Method and apparatus for identifying network attacks

1. A method for identifying network attacks, comprising:

acquiring a plurality of access data sets for each of at least two time periods of a target website server, each of the plurality of access data sets including one or more fields;

determining, for each of the at least two time periods, a quantity of access data sets having a same field of the one or more fields; and

determining that at least two access requests of the plurality of access data sets are network attacks based on at least one of:

a difference between a maximum value and a minimum value of quantities of access data sets having the same field in the at least two time periods, or

a difference between the quantity of the access data sets in each of the at least two time periods and an average value of the quantities of the access data sets having the same field in the at least two time periods.

2. The method of claim 1 , wherein acquiring the plurality of access data sets for each of the at least two time periods of the target website server further comprises:

collecting an access log of the target website server; and

acquiring the access data sets within the at least two time periods from the access log.

3. The method of claim 2 , wherein collecting the access log of the target website server further comprises:

collecting an access log of a front-end application of the target website server.

4. The method of claim 2 , wherein after acquiring the plurality of access data sets for each of the at least two time periods from the access logs, the method further comprises:

storing the plurality of access data sets within the at least two time periods in a database, and

wherein determining, for each of the at least two time periods, the quantity of access data sets having the same field of the one or more fields further comprises:

querying the database for the access data sets within the at least two time periods, and

counting the quantity of the access data sets having the same field for each of the at least two time periods.

5. The method of claim 1 , wherein determining that the at least two access requests of the plurality of access data sets are the network attacks further comprises:

determining whether the quantities of the access data sets having the same field for the at least two time periods are the same; and

in response to the quantities of the access data sets having the same field being the same, determining that the at least two access requests of the plurality of access data sets are the network attacks.

6. The method of claim 1 , wherein determining that the at least two access requests of the plurality of access data sets are the network attacks further comprises:

acquiring the maximum value and the minimum value of the quantities of the access data sets having the same field;

determining the difference between the maximum value and the minimum value; and

determining the at least two access requests of the plurality of access data sets as the network attacks in response to a determination that the difference is less than a preset threshold.

7. The method of claim 1 , wherein determining that the at least two access requests of the plurality of access data sets are the network attacks further comprises:

determining the average value of the quantities of the access data sets having the same field;

determining the difference between the quantity of the access data sets in each of the at least two time periods and the average value; and

determining that the at least two access requests of the plurality of access data sets are the network attacks in response to a determination that the difference is less than a preset threshold.

8. The method of claim 1 , wherein the at least two time periods comprise adjacent time periods.

9. The method of claim 1 , wherein the one or more fields comprise at least one of an Internet Protocol (IP) address, a domain name that accesses the target website, a browser that accesses the target website, or an Uniform Resource Locator (URL).

10. An apparatus for identifying network attacks, comprising:

a memory device storing instructions; and

a processor arranged to execute the instructions to cause the apparatus to:

acquire a plurality of access data sets for at least two time periods of a target website server, each of the plurality of access data sets including one or more fields;

determine, for each of the at least two time periods, a quantity of access data sets having a same field of the one or more fields; and

determine that at least two access requests of the plurality of access data sets are network attacks based on at least one of:

a difference between a maximum value and a minimum value of quantities of access data sets having the same field in the at least two time periods, or

a difference between the quantity of the access data sets in each of the at least two time periods and an average value of the quantities of the access data sets having the same field in the at least two time periods.

11. The apparatus of claim 10 , wherein the processor is arranged to execute the instructions to cause the apparatus to:

collect an access log of the target website server; and

acquire the access data sets within the at least two time periods from the access log.

12. The apparatus of claim 11 , wherein the processor is arranged to execute the instructions to cause the apparatus to collect an access log of a front-end application of the target website server.

13. The apparatus of claim 11 , wherein the processor is arranged to execute the instructions to cause the apparatus to:

store the plurality of access data sets within the at least two time periods in a database, and

query the database for the access data sets within the at least two time periods; and

count the quantity of the access data sets having the same field for each of the at least two time periods.

14. The apparatus of claim 10 , wherein the processor is arranged to execute the instructions to cause the apparatus to:

determine whether the quantities of the access data sets having the same field for the at least two time periods are the same, and

in response to the quantities of the access data sets having the same field being the same, determine that the at least two access requests of the plurality of access data sets are the network attacks.

15. The apparatus of claim 10 , wherein the processor is arranged to execute the instructions to cause the apparatus to:

acquire the maximum value and the minimum value of the quantities of the access data sets having the same field;

determine the difference between the maximum value and the minimum value; and

determine the at least two access requests of the plurality of access data sets as the network attacks in response to a determination that the difference is less than a preset threshold.

16. The apparatus of claim 10 , wherein the processor is arranged to execute the instructions to cause the apparatus to:

determine the average value of the quantities of the access data sets having the same field;

determine the difference between the quantity of the access data sets in each of the at least two periods and the average value;

determine whether the difference is less than a threshold; and

determine that the at least two access requests of the plurality of access data sets are the network attacks in response to a determination that the difference is less than the threshold.

17. The apparatus of claim 10 , wherein the at least two time periods comprise adjacent time periods.

18. The apparatus of claim 10 , wherein the one or more fields comprise at least one of an Internet Protocol (IP) address, a domain name that accesses the target website, a browser that accesses the target website, or an Uniform Resource Locator (URL).

19. A non-transitory computer readable medium that stores a set of instructions that is executable by at least one processor of an electronic device to cause the device to perform a method for identifying network attacks, the method comprising:

acquiring a plurality of access data sets for each of at least two time periods of a target website server, each of the plurality of access data sets including one or more fields;

determining, for each of the at least two time periods, a quantity of access data sets having a same field of the one or more fields; and

determining that at least two access requests of the plurality of access data sets are network attacks based on at least one of:

a difference between a maximum value and a minimum value of quantities of access data sets having the same field in the at least two time periods, or

a difference between the quantity of the access data sets in each of the at least two time periods and an average value of the quantities of the access data sets having the same field in the at least two time periods.

20. The non-transitory computer readable medium of claim 19 , wherein acquiring the plurality of access data sets for each of the at least two time periods of the target website server further comprises:

collecting an access log of the target website server; and

acquiring the access data sets within the at least two time periods from the access log.

21. The non-transitory computer readable medium of claim 20 , wherein collecting the access log of the target website server further comprises:

collecting an access log of a front-end application of the target website server.

22. The non-transitory computer readable medium of claim 20 , wherein after acquiring the plurality of access data sets for each of the at least two time periods from the access logs, the set of instructions is further executable by the at least one processor of the electronic device to perform:

storing the plurality of access data sets within the at least two time periods in a database, and

wherein determining, for each of the at least two time periods, the quantity of access data sets having the same field of the one or more fields further comprises:

querying the database for the access data sets within the at least two time periods, and

counting the quantity of the access data sets having the same field for each of the at least two time periods.

23. The non-transitory computer readable medium of claim 19 , wherein determining the at least two access requests of the plurality of access data sets are the network attacks further comprises:

determining whether the quantities of the access data sets having the same field for the at least two time periods are the same; and

in response to the quantities of the access data sets having the same field being the same, determining that the at least two access requests of the plurality of access data sets are the network attacks.

24. The non-transitory computer readable medium of claim 19 , wherein determining that the at least two access requests of the plurality of access data sets are the network attacks further comprises:

acquiring the maximum value and the minimum value of the quantities of the access data sets having the same field;

determining the difference between the maximum value and the minimum value; and

determining the at least two access requests of the plurality of access data sets as the network attacks in response to a determination that the difference is less than a preset threshold.

25. The non-transitory computer readable medium of claim 19 , wherein determining that the at least two access requests of the plurality of access data sets are the network attacks further comprises:

determining the average value of the quantities of the access data sets having the same field;

determining the difference between the quantity of the access data sets in each of the at least two time periods and the average value; and

determining that the at least two access requests of the plurality of access data sets are the network attacks in response to a determination that the difference is less than a preset threshold.

26. The non-transitory computer readable medium of claim 19 , wherein the at least two time periods comprise adjacent time periods.

27. The non-transitory computer readable medium of claim 19 , wherein the fields comprise at least one of an Internet Protocol (IP) address, a domain name that accesses the target website, a browser that accesses the target website, or an Uniform Resource Locator (URL).