Method and apparatus for identifying network attacks

Abstract

Embodiments of the present disclose provide a method and apparatus for identifying network attacks. The method can include: acquiring access data within at least two time periods of a target website server, wherein the access data include one or more fields; determining, for each of the at least two time periods, a quantity of access data having same content in at least two of the one or more fields; determining whether the quantities of access data for each of the at least two time periods are the same; and in response to the quantities of access data being the same, determining that at least two access requests of the access data are network attacks.

1 - 27 . (canceled) 
     
     
         28 . A method for identifying network attacks, comprising:
 acquiring a plurality of access data sets for each of at least two time periods of a target website server, each of the plurality of access data sets including one or more fields;   determining, for each of the at least two time periods, a quantity of access data sets having a same field of the one or more fields; and   determining that at least two access requests of the plurality of access data sets are network attacks based on at least one of:
 quantities of the access data sets having the same field of the one or more fields within each of the time periods being the same, or 
 a difference between a maximum value and a minimum value of quantities of access data sets having the same field in the at least two time periods, or 
 a difference between the quantity of the access data sets in each of the at least two time periods and an average value of the quantities of the access data sets having the same field in the at least two time periods. 
   
     
     
         29 . The method of  claim 28 , wherein acquiring the plurality of access data sets for each of the at least two time periods of the target website server further comprises:
 collecting an access log of the target website server; and   acquiring the access data sets within the at least two time periods from the access log.   
     
     
         30 . The method of  claim 29 , wherein collecting the access log of the target website server further comprises:
 collecting an access log of a front-end application of the target website server.   
     
     
         31 . The method of  claim 29 , wherein after acquiring the plurality of access data sets for each of the at least two time periods from the access logs, the method further comprises:
 storing the plurality of access data sets within the at least two time periods in a database, and   wherein determining, for each of the at least two time periods, the quantity of access data sets having the same field of the one or more fields further comprises:   querying the database for the access data sets within the at least two time periods, and   counting the quantity of the access data sets having the same field for each of the at least two time periods.   
     
     
         32 . The method of  claim 28 , wherein determining that the at least two access requests of the plurality of access data sets are the network attacks further comprises:
 determining whether the quantities of the access data sets having the same field for the at least two time periods are the same; and   in response to the quantities of the access data sets having the same field being the same, determining that the at least two access requests of the plurality of access data sets are the network attacks.   
     
     
         33 . The method of  claim 28 , wherein determining that the at least two access requests of the plurality of access data sets are the network attacks further comprises:
 acquiring the maximum value and the minimum value of the quantities of the access data sets having the same field;   determining the difference between the maximum value and the minimum value; and   determining the at least two access requests of the plurality of access data sets as the network attacks in response to a determination that the difference is less than a preset threshold.   
     
     
         34 . The method of  claim 28 , wherein determining that the at least two access requests of the plurality of access data sets are the network attacks further comprises:
 determining the average value of the quantities of the access data sets having the same field;   determining the difference between the quantity of the access data sets in each of the at least two time periods and the average value; and   determining that the at least two access requests of the plurality of access data sets are the network attacks in response to a determination that the difference is less than a preset threshold.   
     
     
         35 . The method of  claim 28 , wherein the at least two time periods comprise adjacent time periods. 
     
     
         36 . The method of  claim 28 , wherein the one or more fields comprise at least one of an Internet Protocol (IP) address, a domain name that accesses the target website, a browser that accesses the target website, or an Uniform Resource Locator (URL). 
     
     
         37 . An apparatus for identifying network attacks, comprising:
 a memory device storing instructions; and   a processor arranged to execute the instructions to cause the apparatus to:
 acquire a plurality of access data sets for at least two time periods of a target website server, each of the plurality of access data sets including one or more fields; 
 determine, for each of the at least two time periods, a quantity of access data sets having a same field of the one or more fields; and 
 determine that at least two access requests of the plurality of access data sets are network attacks based on at least one of: 
 quantities of the access data sets having the same field of the one or more fields within each of the time periods being the same, or 
 a difference between a maximum value and a minimum value of quantities of access data sets having the same field in the at least two time periods, or 
 a difference between the quantity of the access data sets in each of the at least two time periods and an average value of the quantities of the access data sets having the same field in the at least two time periods. 
   
     
     
         38 . The apparatus of  claim 37 , wherein the processor is arranged to execute the instructions to cause the apparatus to:
 collect an access log of the target website server; and   acquire the access data sets within the at least two time periods from the access log.   
     
     
         39 . The apparatus of  claim 38 , wherein the processor is arranged to execute the instructions to cause the apparatus to collect an access log of a front-end application of the target website server. 
     
     
         40 . The apparatus of  claim 38 , wherein the processor is arranged to execute the instructions to cause the apparatus to:
 store the plurality of access data sets within the at least two time periods in a database, and   query the database for the access data sets within the at least two time periods; and   count the quantity of the access data sets having the same field for each of the at least two time periods.   
     
     
         41 . The apparatus of  claim 37 , wherein the processor is arranged to execute the instructions to cause the apparatus to:
 determine whether the quantities of the access data sets having the same field for the at least two time periods are the same, and   in response to the quantities of the access data sets having the same field being the same, determine that the at least two access requests of the plurality of access data sets are the network attacks.   
     
     
         42 . The apparatus of  claim 37 , wherein the processor is arranged to execute the instructions to cause the apparatus to:
 acquire the maximum value and the minimum value of the quantities of the access data sets having the same field;   determine the difference between the maximum value and the minimum value; and   determine the at least two access requests of the plurality of access data sets as the network attacks in response to a determination that the difference is less than a preset threshold.   
     
     
         43 . The apparatus of  claim 37 , wherein the processor is arranged to execute the instructions to cause the apparatus to:
 determine the average value of the quantities of the access data sets having the same field;   determine the difference between the quantity of the access data sets in each of the at least two periods and the average value;   determine whether the difference is less than a threshold; and   determine that the at least two access requests of the plurality of access data sets are the network attacks in response to a determination that the difference is less than the threshold.   
     
     
         44 . The apparatus of  claim 37 , wherein the at least two time periods comprise adjacent time periods. 
     
     
         45 . The apparatus of  claim 37 , wherein the one or more fields comprise at least one of an Internet Protocol (IP) address, a domain name that accesses the target website, a browser that accesses the target website, or an Uniform Resource Locator (URL). 
     
     
         46 . A non-transitory computer readable medium that stores a set of instructions that is executable by at least one processor of an electronic device to cause the device to perform a method for identifying network attacks, the method comprising:
 acquiring a plurality of access data sets for each of at least two time periods of a target website server, each of the plurality of access data sets including one or more fields;   determining, for each of the at least two time periods, a quantity of access data sets having a same field of the one or more fields; and   determining that at least two access requests of the plurality of access data sets are network attacks based on at least one of:
 quantities of the access data sets having the same field of the one or more fields within each of the time periods being the same, or 
 a difference between a maximum value and a minimum value of quantities of access data sets having the same field in the at least two time periods, or 
 a difference between the quantity of the access data sets in each of the at least two time periods and an average value of the quantities of the access data sets having the same field in the at least two time periods. 
   
     
     
         47 . The non-transitory computer readable medium of  claim 46 , wherein acquiring the plurality of access data sets for each of the at least two time periods of the target website server further comprises:
 collecting an access log of the target website server; and   acquiring the access data sets within the at least two time periods from the access log.   
     
     
         48 . The non-transitory computer readable medium of  claim 47 , wherein collecting the access log of the target website server further comprises:
 collecting an access log of a front-end application of the target website server.   
     
     
         49 . The non-transitory computer readable medium of  claim 47 , wherein after acquiring the plurality of access data sets for each of the at least two time periods from the access logs, the set of instructions is further executable by the at least one processor of the electronic device to perform:
 storing the plurality of access data sets within the at least two time periods in a database, and   wherein determining, for each of the at least two time periods, the quantity of access data sets having the same field of the one or more fields further comprises:   querying the database for the access data sets within the at least two time periods, and   counting the quantity of the access data sets having the same field for each of the at least two time periods.   
     
     
         50 . The non-transitory computer readable medium of  claim 46 , wherein determining the at least two access requests of the plurality of access data sets are the network attacks further comprises:
 determining whether the quantities of the access data sets having the same field for the at least two time periods are the same; and   in response to the quantities of the access data sets having the same field being the same, determining that the at least two access requests of the plurality of access data sets are the network attacks.   
     
     
         51 . The non-transitory computer readable medium of  claim 46 , wherein determining that the at least two access requests of the plurality of access data sets are the network attacks further comprises:
 acquiring the maximum value and the minimum value of the quantities of the access data sets having the same field;   determining the difference between the maximum value and the minimum value; and   determining the at least two access requests of the plurality of access data sets as the network attacks in response to a determination that the difference is less than a preset threshold.   
     
     
         52 . The non-transitory computer readable medium of  claim 46 , wherein determining that the at least two access requests of the plurality of access data sets are the network attacks further comprises:
 determining the average value of the quantities of the access data sets having the same field;   determining the difference between the quantity of the access data sets in each of the at least two time periods and the average value; and   determining that the at least two access requests of the plurality of access data sets are the network attacks in response to a determination that the difference is less than a preset threshold.   
     
     
         53 . The non-transitory computer readable medium of  claim 46 , wherein the at least two time periods comprise adjacent time periods. 
     
     
         54 . The non-transitory computer readable medium of  claim 46 , wherein the fields comprise at least one of an Internet Protocol (IP) address, a domain name that accesses the target website, a browser that accesses the target website, or an Uniform Resource Locator (URL).