WEB Log Analysis of connection overload attacks

Yunshu

This section briefly describes how to analyze IP Address Access frequency data from WEB logs to roughly determine application resource abuse and connection overload attacks. Of course, you can use log analysis tools, but I'm not sure if I can be flexible enough.

The simplest and easiest way to come up is to take the logs of one day and sort the logs by the Access Frequency of the IP addresses, and count the IP addresses with the most visits and the most visited URLs, evaluate the connection status roughly. However, this is not delicate enough. For further improvement, You Can shard logs by time, make statistics every hour or other time period to evaluate the IP address activity in the time period.

Better, it may be to make the time slice more detailed. For each IP address, start from the first access to determine the time slice, and count the activity level within a specified period of time. However, there will also be some problems. For example, the number of visits to the first half of an IP address in the first hour of the first access is small, but the Access frequency in the second half is faster, the same is true in the second hour, and so on. According to the statistical results, the results do not show this state completely, but show that every hour is average, rather than the peak period in the middle.

To solve this problem, we can use calculus to calculate the curve area. Divide the time into tiny segments. The length of the segments is obtained by testing based on experience or business type. Slice starts from the first access and performs continuous analysis on logs for multiple days. Assume that the statistical period is 1 hour, and the Access Frequency of multiple neighboring time segments is accumulated to find the maximum value. Then, the Access Frequency of the IP address during the peak period is obtained. The difficulty lies in determining the size of the small time segment and the maximum value of the adjacent accumulative search by combining the script performance and accuracy.