, it is determined that a flood attack occurs.
Claims5
A flood attack detection method, the method being carried out by a computer device having a processor, comprising the steps of:
- receiving, by the device, source packets transmitted from a plurality of hosts, wherein the source packets include text content;
- and
- counting, by the device, a total quantity of the received source packets carrying a keyword in a predetermined time to obtain a total quantity of the source packets with the keyword, wherein each received source packet's text content carries the keyword;
- and
- obtaining, by the device, a quantity of a characteristic parameter of the source packets;
- and
- wherein if a ratio of the quantity of the characteristic parameter of the source packets to the total quantity of the source packets with the keyword exceeds or is equal to a preset threshold, it is determined that the flood attack occurs, wherein the characteristic parameter of the source packets is a repetition number of a text hash string in the source packets, and wherein the preset threshold is a similar threshold.
4 more elements
A flood attack detection apparatus, comprising:
- a processor configured to receive source packets transmitted from a plurality of hosts, wherein the source packets include text content;
- count a total quantity of the received source packets carrying a keyword in a predetermined time to obtain a total quantity of the source packets with the keyword, wherein each received source packet's text content carries the keyword;
- obtain a quantity of a characteristic parameter of the source packets;
- compare a ratio of the quantity of the characteristic parameter to the total quantity of the source packets with the keyword with a preset threshold;
- and
- wherein if the ratio exceeds or is equal to the preset threshold, it is determined that the flood attack occurs, wherein obtain the quantity of the characteristic parameter of the source packets, further comprising:
- obtain a repetition number of a text hash string in the source packets, and wherein the preset threshold is a similar threshold.
4 more elements
Dependencies are inferred from the claim text.