WO2017071511A1 - 防攻击数据传输方法及装置 - Google Patents

防攻击数据传输方法及装置 Download PDF

Info

Publication number
WO2017071511A1
WO2017071511A1 PCT/CN2016/102646 CN2016102646W WO2017071511A1 WO 2017071511 A1 WO2017071511 A1 WO 2017071511A1 CN 2016102646 W CN2016102646 W CN 2016102646W WO 2017071511 A1 WO2017071511 A1 WO 2017071511A1
Authority
WO
WIPO (PCT)
Prior art keywords
communication protocol
attack
packet
data
protocol packet
Prior art date
Application number
PCT/CN2016/102646
Other languages
English (en)
French (fr)
Inventor
屠一凡
张钊
朱家睿
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Publication of WO2017071511A1 publication Critical patent/WO2017071511A1/zh
Priority to US15/965,486 priority Critical patent/US11252184B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/04—Protocols for data compression, e.g. ROHC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/08—Protocols for interworking; Protocol conversion
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Definitions

  • the present invention relates to the field of computers, and in particular to an anti-attack data transmission method and apparatus.
  • SYN attack is a kind of DOS attack. It utilizes TCP protocol defects and consumes a large number of semi-join requests, which consumes CPU and memory resources. In addition to affecting the host, SYN attacks can also harm network systems such as routers and firewalls. In fact, SYN attacks do not care what the target system is. As long as these systems open TCP services, they can be implemented.
  • the server When the server does not receive the client's acknowledgment packet, it resends the request packet until the timeout expires before the entry is removed from the unconnected queue.
  • IP spoofing SYN attacks can achieve good results.
  • the client Forges a large number of non-existent IP addresses in a short time, continuously sends the syn packet to the server, the server replies with the confirmation packet, and waits for the customer's confirmation, due to the source. The address does not exist.
  • the server needs to retransmit continuously until timeout.
  • These forged SYN packets will occupy the unconnected queue for a long time.
  • the normal SYN request is discarded.
  • the target system runs slowly. In severe cases, the network is blocked or even the system is paralyzed.
  • ACK attack the attack principle is as follows: After the TCP connection is established, all data transmission TCP messages are marked with ACK, and the host needs to check when receiving a packet with the ACK flag. Whether the connection quad represented by the packet exists, if it exists, checks whether the status indicated by the packet is legal, and then passes the packet to the application layer. If the packet is found to be illegal in the check, for example, the destination port pointed to by the packet is not open on the local machine, the host operating system protocol stack will respond to the RST packet to tell the other party that the port does not exist. Usually the stateful inspection firewall does something similar, except that the firewall only intercepts illegal packets and does not respond.
  • the stateful inspection firewall can effectively filter the attack packets by determining the status of the ACK packets.
  • the firewall will be overwhelmed and cause the entire network to crash due to the need to maintain a large connection state table and check the status of a large number of ACK packets.
  • the current common processing method is: broadband traffic cleaning.
  • Broadband traffic cleansing to alleviate the pressure on the network and servers from attack traffic.
  • the broadband traffic cleaning solution is mainly divided into three steps: The first step is to use a dedicated detection device to analyze and monitor user traffic.
  • the detecting device reports to the dedicated service management platform to generate a cleaning task, and the user traffic is pulled to the traffic cleaning center.
  • the traffic cleaning center cleans the user traffic that is pulled, and The legitimate user traffic of the cleaned user is injected back to the server.
  • an anti-attack data transmission method including: acquiring a communication protocol message to be transmitted; and preventing data in the information bit of the message protocol header in the message protocol header. Attack preprocessing, generating processing information; storing the foregoing processing information in an extension bit of the communication protocol packet in the header of the packet, to obtain a converted communication protocol packet, wherein the foregoing packet of the communication protocol packet
  • the header includes the above information bit and the extension bit; and the converted communication protocol message is sent to the receiving device
  • the anti-attack pre-processing of the data in the information protocol bit of the packet in the foregoing communication protocol packet includes at least one of: adjusting an order of the data on the information bit; or The data is compressed in whole or in part, and the characters are padded to the compressed idle position; or the data on the information bits are encrypted in whole or in part; or the data on the information bits are signed in whole or in part.
  • the method further includes: placing, in the communication protocol packet, a partial byte located in the header of the packet Set to the above extension bit.
  • setting a partial byte of the communication protocol packet located at a packet header to an extension bit includes: setting a partial byte in a sequence number and/or a confirmation number in the message header to the extension. Bit.
  • the method before the sending the converted communication protocol packet to the receiving device, the method further includes: determining whether the data traffic of the current communication protocol packet is greater than a predetermined threshold; if the data traffic is greater than the predetermined threshold, reaching the foregoing A gateway-type network device is configured in the transmission link before the receiving device, so that the gateway-type network device and the receiving device forward the converted communication protocol packet to the third-party device for processing.
  • the apparatus for performing anti-attack pre-processing on the data located in the information bit of the packet header in the foregoing communication protocol packet includes at least one of the following: a network card driver, a virtual network card, or a local gateway.
  • an anti-attack data transmission method including: receiving a converted communication protocol packet obtained by anti-attack pre-processing; according to the converted communication protocol packet The processing information of the attack defense pre-processing indicated by the extension bit of the packet header is parsed by the converted communication protocol packet; and the information of the converted communication protocol packet located at the header of the packet header is obtained. Data, wherein the message header of the communication protocol message includes the information bit and the extension bit.
  • the device for parsing the converted communication protocol packet according to the processing information of the anti-attack pre-processing indicated by the extension bit of the packet header in the converted communication protocol packet includes at least one of the following: NIC driver, virtual NIC or local gateway.
  • an anti-attack data transmission device which is located in a sending device, where the device includes: an acquiring unit, configured to acquire a communication protocol packet to be transmitted; and an anti-attack pre-processing unit, The method is configured to perform anti-attack pre-processing on the data in the information packet of the foregoing communication protocol packet to generate processing information, and the saving unit is configured to save the foregoing processing information in the foregoing communication protocol packet in the foregoing packet.
  • the extended communication bit in the header, the converted communication protocol packet wherein the message header of the communication protocol packet includes the information bit and the extension bit
  • the sending unit is configured to send the converted communication Protocol message to the receiving device.
  • the foregoing attack defense pre-processing unit includes at least one of: an adjustment module, configured to adjust a sequence of data on the information bits; or a compression module, configured to perform overall or partial compression on data on the information bits. And filling the character to the compressed idle position; or the encryption module for encrypting the data on the information bit in whole or in part; or the signature module for signing the data on the information bit in whole or in part .
  • the foregoing apparatus further includes: a setting unit, configured to: before the anti-attack pre-processing of the data located in the information bit of the packet header in the communication protocol packet, the communication protocol packet is located in the foregoing report
  • the partial bytes of the header are set to the above extension bits.
  • the setting unit includes: a setting module, configured to: use a serial number and/or a confirmation in the header of the foregoing message Some of the bytes in the number are set to the above extension bits.
  • the device further includes: a determining unit, configured to determine, before sending the converted communication protocol message to the receiving device, whether the data traffic of the current communication protocol packet is greater than a predetermined threshold; When the data traffic is greater than the predetermined threshold, the gateway type network device is configured in the transmission link before reaching the receiving device, so that the gateway network device proxying the receiving device forwards the converted communication protocol packet to the third party device. deal with.
  • a determining unit configured to determine, before sending the converted communication protocol message to the receiving device, whether the data traffic of the current communication protocol packet is greater than a predetermined threshold
  • the gateway type network device is configured in the transmission link before reaching the receiving device, so that the gateway network device proxying the receiving device forwards the converted communication protocol packet to the third party device. deal with.
  • the foregoing attack defense pre-processing unit includes at least one of the following: a network card driver, a virtual network card, or a local gateway.
  • an anti-attack data transmission apparatus which is located in a receiving device, where the apparatus includes: a receiving unit, configured to receive a converted communication protocol report obtained after anti-attack pre-processing
  • the parsing unit is configured to parse the converted communication protocol packet according to the processing information of the anti-attack pre-processing indicated by the extension bit of the packet header in the converted communication protocol packet; And obtaining the data located in the information bit of the message header in the converted communication protocol message, wherein the message header of the communication protocol message includes the information bit and the extension bit.
  • the parsing unit includes at least one of the following: a network card driver, a virtual network card, or a local gateway.
  • the anti-attack pre-processing is performed on the data of the communication protocol packet information to be directly transmitted on the sending device, and the anti-attack pre-processing information is stored in the original communication protocol packet. Further, the converted communication protocol message is sent to the receiving device.
  • the sending device performs the anti-attack pre-processing communication protocol packet on the information bit of the packet header to transmit the normal data traffic and the abnormal data traffic to facilitate the receiving device.
  • FIG. 1 is a flowchart of an optional anti-attack data transmission method according to an embodiment of the present application
  • FIG. 2 is a schematic diagram of an application scenario of an optional attack defense data transmission method according to an embodiment of the present application
  • FIG. 3 is a schematic diagram of an optional anti-attack data transmission method according to an embodiment of the present application.
  • FIG. 4 is a schematic diagram of another optional anti-attack data transmission method according to an embodiment of the present application.
  • FIG. 5 is a schematic diagram of still another optional anti-attack data transmission method according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of still another optional anti-attack data transmission method according to an embodiment of the present application.
  • FIG. 7 is a flowchart of still another optional anti-attack data transmission method according to an embodiment of the present application.
  • FIG. 8 is a schematic diagram of an optional anti-attack data transmission apparatus according to an embodiment of the present application.
  • FIG. 9 is a schematic diagram of another optional anti-attack data transmission apparatus according to an embodiment of the present application.
  • an embodiment of an anti-attack data transmission method is provided, and it should be noted that the steps shown in the flowchart of the accompanying drawings may be executed in a computer system such as a set of computer executable instructions, and Although the logical order is shown in the flowcharts, in some cases the steps shown or described may be performed in a different order than the ones described herein.
  • FIG. 1 is a method for transmitting an attack defense data according to an embodiment of the present application. As shown in FIG. 1 , the method includes the following steps. Step:
  • S104 Perform anti-attack pre-processing on data in the information bit of the packet in the communication protocol packet to generate processing information.
  • the processing information is stored in the extension bit of the communication protocol packet in the packet header, to obtain the converted communication protocol packet, where the packet header of the communication protocol packet includes the information bit and the extension bit;
  • the foregoing attack data transmission method may be, but is not limited to, being applied to an application environment as shown in FIG. 2, and the terminal 202 as a transmitting device passes through the network 204 and as a receiving device according to a predetermined communication protocol.
  • the server 206 communicates, wherein the network may include, but is not limited to, a local area network, a metropolitan area network, or a wide area network, and the foregoing terminals may include, but are not limited to, a mobile phone, a PC, a notebook, or a tablet.
  • the network may include, but is not limited to, a local area network, a metropolitan area network, or a wide area network
  • the foregoing terminals may include, but are not limited to, a mobile phone, a PC, a notebook, or a tablet.
  • the above is only an example, and the embodiment does not limit this.
  • the foregoing sending device may be, but is not limited to, an collecting device that can collect data in the network, for example, a router, and can collect the communication protocol packet to be transmitted through the NET FLOW protocol.
  • the terminal 202 after obtaining the communication protocol packet to be transmitted, the terminal 202, as the transmitting device, performs anti-attack pre-processing on the data located in the information bit of the packet header in the communication protocol packet, and generates corresponding processing.
  • the information is saved in the extension bit of the communication protocol packet in the packet header to obtain the converted communication protocol packet, and further, the converted communication protocol packet is sent to the server as the receiving device. 206.
  • the anti-attack pre-processing is performed on the data on the information packet of the communication protocol packet to be directly transmitted on the transmitting device, and the processing information of the anti-attack pre-processing is stored in the original communication.
  • the newly set extension bit in the protocol packet wherein the operation of the anti-attack pre-processing is performed by the sending device and the receiving device to perform an operation on the data on the packet header information bit to achieve the security defense communication process.
  • the purpose of the aggressive act That is, after the sending device performs anti-attack pre-processing with the receiving device, the receiving device can directly parse according to the convention. If the data can be parsed, it is normal data traffic.
  • the attack behavior corresponding to the abnormal data traffic can be defended. Further, in the process of the communication device communicating with the receiving device according to the communication protocol, the security and accuracy of the data transmission are improved without affecting the normal communication, and the normal transmission caused by the existing anti-attack mode is avoided. The problem of data traffic.
  • the foregoing communication protocol packet may be, but is not limited to, a Transmission Control Protocol (TCP), where the data format of the TCP protocol packet may be as follows:
  • TCP Transmission Control Protocol
  • the header length, URG, ACK, RST, SYN, FIN, window size, TCP checksum, and emergency pointer are all information bits that contain important information in the TCP protocol packet.
  • the entire TCP protocol packet is defended against attack protection, but the data on the information bit of the packet header is used for anti-attack pre-processing protection, thereby facilitating the receiving device to receive.
  • the TCP protocol packet is received, all data traffic can be cleaned and filtered without using broadband traffic cleaning to avoid the problem that normal data traffic is mistakenly killed as abnormal data traffic.
  • the receiving device can directly parse the communication protocol packet forged by the attacking end by determining whether the data in the corresponding information bit can be parsed according to the agreed manner, thereby further improving the accuracy of the attack defense behavior during the data transmission process.
  • the format of the packet of the converted communication protocol packet is as follows:
  • the extension bit in the foregoing communication protocol packet may be, but is not limited to, an extension bit added in the original communication protocol packet, that is, without increasing the packet length. , set part of the location to An extension bit for storing processing information for anti-attack pre-processing. Therefore, the security of data transmission is ensured without increasing the packet load overhead.
  • the foregoing attack defense pre-processing may include, but is not limited to, at least one of the following operations:
  • the above information bits are used to refer to data on all information bits, and the information bits are used to refer to data in partial information bits.
  • the above-described padding characters may be, but are not limited to, characters having no practical meaning, and may be, but are not limited to, extension bits as other information. This embodiment does not limit this.
  • the method before sending the converted communication protocol packet to the receiving device, the method further includes: S1, deploying the network device. That is, the network devices in the network are laid out according to the actual transmitted data traffic.
  • a gateway type network device is set between the sending device and the receiving device, so that the network device forwards part of the data traffic to the third-party receiving device to avoid The original receiving device is overloaded, so as to reduce the load on the device and avoid the system crash due to overload of the receiving device.
  • the anti-attack pre-processing of the communication protocol packet to be transmitted may be directly performed by setting at least one of the following devices on the sending side: network card driver, virtual NIC or local gateway.
  • the anti-attack pre-processing is performed on the data of the communication protocol packet information to be directly transmitted on the sending device, and the processing information of the anti-attack pre-processing is stored in the original communication protocol packet.
  • the converted communication protocol message is sent to the receiving device.
  • the sending device performs the anti-attack pre-processing communication protocol packet on the information bit of the packet header to transmit the normal data traffic and the abnormal data traffic to facilitate the receiving device.
  • the anti-attack pre-processing of the data in the information packet of the packet in the communication protocol packet includes at least one of the following:
  • the following example is used to illustrate that the information bits in the header of the TCP protocol packet include the header length, URG, ACK, RST, SYN, FIN, window size, TCP checksum, and emergency pointer.
  • the order of the data may be adjusted accordingly to ensure that the TCP protocol is reached during the normal encapsulation and transmission of the TCP protocol packets.
  • the packet is used for anti-attack pre-processing.
  • the data format of the converted TCP protocol packet can be as follows:
  • the information bits in the header of the TCP protocol packet include the header length, URG, ACK, RST, SYN, FIN, window size, TCP checksum, and emergency pointer.
  • the data on the information bits may be compressed in whole or in part to ensure the normal encapsulation and transmission of the TCP protocol packets. The purpose of anti-attack pre-processing for TCP packets is achieved.
  • the data format of the converted TCP protocol packet can be as follows:
  • the local check is performed on the TCP checksum, for example, from 16 bits to 10 bits, and the compressed idle position is filled with a certain character to change the TCP checksum in the communication protocol.
  • the location relationship is known in the text, thereby implementing protection against third-party devices and avoiding attacks generated by third-party devices.
  • the data in the information bits may be compressed in a proportioned manner, and the compression mode is the same as the local compression.
  • all the data on the information bits may be encrypted as a whole, or only the data in some predetermined positions in the information bits may be locally encrypted. This example does not limit the encryption manner.
  • the signature refers to: a digit string that only the sender of the information can generate that cannot be forged by another person, and the digit string is also a valid proof of the authenticity of the information sent by the sender of the information. .
  • all the data on the information bit may be subjected to overall signature authentication, or only partial signature authentication may be performed on the data in a predetermined position in the information bit.
  • This example does not do any way for the signature. limited.
  • the anti-attack pre-processing of the data located in the information bit of the packet header in the communication protocol packet is performed by using the foregoing embodiment, and the data of the packet header is pre-processed. , further improving the security of the communication protocol message to be transmitted, thereby preventing the third party device from deciphering the above preprocessing operation
  • the receiving device can also parse the received converted communication protocol packet in a manner corresponding to the pre-processing operation, and correctly identify the normal data traffic and the abnormal data traffic, thereby overcoming the prior art. Error problem.
  • the method before the anti-attack pre-processing of the data in the information packet of the packet header in the communication protocol packet, the method further includes:
  • S1 Set a part of the byte of the communication protocol message located at the head of the message as an extension bit.
  • setting a partial byte of the communication protocol packet located in the packet header to the extension bit includes: S12, the part of the sequence number and/or the confirmation number in the packet header.
  • the byte is set to an extension bit.
  • the anti-attack data transmission method is implemented based on the TCP protocol packet, and in the embodiment, the packet header of the TCP protocol packet is adopted in consideration of the characteristics of the IP forwarding and the characteristics of the TCP protocol.
  • the original part of the field is set to the extension bit, so that the TCP protocol packet to be transmitted is preprocessed to ensure that the TCP protocol is in the transmission process without increasing the packet load overhead (that is, without increasing the packet length). Compatibility and consistency.
  • the serial number and the confirmation number are both 32 Bit.
  • the role of these two sequence numbers is to identify the length of the last transmitted message.
  • the maximum length of a single message is 8192 bytes (Jumbo frame length).
  • At least one pre-processing operation is performed on the data on the information bit of the message header, TCP header reassembly, obfuscation, encryption, etc., and the converted TCP communication protocol message is sent to the reception. device.
  • the operation of pre-processing the data on the information bit of the message header by using the extended bit record is realized, so that the receiving device can follow the The agreement correctly parses out the corresponding data, thereby achieving accurate differentiation between normal data traffic and abnormal data traffic, and overcoming the problem of accidentally injuring normal transmitted data traffic in the prior art.
  • the method before sending the converted communication protocol packet to the receiving device, the method further includes:
  • the gateway type network device is configured in the transmission link before the receiving device, so that the gateway network device proxy receiving device forwards the converted communication protocol packet to the third-party device for processing.
  • the gateway type network device when the data traffic is greater than a predetermined threshold, between the sending device and the receiving device The gateway type network device is set up, so that the network device forwards part of the data traffic to the third-party receiving device to avoid overloading the original receiving device, thereby reducing the load on the device and avoiding the system crash due to overload of the receiving device.
  • the foregoing predetermined threshold may be, but is not limited to, determined according to a processing load of the receiving device.
  • the TCP protocol packet is used as an example.
  • the terminal 202 as the sending device can determine the receiving device according to the current network traffic. Whether the server 206 can be processed normally. For example, if the predetermined threshold is 100M and the current data traffic is 120M, the terminal 202 as the transmitting device determines that the data traffic is greater than the predetermined threshold after comparison, and the gateway type network device 302 is deployed in the network to enable the gateway type network device. 302 forwards the extra 20M data traffic to the third party device to avoid the system crash due to overload of the receiving device.
  • the relationship between the data traffic of the current communication protocol packet and the predetermined threshold is compared in advance, so as to determine whether the gateway type network device is set in the transmission link, thereby implementing the anti-attack process. Avoid the problem of the system crashing due to overload of the receiving device.
  • the apparatus for performing anti-attack pre-processing on the data in the information packet of the packet header in the communication protocol packet includes at least one of the following: a network card driver, a virtual network card, or a local gateway.
  • a TCP protocol packet is taken as an example, a TCP client 402 is provided on a terminal as a sending device, and a TCP server 404 is provided on a server as a receiving device.
  • the network card driver 406-1 is set in the TCP client as an anti-attack device to implement the pre-processing in the anti-attack transmission method; the network card driver 406-2 is set on the TCP server as the defense
  • the attack detecting device implements the parsing operation in the above attack defense transmission method.
  • the TCP client still uses the physical network card communication normally. Only the NIC driver will detect the destination of the communication. If it finds that it is communicating with the external TCP protocol anti-attack detection device, the data message will be processed according to the format set in advance, and the data message will be sent to the destination as it is.
  • a TCP protocol packet is taken as an example, a TCP client 402 is provided on a terminal as a transmitting device, and a TCP server is provided on a server as a receiving device. 404.
  • the virtual network card 502-1 is set as the anti-attack device on the TCP client to implement the pre-processing in the anti-attack transmission method; the virtual network card 502-2 is set on the TCP server as the defense
  • the attack detecting device implements the parsing operation in the above attack defense transmission method.
  • this type is like a link tunnel.
  • the TCP client only needs to send data to the specified network card. Does not perceive physical link changes in specific operations, all and external TCP protocol defense
  • the communication of the detection device is represented by a virtual network card.
  • the TCP protocol packet is taken as an example, and a TCP client is provided on the terminal as the transmitting device, and a TCP server is provided on the server as the receiving device.
  • the local gateway 602-1 is set as the anti-attack device on the TCP client to implement the pre-processing in the anti-attack transmission method; the local gateway 602-2 is set on the TCP server as the defense
  • the attack detecting device implements the parsing operation in the above attack defense transmission method.
  • the TCP client only needs to establish a communication relationship with the local gateway in this scenario.
  • the local gateway is responsible for communicating with the external TCP protocol anti-attack detection device.
  • the foregoing anti-attack data transmission is implemented by different devices to implement diversification of anti-attack control.
  • an embodiment of an anti-attack data transmission method is provided, and it should be noted that the steps shown in the flowchart of the accompanying drawings may be executed in a computer system such as a set of computer executable instructions, and Although the logical order is shown in the flowcharts, in some cases the steps shown or described may be performed in a different order than the ones described herein.
  • FIG. 7 is a method for transmitting an attack defense data according to an embodiment of the present application. As shown in FIG. 7, the method includes the following steps:
  • S704 Parsing the converted communication protocol packet according to the processing information of the anti-attack pre-processing indicated by the extension bit of the packet in the converted communication protocol packet;
  • S706 Obtain data in the information bit of the packet in the converted communication protocol packet, where the packet header of the communication protocol packet includes an information bit and an extension bit.
  • the foregoing attack data transmission method may be, but is not limited to, being applied to an application environment as shown in FIG. 2, and the terminal 202 as a transmitting device passes through the network 204 and as a receiving device according to a predetermined communication protocol.
  • the server 206 communicates, wherein the network may include, but is not limited to, a local area network, a metropolitan area network, or a wide area network, and the foregoing terminals may include, but are not limited to, a mobile phone, a PC, a notebook, or a tablet.
  • the network may include, but is not limited to, a local area network, a metropolitan area network, or a wide area network
  • the foregoing terminals may include, but are not limited to, a mobile phone, a PC, a notebook, or a tablet.
  • the above is only an example, and the embodiment does not limit this.
  • the foregoing receiving device may also be, but not limited to, a router.
  • the anti-attack pre-processing information indicated by the extension bit in the header of the received communication protocol packet is parsed by the predetermined program installed in the router to obtain the converted communication protocol packet. .
  • the server 206 as the receiving device receives the converted communication protocol message obtained after the anti-attack pre-processing; further, according to the extension indicated by the extension bit in the packet header of the converted communication protocol message
  • the processing information of the attack pre-processing parses the converted communication protocol packet to obtain the data in the information bit of the packet in the converted communication protocol packet, wherein the packet header of the communication protocol packet includes information. Bit and extension bits.
  • the anti-attack pre-processing is performed on the data on the information packet of the communication protocol packet to be directly transmitted on the transmitting device, and the processing information of the anti-attack pre-processing is stored in the original communication.
  • the newly set extension bit in the protocol packet so that the receiving device can parse and obtain the data on the header information bit according to the agreement of both parties. If the data can be parsed correctly, it is normal data traffic, if it cannot be correctly parsed. If it can be determined as abnormal data traffic, it can be directly discarded to prevent the attack behavior corresponding to the abnormal data traffic. Further, in the process of the communication device communicating with the receiving device according to the communication protocol, the security and accuracy of the data transmission are improved without affecting the normal communication, and the normal transmission caused by the existing anti-attack mode is avoided. The problem of data traffic.
  • the foregoing communication protocol packet may be, but is not limited to, a Transmission Control Protocol (TCP), where the data format of the TCP protocol packet may be as follows:
  • TCP Transmission Control Protocol
  • the header length, URG, ACK, RST, SYN, FIN, window size, TCP checksum, and emergency pointer are all information bits that contain important information in the TCP protocol packet.
  • the entire TCP protocol packet is defended against attack protection, but the data on the information bit of the packet header is used for anti-attack pre-processing protection, thereby facilitating the receiving device to receive.
  • the TCP protocol packet is sent, all data traffic can be cleaned and filtered without using broadband traffic cleaning. Avoid the problem of normal data traffic being mistaken for abnormal data traffic.
  • the receiving device can directly parse the communication protocol packet forged by the attacking end by determining whether the data in the corresponding information bit can be parsed according to the agreed manner, thereby further improving the accuracy of the attack defense behavior during the data transmission process.
  • the format of the packet of the converted communication protocol packet is as follows:
  • the extension bit in the foregoing communication protocol packet may be, but is not limited to, an extension bit added in the original communication protocol packet, that is, without increasing the packet length.
  • the foregoing attack defense pre-processing may include, but is not limited to, at least one of the following operations:
  • the above information bits are used to refer to data on all information bits, and the information bits are used to refer to data in partial information bits.
  • the above-described padding characters may be, but are not limited to, characters having no practical meaning, and may be, but are not limited to, extension bits as other information. This embodiment does not limit this.
  • the method before sending the converted communication protocol packet to the receiving device, the method further includes: S1, deploying the network device. That is, the network devices in the network are laid out according to the actual transmitted data traffic.
  • a gateway type network device is set between the sending device and the receiving device, so that the network device forwards part of the data traffic to the third-party receiving device to avoid The original receiving device is overloaded, so as to reduce the load on the device and avoid the system of the receiving device due to overload. The problem of crashing.
  • the anti-attack pre-processing of the communication protocol packet to be transmitted may be directly performed by setting at least one of the following devices on the sending side: network card driver, virtual NIC or local gateway.
  • the server 206 as the receiving device receives the converted communication protocol message obtained after the anti-attack pre-processing; further, according to the extended bit in the packet header of the converted communication protocol message
  • the processing information of the attack defense pre-processing is analyzed to parse the converted communication protocol packet, so as to obtain the data located in the information bit of the packet header in the converted communication protocol packet, where the packet of the communication protocol packet is received.
  • the header includes information bits and extension bits.
  • the receiving device parses the data on the information bit of the packet header of the received communication protocol packet, processes the correctly parsed normal data traffic, and filters out the abnormal data traffic to implement
  • the normal data traffic is differentiated from the abnormal data traffic, so that the receiving device can obtain the communication protocol packets that are correctly parsed, and filter out the abnormal packets that cannot be correctly parsed, so as to achieve accurate defense communication without affecting normal communication.
  • the purpose of the attack behavior that occurs during the process, thereby avoiding the problem of accidentally injuring normal transmitted data traffic caused by the existing attack defense mode.
  • the device for parsing the converted communication protocol packet according to the processing information of the anti-attack pre-processing indicated by the extension bit of the packet in the converted communication protocol packet includes at least one of the following : NIC driver, virtual NIC or local gateway.
  • a TCP protocol packet is taken as an example, a TCP client 402 is provided on a terminal as a sending device, and a TCP server 404 is provided on a server as a receiving device.
  • the network card driver 406-1 is set in the TCP client as an anti-attack device to implement the pre-processing in the anti-attack transmission method; the network card driver 406-2 is set on the TCP server as the defense
  • the attack detecting device implements the parsing operation in the above attack defense transmission method.
  • the TCP client still uses the physical network card communication normally. Only the NIC driver will detect the destination of the communication. If it finds that it is communicating with the external TCP protocol anti-attack detection device, the data message will be processed according to the format set in advance, and the data message will be sent to the destination as it is.
  • a TCP protocol packet is taken as an example, a TCP client 402 is provided on a terminal as a transmitting device, and a TCP server is provided on a server as a receiving device. 404.
  • the virtual network card 502-1 is set as the anti-attack device on the TCP client to implement the pre-processing in the anti-attack transmission method; the virtual network card 502-2 is set on the TCP server as the defense Attack detection device. To implement the parsing operation in the above anti-attack transmission method.
  • this type is like a link tunnel.
  • the TCP client only needs to send data to the specified network card.
  • the physical link changes are not perceived in the specific operation, and all communication with the external TCP protocol anti-attack detection device is represented by the virtual network card.
  • the TCP protocol packet is taken as an example, and a TCP client is provided on the terminal as the transmitting device, and a TCP server is provided on the server as the receiving device.
  • the local gateway 602-1 is set as the anti-attack device on the TCP client to implement the pre-processing in the anti-attack transmission method; the local gateway 602-2 is set on the TCP server as the defense
  • the attack detecting device implements the parsing operation in the above attack defense transmission method.
  • the TCP client only needs to establish a communication relationship with the local gateway in this scenario.
  • the local gateway is responsible for communicating with the external TCP protocol anti-attack detection device.
  • the foregoing anti-attack data transmission is implemented by different devices to implement diversification of anti-attack control.
  • an embodiment of an anti-attack data transmission apparatus is provided.
  • the apparatus is located in a transmitting apparatus. As shown in FIG. 8, the apparatus includes:
  • an obtaining unit 802 configured to obtain a communication protocol packet to be transmitted
  • the attack defense pre-processing unit 804 is configured to perform anti-attack pre-processing on the data located in the information bit of the packet header in the communication protocol packet, and generate processing information;
  • the saving unit 806 is configured to save the processing information in the extension bit of the communication protocol packet in the packet header to obtain the converted communication protocol packet, where the packet header of the communication protocol packet includes information. Bit and extension bit;
  • the sending unit 808 is configured to send the converted communication protocol message to the receiving device.
  • the foregoing attack data transmission device may be, but is not limited to, applied to an application environment as shown in FIG. 2, and the terminal 202 as the transmitting device passes through the network 204 and serves as a receiving device according to a predetermined communication protocol.
  • the server 206 communicates, wherein the network may include, but is not limited to, a local area network, a metropolitan area network, or a wide area network, and the foregoing terminals may include, but are not limited to, a mobile phone, a PC, a notebook, or a tablet.
  • the above is only an example, and the embodiment does not limit this.
  • the foregoing sending device may be, but is not limited to, an collecting device that can collect data in the network, for example, a router, and can collect the communication protocol packet to be transmitted through the NET FLOW protocol.
  • the terminal 202 After obtaining the communication protocol message to be transmitted, the terminal 202, which is the transmitting device, will contact the communication protocol.
  • the data in the information bit at the head of the message is pre-attacked and pre-processed, and the corresponding processing information is generated, and the processing information is stored in the extension bit of the communication protocol packet in the packet header.
  • the converted communication protocol message is obtained, and further, the converted communication protocol message is sent to the server 206 as the receiving device.
  • the anti-attack pre-processing is performed on the data on the information packet of the communication protocol packet to be directly transmitted on the transmitting device, and the processing information of the anti-attack pre-processing is stored in the original communication.
  • the newly set extension bit in the protocol packet wherein the operation of the anti-attack pre-processing is performed by the sending device and the receiving device to perform an operation on the data on the packet header information bit to achieve the security defense communication process.
  • the purpose of the aggressive act That is, after the sending device performs anti-attack pre-processing with the receiving device, the receiving device can directly parse according to the convention. If the data can be parsed, it is normal data traffic.
  • the attack behavior corresponding to the abnormal data traffic can be defended. Further, in the process of the communication device communicating with the receiving device according to the communication protocol, the security and accuracy of the data transmission are improved without affecting the normal communication, and the normal transmission caused by the existing anti-attack mode is avoided. The problem of data traffic.
  • the foregoing communication protocol packet may be, but is not limited to, a Transmission Control Protocol (TCP), where the data format of the TCP protocol packet may be as follows:
  • TCP Transmission Control Protocol
  • the header length, URG, ACK, RST, SYN, FIN, window size, TCP checksum, and emergency pointer are all information bits that contain important information in the TCP protocol packet.
  • the entire TCP protocol packet is defended against attack protection, but the data on the information bit of the packet header is used for anti-attack pre-processing protection, thereby facilitating the receiving device to receive.
  • all data traffic can be cleaned and filtered without using broadband traffic cleaning to avoid the problem that normal data traffic is killed as abnormal data traffic.
  • the receiving device can directly parse the communication protocol packet forged by the attacking end by determining whether the data in the corresponding information bit can be parsed according to the agreed manner, thereby further improving the accuracy of the attack defense behavior during the data transmission process.
  • the format of the packet of the converted communication protocol packet is as follows:
  • the extension bit in the foregoing communication protocol packet may be, but is not limited to, an extension bit added in the original communication protocol packet, that is, without increasing the packet length.
  • the foregoing attack defense pre-processing may include, but is not limited to, at least one of the following operations:
  • the above information bits are used to refer to data on all information bits, and the information bits are used to refer to data in partial information bits.
  • the above-described padding characters may be, but are not limited to, characters having no practical meaning, and may be, but are not limited to, extension bits as other information. This embodiment does not limit this.
  • the method before sending the converted communication protocol packet to the receiving device, the method further includes: S1, deploying the network device. That is, the network devices in the network are laid out according to the actual transmitted data traffic.
  • a gateway type network device is set between the sending device and the receiving device, so that the network device forwards part of the data traffic to the third-party receiving device to avoid The original receiving device is overloaded, so as to reduce the load of the device and avoid the system crash due to overload of the receiving device.
  • the anti-attack pre-processing of the communication protocol packet to be transmitted may be directly performed by setting at least one of the following devices on the sending side: network card driver, virtual NIC or local gateway.
  • the anti-attack pre-processing is performed on the data of the communication protocol packet information to be directly transmitted on the sending device, and the processing information of the anti-attack pre-processing is stored in the original communication protocol packet.
  • the converted communication protocol message is sent to the receiving device.
  • the sending device performs the anti-attack pre-processing communication protocol packet on the information bit of the packet header to transmit the normal data traffic and the abnormal data traffic to facilitate the receiving device.
  • the anti-attack pre-processing unit 804 includes at least one of the following:
  • the following example is used to illustrate that the information bits in the header of the TCP protocol packet include the header length, URG, ACK, RST, SYN, FIN, window size, TCP checksum, and emergency pointer.
  • the order of the data may be adjusted accordingly to ensure that the TCP protocol is reached during the normal encapsulation and transmission of the TCP protocol packets.
  • the packet is used for anti-attack pre-processing.
  • the data format of the converted TCP protocol packet can be as follows:
  • the information bits in the header of the TCP protocol packet include the header length, URG, ACK, RST, SYN, FIN, window size, TCP checksum, and emergency pointer.
  • the data on the information bits may be compressed in whole or in part to ensure the normal encapsulation and transmission of the TCP protocol packets. The purpose of anti-attack pre-processing for TCP packets is achieved.
  • the data format of the converted TCP protocol packet can be as follows:
  • the local check is performed on the TCP checksum, for example, from 16 bits to 10 bits, and the compressed idle position is filled with a certain character to change the TCP checksum in the communication protocol.
  • the location relationship is known in the text, thereby implementing protection against third-party devices and avoiding attacks generated by third-party devices.
  • the data in the information bits may be compressed in a proportioned manner, and the compression mode is the same as the local compression.
  • an encryption module for encrypting the data on the information bits in whole or in part;
  • all the data on the information bits may be encrypted as a whole, or only the data in some predetermined positions in the information bits may be locally encrypted. This example does not limit the encryption manner.
  • a signature module for signing the data on the information bits in whole or in part.
  • the signature refers to: a digit string that only the sender of the information can generate that cannot be forged by another person, and the digit string is also a valid proof of the authenticity of the information sent by the sender of the information. .
  • all the data on the information bit may be subjected to overall signature authentication, or only partial signature authentication may be performed on the data in a predetermined position in the information bit.
  • This example does not do any way for the signature. limited.
  • the anti-attack pre-processing of the data located in the information bit of the packet header in the communication protocol packet is performed by using the foregoing embodiment, and the data of the packet header is pre-processed. Further, the security of the communication protocol packet to be transmitted is further improved, so that the third-party device can prevent the third-party device from attacking after the operation of decomposing the pre-processing; further, the receiving device can be parsed and received according to the manner corresponding to the pre-processing operation.
  • the converted communication protocol message correctly identifies normal data traffic and abnormal data traffic, and overcomes the error problem occurring in the prior art.
  • the above device further includes:
  • a setting unit configured to set a partial byte of the communication protocol message at the head of the message to be extended before performing anti-attack pre-processing on the data in the information bit of the message header in the communication protocol message. Bit.
  • the setting unit includes:
  • a setting module for setting a partial byte in the serial number and/or the confirmation number in the message header as an extension bit.
  • the anti-attack data transmission apparatus is implemented based on the TCP protocol packet, and in the embodiment, the packet header of the TCP protocol packet is adopted in consideration of the characteristics of the IP forwarding and the characteristics of the TCP protocol.
  • the original part of the field is set to the extension bit, so that the TCP protocol packet to be transmitted is preprocessed to ensure that the TCP protocol is in the transmission process without increasing the packet load overhead (that is, without increasing the packet length). Compatibility and consistency.
  • the serial number and the confirmation number are both 32 Bit.
  • the role of these two sequence numbers is to identify the length of the last transmitted message.
  • the maximum length of a single message is 8192 bytes (Jumbo frame length).
  • the data on the information bit performs at least one pre-processing operation such as signature, TCP header reassembly, obfuscation, encryption, etc., and sends the converted TCP communication protocol message to the receiving device.
  • pre-processing operation such as signature, TCP header reassembly, obfuscation, encryption, etc.
  • the operation of pre-processing the data on the information bit of the message header by using the extended bit record is realized, so that the receiving device can follow the The agreement correctly parses out the corresponding data, thereby achieving accurate differentiation between normal data traffic and abnormal data traffic, and overcoming the problem of accidentally injuring normal transmitted data traffic in the prior art.
  • the above device further includes:
  • a judging unit configured to determine whether the data traffic of the current communication protocol packet is greater than a predetermined threshold before transmitting the converted communication protocol packet to the receiving device;
  • a configuration unit configured to configure a gateway type network device in a transmission link before reaching the receiving device when the data traffic is greater than a predetermined threshold, so that the gateway type network device proxy receiving device forwards the converted communication protocol packet to Third-party device processing.
  • a gateway type network device is set between the sending device and the receiving device, so that the network device forwards part of the data traffic to the third-party receiving device to avoid The original receiving device is overloaded, so as to reduce the load on the device and avoid the system crash due to overload of the receiving device.
  • the foregoing predetermined threshold may be, but is not limited to, determined according to a processing load of the receiving device.
  • the TCP protocol packet is used as an example.
  • the terminal 202 as the sending device can determine the receiving device according to the current network traffic. Whether the server 206 can be processed normally. For example, if the predetermined threshold is 100M and the current data traffic is 120M, the terminal 202 as the transmitting device determines that the data traffic is greater than the predetermined threshold after comparison, and the gateway type network device 302 is deployed in the network to enable the gateway type network device. 302 forwards the extra 20M data traffic to the third party device to avoid the system crash due to overload of the receiving device.
  • the relationship between the data traffic of the current communication protocol packet and the predetermined threshold is compared in advance, so as to determine whether the gateway type network device is set in the transmission link, thereby implementing the anti-attack process. Avoid the problem of the system crashing due to overload of the receiving device.
  • the anti-attack pre-processing unit includes at least one of the following: a network card driver, a virtual network card, or a local gateway.
  • a TCP protocol packet is taken as an example, a TCP client 402 is provided on a terminal as a sending device, and a TCP server 404 is provided on a server as a receiving device.
  • the network card driver 406-1 is set in the TCP client as an anti-attack device to implement the pre-processing operation in the anti-attack transmission device; the network card driver 406-2 is set on the TCP server as the anti-attack detection. Apparatus to implement an analysis operation in the above-described attack defense transmission device.
  • the TCP client still uses the physical network card communication normally. Only the NIC driver will detect the destination of the communication. If it finds that it is communicating with the external TCP protocol anti-attack detection device, the data message will be processed according to the format set in advance, and the data message will be sent to the destination as it is.
  • a TCP protocol packet is taken as an example, a TCP client 402 is provided on a terminal as a transmitting device, and a TCP server is provided on a server as a receiving device. 404.
  • the virtual network card 502-1 is set as the anti-attack device on the TCP client to implement the pre-processing operation in the anti-attack transmission device; the virtual network card 502-2 is set on the TCP server as the defense An attack detection device to implement an analysis operation in the above-described attack defense transmission device.
  • this type is like a link tunnel.
  • the TCP client only needs to send data to the specified network card.
  • the physical link changes are not perceived in the specific operation, and all communication with the external TCP protocol anti-attack detection device is represented by the virtual network card.
  • the TCP protocol packet is taken as an example, and a TCP client is provided on the terminal as the transmitting device, and a TCP server is provided on the server as the receiving device.
  • the local gateway 602-1 is set as the anti-attack device on the TCP client to implement the pre-processing operation in the anti-attack transmission device; the local gateway 602-2 is set as the defense on the TCP server.
  • An attack detection device to implement an analysis operation in the above-described attack defense transmission device.
  • the TCP client only needs to establish a communication relationship with the local gateway in this scenario.
  • the local gateway is responsible for communicating with the external TCP protocol anti-attack detection device.
  • the foregoing anti-attack data transmission is implemented by different devices to implement diversification of anti-attack control.
  • an embodiment of an anti-attack data transmission apparatus is provided.
  • the apparatus is located in a receiving device. As shown in FIG. 9, the apparatus includes:
  • the receiving unit 902 is configured to receive the converted communication protocol packet obtained after the anti-attack pre-processing
  • the parsing unit 904 is configured to parse the converted communication protocol packet according to the processing information of the anti-attack pre-processing indicated by the extension bit in the packet header of the converted communication protocol packet;
  • the obtaining unit 906 is configured to obtain the number of information bits located in the header of the message in the converted communication protocol packet.
  • the message header of the communication protocol message includes an information bit and an extension bit.
  • the foregoing attack data transmission device may be, but is not limited to, applied to an application environment as shown in FIG. 2, and the terminal 202 as the transmitting device passes through the network 204 and serves as a receiving device according to a predetermined communication protocol.
  • the server 206 communicates, wherein the network may include, but is not limited to, a local area network, a metropolitan area network, or a wide area network, and the foregoing terminals may include, but are not limited to, a mobile phone, a PC, a notebook, or a tablet.
  • the above is only an example, and the embodiment does not limit this.
  • the foregoing receiving device may also be, but not limited to, a router.
  • the anti-attack pre-processing information indicated by the extension bit in the header of the received communication protocol packet is parsed by the predetermined program installed in the router to obtain the converted communication protocol packet. .
  • the server 206 as the receiving device receives the converted communication protocol message obtained after the anti-attack pre-processing; further, according to the extension indicated by the extension bit in the packet header of the converted communication protocol message
  • the processing information of the attack pre-processing parses the converted communication protocol packet to obtain the data in the information bit of the packet in the converted communication protocol packet, wherein the packet header of the communication protocol packet includes information. Bit and extension bits.
  • the anti-attack pre-processing is performed on the data on the information packet of the communication protocol packet to be directly transmitted on the transmitting device, and the processing information of the anti-attack pre-processing is stored in the original communication.
  • the newly set extension bit in the protocol packet so that the receiving device can parse and obtain the data on the header information bit according to the agreement of both parties. If the data can be parsed correctly, it is normal data traffic, if it cannot be correctly parsed. If it can be determined as abnormal data traffic, it can be directly discarded to prevent the attack behavior corresponding to the abnormal data traffic. Further, in the process of the communication device communicating with the receiving device according to the communication protocol, the security and accuracy of the data transmission are improved without affecting the normal communication, and the normal transmission caused by the existing anti-attack mode is avoided. The problem of data traffic.
  • the foregoing communication protocol packet may be, but is not limited to, a Transmission Control Protocol (TCP), where the data format of the TCP protocol packet may be as follows:
  • TCP Transmission Control Protocol
  • the header length, URG, ACK, RST, SYN, FIN, window size, TCP checksum, and emergency pointer are all information bits that contain important information in the TCP protocol packet.
  • the entire TCP protocol packet is defended against attack protection, but the data on the information bit of the packet header is used for anti-attack pre-processing protection, thereby facilitating the receiving device to receive.
  • the TCP protocol packet is received, all data traffic can be cleaned and filtered without using broadband traffic cleaning to avoid the problem that normal data traffic is mistakenly killed as abnormal data traffic.
  • the receiving device can directly parse the communication protocol packet forged by the attacking end by determining whether the data in the corresponding information bit can be parsed according to the agreed manner, thereby further improving the accuracy of the attack defense behavior during the data transmission process.
  • the format of the packet of the converted communication protocol packet is as follows:
  • the extension bit in the foregoing communication protocol packet may be, but is not limited to, an extension bit added in the original communication protocol packet, that is, without increasing the packet length.
  • the foregoing attack defense pre-processing may include, but is not limited to, at least one of the following operations:
  • the above information bits are used to refer to data on all information bits, and the information bits are used to refer to data in partial information bits.
  • the above-described padding characters may be, but are not limited to, characters having no practical meaning, and may be, but are not limited to, extension bits as other information. This embodiment does not limit this.
  • the method before sending the converted communication protocol packet to the receiving device, the method further includes: S1, deploying the network device. That is, the network devices in the network are laid out according to the actual transmitted data traffic.
  • a gateway type network device is set between the sending device and the receiving device, so that the network device forwards part of the data traffic to the third-party receiving device to avoid The original receiving device is overloaded, so as to reduce the load on the device and avoid the system crash due to overload of the receiving device.
  • the anti-attack pre-processing of the communication protocol packet to be transmitted may be directly performed by setting at least one of the following devices on the sending side: network card driver, virtual NIC or local gateway.
  • the server 206 as the receiving device receives the converted communication protocol message obtained after the anti-attack pre-processing; further, according to the extended bit in the packet header of the converted communication protocol message
  • the processing information of the attack defense pre-processing is analyzed to parse the converted communication protocol packet, so as to obtain the data located in the information bit of the packet header in the converted communication protocol packet, where the packet of the communication protocol packet is received.
  • the header includes information bits and extension bits.
  • the receiving device parses the data on the information bit of the packet header of the received communication protocol packet, processes the correctly parsed normal data traffic, and filters out the abnormal data traffic to implement
  • the normal data traffic is differentiated from the abnormal data traffic, so that the receiving device can obtain the communication protocol packets that are correctly parsed, and filter out the abnormal packets that cannot be correctly parsed, so as to achieve accurate defense communication without affecting normal communication.
  • the purpose of the attack behavior that occurs during the process, thereby avoiding the problem of accidentally injuring normal transmitted data traffic caused by the existing attack defense mode.
  • the parsing unit 904 includes at least one of the following: a network card driver, a virtual network card, or a local gateway.
  • a TCP protocol packet is taken as an example, a TCP client 402 is provided on a terminal as a sending device, and a TCP server 404 is provided on a server as a receiving device.
  • the network card driver 406-1 is set on the TCP client as an anti-attack device to implement the above-mentioned anti-attack transmission.
  • the pre-processing operation in the transmission device; the network card driver 406-2 is set on the TCP server as an anti-attack detection device to implement the parsing operation in the above-described anti-attack transmission device.
  • the TCP client still uses the physical network card communication normally. Only the NIC driver will detect the destination of the communication. If it finds that it is communicating with the external TCP protocol anti-attack detection device, the data message will be processed according to the format set in advance, and the data message will be sent to the destination as it is.
  • a TCP protocol packet is taken as an example, a TCP client 402 is provided on a terminal as a transmitting device, and a TCP server is provided on a server as a receiving device. 404.
  • the virtual network card 502-1 is set as the anti-attack device on the TCP client to implement the pre-processing operation in the anti-attack transmission device; the virtual network card 502-2 is set on the TCP server as the defense An attack detection device to implement an analysis operation in the above-described attack defense transmission device.
  • this type is like a link tunnel.
  • the TCP client only needs to send data to the specified network card.
  • the physical link changes are not perceived in the specific operation, and all communication with the external TCP protocol anti-attack detection device is represented by the virtual network card.
  • the TCP protocol packet is taken as an example, and a TCP client is provided on the terminal as the transmitting device, and a TCP server is provided on the server as the receiving device.
  • the local gateway 602-1 is set as the anti-attack device on the TCP client to implement the pre-processing operation in the anti-attack transmission device; the local gateway 602-2 is set as the defense on the TCP server.
  • An attack detection device to implement an analysis operation in the above-described attack defense transmission device.
  • the TCP client only needs to establish a communication relationship with the local gateway in this scenario.
  • the local gateway is responsible for communicating with the external TCP protocol anti-attack detection device.
  • the foregoing anti-attack data transmission is implemented by different devices to implement diversification of anti-attack control.
  • Embodiments of the present application may provide a computer terminal, which may be any one of computer terminal groups.
  • the foregoing computer terminal may also be replaced with a terminal device such as a mobile terminal.
  • the computer terminal may be located in at least one network device of the plurality of network devices of the computer network.
  • the computer terminal may execute the program code of the following steps in the vulnerability detection method of the application:
  • S2 performing anti-attack pre-processing on data in the information bit of the packet in the communication protocol packet to generate processing information
  • the processing information is stored in the extension bit of the communication protocol packet in the packet header, and the converted communication protocol packet is obtained, where the packet header of the communication protocol packet includes an information bit and an extension bit;
  • Embodiments of the present application may provide a computer server, which may be any one of computer server servers.
  • the foregoing computer server may be located in at least one network device of the plurality of network devices of the computer network.
  • the computer terminal may execute the program code of the following steps in the vulnerability detection method of the application:
  • S2 parsing the converted communication protocol packet according to the processing information of the anti-attack pre-processing indicated by the extension bit of the packet header in the converted communication protocol packet;
  • S3 Obtain data in the information bit of the packet in the converted communication protocol packet, where the packet header of the communication protocol packet includes an information bit and an extension bit.
  • Embodiments of the present application also provide a storage medium.
  • the foregoing storage medium may be used to save the program code executed by the attack defense data transmission method provided in the first embodiment.
  • the storage medium is arranged to store program code for performing the following steps:
  • S2 performing anti-attack pre-processing on data in the information bit of the packet in the communication protocol packet to generate processing information
  • the processing information is stored in the extension bit of the communication protocol packet in the packet header, to obtain the converted communication protocol packet, wherein the packet header of the communication protocol packet includes the information bit and the extension bit;
  • the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • a mobile hard disk e.g., a hard disk
  • magnetic memory e.g., a hard disk
  • Embodiments of the present application also provide a storage medium.
  • the foregoing storage medium may be used to save the program code executed by the attack defense data transmission method provided in the first embodiment.
  • the storage medium is arranged to store program code for performing the following steps:
  • S2 parsing the converted communication protocol packet according to the processing information of the anti-attack pre-processing indicated by the extension bit of the packet header in the converted communication protocol packet;
  • S3 Obtain data in the information bit of the packet in the converted communication protocol packet, where the packet header of the communication protocol packet includes an information bit and an extension bit.
  • the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • a mobile hard disk e.g., a hard disk
  • magnetic memory e.g., a hard disk
  • the disclosed technical contents may be implemented in other manners.
  • the device embodiments described above are merely illustrative, such as the division of the unit, In view of a logical function division, there may be another division manner in actual implementation, for example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, unit or module, and may be electrical or otherwise.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present invention which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明公开了一种防攻击数据传输方法及装置。其中，该方法包括：获取待传输的通信协议报文；对通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理，生成处理信息；将处理信息保存在通信协议报文在报文头部中的扩展位上，得到转换后的通信协议报文，其中，通信协议报文的报文头部包括信息位和扩展位；发送转换后的通信协议报文至接收设备。本发明解决了由于采用现有的防攻击方式所导致的误伤正常传输的数据流量的技术问题。

Description

防攻击数据传输方法及装置
本申请要求2015年10月29日递交的申请号为201510719829.1、发明名称为“防攻击数据传输方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及计算机领域，具体而言，涉及一种防攻击数据传输方法及装置。
背景技术
目前，在现有技术中，常见的通信攻击方式包括以下两种：
1、SYN攻击，攻击原理如下：SYN攻击属于DOS攻击的一种，它利用TCP协议缺陷，通过发送大量的半连接请求，耗费CPU和内存资源。SYN攻击除了能影响主机外，还可以危害路由器、防火墙等网络***，事实上SYN攻击并不管目标是什么***，只要这些***打开TCP服务就可以实施。服务器接收到连接请求(syn＝j)，将此信息加入未连接队列，并发送请求包给客户(syn＝k,ack＝j+1)，此时进入SYN_RECV状态。当服务器未收到客户端的确认包时，重发请求包，一直到超时，才将此条目从未连接队列删除。配合IP欺骗，SYN攻击能达到很好的效果，通常，客户端在短时间内伪造大量不存在的IP地址，向服务器不断地发送syn包，服务器回复确认包，并等待客户的确认，由于源地址是不存在的，服务器需要不断的重发直至超时，这些伪造的SYN包将长时间占用未连接队列，正常的SYN请求被丢弃，目标***运行缓慢，严重者引起网络堵塞甚至***瘫痪。
2、ACK攻击，攻击原理如下：在TCP连接建立之后，所有的数据传输TCP报文都是带有ACK标志位的，主机在接收到一个带有ACK标志位的数据包的时候，需要检查该数据包所表示的连接四元组是否存在，如果存在则检查该数据包所表示的状态是否合法，然后再向应用层传递该数据包。如果在检查中发现该数据包不合法，例如该数据包所指向的目的端口在本机并未开放，则主机操作***协议栈会回应RST包告诉对方此端口不存在。通常状态检测防火墙所做的事情与此类似，只不过防火墙只拦截非法的数据包，而不主动回应。
对比主机以及防火墙在接收到ACK报文和SYN报文时所做动作的复杂程度，显然ACK报文带来的负载要小得多。所以在实际环境中，只有当攻击程序每秒钟发送ACK 报文的速率达到一定的程度，才能使主机和防火墙的负载有大的变化。当发包速率很大的时候，主机操作***将耗费大量的精力接收报文、判断状态，同时要主动回应RST报文，正常的数据包就可能无法得到及时的处理。这时候客户端(以IE为例)的表现就是访问页面反应很慢，丢包率较高。但是状态检测的防火墙通过判断ACK报文的状态是否合法，借助其强大的硬件能力可以较为有效的过滤攻击报文。当然如果攻击流量非常大，由于需要维护很大的连接状态表同时要检查数量巨大的ACK报文的状态，防火墙也会不堪重负导致全网瘫痪。
为了解决上述问题，目前常用的处理方式是：宽带流量清洗。通过宽带流量清洗的方式，以减轻来自于攻击流量对网络和服务器造成的压力。其中，宽带流量清洗解决方案主要分为三个步骤：第一步，利用专用的检测设备对用户业务流量进行分析监控。第二步，当服务器遭受到攻击时，检测设备上报给专用的业务管理平台生成清洗任务，将用户流量牵引到流量清洗中心；第三步，流量清洗中心对牵引过来的用户流量进行清洗，并将清洗后的用户合法流量回注到服务器。
但是在现有的清洗方案中，由于通讯协议各有不同，均采用流量清洗的方式来御防攻击，则很有可能会造成误伤，即将正常的数据流量当成攻击流量进行过滤。针对上述的问题，目前尚未提出有效的解决方案。
发明内容
根据本发明实施例的一个方面，提供了一种防攻击数据传输方法，包括：获取待传输的通信协议报文；对上述通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理，生成处理信息；将上述处理信息保存在上述通信协议报文在上述报文头部中的扩展位上，得到转换后的通信协议报文，其中，上述通信协议报文的上述报文头部包括上述信息位和上述扩展位；发送上述转换后的通信协议报文至接收设备
可选地，对上述通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理包括以下至少之一：调整上述信息位上的数据的顺序；或者对上述信息位上的数据进行整体或局部的压缩，并填充字符到压缩后的空闲位置；或者对上述信息位上的数据进行整体或局部的加密；或者对上述信息位上的数据进行整体或局部的签名。
可选地，在对上述通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理之前，还包括：将上述通信协议报文中位于上述报文头部的部分字节设置为上述扩展位。
可选地，将上述通信协议报文中位于报文头部的部分字节设置为扩展位包括：将上述报文头部中的序列号和/或确认号中的部分字节设置为上述扩展位。
可选地，在发送上述转换后的通信协议报文至接收设备之前，还包括：判断当前上述通信协议报文的数据流量是否大于预定阈值；若上述数据流量大于上述预定阈值，则在到达上述接收设备之前的传输链路中配置网关型网络设备，以使上述网关型网络设备代理上述接收设备将上述转换后的通信协议报文转发给第三方设备处理。
可选地，对上述通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理的装置包括以下至少之一：网卡驱动、虚拟网卡或本地网关。
根据本发明实施例的另一方面，还提供了一种防攻击数据传输方法，包括：接收经防攻击预处理后得到的转换后的通信协议报文；根据上述转换后的通信协议报文中位于报文头部的扩展位所指示的上述防攻击预处理的处理信息解析上述转换后的通信协议报文；获取上述转换后的通信协议报文中位于上述报文头部的信息位上的数据，其中，上述通信协议报文的上述报文头部包括上述信息位和上述扩展位。
可选地，根据上述转换后的通信协议报文中位于报文头部的扩展位所指示的上述防攻击预处理的处理信息解析上述转换后的通信协议报文的装置包括以下至少之一：网卡驱动、虚拟网卡或本地网关。
根据本发明实施例的又一方面，还提供了一种防攻击数据传输装置，位于发送设备中，上述装置包括：获取单元，用于获取待传输的通信协议报文；防攻击预处理单元，用于对上述通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理，生成处理信息；保存单元，用于将上述处理信息保存在上述通信协议报文在上述报文头部中的扩展位上，得到转换后的通信协议报文，其中，上述通信协议报文的上述报文头部包括上述信息位和上述扩展位；发送单元，用于发送上述转换后的通信协议报文至接收设备。
可选地，上述防攻击预处理单元包括以下至少之一：调整模块，用于调整上述信息位上的数据的顺序；或者压缩模块，用于对上述信息位上的数据进行整体或局部的压缩，并填充字符到压缩后的空闲位置；或者加密模块，用于对上述信息位上的数据进行整体或局部的加密；或者签名模块，用于对上述信息位上的数据进行整体或局部的签名。
可选地，上述装置还包括：设置单元，用于在对上述通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理之前，将上述通信协议报文中位于上述报文头部的部分字节设置为上述扩展位。
可选地，上述设置单元包括：设置模块，用于将上述报文头部中的序列号和/或确认 号中的部分字节设置为上述扩展位。
可选地，上述装置还包括：判断单元，用于在发送上述转换后的通信协议报文至接收设备之前判断当前上述通信协议报文的数据流量是否大于预定阈值；配置单元，用于在上述数据流量大于上述预定阈值时，在到达上述接收设备之前的传输链路中配置网关型网络设备，以使上述网关型网络设备代理上述接收设备将上述转换后的通信协议报文转发给第三方设备处理。
可选地，上述防攻击预处理单元包括以下至少之一：网卡驱动、虚拟网卡或本地网关。
根据本发明实施例的又一方面，还提供了一种防攻击数据传输装置，位于接收设备中，上述装置包括：接收单元，用于接收经防攻击预处理后得到的转换后的通信协议报文；解析单元，用于根据上述转换后的通信协议报文中位于报文头部的扩展位所指示的上述防攻击预处理的处理信息解析上述转换后的通信协议报文；获取单元，用于获取上述转换后的通信协议报文中位于上述报文头部的信息位上的数据，其中，上述通信协议报文的上述报文头部包括上述信息位和上述扩展位。
可选地，上述解析单元包括以下至少之一：网卡驱动、虚拟网卡或本地网关。
在本发明实施例中，通过在发送设备上直接对待传输的通信协议报文信息位上的数据进行防攻击预处理，并将防攻击预处理的处理信息存储在原有的通信协议报文中新设置的扩展位上，进一步，将转换后的通信协议报文发送至接收设备。也就是说，发送设备通过向接收设备发送对报文头部的信息位上的数据进行过防攻击预处理的通信协议报文，以实现将正常数据流量与异常数据流量进行区分，便于接收设备获取通过正确解析得到的通信协议报文，并过滤掉无法正确解析的异常报文，从而在不影响正常通信的情况下，达到准确御防通信过程中出现的攻击行为的目的，进而避免现有的防攻击方式所导致的误伤正常传输的数据流量的问题。
进一步，在本实施例中，仅对报文头部中的信息位上的数据进行防攻击预处理，以实现对传输链路的透明化，避免转换后的通信协议报文被破译，进一步提高数据传输过程中的安全性。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是根据本申请实施例的一种可选的防攻击的数据传输方法的流程图；
图2是根据本申请实施例的一种可可选的防攻击的数据传输方法的应用场景示意图；
图3是根据本申请实施例的一种可选的防攻击的数据传输方法的示意图；
图4是根据本申请实施例的另一种可选的防攻击的数据传输方法的示意图；
图5是根据本申请实施例的又一种可选的防攻击的数据传输方法的示意图；
图6是根据本申请实施例的又一种可选的防攻击的数据传输方法的示意图；
图7是根据本申请实施例的又一种可选的防攻击的数据传输方法的流程图；
图8是根据本申请实施例的一种可选的防攻击的数据传输装置的示意图；以及
图9是根据本申请实施例的另一种可选的防攻击的数据传输装置的示意图。
具体实施方式
为了使本技术领域的人员更好地理解本发明方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本申请保护的范围。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本发明的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、***、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
实施例1
根据本申请实施例，提供了一种防攻击数据传输方法的实施例，需要说明的是，在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机***中执行，并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
图1是根据本申请实施例的防攻击数据传输方法，如图1所示，该方法包括如下步 骤：
S102，获取待传输的通信协议报文；
S104，对通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理，生成处理信息；
S106，将处理信息保存在通信协议报文在报文头部中的扩展位上，得到转换后的通信协议报文，其中，通信协议报文的报文头部包括信息位和扩展位；
S108，发送转换后的通信协议报文至接收设备。
可选地，在本实施例中，上述防攻击数据传输方法可以但不限于应用于如图2所示的应用环境中，作为发送设备的终端202按照预定的通信协议通过网络204与作为接收设备的服务器206进行通信，其中，上述网络可以包括但不限于：局域网、城域网或广域网，上述终端可以包括但不限于手机、PC机、笔记本或平板电脑。上述仅是一种示例，本实施例对此不做任何限定。
需要说明的是，上述发送设备可以但不限于网络中可以采集数据的采集设备，例如，路由器，可以通过NET FLOW协议采集待传输的通信协议报文。
具体而言，作为发送设备的终端202在获取待传输的通信协议报文后，将对通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理，并生成对应的处理信息，将上述处理信息保存在通信协议报文在报文头部中的扩展位上，以得到转换后的通信协议报文，进一步，将转换后的通信协议报文发送至作为接收设备的服务器206。
需要说明的是，在本申请实施例中，通过在发送设备上直接对待传输的通信协议报文信息位上的数据进行防攻击预处理，并将防攻击预处理的处理信息存储在原有的通信协议报文中新设置的扩展位上，其中，上述防攻击预处理的操作为发送设备和接收设备双方约定对报文头部信息位上的数据执行的操作，来达到御防通信过程中出现的攻击行为的目的。也就是说，发送设备对数据进行与接收设备约定的防攻击预处理后，接收设备可以直接按照约定解析，若可以解析出数据，即为正常的数据流量，若无法正常解析，则可以判定为异常数据流量，则可以直接通过丢弃来来御防该异常数据流量对应的攻击行为。进而实现在发送设备按照通信协议与接收设备进行通信的过程中，在不影响正常通信的情况下，提高数据传输的安全性与准确性，避免现有的防攻击方式所导致的误伤正常传输的数据流量的问题。
可选地，在本实施例中，上述通信协议报文可以但不限于传输控制协议(TCP，Transmission Control Protocol)，其中，TCP协议报文的数据格式可以如下：
TCP协议报文的数据格式：
Figure PCTCN2016102646-appb-000001
由上述内容可知，TCP协议报文中的前20个字节是固定的，后面有4N字节是根据需要而增加的选项。其中，头部长度、URG、ACK、RST、SYN、FIN、窗口尺寸、TCP校验和与紧急指针均是TCP协议报文中包含重要信息的信息位。
在本实施例中，不同于现有技术中对整个TCP协议报文进行防攻击保护，而是采用对报文头部的信息位上的数据进行防攻击预处理保护，从而便于接收设备在接收到该TCP协议报文时，可以不通过宽带流量清洗的方式对所有的数据流量进行清洗过滤，以避免将正常数据流量当作异常数据流量被误杀的问题。使接收设备通过判断是否可以按照约定的方式解析对应信息位上的数据，来实现直接过滤攻击端伪造的通信协议报文，进一步提高在数据传输过程中，御防攻击行为的准确性。其中，转换后的通信协议报文的报文格式如下：
转换后的通信协议报文的报文格式：
Figure PCTCN2016102646-appb-000002
可选地，在本实施例中，上述通信协议报文中的扩展位可以但不限于在原有的通信协议报文中新增的扩展位，也就是说，在不增加报文长度的情况下，将部分位置设置为 用于存放防攻击预处理的处理信息的扩展位。从而实现在不增加报文负载开销的情况下，保证数据传输的安全性。
可选地，在本实施例中，上述防攻击预处理可以包括但不限于以下至少一种操作：
1)调整信息位上的数据的顺序；或者
2)对信息位上的数据进行整体或局部的压缩，并填充字符到压缩后的空闲位置；或者
3)对信息位上的数据进行整体或局部的加密；或者
4)对信息位上的数据进行整体或局部的签名。
需要说明的是，上述信息位的整体用于指所有信息位上的数据，信息位的局部用于指部分信息位中的数据。此外，上述填充字符可以但不限于无实际意义的字符，也可以但不限于作为其他信息的扩展位。本实施例中对此不作任何限定。
可选地，在本实施例中，在发送转换后的通信协议报文至接收设备之前，还包括：S1，部署网络设备。也就是说，根据实际传输的数据流量布局网络中的网络设备。
可选地，在本实施例中，当数据流量大于预定阈值，则在发送设备与接收设备之间设置网关型网络设备，以便于该网络设备将部分数据流量转发到第三方接收设备，以避免原有的接收设备出现过载，从而达到减轻设备负载，避免接收设备由于过载出现***崩溃的问题。
可选地，在本实施例中，当数据流量小于等于预定阈值，则可以直接通过在发送侧设置以下至少一种装置来执行对待传输的通信协议报文的防攻击预处理：网卡驱动、虚拟网卡或本地网关。
通过本申请提供的实施例，通过在发送设备上直接对待传输的通信协议报文信息位上的数据进行防攻击预处理，并将防攻击预处理的处理信息存储在原有的通信协议报文中新设置的扩展位上，进一步，将转换后的通信协议报文发送至接收设备。也就是说，发送设备通过向接收设备发送对报文头部的信息位上的数据进行过防攻击预处理的通信协议报文，以实现将正常数据流量与异常数据流量进行区分，便于接收设备获取通过正确解析得到的通信协议报文，并过滤掉无法正确解析的异常报文，从而在不影响正常通信的情况下，达到准确御防通信过程中出现的攻击行为的目的，进而避免现有的防攻击方式所导致的误伤正常传输的数据流量的问题。进一步，在本实施例中，仅对报文头部中的信息位上的数据进行防攻击预处理，而并没有针对全部通信协议报文中的数据，以实现对传输链路的透明化，避免转换后的通信协议报文被破译，进一步提高数据传输过 程中的安全性。
作为一种可选的方案，对通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理包括以下至少之一：
1)调整信息位上的数据的顺序；或者
具体结合以下示例进行说明，TCP协议报文中位于报文头部的信息位包括头部长度、URG、ACK、RST、SYN、FIN、窗口尺寸、TCP校验和与紧急指针。在本实施例中，在对上述信息位上的数据进行防攻击预处理时，可以对数据的顺序进行相应调整，以保证在TCP协议报文正常的封装、传输的过程中，达到对TCP协议报文进行防攻击预处理的目的。
例如，转换后的TCP协议报文的数据格式可以如下：
Figure PCTCN2016102646-appb-000003
由上述内容可知，本示例中，通过调整URG、RST和SYN的顺序，改变其在通信协议报文中公知的位置关系，从而实现针对第三方设备的防护，避免第三方设备产生的攻击。
2)对信息位上的数据进行整体或局部的压缩，并填充字符到压缩后的空闲位置；或者
具体结合以下示例进行说明，TCP协议报文中位于报文头部的信息位包括头部长度、URG、ACK、RST、SYN、FIN、窗口尺寸、TCP校验和与紧急指针。在本实施例中，在对上述信息位上的数据进行防攻击预处理时，可以对信息位上的数据进行整体或局部的压缩，以保证在TCP协议报文正常的封装、传输的过程中，达到对TCP协议报文进行防攻击预处理的目的。
例如，转换后的TCP协议报文的数据格式可以如下：
Figure PCTCN2016102646-appb-000004
由上述内容可知，本示例中，通过对TCP校验和进行局部压缩，例如，由16位压缩到10位，并将压缩后的空闲位置填充一定字符，以改变TCP校验和在通信协议报文中公知的位置关系，从而实现针对第三方设备的防护，避免第三方设备产生的攻击。
可选地，在本实施例中，还可以对上述信息位中的数据按比例进行整体压缩，压缩方式同上述局部压缩，本实施例在此不再赘述。
3)对信息位上的数据进行整体或局部的加密；或者
可选地，在本实施例中，可以对信息位上的全部数据进行整体加密，也可以仅对信息位中部分预定位置上的数据进行局部加密，本示例对加密的方式不做任何限定。
4)对信息位上的数据进行整体或局部的签名。
可选地，在本实施例中，上述签名是指：只有信息的发送者才能产生的别人无法伪造的一段数字串，这段数字串同时也是对信息的发送者发送信息真实性的一个有效证明。
可选地，在本实施例中，可以对信息位上的全部数据进行整体签名认证，也可以仅对信息位中部分预定位置上的数据进行局部签名认证，本示例对签名的方式不做任何限定。
通过本申请提供的实施例，通过上述至少一种方式对通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理的操作，通过对报文头部的数据进行预处理，进一步提高了待传输的通信协议报文的安全性，从而避免第三方设备在破译上述预处理的操 作后发起攻击；进一步，还可以使接收设备按照与预处理的操作对应的方式解析接收到的转换后的通讯协议报文，正确识别出正常数据流量和异常数据流量，克服现有技术中出现的误差问题。
作为一种可选的方案，在对通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理之前，还包括：
S1，将通信协议报文中位于报文头部的部分字节设置为扩展位。
可选地，在本实施例中，将通信协议报文中位于报文头部的部分字节设置为扩展位包括：S12，将报文头部中的序列号和/或确认号中的部分字节设置为扩展位。
可选地，在本实施例中，基于TCP协议报文实施上述防攻击数据传输方法，考虑到IP转发的特性和TCP协议的特点，本实施例中通过在TCP协议报文的报文头部将原有的部分字段设置为扩展位，以实现不增加报文负载开销的情况下(即不增加报文长度)，实现对待传输的TCP协议报文的预处理，以保证TCP协议在传输过程中的兼容性和一致性。
需要说明的是，在TCP协议报文，序列号和确认号都是32Bit的。这两个序号的作用是标识上一次传输的报文的长度。考虑现有网络传输环境，在以太网情况下，单个报文最大长度是8192字节(Jumbo帧长度)。而32Bit可以表示2^32＝4G字节，因此这部分数据是有可利用余地的。例如，将其中28Bit作为序列号，各保留4Bit用作扩展位，那么就可以将这8Bit用于标识上述预处理的处理信息。利用这部分扩展位，对报文头部的信息位上的数据进行签名、TCP头部重组、模糊、加密等至少一种预处理的操作，并将转换后的TCP通信协议报文发送至接收设备。
通过本申请提供的实施例，通过在原有的通信协议报文中设置扩展位，以实现利用扩展位记录对报文头部的信息位上的数据进行的预处理的操作，以便于接收设备按照约定正确解析出对应的数据，从而实现对正常数据流量和异常数据流量的准确区分，克服现有技术中存在的误伤正常传输的数据流量的问题。
作为一种可选的方案，在发送转换后的通信协议报文至接收设备之前，还包括：
S1，判断当前通信协议报文的数据流量是否大于预定阈值；
S2，若数据流量大于预定阈值，则在到达接收设备之前的传输链路中配置网关型网络设备，以使网关型网络设备代理接收设备将转换后的通信协议报文转发给第三方设备处理。
可选地，在本实施例中，当数据流量大于预定阈值，则在发送设备与接收设备之间 设置网关型网络设备，以便于该网络设备将部分数据流量转发到第三方接收设备，以避免原有的接收设备出现过载，从而达到减轻设备负载，避免接收设备由于过载出现***崩溃的问题。其中，上述预定阈值可以但不限于根据接收设备的处理负荷确定。
具体结合以下示例进行说明，以TCP协议报文为例，如图3所示，在终端202向服务器206发送TCP协议报文之前，作为发送设备的终端202可以根据当前的网络流量判断作为接收设备的服务器206是否可以正常处理。例如，假设预定阈值为100M，当前数据流量为120M，则作为发送设备的终端202在比较后判断出数据流量大于预定阈值，则将在网络中部署网关型网络设备302，以使网关型网络设备302将多出的20M数据流量转发至第三方设备，以避免接收设备由于过载出现***崩溃的问题。
通过本申请提供的实施例，通过预先比较当前通信协议报文的数据流量与预定阈值的大小关系，以便于判断是否在传输链路中设置网关型网络设备，从而实现在防攻击的过程中，避免接收设备由于过载出现***崩溃的问题。
作为一种可选的方案，对通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理的装置包括以下至少之一：网卡驱动、虚拟网卡或本地网关。
具体结合以下示例进行说明：
作为一种可选的实施方式，如图4所示，以TCP协议报文为例，在作为发送设备的终端上设有TCP客户端402，在作为接收设备的服务器上设有TCP服务端404。在本实施例中，在TCP客户端设置网卡驱动406-1，作为防攻击装置，以实现对上述防攻击传输方法中的预处理的操作；在TCP服务端设置网卡驱动406-2，作为防攻击检测装置.以实现对上述防攻击传输方法中的解析操作。
需要说明的是，在本实施例中，TCP客户端还是正常的使用物理网卡通信。只是网卡驱动会检测通信的目的地，如果发现是和外部TCP协议防攻击检测装置通信，就会将数据报文按照事先设定好的格式进行处理，反之则原样发送给目的地。
作为另一种可选的实施方式，如图5所示，以TCP协议报文为例，在作为发送设备的终端上设有TCP客户端402，在作为接收设备的服务器上设有TCP服务端404。在本实施例中，在TCP客户端设置虚拟网卡502-1，作为防攻击装置，以实现对上述防攻击传输方法中的预处理的操作；在TCP服务端设置虚拟网卡502-2，作为防攻击检测装置.以实现对上述防攻击传输方法中的解析操作。
需要说明的是，在本实施例中，这种类型比较像一个链接隧道。TCP客户端只要往指定网卡发送数据即可。在具体操作上不感知物理链路变化，所有和外部TCP协议防攻 击检测装置的通信由虚拟网卡代理。
作为又一种可选的实施方式，如图6所示，以TCP协议报文为例，在作为发送设备的终端上设有TCP客户端，在作为接收设备的服务器上设有TCP服务端。在本实施例中，在TCP客户端设置本地网关602-1，作为防攻击装置，以实现对上述防攻击传输方法中的预处理的操作；在TCP服务端设置本地网关602-2，作为防攻击检测装置.以实现对上述防攻击传输方法中的解析操作。
需要说明的是，在本实施例中，这种场景下TCP客户端只需要和本地网关建立通信关系即可。由本地网关负责和外部TCP协议防攻击检测装置通信即可。
通过本申请提供的实施例，通过不同的装置实现上述防攻击数据传输，以实现防攻击控制的多样化。
实施例2
根据本申请实施例，提供了一种防攻击数据传输方法的实施例，需要说明的是，在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机***中执行，并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
图7是根据本申请实施例的防攻击数据传输方法，如图7所示，该方法包括如下步骤：
S702，接收经防攻击预处理后得到的转换后的通信协议报文；
S704，根据转换后的通信协议报文中位于报文头部的扩展位所指示的防攻击预处理的处理信息解析转换后的通信协议报文；
S706，获取转换后的通信协议报文中位于报文头部的信息位上的数据，其中，通信协议报文的报文头部包括信息位和扩展位。
可选地，在本实施例中，上述防攻击数据传输方法可以但不限于应用于如图2所示的应用环境中，作为发送设备的终端202按照预定的通信协议通过网络204与作为接收设备的服务器206进行通信，其中，上述网络可以包括但不限于：局域网、城域网或广域网，上述终端可以包括但不限于手机、PC机、笔记本或平板电脑。上述仅是一种示例，本实施例对此不做任何限定。
需要说明的是，上述接收设备也可以但不限于为路由器。通过在路由器中安装预定程序实现对接收到的转换后的通信协议报文中位于报文头部的扩展位所指示的防攻击预处理的处理信息进行解析，以得到转换后的通信协议报文。
具体而言，作为接收设备的服务器206接收经防攻击预处理后得到的转换后的通信协议报文；进一步，根据转换后的通信协议报文中位于报文头部的扩展位所指示的防攻击预处理的处理信息解析转换后的通信协议报文，以获取转换后的通信协议报文中位于报文头部的信息位上的数据，其中，通信协议报文的报文头部包括信息位和扩展位。
需要说明的是，在本申请实施例中，通过在发送设备上直接对待传输的通信协议报文信息位上的数据进行防攻击预处理，并将防攻击预处理的处理信息存储在原有的通信协议报文中新设置的扩展位上，以使接收设备可以按照双方约定解析并获取报文头部信息位上的数据，若可以正确解析出数据，即为正常的数据流量，若无法正确解析，则可以判定为异常数据流量，则可以直接通过丢弃来来御防该异常数据流量对应的攻击行为。进而实现在发送设备按照通信协议与接收设备进行通信的过程中，在不影响正常通信的情况下，提高数据传输的安全性与准确性，避免现有的防攻击方式所导致的误伤正常传输的数据流量的问题。
可选地，在本实施例中，上述通信协议报文可以但不限于传输控制协议(TCP，Transmission Control Protocol)，其中，TCP协议报文的数据格式可以如下：
TCP协议报文的数据格式：
Figure PCTCN2016102646-appb-000005
由上述内容可知，TCP协议报文中的前20个字节是固定的，后面有4N字节是根据需要而增加的选项。其中，头部长度、URG、ACK、RST、SYN、FIN、窗口尺寸、TCP校验和与紧急指针均是TCP协议报文中包含重要信息的信息位。
在本实施例中，不同于现有技术中对整个TCP协议报文进行防攻击保护，而是采用对报文头部的信息位上的数据进行防攻击预处理保护，从而便于接收设备在接收到该TCP协议报文时，可以不通过宽带流量清洗的方式对所有的数据流量进行清洗过滤，以 避免将正常数据流量当作异常数据流量被误杀的问题。使接收设备通过判断是否可以按照约定的方式解析对应信息位上的数据，来实现直接过滤攻击端伪造的通信协议报文，进一步提高在数据传输过程中，御防攻击行为的准确性。其中，转换后的通信协议报文的报文格式如下：
转换后的通信协议报文的报文格式：
Figure PCTCN2016102646-appb-000006
可选地，在本实施例中，上述通信协议报文中的扩展位可以但不限于在原有的通信协议报文中新增的扩展位，也就是说，在不增加报文长度的情况下，将部分位置设置为用于存放防攻击预处理的处理信息的扩展位。从而实现在不增加报文负载开销的情况下，保证数据传输的安全性。
可选地，在本实施例中，上述防攻击预处理可以包括但不限于以下至少一种操作：
1)调整信息位上的数据的顺序；或者
2)对信息位上的数据进行整体或局部的压缩，并填充字符到压缩后的空闲位置；或者
3)对信息位上的数据进行整体或局部的加密；或者
4)对信息位上的数据进行整体或局部的签名。
需要说明的是，上述信息位的整体用于指所有信息位上的数据，信息位的局部用于指部分信息位中的数据。此外，上述填充字符可以但不限于无实际意义的字符，也可以但不限于作为其他信息的扩展位。本实施例中对此不作任何限定。
可选地，在本实施例中，在发送转换后的通信协议报文至接收设备之前，还包括：S1，部署网络设备。也就是说，根据实际传输的数据流量布局网络中的网络设备。
可选地，在本实施例中，当数据流量大于预定阈值，则在发送设备与接收设备之间设置网关型网络设备，以便于该网络设备将部分数据流量转发到第三方接收设备，以避免原有的接收设备出现过载，从而达到减轻设备负载，避免接收设备由于过载出现*** 崩溃的问题。
可选地，在本实施例中，当数据流量小于等于预定阈值，则可以直接通过在发送侧设置以下至少一种装置来执行对待传输的通信协议报文的防攻击预处理：网卡驱动、虚拟网卡或本地网关。
通过本申请提供的实施例，作为接收设备的服务器206接收经防攻击预处理后得到的转换后的通信协议报文；进一步，根据转换后的通信协议报文中位于报文头部的扩展位所指示的防攻击预处理的处理信息解析转换后的通信协议报文，以获取转换后的通信协议报文中位于报文头部的信息位上的数据，其中，通信协议报文的报文头部包括信息位和扩展位。也就是说，接收设备通过对接收到的通信协议报文的报文头部的信息位上的数据进行解析，并对正确解析出的正常数据流量进行处理，过滤掉异常数据流量，以实现将正常数据流量与异常数据流量进行区分，便于接收设备获取通过正确解析得到的通信协议报文，并过滤掉无法正确解析的异常报文，从而在不影响正常通信的情况下，达到准确御防通信过程中出现的攻击行为的目的，进而避免现有的防攻击方式所导致的误伤正常传输的数据流量的问题。
作为一种可选的方案，根据转换后的通信协议报文中位于报文头部的扩展位所指示的防攻击预处理的处理信息解析转换后的通信协议报文的装置包括以下至少之一：网卡驱动、虚拟网卡或本地网关。
具体结合以下示例进行说明：
作为一种可选的实施方式，如图4所示，以TCP协议报文为例，在作为发送设备的终端上设有TCP客户端402，在作为接收设备的服务器上设有TCP服务端404。在本实施例中，在TCP客户端设置网卡驱动406-1，作为防攻击装置，以实现对上述防攻击传输方法中的预处理的操作；在TCP服务端设置网卡驱动406-2，作为防攻击检测装置.以实现对上述防攻击传输方法中的解析操作。
需要说明的是，在本实施例中，TCP客户端还是正常的使用物理网卡通信。只是网卡驱动会检测通信的目的地，如果发现是和外部TCP协议防攻击检测装置通信，就会将数据报文按照事先设定好的格式进行处理，反之则原样发送给目的地。
作为另一种可选的实施方式，如图5所示，以TCP协议报文为例，在作为发送设备的终端上设有TCP客户端402，在作为接收设备的服务器上设有TCP服务端404。在本实施例中，在TCP客户端设置虚拟网卡502-1，作为防攻击装置，以实现对上述防攻击传输方法中的预处理的操作；在TCP服务端设置虚拟网卡502-2，作为防攻击检测装置. 以实现对上述防攻击传输方法中的解析操作。
需要说明的是，在本实施例中，这种类型比较像一个链接隧道。TCP客户端只要往指定网卡发送数据即可。在具体操作上不感知物理链路变化，所有和外部TCP协议防攻击检测装置的通信由虚拟网卡代理。
作为又一种可选的实施方式，如图6所示，以TCP协议报文为例，在作为发送设备的终端上设有TCP客户端，在作为接收设备的服务器上设有TCP服务端。在本实施例中，在TCP客户端设置本地网关602-1，作为防攻击装置，以实现对上述防攻击传输方法中的预处理的操作；在TCP服务端设置本地网关602-2，作为防攻击检测装置.以实现对上述防攻击传输方法中的解析操作。
需要说明的是，在本实施例中，这种场景下TCP客户端只需要和本地网关建立通信关系即可。由本地网关负责和外部TCP协议防攻击检测装置通信即可。
通过本申请提供的实施例，通过不同的装置实现上述防攻击数据传输，以实现防攻击控制的多样化。
实施例3
根据本申请实施例，提供了一种防攻击数据传输装置的实施例，该装置位于发送设备中，如图8所示，该装置包括：
1)获取单元802，用于获取待传输的通信协议报文；
2)防攻击预处理单元804，用于对通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理，生成处理信息；
3)保存单元806，用于将处理信息保存在通信协议报文在报文头部中的扩展位上，得到转换后的通信协议报文，其中，通信协议报文的报文头部包括信息位和扩展位；
4)发送单元808，用于发送转换后的通信协议报文至接收设备。
可选地，在本实施例中，上述防攻击数据传输装置可以但不限于应用于如图2所示的应用环境中，作为发送设备的终端202按照预定的通信协议通过网络204与作为接收设备的服务器206进行通信，其中，上述网络可以包括但不限于：局域网、城域网或广域网，上述终端可以包括但不限于手机、PC机、笔记本或平板电脑。上述仅是一种示例，本实施例对此不做任何限定。
需要说明的是，上述发送设备可以但不限于网络中可以采集数据的采集设备，例如，路由器，可以通过NET FLOW协议采集待传输的通信协议报文。
具体而言，作为发送设备的终端202在获取待传输的通信协议报文后，将对通信协 议报文中位于报文头部的信息位上的数据进行防攻击预处理，并生成对应的处理信息，将上述处理信息保存在通信协议报文在报文头部中的扩展位上，以得到转换后的通信协议报文，进一步，将转换后的通信协议报文发送至作为接收设备的服务器206。
需要说明的是，在本申请实施例中，通过在发送设备上直接对待传输的通信协议报文信息位上的数据进行防攻击预处理，并将防攻击预处理的处理信息存储在原有的通信协议报文中新设置的扩展位上，其中，上述防攻击预处理的操作为发送设备和接收设备双方约定对报文头部信息位上的数据执行的操作，来达到御防通信过程中出现的攻击行为的目的。也就是说，发送设备对数据进行与接收设备约定的防攻击预处理后，接收设备可以直接按照约定解析，若可以解析出数据，即为正常的数据流量，若无法正常解析，则可以判定为异常数据流量，则可以直接通过丢弃来来御防该异常数据流量对应的攻击行为。进而实现在发送设备按照通信协议与接收设备进行通信的过程中，在不影响正常通信的情况下，提高数据传输的安全性与准确性，避免现有的防攻击方式所导致的误伤正常传输的数据流量的问题。
可选地，在本实施例中，上述通信协议报文可以但不限于传输控制协议(TCP，Transmission Control Protocol)，其中，TCP协议报文的数据格式可以如下：
TCP协议报文的数据格式：
Figure PCTCN2016102646-appb-000007
由上述内容可知，TCP协议报文中的前20个字节是固定的，后面有4N字节是根据需要而增加的选项。其中，头部长度、URG、ACK、RST、SYN、FIN、窗口尺寸、TCP校验和与紧急指针均是TCP协议报文中包含重要信息的信息位。
在本实施例中，不同于现有技术中对整个TCP协议报文进行防攻击保护，而是采用对报文头部的信息位上的数据进行防攻击预处理保护，从而便于接收设备在接收到该 TCP协议报文时，可以不通过宽带流量清洗的方式对所有的数据流量进行清洗过滤，以避免将正常数据流量当作异常数据流量被误杀的问题。使接收设备通过判断是否可以按照约定的方式解析对应信息位上的数据，来实现直接过滤攻击端伪造的通信协议报文，进一步提高在数据传输过程中，御防攻击行为的准确性。其中，转换后的通信协议报文的报文格式如下：
转换后的通信协议报文的报文格式：
Figure PCTCN2016102646-appb-000008
可选地，在本实施例中，上述通信协议报文中的扩展位可以但不限于在原有的通信协议报文中新增的扩展位，也就是说，在不增加报文长度的情况下，将部分位置设置为用于存放防攻击预处理的处理信息的扩展位。从而实现在不增加报文负载开销的情况下，保证数据传输的安全性。
可选地，在本实施例中，上述防攻击预处理可以包括但不限于以下至少一种操作：
1)调整信息位上的数据的顺序；或者
2)对信息位上的数据进行整体或局部的压缩，并填充字符到压缩后的空闲位置；或者
3)对信息位上的数据进行整体或局部的加密；或者
4)对信息位上的数据进行整体或局部的签名。
需要说明的是，上述信息位的整体用于指所有信息位上的数据，信息位的局部用于指部分信息位中的数据。此外，上述填充字符可以但不限于无实际意义的字符，也可以但不限于作为其他信息的扩展位。本实施例中对此不作任何限定。
可选地，在本实施例中，在发送转换后的通信协议报文至接收设备之前，还包括：S1，部署网络设备。也就是说，根据实际传输的数据流量布局网络中的网络设备。
可选地，在本实施例中，当数据流量大于预定阈值，则在发送设备与接收设备之间设置网关型网络设备，以便于该网络设备将部分数据流量转发到第三方接收设备，以避 免原有的接收设备出现过载，从而达到减轻设备负载，避免接收设备由于过载出现***崩溃的问题。
可选地，在本实施例中，当数据流量小于等于预定阈值，则可以直接通过在发送侧设置以下至少一种装置来执行对待传输的通信协议报文的防攻击预处理：网卡驱动、虚拟网卡或本地网关。
通过本申请提供的实施例，通过在发送设备上直接对待传输的通信协议报文信息位上的数据进行防攻击预处理，并将防攻击预处理的处理信息存储在原有的通信协议报文中新设置的扩展位上，进一步，将转换后的通信协议报文发送至接收设备。也就是说，发送设备通过向接收设备发送对报文头部的信息位上的数据进行过防攻击预处理的通信协议报文，以实现将正常数据流量与异常数据流量进行区分，便于接收设备获取通过正确解析得到的通信协议报文，并过滤掉无法正确解析的异常报文，从而在不影响正常通信的情况下，达到准确御防通信过程中出现的攻击行为的目的，进而避免现有的防攻击方式所导致的误伤正常传输的数据流量的问题。进一步，在本实施例中，仅对报文头部中的信息位上的数据进行防攻击预处理，而并没有针对全部通信协议报文中的数据，以实现对传输链路的透明化，避免转换后的通信协议报文被破译，进一步提高数据传输过程中的安全性。
作为一种可选的方案，防攻击预处理单元804包括以下至少之一：
1)调整模块，用于调整信息位上的数据的顺序；或者
具体结合以下示例进行说明，TCP协议报文中位于报文头部的信息位包括头部长度、URG、ACK、RST、SYN、FIN、窗口尺寸、TCP校验和与紧急指针。在本实施例中，在对上述信息位上的数据进行防攻击预处理时，可以对数据的顺序进行相应调整，以保证在TCP协议报文正常的封装、传输的过程中，达到对TCP协议报文进行防攻击预处理的目的。
例如，转换后的TCP协议报文的数据格式可以如下：
Figure PCTCN2016102646-appb-000009
Figure PCTCN2016102646-appb-000010
由上述内容可知，本示例中，通过调整URG、RST和SYN的顺序，改变其在通信协议报文中公知的位置关系，从而实现针对第三方设备的防护，避免第三方设备产生的攻击。
2)压缩模块，用于对信息位上的数据进行整体或局部的压缩，并填充字符到压缩后的空闲位置；或者
具体结合以下示例进行说明，TCP协议报文中位于报文头部的信息位包括头部长度、URG、ACK、RST、SYN、FIN、窗口尺寸、TCP校验和与紧急指针。在本实施例中，在对上述信息位上的数据进行防攻击预处理时，可以对信息位上的数据进行整体或局部的压缩，以保证在TCP协议报文正常的封装、传输的过程中，达到对TCP协议报文进行防攻击预处理的目的。
例如，转换后的TCP协议报文的数据格式可以如下：
Figure PCTCN2016102646-appb-000011
由上述内容可知，本示例中，通过对TCP校验和进行局部压缩，例如，由16位压缩到10位，并将压缩后的空闲位置填充一定字符，以改变TCP校验和在通信协议报文中公知的位置关系，从而实现针对第三方设备的防护，避免第三方设备产生的攻击。
可选地，在本实施例中，还可以对上述信息位中的数据按比例进行整体压缩，压缩方式同上述局部压缩，本实施例在此不再赘述。
3)加密模块，用于对信息位上的数据进行整体或局部的加密；或者
可选地，在本实施例中，可以对信息位上的全部数据进行整体加密，也可以仅对信息位中部分预定位置上的数据进行局部加密，本示例对加密的方式不做任何限定。
4)签名模块，用于对信息位上的数据进行整体或局部的签名。
可选地，在本实施例中，上述签名是指：只有信息的发送者才能产生的别人无法伪造的一段数字串，这段数字串同时也是对信息的发送者发送信息真实性的一个有效证明。
可选地，在本实施例中，可以对信息位上的全部数据进行整体签名认证，也可以仅对信息位中部分预定位置上的数据进行局部签名认证，本示例对签名的方式不做任何限定。
通过本申请提供的实施例，通过上述至少一种方式对通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理的操作，通过对报文头部的数据进行预处理，进一步提高了待传输的通信协议报文的安全性，从而避免第三方设备在破译上述预处理的操作后发起攻击；进一步，还可以使接收设备按照与预处理的操作对应的方式解析接收到的转换后的通讯协议报文，正确识别出正常数据流量和异常数据流量，克服现有技术中出现的误差问题。
作为一种可选的方案，上述装置还包括：
1)设置单元，用于在对通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理之前，将通信协议报文中位于报文头部的部分字节设置为扩展位。
可选地，在本实施例中，设置单元包括：
1)设置模块，用于将报文头部中的序列号和/或确认号中的部分字节设置为扩展位。
可选地，在本实施例中，基于TCP协议报文实施上述防攻击数据传输装置，考虑到IP转发的特性和TCP协议的特点，本实施例中通过在TCP协议报文的报文头部将原有的部分字段设置为扩展位，以实现不增加报文负载开销的情况下(即不增加报文长度)，实现对待传输的TCP协议报文的预处理，以保证TCP协议在传输过程中的兼容性和一致性。
需要说明的是，在TCP协议报文，序列号和确认号都是32Bit的。这两个序号的作用是标识上一次传输的报文的长度。考虑现有网络传输环境，在以太网情况下，单个报文最大长度是8192字节(Jumbo帧长度)。而32Bit可以表示2^32＝4G字节，因此这部分数据是有可利用余地的。例如，将其中28Bit作为序列号，各保留4Bit用作扩展位，那么就可以将这8Bit用于标识上述预处理的处理信息。利用这部分扩展位，对报文头部 的信息位上的数据进行签名、TCP头部重组、模糊、加密等至少一种预处理的操作，并将转换后的TCP通信协议报文发送至接收设备。
通过本申请提供的实施例，通过在原有的通信协议报文中设置扩展位，以实现利用扩展位记录对报文头部的信息位上的数据进行的预处理的操作，以便于接收设备按照约定正确解析出对应的数据，从而实现对正常数据流量和异常数据流量的准确区分，克服现有技术中存在的误伤正常传输的数据流量的问题。
作为一种可选的方案，上述装置还包括：
1)判断单元，用于在发送转换后的通信协议报文至接收设备之前判断当前通信协议报文的数据流量是否大于预定阈值；
2)配置单元，用于在数据流量大于预定阈值时，在到达接收设备之前的传输链路中配置网关型网络设备，以使网关型网络设备代理接收设备将转换后的通信协议报文转发给第三方设备处理。
可选地，在本实施例中，当数据流量大于预定阈值，则在发送设备与接收设备之间设置网关型网络设备，以便于该网络设备将部分数据流量转发到第三方接收设备，以避免原有的接收设备出现过载，从而达到减轻设备负载，避免接收设备由于过载出现***崩溃的问题。其中，上述预定阈值可以但不限于根据接收设备的处理负荷确定。
具体结合以下示例进行说明，以TCP协议报文为例，如图3所示，在终端202向服务器206发送TCP协议报文之前，作为发送设备的终端202可以根据当前的网络流量判断作为接收设备的服务器206是否可以正常处理。例如，假设预定阈值为100M，当前数据流量为120M，则作为发送设备的终端202在比较后判断出数据流量大于预定阈值，则将在网络中部署网关型网络设备302，以使网关型网络设备302将多出的20M数据流量转发至第三方设备，以避免接收设备由于过载出现***崩溃的问题。
通过本申请提供的实施例，通过预先比较当前通信协议报文的数据流量与预定阈值的大小关系，以便于判断是否在传输链路中设置网关型网络设备，从而实现在防攻击的过程中，避免接收设备由于过载出现***崩溃的问题。
作为一种可选的方案，防攻击预处理单元包括以下至少之一：网卡驱动、虚拟网卡或本地网关。
具体结合以下示例进行说明：
作为一种可选的实施方式，如图4所示，以TCP协议报文为例，在作为发送设备的终端上设有TCP客户端402，在作为接收设备的服务器上设有TCP服务端404。在本实 施例中，在TCP客户端设置网卡驱动406-1，作为防攻击装置，以实现对上述防攻击传输装置中的预处理的操作；在TCP服务端设置网卡驱动406-2，作为防攻击检测装置.以实现对上述防攻击传输装置中的解析操作。
需要说明的是，在本实施例中，TCP客户端还是正常的使用物理网卡通信。只是网卡驱动会检测通信的目的地，如果发现是和外部TCP协议防攻击检测装置通信，就会将数据报文按照事先设定好的格式进行处理，反之则原样发送给目的地。
作为另一种可选的实施方式，如图5所示，以TCP协议报文为例，在作为发送设备的终端上设有TCP客户端402，在作为接收设备的服务器上设有TCP服务端404。在本实施例中，在TCP客户端设置虚拟网卡502-1，作为防攻击装置，以实现对上述防攻击传输装置中的预处理的操作；在TCP服务端设置虚拟网卡502-2，作为防攻击检测装置.以实现对上述防攻击传输装置中的解析操作。
需要说明的是，在本实施例中，这种类型比较像一个链接隧道。TCP客户端只要往指定网卡发送数据即可。在具体操作上不感知物理链路变化，所有和外部TCP协议防攻击检测装置的通信由虚拟网卡代理。
作为又一种可选的实施方式，如图6所示，以TCP协议报文为例，在作为发送设备的终端上设有TCP客户端，在作为接收设备的服务器上设有TCP服务端。在本实施例中，在TCP客户端设置本地网关602-1，作为防攻击装置，以实现对上述防攻击传输装置中的预处理的操作；在TCP服务端设置本地网关602-2，作为防攻击检测装置.以实现对上述防攻击传输装置中的解析操作。
需要说明的是，在本实施例中，这种场景下TCP客户端只需要和本地网关建立通信关系即可。由本地网关负责和外部TCP协议防攻击检测装置通信即可。
通过本申请提供的实施例，通过不同的装置实现上述防攻击数据传输，以实现防攻击控制的多样化。
实施例4
根据本申请实施例，提供了一种防攻击数据传输装置的实施例，该装置位于接收设备中，如图9所示，该装置包括：
1)接收单元902，用于接收经防攻击预处理后得到的转换后的通信协议报文；
2)解析单元904，用于根据转换后的通信协议报文中位于报文头部的扩展位所指示的防攻击预处理的处理信息解析转换后的通信协议报文；
3)获取单元906，用于获取转换后的通信协议报文中位于报文头部的信息位上的数 据，其中，通信协议报文的报文头部包括信息位和扩展位。
可选地，在本实施例中，上述防攻击数据传输装置可以但不限于应用于如图2所示的应用环境中，作为发送设备的终端202按照预定的通信协议通过网络204与作为接收设备的服务器206进行通信，其中，上述网络可以包括但不限于：局域网、城域网或广域网，上述终端可以包括但不限于手机、PC机、笔记本或平板电脑。上述仅是一种示例，本实施例对此不做任何限定。
需要说明的是，上述接收设备也可以但不限于为路由器。通过在路由器中安装预定程序实现对接收到的转换后的通信协议报文中位于报文头部的扩展位所指示的防攻击预处理的处理信息进行解析，以得到转换后的通信协议报文。
具体而言，作为接收设备的服务器206接收经防攻击预处理后得到的转换后的通信协议报文；进一步，根据转换后的通信协议报文中位于报文头部的扩展位所指示的防攻击预处理的处理信息解析转换后的通信协议报文，以获取转换后的通信协议报文中位于报文头部的信息位上的数据，其中，通信协议报文的报文头部包括信息位和扩展位。
需要说明的是，在本申请实施例中，通过在发送设备上直接对待传输的通信协议报文信息位上的数据进行防攻击预处理，并将防攻击预处理的处理信息存储在原有的通信协议报文中新设置的扩展位上，以使接收设备可以按照双方约定解析并获取报文头部信息位上的数据，若可以正确解析出数据，即为正常的数据流量，若无法正确解析，则可以判定为异常数据流量，则可以直接通过丢弃来来御防该异常数据流量对应的攻击行为。进而实现在发送设备按照通信协议与接收设备进行通信的过程中，在不影响正常通信的情况下，提高数据传输的安全性与准确性，避免现有的防攻击方式所导致的误伤正常传输的数据流量的问题。
可选地，在本实施例中，上述通信协议报文可以但不限于传输控制协议(TCP，Transmission Control Protocol)，其中，TCP协议报文的数据格式可以如下：
TCP协议报文的数据格式：
Figure PCTCN2016102646-appb-000012
Figure PCTCN2016102646-appb-000013
由上述内容可知，TCP协议报文中的前20个字节是固定的，后面有4N字节是根据需要而增加的选项。其中，头部长度、URG、ACK、RST、SYN、FIN、窗口尺寸、TCP校验和与紧急指针均是TCP协议报文中包含重要信息的信息位。
在本实施例中，不同于现有技术中对整个TCP协议报文进行防攻击保护，而是采用对报文头部的信息位上的数据进行防攻击预处理保护，从而便于接收设备在接收到该TCP协议报文时，可以不通过宽带流量清洗的方式对所有的数据流量进行清洗过滤，以避免将正常数据流量当作异常数据流量被误杀的问题。使接收设备通过判断是否可以按照约定的方式解析对应信息位上的数据，来实现直接过滤攻击端伪造的通信协议报文，进一步提高在数据传输过程中，御防攻击行为的准确性。其中，转换后的通信协议报文的报文格式如下：
转换后的通信协议报文的报文格式：
Figure PCTCN2016102646-appb-000014
可选地，在本实施例中，上述通信协议报文中的扩展位可以但不限于在原有的通信协议报文中新增的扩展位，也就是说，在不增加报文长度的情况下，将部分位置设置为用于存放防攻击预处理的处理信息的扩展位。从而实现在不增加报文负载开销的情况下，保证数据传输的安全性。
可选地，在本实施例中，上述防攻击预处理可以包括但不限于以下至少一种操作：
1)调整信息位上的数据的顺序；或者
2)对信息位上的数据进行整体或局部的压缩，并填充字符到压缩后的空闲位置；或者
3)对信息位上的数据进行整体或局部的加密；或者
4)对信息位上的数据进行整体或局部的签名。
需要说明的是，上述信息位的整体用于指所有信息位上的数据，信息位的局部用于指部分信息位中的数据。此外，上述填充字符可以但不限于无实际意义的字符，也可以但不限于作为其他信息的扩展位。本实施例中对此不作任何限定。
可选地，在本实施例中，在发送转换后的通信协议报文至接收设备之前，还包括：S1，部署网络设备。也就是说，根据实际传输的数据流量布局网络中的网络设备。
可选地，在本实施例中，当数据流量大于预定阈值，则在发送设备与接收设备之间设置网关型网络设备，以便于该网络设备将部分数据流量转发到第三方接收设备，以避免原有的接收设备出现过载，从而达到减轻设备负载，避免接收设备由于过载出现***崩溃的问题。
可选地，在本实施例中，当数据流量小于等于预定阈值，则可以直接通过在发送侧设置以下至少一种装置来执行对待传输的通信协议报文的防攻击预处理：网卡驱动、虚拟网卡或本地网关。
通过本申请提供的实施例，作为接收设备的服务器206接收经防攻击预处理后得到的转换后的通信协议报文；进一步，根据转换后的通信协议报文中位于报文头部的扩展位所指示的防攻击预处理的处理信息解析转换后的通信协议报文，以获取转换后的通信协议报文中位于报文头部的信息位上的数据，其中，通信协议报文的报文头部包括信息位和扩展位。也就是说，接收设备通过对接收到的通信协议报文的报文头部的信息位上的数据进行解析，并对正确解析出的正常数据流量进行处理，过滤掉异常数据流量，以实现将正常数据流量与异常数据流量进行区分，便于接收设备获取通过正确解析得到的通信协议报文，并过滤掉无法正确解析的异常报文，从而在不影响正常通信的情况下，达到准确御防通信过程中出现的攻击行为的目的，进而避免现有的防攻击方式所导致的误伤正常传输的数据流量的问题。
作为一种可选的方案，解析单元904包括以下至少之一：网卡驱动、虚拟网卡或本地网关。
具体结合以下示例进行说明：
作为一种可选的实施方式，如图4所示，以TCP协议报文为例，在作为发送设备的终端上设有TCP客户端402，在作为接收设备的服务器上设有TCP服务端404。在本实施例中，在TCP客户端设置网卡驱动406-1，作为防攻击装置，以实现对上述防攻击传 输装置中的预处理的操作；在TCP服务端设置网卡驱动406-2，作为防攻击检测装置.以实现对上述防攻击传输装置中的解析操作。
需要说明的是，在本实施例中，TCP客户端还是正常的使用物理网卡通信。只是网卡驱动会检测通信的目的地，如果发现是和外部TCP协议防攻击检测装置通信，就会将数据报文按照事先设定好的格式进行处理，反之则原样发送给目的地。
作为另一种可选的实施方式，如图5所示，以TCP协议报文为例，在作为发送设备的终端上设有TCP客户端402，在作为接收设备的服务器上设有TCP服务端404。在本实施例中，在TCP客户端设置虚拟网卡502-1，作为防攻击装置，以实现对上述防攻击传输装置中的预处理的操作；在TCP服务端设置虚拟网卡502-2，作为防攻击检测装置.以实现对上述防攻击传输装置中的解析操作。
需要说明的是，在本实施例中，这种类型比较像一个链接隧道。TCP客户端只要往指定网卡发送数据即可。在具体操作上不感知物理链路变化，所有和外部TCP协议防攻击检测装置的通信由虚拟网卡代理。
作为又一种可选的实施方式，如图6所示，以TCP协议报文为例，在作为发送设备的终端上设有TCP客户端，在作为接收设备的服务器上设有TCP服务端。在本实施例中，在TCP客户端设置本地网关602-1，作为防攻击装置，以实现对上述防攻击传输装置中的预处理的操作；在TCP服务端设置本地网关602-2，作为防攻击检测装置.以实现对上述防攻击传输装置中的解析操作。
需要说明的是，在本实施例中，这种场景下TCP客户端只需要和本地网关建立通信关系即可。由本地网关负责和外部TCP协议防攻击检测装置通信即可。
通过本申请提供的实施例，通过不同的装置实现上述防攻击数据传输，以实现防攻击控制的多样化。
实施例5
本申请的实施例可以提供一种计算机终端，该计算机终端可以是计算机终端群中的任意一个计算机终端设备。可选地，在本实施例中，上述计算机终端也可以替换为移动终端等终端设备。
可选地，在本实施例中，上述计算机终端可以位于计算机网络的多个网络设备中的至少一个网络设备。
在本实施例中，上述计算机终端可以执行应用程序的漏洞检测方法中以下步骤的程序代码：
S1，获取待传输的通信协议报文；
S2，对通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理，生成处理信息；
S3，将处理信息保存在通信协议报文在报文头部中的扩展位上，得到转换后的通信协议报文，其中，通信协议报文的报文头部包括信息位和扩展位；
S4，发送转换后的通信协议报文至接收设备。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令终端设备相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质可以包括：闪存盘、只读存储器(Read-Only Memory，ROM)、随机存取器(Random Access Memory，RAM)、磁盘或光盘等。
实施例6
本申请的实施例可以提供一种计算机服务器，该计算机服务器可以是计算机服务器群中的任意一个计算机服务器设备。
可选地，在本实施例中，上述计算机服务器可以位于计算机网络的多个网络设备中的至少一个网络设备。
在本实施例中，上述计算机终端可以执行应用程序的漏洞检测方法中以下步骤的程序代码：
S1，接收经防攻击预处理后得到的转换后的通信协议报文；
S2，根据转换后的通信协议报文中位于报文头部的扩展位所指示的防攻击预处理的处理信息解析转换后的通信协议报文；
S3，获取转换后的通信协议报文中位于报文头部的信息位上的数据，其中，通信协议报文的报文头部包括信息位和扩展位。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令终端设备相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质可以包括：闪存盘、只读存储器(Read-Only Memory，ROM)、随机存取器(Random Access Memory，RAM)、磁盘或光盘等。
实施例7
本申请的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以用于保存上述实施例一所提供的防攻击数据传输方法所执行的程序代码。
可选地，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：
S1，获取待传输的通信协议报文；
S2，对通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理，生成处理信息；
S2，将处理信息保存在通信协议报文在报文头部中的扩展位上，得到转换后的通信协议报文，其中，通信协议报文的报文头部包括信息位和扩展位；
S4，发送转换后的通信协议报文至接收设备。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
可选地，本实施例中的具体示例可以参考上述实施例1和实施例2中所描述的示例，本实施例在此不再赘述。
实施例8
本申请的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以用于保存上述实施例一所提供的防攻击数据传输方法所执行的程序代码。
可选地，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：
S1，接收经防攻击预处理后得到的转换后的通信协议报文；
S2，根据转换后的通信协议报文中位于报文头部的扩展位所指示的防攻击预处理的处理信息解析转换后的通信协议报文；
S3，获取转换后的通信协议报文中位于报文头部的信息位上的数据，其中，通信协议报文的报文头部包括信息位和扩展位。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
可选地，本实施例中的具体示例可以参考上述实施例1和实施例2中所描述的示例，本实施例在此不再赘述。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
在本发明的上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的技术内容，可通过其它的方式实现。其中，以上所描述的装置实施例仅仅是示意性的，例如所述单元的划分，可 以为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个***，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，单元或模块的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述仅是本发明的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (16)

  1. 一种防攻击数据传输方法，其特征在于，包括：
    获取待传输的通信协议报文；
    对所述通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理，生成处理信息；
    将所述处理信息保存在所述通信协议报文在所述报文头部中的扩展位上，得到转换后的通信协议报文，其中，所述通信协议报文的所述报文头部包括所述信息位和所述扩展位；
    发送所述转换后的通信协议报文至接收设备。
  2. 根据权利要求1所述的方法，其特征在于，对所述通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理包括以下至少之一：
    调整所述信息位上的数据的顺序；或者
    对所述信息位上的数据进行整体或局部的压缩，并填充字符到压缩后的空闲位置；或者
    对所述信息位上的数据进行整体或局部的加密；或者
    对所述信息位上的数据进行整体或局部的签名。
  3. 根据权利要求1所述的方法，其特征在于，在对所述通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理之前，还包括：
    将所述通信协议报文中位于所述报文头部的部分字节设置为所述扩展位。
  4. 根据权利要求3所述的方法，其特征在于，将所述通信协议报文中位于报文头部的部分字节设置为扩展位包括：
    将所述报文头部中的序列号和/或确认号中的部分字节设置为所述扩展位。
  5. 根据权利要求1所述的方法，其特征在于，在发送所述转换后的通信协议报文至接收设备之前，还包括：
    判断当前所述通信协议报文的数据流量是否大于预定阈值；
    若所述数据流量大于所述预定阈值，则在到达所述接收设备之前的传输链路中配置网关型网络设备，以使所述网关型网络设备代理所述接收设备将所述转换后的通信协议报文转发给第三方设备处理。
  6. 根据权利要求1所述的方法，其特征在于，对所述通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理的装置包括以下至少之一：网卡驱动、虚拟网卡 或本地网关。
  7. 一种防攻击数据传输方法，其特征在于，包括：
    接收经防攻击预处理后得到的转换后的通信协议报文；
    根据所述转换后的通信协议报文中位于报文头部的扩展位所指示的所述防攻击预处理的处理信息解析所述转换后的通信协议报文；
    获取所述转换后的通信协议报文中位于所述报文头部的信息位上的数据，其中，所述通信协议报文的所述报文头部包括所述信息位和所述扩展位。
  8. 根据权利要求7所述的方法，其特征在于，根据所述转换后的通信协议报文中位于报文头部的扩展位所指示的所述防攻击预处理的处理信息解析所述转换后的通信协议报文的装置包括以下至少之一：网卡驱动、虚拟网卡或本地网关。
  9. 一种防攻击数据传输装置，其特征在于，位于发送设备中，所述装置包括：
    获取单元，用于获取待传输的通信协议报文；
    防攻击预处理单元，用于对所述通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理，生成处理信息；
    保存单元，用于将所述处理信息保存在所述通信协议报文在所述报文头部中的扩展位上，得到转换后的通信协议报文，其中，所述通信协议报文的所述报文头部包括所述信息位和所述扩展位；
    发送单元，用于发送所述转换后的通信协议报文至接收设备。
  10. 根据权利要求9所述的装置，其特征在于，所述防攻击预处理单元包括以下至少之一：
    调整模块，用于调整所述信息位上的数据的顺序；或者
    压缩模块，用于对所述信息位上的数据进行整体或局部的压缩，并填充字符到压缩后的空闲位置；或者
    加密模块，用于对所述信息位上的数据进行整体或局部的加密；或者
    签名模块，用于对所述信息位上的数据进行整体或局部的签名。
  11. 根据权利要求9所述的装置，其特征在于，还包括：
    设置单元，用于在对所述通信协议报文中位于报文头部的信息位上的数据进行防攻击预处理之前，将所述通信协议报文中位于所述报文头部的部分字节设置为所述扩展位。
  12. 根据权利要求11所述的装置，其特征在于，所述设置单元包括：
    设置模块，用于将所述报文头部中的序列号和/或确认号中的部分字节设置为所述扩展位。
  13. 根据权利要求9所述的装置，其特征在于，还包括：
    判断单元，用于在发送所述转换后的通信协议报文至接收设备之前判断当前所述通信协议报文的数据流量是否大于预定阈值；
    配置单元，用于在所述数据流量大于所述预定阈值时，在到达所述接收设备之前的传输链路中配置网关型网络设备，以使所述网关型网络设备代理所述接收设备将所述转换后的通信协议报文转发给第三方设备处理。
  14. 根据权利要求9所述的装置，其特征在于，所述防攻击预处理单元包括以下至少之一：网卡驱动、虚拟网卡或本地网关。
  15. 一种防攻击数据传输装置，其特征在于，位于接收设备中，所述装置包括：
    接收单元，用于接收经防攻击预处理后得到的转换后的通信协议报文；
    解析单元，用于根据所述转换后的通信协议报文中位于报文头部的扩展位所指示的所述防攻击预处理的处理信息解析所述转换后的通信协议报文；
    获取单元，用于获取所述转换后的通信协议报文中位于所述报文头部的信息位上的数据，其中，所述通信协议报文的所述报文头部包括所述信息位和所述扩展位。
  16. 根据权利要求15所述的装置，其特征在于，所述解析单元包括以下至少之一：网卡驱动、虚拟网卡或本地网关。
PCT/CN2016/102646 2015-10-29 2016-10-20 防攻击数据传输方法及装置 WO2017071511A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/965,486 US11252184B2 (en) 2015-10-29 2018-04-27 Anti-attack data transmission method and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510719829.1A CN106656914A (zh) 2015-10-29 2015-10-29 防攻击数据传输方法及装置
CN201510719829.1 2015-10-29

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/965,486 Continuation US11252184B2 (en) 2015-10-29 2018-04-27 Anti-attack data transmission method and device

Publications (1)

Publication Number Publication Date
WO2017071511A1 true WO2017071511A1 (zh) 2017-05-04

Family

ID=58629824

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/102646 WO2017071511A1 (zh) 2015-10-29 2016-10-20 防攻击数据传输方法及装置

Country Status (3)

Country Link
US (1) US11252184B2 (zh)
CN (1) CN106656914A (zh)
WO (1) WO2017071511A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR102390465B1 (ko) * 2016-04-14 2022-04-22 현대자동차주식회사 네트워크에서 전원 관리 방법 및 장치
CN107483514A (zh) * 2017-10-13 2017-12-15 北京知道创宇信息技术有限公司 攻击监控设备及智能设备
CN113162941B (zh) * 2021-04-27 2023-06-27 航天新通科技有限公司 一种网关协议报文同步转换方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101404579A (zh) * 2008-10-31 2009-04-08 成都市华为赛门铁克科技有限公司 一种防止网络攻击的方法及装置
CN101669347A (zh) * 2007-04-23 2010-03-10 国际商业机器公司 用于检测具有伪造源地址的端口扫描的方法和装置
CN103532964A (zh) * 2013-10-22 2014-01-22 邱文乔 一种验证tcp连接安全性的方法
US20140298021A1 (en) * 2011-10-10 2014-10-02 Korea University Research And Business Foundation Method and system for storing information by using tcp communication

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8255996B2 (en) * 2005-12-30 2012-08-28 Extreme Networks, Inc. Network threat detection and mitigation
JP5716712B2 (ja) * 2012-07-24 2015-05-13 横河電機株式会社 パケット転送装置及び方法
GB2512733B (en) * 2014-02-25 2018-09-05 Qualcomm Technologies Int Ltd Broadcast retransmission
US10389690B2 (en) * 2015-04-28 2019-08-20 Telefonaktiebolaget Lm Ericsson (Publ) Method and system for managing communications in a system comprising a receiver entity, a sender entity, and a network entity
US10051000B2 (en) * 2015-07-28 2018-08-14 Citrix Systems, Inc. Efficient use of IPsec tunnels in multi-path environment

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101669347A (zh) * 2007-04-23 2010-03-10 国际商业机器公司 用于检测具有伪造源地址的端口扫描的方法和装置
CN101404579A (zh) * 2008-10-31 2009-04-08 成都市华为赛门铁克科技有限公司 一种防止网络攻击的方法及装置
US20140298021A1 (en) * 2011-10-10 2014-10-02 Korea University Research And Business Foundation Method and system for storing information by using tcp communication
CN103532964A (zh) * 2013-10-22 2014-01-22 邱文乔 一种验证tcp连接安全性的方法

Also Published As

Publication number Publication date
US20180248910A1 (en) 2018-08-30
US11252184B2 (en) 2022-02-15
CN106656914A (zh) 2017-05-10

Similar Documents

Publication Publication Date Title
CN110198293B (zh) 服务器的攻击防护方法、装置、存储介质和电子装置
US11570098B2 (en) Systems, apparatuses and methods for cooperating routers
US8499146B2 (en) Method and device for preventing network attacks
US7783880B2 (en) Method and apparatus for secure internet protocol (IPSEC) offloading with integrated host protocol stack management
TWI528761B (zh) 網路訊務處理系統
Touch Defending TCP against spoofing attacks
WO2017088326A1 (zh) Tcp连接的处理方法、装置及***
US20120227088A1 (en) Method for authenticating communication traffic, communication system and protective apparatus
CN107046495B (zh) 用于构建虚拟专用网络的方法、装置和***
EP4047886A1 (en) Information reporting method and information processing method, and device
WO2017071511A1 (zh) 防攻击数据传输方法及装置
WO2018103364A1 (zh) 攻击的防御方法、防御设备及计算机可读存储介质
US9380069B2 (en) Method and device for data transmission
WO2019085923A1 (zh) 数据处理方法、装置及计算机
WO2019096104A1 (zh) 攻击防范
EP3539235B1 (en) Systems, apparatuses and methods for cooperating routers
EP2007066A2 (en) A policy enforcement point and a linkage method and system for intrude detection system
JP6932375B2 (ja) 通信装置
TWI721086B (zh) 防攻擊資料傳輸方法及裝置
Smyslov Internet Key Exchange Protocol Version 2 (IKEv2) Message Fragmentation
CN111654474B (zh) 一种安全检测的方法和装置
Singh et al. Stateless model for the prevention of malicious communication channels
Smyslov RFC 7383: Internet Key Exchange Protocol Version 2 (IKEv2) Message Fragmentation
CN116506191A (zh) 一种隧道报文的阻断方法和阻断装置
WO2018079716A1 (ja) 通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16858946

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16858946

Country of ref document: EP

Kind code of ref document: A1