WO2017114200A1 - 报文清洗方法及装置 - Google Patents

报文清洗方法及装置 Download PDF

Info

Publication number
WO2017114200A1
WO2017114200A1 PCT/CN2016/110659 CN2016110659W WO2017114200A1 WO 2017114200 A1 WO2017114200 A1 WO 2017114200A1 CN 2016110659 W CN2016110659 W CN 2016110659W WO 2017114200 A1 WO2017114200 A1 WO 2017114200A1
Authority
WO
WIPO (PCT)
Prior art keywords
attack
packet
cleaning
type
attack type
Prior art date
Application number
PCT/CN2016/110659
Other languages
English (en)
French (fr)
Inventor
何卫斌
Original Assignee
阿里巴巴集团控股有限公司
何卫斌
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司, 何卫斌 filed Critical 阿里巴巴集团控股有限公司
Publication of WO2017114200A1 publication Critical patent/WO2017114200A1/zh
Priority to US16/024,523 priority Critical patent/US10924457B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0245—Filtering by information in the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers

Definitions

  • the present application relates to the field of network security, and in particular, to a packet cleaning method and apparatus.
  • the packet When a packet is attacked, traffic is usually pulled to a dedicated cleaning device to filter attack packets.
  • the general processing procedure of the cleaning device is as follows: the packet enters from the inbound direction, and according to the destination IP of the packet, the query obtains the policy for the IP of the destination. According to the policy, the message can be "accepted”, "passed” or "discarded".
  • the cleaning device only needs to perform these policies mechanically.
  • the strategy is pre-configured, that is, for a protected IP, predict the type of attack it may be subjected to, and then add all corresponding policies to the policy chain.
  • the embodiment of the present application provides a packet cleaning method and device, so as to at least solve the technical problem that the cleaning efficiency of the cleaning device is low due to the pre-configured policy.
  • a packet cleaning method including: obtaining a packet type and a destination address of a packet to be cleaned; and obtaining, according to the packet type, a preset configuration file.
  • the first attack type set corresponding to the packet type, and the second attack type set is obtained according to the destination address, where the second attack type set includes the device pointed by the destination address received within a preset time period
  • the attack type is generated according to the first attack type set and the second attack type set, and the cleaning policy chain corresponding to the to-be-cleaned message is generated; and the to-be-cleaned message is cleaned according to the cleaning policy chain.
  • a message cleaning apparatus including: a first acquiring unit, configured to obtain a packet type and a destination address of the packet to be cleaned; and a second acquiring unit, configured to acquire, according to the packet type, a corresponding type of the packet from the preset configuration file
  • the first attack type set, and the second attack type set is obtained according to the destination address, where the second attack type set includes an attack type that the device pointed by the destination address receives within a preset time period;
  • a cleaning policy chain corresponding to the to-be-cleaned message according to the first attack type set and the second attack type set, and a cleaning unit, configured to clean the to-be-cleaned according to the cleaning policy chain Clean the message.
  • the packet type and the destination address of the packet to be cleaned are obtained, and the first attack type set corresponding to the packet type is obtained from the preset configuration file according to the packet type, and according to the destination address.
  • Obtaining a second attack type set where the second attack type set includes an attack type that the device pointed to by the destination address is received within a preset time period; and the first attack type set and the second attack type set are generated corresponding to the to-be-cleaned
  • the cleaning policy chain of the packet is cleaned according to the cleaning policy chain, and the dynamic cleaning policy chain corresponding to the packet to be cleaned is obtained by the packet type and destination address of the packet to be cleaned.
  • the purpose of packet cleaning is targeted, thereby achieving the technical effect of improving the efficiency of packet cleaning, and further solving the technical problem that the cleaning efficiency of the cleaning device is low due to the pre-configured strategy.
  • FIG. 1 is a block diagram showing the hardware structure of a computer terminal for running a message cleaning method according to an embodiment of the present application
  • FIG. 2 is a schematic flowchart of an optional message cleaning method according to an embodiment of the present application.
  • FIG. 3 is a schematic structural diagram of an optional message cleaning apparatus according to an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of an optional generating unit according to an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of another optional message cleaning apparatus according to an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of an optional first acquiring unit according to an embodiment of the present application.
  • FIG. 7 is a structural block diagram of a computer terminal according to an embodiment of the present application.
  • a method embodiment of a message cleaning method is also provided. It should be noted that the steps shown in the flowchart of the drawing may be performed in a computer system such as a set of computer executable instructions. Also, although logical sequences are shown in the flowcharts, in some cases the steps shown or described may be performed in a different order than the ones described herein.
  • FIG. 1 is a hardware structural block diagram of a computer terminal of a message cleaning method according to an embodiment of the present application.
  • computer terminal 10 may include one or more (only one shown) processor 102 (processor) 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA, a memory 104 for storing data, and a transmission device 106 for communication functions.
  • processor 102 processor
  • FIG. 1 is merely illustrative and does not limit the structure of the above electronic device.
  • computer terminal 10 may also include more or fewer components than those shown in FIG. 1, or have a different configuration than that shown in FIG.
  • the memory 104 can be used to store software programs and modules of the application software, such as program instructions/modules corresponding to the message cleaning method in the embodiment of the present application, and the processor 102 executes each by running a software program and a module stored in the memory 104.
  • a functional application and data processing, that is, the above message cleaning method is implemented.
  • Memory 104 may include high speed random access memory, and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory.
  • memory 104 may further include memory remotely located relative to processor 102, which may be coupled to computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • Transmission device 106 is for receiving or transmitting data via a network.
  • the network specific examples described above may include a wireless network provided by a communication provider of the computer terminal 10.
  • the transmission device 106 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet.
  • the transmission device 106 can be a Radio Frequency (RF) module for communicating with the Internet wirelessly.
  • NIC Network Interface Controller
  • RF Radio Frequency
  • FIG. 2 is a flowchart of a message cleaning method according to Embodiment 1 of the present application.
  • Step S202 Obtain a packet type and a destination address of the packet to be cleaned.
  • the packet type includes one or more of the following: a TCP SYN (Transmission Control Protocol synchronous) packet, and a Transmission Control Protocol acknowledge TCP ACK (Transmission Control Protocol acknowledge)
  • TCP SYN Transmission Control Protocol synchronous
  • TCP ACK Transmission Control Protocol acknowledge
  • Destination address is used to indicate the The device to be cleaned needs to send the arriving device.
  • the packet type and the destination address of the packet to be cleaned may include:
  • step S10 the header of the message to be cleaned is parsed.
  • the header of the to-be-cleaned packet needs to be parsed first.
  • Step S12 Extract the packet type from the to-be-cleaned message and the destination address based on the offset of the field corresponding to the destination address, based on the offset of the field corresponding to the packet type.
  • the packet type is extracted from the to-be-cleaned message and the offset of the field corresponding to the destination address is based on the offset of the field corresponding to the packet type.
  • the destination address is extracted from the to-be-cleaned packet, where the offset of the field corresponding to the packet type and the offset of the field corresponding to the destination address may be determined from the protocol.
  • Step S204 Acquire a first attack type set corresponding to the packet type from the preset configuration file according to the packet type, and obtain a second attack type set according to the destination address.
  • the packet type of the packet to be cleaned is analyzed for each packet to be cleaned, and the first attack type set corresponding to the packet type is obtained (denoted as AttackSet_1). It is to be noted that the type of the packet to be used for each attack type is determined. Therefore, the mapping between the attack type and the packet type is organized into a configuration file, that is, according to the report of the packet to be cleaned when the packet is cleaned. For the type of the text, it is inferred which attacks may be caused by the message to be cleaned.
  • the first attack type set includes the attack type corresponding to the packet type, and the attack type includes one or more of the following: a SYN flood of the sn message flooding, an ACK flood of the ack packet flooding, and an overflow of the rst packet.
  • the configuration file contains the packet type, the attack type, and the correspondence between the packet type and the attack type.
  • the obtaining, according to the packet type, the first attack type set corresponding to the packet type from the preset configuration file may include:
  • step S20 the attack type corresponding to the packet type is searched from the preset configuration file.
  • the preset configuration file includes a correspondence between the packet type and the attack type, and the packet type of the packet to be cleaned is a TCP ACK packet, and the report is found in Table 1.
  • the file type is the attack type ACK flood corresponding to the TCP ACK packet.
  • Step S22 Generate a first attack type set including an attack type corresponding to the packet type.
  • the packet type of the packet to be cleaned is a TCP ACK packet
  • the second attack type set includes the attack type that the device pointed to by the destination address receives within a preset time period.
  • DDOS attack distributed Denial of Service
  • the attacker sends a large number of carefully constructed attack packets to the target by controlling a large number of zombie hosts.
  • the link of the network is congested, the system resources are exhausted, so that the attacker has the effect of refusing to provide services to the normal user's request), and the hacker simultaneously launches various types of DDOS attacks, such as SYN flood, RST flood, and UDP.
  • SYN flood, RST flood, and UDP various types of DDOS attacks
  • the weight value of the first attack type set may be obtained from the packet cleaning device, and the weight value of the second attack type set may be preset or not preset.
  • the default value is used, and the weight value can be used to indicate the arrangement of the cleaning policy chain that is generated in the following, which will be described in detail in the following embodiments, and is not described here.
  • Step S206 Generate a cleaning policy chain corresponding to the to-be-cleaned message according to the first attack type set and the second attack type set.
  • the cleaning policy chain corresponding to the to-be-cleaned message may be generated according to the first attack type set and the second attack type set.
  • step S206 generating, according to the first attack type set and the second attack type set, the cleaning policy chain corresponding to the to-be-cleaned message may include:
  • Step S30 calculating an intersection of the first attack type set and the second attack type set, to obtain a third attack type set.
  • the third attack type set includes the same attack type in the first attack type set and the second attack type set.
  • AttackSet_1 ⁇ ACKflood ⁇
  • AttackSet_2 ⁇ SYN flood
  • RST flood ACK flood ⁇
  • Step S32 Generate a cleaning policy chain according to the third attack type set.
  • the cleaning policy chain for the to-be-cleaned message may be generated based on the weight value of each attack type in the third attack type set.
  • step S32 generating a cleaning policy chain according to the third attack type set may include:
  • Step S40 Acquire a weight value of each attack type in the third attack type set.
  • the weight value may be an indicator used to measure the proportion of an attack type in the first attack type set and the second attack type set. For example, suppose The SYN flood TCP SYN packet PPS (Packets per Second, packet per second) is 10000, the TCP RST packet PPS of the RST flood is 5000, and the UDP flood TCP packet PPS is 20000, then the SYN flood The weight is 2, the weight of the RST flood is 1, and the weight of the UDP flood is 4.
  • the weight value may also be preset, for example, setting the weight of the ACK flood in the first attack type set to be 3.
  • step S42 each attack type is sorted according to the size of the weight value.
  • Step S44 The cleaning policy corresponding to each attack type is obtained, where the order of the cleaning policies is the same as the order of the sorted attack types.
  • step S44 of the present application on the basis of sorting each attack type, the cleaning policies corresponding to the sorted attack types, such as Rule_a, Rule_b, Rule_c, and Rule_d, are obtained.
  • Step S46 Generate a cleaning policy chain that includes the cleaning policy corresponding to each attack type after sorting.
  • AttackSet_3 contains attack types of Attack_1 and Attack_2.
  • the cleaning policy set of Attack_1 is RuleSet_1
  • the cleaning policy included in RuleSet_1 is Rule_a
  • Rule_b the cleaning policy set of Attack_2 is RuleSet_2
  • the cleaning policies included in RuleSet_2 are Rule_b and Rule_c.
  • the collection action of the attack type is an intersection
  • the collection action of the cleaning policy is a union
  • Step S208 cleaning the message to be cleaned according to the cleaning policy chain.
  • each cleaning policy is sequentially invoked according to the cleaning policy chain generated in the previous step. If the packet to be cleaned is discarded, the cleaning policy chain is terminated and the packet to be cleaned is discarded. If the packets to be cleaned are "passed", the subsequent cleaning policies are invoked according to the order of the cleaning policy. If the message to be cleaned is "accepted” or is not “discarded” after all the cleaning policies are passed, the message to be cleaned is sent to the outbound channel and forwarded to the original destination (that is, the device pointed to by the destination address).
  • all inputs are unified into pointers to messages, and all outputs are unified into actions for messages (eg, "Accept", "Pass", “Reject”).
  • All cleaning strategies are uniformly registered.
  • the function pointers of all cleaning strategies are uniformly registered to all variables.
  • All cleaning policies are uniformly numbered, and a cleaning strategy is referenced internally by the number.
  • the cleaning strategy chain is essentially a vector whose elements are numbered by the strategy.
  • the solution provided in the first embodiment of the present application obtains a dynamic cleaning policy chain corresponding to the to-be-cleaned message based on the packet type and the destination address of the packet to be cleaned, and achieves targeted implementation.
  • the purpose of packet cleaning is to achieve the technical effect of improving the efficiency of packet cleaning, and further solve the technical problem that the cleaning efficiency of the cleaning device is low due to the pre-configured strategy.
  • the cleaning the to-be-cleaned message according to the cleaning policy chain includes: sequentially invoking each cleaning policy to clean the to-be-cleaned message according to the sequence of each cleaning policy in the cleaning policy chain, Determining whether to discard the message to be cleaned.
  • the cleaning method may further include: sending the to-be-cleaned message to the device pointed to by the destination address.
  • the prior art has a policy that is configured in advance, that is, for a protected IP, predicts the type of attack that it may be subjected to, and then queries all corresponding policies to make the packet enter. Some problems that do not need to be entered at all, causing mis-cleaning and reducing the cleaning efficiency of the cleaning device.
  • the present application proposes a packet cleaning method, which obtains a correspondence corresponding to the packet to be cleaned based on the packet type and the destination address of the packet to be cleaned.
  • the dynamic cleaning policy chain of the packet achieves the purpose of packet cleaning in a targeted manner, thereby achieving the technical effect of improving the efficiency of message cleaning.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the technical solution of the present application which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk,
  • the optical disc includes a number of instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present application.
  • an apparatus embodiment for implementing the foregoing method embodiments is also provided.
  • the apparatus provided by the foregoing embodiment of the present application may be run on a computer terminal.
  • FIG. 3 is a schematic structural diagram of a message cleaning apparatus according to an embodiment of the present application.
  • the message cleaning apparatus may include a first obtaining unit 302, a second obtaining unit 304, a generating unit 306, and a washing unit 308.
  • the first obtaining unit 302 is configured to obtain a packet type and a destination address of the packet to be cleaned.
  • the second obtaining unit 304 is configured to obtain the report from the preset configuration file according to the packet type.
  • the first attack type set corresponding to the text type, and the second attack type set is obtained according to the destination address, where the second attack type set includes an attack that the device pointed by the destination address receives within a preset time period.
  • a generating unit 306, configured to generate, according to the first attack type set and the second attack type set, a cleaning policy chain corresponding to the to-be-cleaned message; the cleaning unit 308, configured to use the cleaning policy Chain, cleaning the message to be cleaned.
  • Embodiment 2 of the present application obtains a dynamic cleaning policy chain corresponding to the to-be-cleaned message based on the packet type and the destination address of the packet to be cleaned, and achieves targeted implementation.
  • the purpose of packet cleaning is to achieve the technical effect of improving the efficiency of packet cleaning, and further solve the technical problem that the cleaning efficiency of the cleaning device is low due to the pre-configured strategy.
  • first acquiring unit 302, the second obtaining unit 304, the generating unit 306, and the cleaning unit 308 correspond to steps S202 to S208 in the first embodiment, and the four modules are implemented by corresponding steps.
  • the examples and application scenarios are the same, but are not limited to the contents disclosed in the above embodiment 1.
  • the foregoing module may be implemented in the computer terminal 10 provided in the first embodiment as a part of the device, and may be implemented by software or by hardware.
  • the generating unit 306 includes: a calculating module 402 and a generating module 404.
  • the calculation module 402 is configured to calculate an intersection of the first attack type set and the second attack type set, to obtain a third attack type set, where the third attack type set includes the first attack The type of the attack is the same as the attack type of the second attack type set.
  • the generating module 404 is configured to generate the cleaning policy chain according to the third attack type set.
  • the foregoing calculation module 402 and the generation module 404 correspond to the steps S30 to S32 in the first embodiment, and the two modules are the same as the examples and application scenarios implemented by the corresponding steps, but are not limited to the above embodiments.
  • the foregoing module may be implemented in the computer terminal 10 provided in the first embodiment as a part of the device, and may be implemented by software or by hardware.
  • the generating module 404 is configured to: generate, according to the third attack type set, the cleaning policy chain: acquiring a weight value of each attack type in the third attack type set; according to the weight value The size of each attack type is sorted. The cleaning policy corresponding to each attack type is obtained. The order of the cleaning policies is the same as the order of the sorted attack types. The corresponding attack types are generated. The cleaning strategy chain of the cleaning strategy.
  • the cleaning unit 308 is configured to perform the following steps: cleaning the to-be-cleaned message according to the cleaning policy chain: sequentially calling each cleaning policy to the to-be-cleaned according to the sequence of each cleaning policy in the cleaning policy chain.
  • the packet is cleaned to determine whether to discard the message to be cleaned.
  • the message cleaning apparatus further includes: a sending unit 502, configured to send the to-be-cleaned message to the destination address if it is determined that the to-be-cleaned message is not discarded The device pointed to.
  • a sending unit 502 configured to send the to-be-cleaned message to the destination address if it is determined that the to-be-cleaned message is not discarded The device pointed to.
  • the first obtaining unit 302 includes: a parsing module 602 and an extracting module 604.
  • the parsing module 602 is configured to parse the header of the to-be-cleaned packet
  • the extracting module 604 is configured to extract the packet from the to-be-cleaned packet based on the offset of the field corresponding to the packet type. And selecting, according to the offset of the field corresponding to the destination address, the destination address from the to-be-cleaned message.
  • the foregoing parsing module 602 and the extracting module 604 correspond to the steps S10 to S12 in the first embodiment, and the two modules are the same as the examples and application scenarios implemented by the corresponding steps, but are not limited to the above embodiments.
  • a public content It should be noted that the above model The block can be implemented in the computer terminal 10 provided in the first embodiment as a part of the device, and can be implemented by software or by hardware.
  • the second obtaining unit 304 is configured to: according to the packet type, obtain, from the preset configuration file, a first attack type set corresponding to the packet type: from the preset
  • the configuration file is configured to search for an attack type corresponding to the packet type, where the preset configuration file includes a correspondence between the packet type and an attack type, and the generating includes the packet type corresponding to the packet type.
  • the first set of attack types of the type of attack is configured to: according to the packet type, obtain, from the preset configuration file, a first attack type set corresponding to the packet type: from the preset
  • the configuration file is configured to search for an attack type corresponding to the packet type, where the preset configuration file includes a correspondence between the packet type and an attack type, and the generating includes the packet type corresponding to the packet type.
  • the first set of attack types of the type of attack is configured to: according to the packet type, obtain, from the preset configuration file, a first attack type set corresponding to the packet type: from the preset
  • the configuration file
  • the packet type includes one or more of the following: a transmission control protocol synchronization TCPSYN packet, a transmission control protocol confirmation TCP ACK packet, and a transmission control protocol reset TCPRST packet;
  • the attack type includes the following Or several types: s flood flooding SYN flood, ack packet flood attack ACK flood, rst packet flood attack RST flood, and udp packet flood attack UDP flood.
  • Embodiments of the present application may provide a computer terminal, which may be any one of computer terminal groups.
  • the foregoing computer terminal may also be replaced with a terminal device such as a mobile terminal.
  • the computer terminal may be located in at least one network device of the plurality of network devices of the computer network.
  • the computer terminal may execute the program code of the following steps in the packet cleaning method: obtaining the packet type and the destination address of the packet to be cleaned; and obtaining the preset configuration file according to the packet type. a first set of attack types corresponding to the packet type, and acquiring a second set of attack types according to the destination address, where the second set of attack types includes a device pointed by the destination address in a preset time period The type of the attack to be received; the cleaning policy chain corresponding to the to-be-cleaned message is generated according to the first attack type set and the second attack type set; and the to-be-cleaned report is cleaned according to the cleaning policy chain Text.
  • FIG. 7 is a structural block diagram of a computer terminal according to an embodiment of the present application.
  • the computer terminal A may include one or more (only one shown in the figure) processor 702, memory 704, and transmission device 706.
  • the memory 704 can be used to store the software program and the module, such as the message cleaning method and the program instruction/module block corresponding to the device in the embodiment of the present application, and the processor 702 runs the software program stored in the memory 704 and The module blocks, thereby performing various function applications and data processing, that is, implementing the above-described message cleaning method.
  • Memory 704 can include high speed random access memory, and can also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory.
  • memory 704 can further include memory remotely located relative to the processor, which can be connected to terminal A over a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • the transmission device 706 described above is for receiving or transmitting data via a network.
  • Specific examples of the above network may include a wired network and a wireless network.
  • transmission device 706 includes a Network Interface Controller (NIC) that can be connected to other network devices and routers via a network cable to communicate with the Internet or a local area network.
  • NIC Network Interface Controller
  • the transmission device 706 is a Radio Frequency (RF) module for communicating with the Internet wirelessly.
  • RF Radio Frequency
  • the memory 704 is configured to store preset action conditions and information of the preset rights user, and an application.
  • the processor 702 can call the information and the application stored in the memory by the transmission device to perform the following steps: acquiring the packet type and the destination address of the message to be cleaned; and obtaining the preset configuration file according to the packet type. a first set of attack types corresponding to the packet type, and acquiring a second set of attack types according to the destination address, where the second set of attack types includes a device pointed by the destination address in a preset time period The type of the attack to be received; the cleaning policy chain corresponding to the to-be-cleaned message is generated according to the first attack type set and the second attack type set; and the to-be-cleaned report is cleaned according to the cleaning policy chain Text.
  • the solution provided in the foregoing Embodiment 3 of the present application obtains a dynamic cleaning policy corresponding to the packet to be cleaned by the packet type and the destination address of the packet to be cleaned.
  • the chain achieves the purpose of cleaning the message in a targeted manner, thereby achieving the technical effect of improving the efficiency of message cleaning, and further solving the technical problem that the cleaning efficiency of the cleaning device is low due to the pre-configured strategy.
  • the processor 702 may further execute the following steps: calculating an intersection of the first attack type set and the second attack type set, to obtain a third attack type set, where the third attack The type set includes the same attack type as the first attack type set and the second attack type set; and the cleaning policy chain is generated according to the third attack type set.
  • the processor 702 may further execute the following steps: acquiring a weight value of each attack type in the third attack type set; sorting each attack type according to the weight value; acquiring the sort A cleaning policy corresponding to each attack type, wherein the order of the cleaning policies is the same as the order of the sorted attack types; and the cleaning policy chain that includes the cleaning policies corresponding to the sorted attack types is generated.
  • the processor 702 may further execute the following steps: in accordance with the sequence of the cleaning policies in the cleaning policy chain, sequentially invoking each cleaning policy to clean the to-be-cleaned message to determine whether to discard the The cleaning message is mentioned.
  • processor 702 may further execute the following program code: send the to-be-cleaned message to the device pointed to by the destination address.
  • the processor 702 may further execute the following steps: parsing a header of the to-be-cleaned packet; and extracting, according to the offset of the field corresponding to the packet type, the packet to be cleaned And selecting the destination address from the to-be-cleaned message according to the packet type and the offset of the field corresponding to the destination address.
  • the processor 702 may further execute the following step: searching, according to the preset configuration file, an attack type corresponding to the packet type, where the preset configuration file includes Corresponding relationship between the packet type and the attack type; generating the first attack type set including the attack type corresponding to the packet type.
  • FIG. 7 is only schematic and the computer is final.
  • the terminal can also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, an applause computer, and a mobile Internet device (MID), a PAD, and the like.
  • FIG. 7 does not limit the structure of the above electronic device.
  • computer terminal 10 may also include more or fewer components (such as a network interface, display device, etc.) than shown in FIG. 7, or have a different configuration than that shown in FIG.
  • Embodiments of the present application also provide a storage medium.
  • the foregoing storage medium may be used to save the program code executed by the message cleaning method provided in the first embodiment.
  • the foregoing storage medium may be located in any one of the computer terminal groups in the computer network, or in any one of the mobile terminal groups.
  • the storage medium is configured to store program code for performing the following steps: obtaining a message type of the message to be cleaned and a destination address; and according to the message type, from the preset configuration Obtaining a first attack type set corresponding to the packet type, and acquiring a second attack type set according to the destination address, where the second attack type set includes the device pointed to by the destination address And determining, according to the first attack type set and the second attack type set, a cleaning policy chain corresponding to the to-be-cleaned message; and cleaning the cleaning policy chain according to the cleaning policy chain The message to be cleaned.
  • the storage medium is further configured to store program code for performing the following steps: calculating an intersection of the first attack type set and the second attack type set to obtain a third attack a set of types, wherein the third attack type set includes the same attack type in the first attack type set and the second attack type set; and the cleaning policy chain is generated according to the third attack type set .
  • the storage medium is further configured to store program code for performing the following steps: acquiring weight values of each attack type in the third attack type set; sorting each attack type according to the weight value And obtaining the cleaning policy corresponding to each attack type after the sorting, wherein the sorting order of each cleaning policy is the same as the sorting order of each sorted attack type; and the cleaning policy including the cleaning policy corresponding to each sorted attack type is generated. chain.
  • the storage medium is further configured to store the program code for performing the following steps: sequentially, according to the sequence of the cleaning policies in the cleaning policy chain, sequentially invoking each cleaning policy to clean the to-be-cleaned message to determine Whether to discard the message to be cleaned.
  • the storage medium is further configured to store program code for performing the step of: transmitting the message to be cleaned to a device to which the destination address is directed.
  • the storage medium is further configured to store program code for performing the following steps: parsing a header of the message to be cleaned; and extracting the message to be cleaned based on an offset of a field corresponding to the message type The message type is extracted, and the destination address is extracted from the to-be-cleaned message based on an offset of a field corresponding to the destination address.
  • the storage medium is further configured to store program code for performing the following steps: searching for an attack type corresponding to the packet type from the preset configuration file, where the preset configuration file The mapping between the packet type and the attack type is included, and the first attack type set that includes the attack type corresponding to the packet type is generated.
  • the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • a mobile hard disk e.g., a hard disk
  • magnetic memory e.g., a hard disk
  • the disclosed processing apparatus for order information may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, unit or module, and may be electrical or otherwise.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • a computer readable storage medium A number of instructions are included to cause a computer device (which may be a personal computer, server or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes: a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种报文清洗方法及装置。其中，该方法包括：获取待清洗报文的报文类型以及目的地址；根据所述报文类型，从预设的配置文件中获取与所述报文类型对应的第一攻击类型集合，并根据所述目的地址获取第二攻击类型集合，其中，所述第二攻击类型集合包含所述目的地址所指向的设备在预设时间段内受到的攻击类型；根据所述第一攻击类型集合和所述第二攻击类型集合，生成对应于所述待清洗报文的清洗策略链；依据所述清洗策略链，清洗所述待清洗报文。本申请解决了由于策略是事先配置好的造成的清洗设备的清洗效率较低的技术问题。

Description

报文清洗方法及装置 技术领域
本申请涉及网络安全领域，具体而言，涉及一种报文清洗方法及装置。
背景技术
在遭遇报文攻击时，一般会将流量牵引至专门的清洗设备，对攻击报文进行过滤。清洗设备的一般处理过程是这样的：报文从入方向进来，根据该报文目的IP，查询得到针对此目的IP的策略。根据策略，可以对报文做出“接受”、“通过”或者“丢弃”的决定。
对目前的技术而言，对于某一种特定的攻击类型，会有一个或者多个对应的策略，清洗设备只需要机械地执行这些策略即可。在一般的工程实践中，策略是事先配置好的，即，针对某个被保护的IP，预测其可能遭受的攻击类型，然后把所有对应的策略都加入策略链。
然而，这会带来这样的问题：报文会进入一些完全不需要进入的策略，造成误清洗，降低清洗设备的清洗效率。
针对上述的问题，目前尚未提出有效的解决方案。
发明内容
本申请实施例提供了一种报文清洗方法及装置，以至少解决由于策略是事先配置好的造成的清洗设备的清洗效率较低的技术问题。
根据本申请实施例的一个方面，提供了一种报文清洗方法，包括：获取待清洗报文的报文类型以及目的地址；根据所述报文类型，从预设的配置文件中获取与所述报文类型对应的第一攻击类型集合，并根据所述目的地址获取第二攻击类型集合，其中，所述第二攻击类型集合包含所述目的地址所指向的设备在预设时间段内受到的攻击类型；根据所述第一攻击类型集合和所述第二攻击类型集合，生成对应于所述待清洗报文的清洗策略链；依据所述清洗策略链，清洗所述待清洗报文。
根据本申请实施例的另一方面，还提供了一种报文清洗装置，包括： 第一获取单元，用于获取待清洗报文的报文类型以及目的地址；第二获取单元，用于根据所述报文类型，从预设的配置文件中获取与所述报文类型对应的第一攻击类型集合，并根据所述目的地址获取第二攻击类型集合，其中，所述第二攻击类型集合包含所述目的地址所指向的设备在预设时间段内受到的攻击类型；生成单元，用于根据所述第一攻击类型集合和所述第二攻击类型集合，生成对应于所述待清洗报文的清洗策略链；清洗单元，用于依据所述清洗策略链，清洗所述待清洗报文。
在本申请实施例中，采用获取待清洗报文的报文类型以及目的地址；根据报文类型，从预设的配置文件中获取与报文类型对应的第一攻击类型集合，并根据目的地址获取第二攻击类型集合，其中，第二攻击类型集合包含目的地址所指向的设备在预设时间段内受到的攻击类型；根据第一攻击类型集合和第二攻击类型集合，生成对应于待清洗报文的清洗策略链；依据清洗策略链，清洗待清洗报文的方式，通过基于待清洗报文的报文类型以及目的地址得到一条对应于待清洗报文的动态的清洗策略链，达到了有针对性地进行报文清洗的目的，从而实现了提高报文清洗效率的技术效果，进而解决了由于策略是事先配置好的造成的清洗设备的清洗效率较低的技术问题。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1是根据本申请实施例的一种运行报文清洗方法的计算机终端的硬件结构框图；
图2是根据本申请实施例的一种可选的报文清洗方法的流程示意图；
图3是根据本申请实施例的一种可选的报文清洗装置的结构示意图；
图4是根据本申请实施例的一种可选的生成单元的结构示意图；
图5是根据本申请实施例的另一种可选的报文清洗装置的结构示意图；
图6是根据本申请实施例的一种可选的第一获取单元的结构示意图；
图7是根据本申请实施例的一种计算机终端的结构框图。
具体实施方式
为了使本技术领域的人员更好地理解本申请方案，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本申请保护的范围。
需要说明的是，本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本申请的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、***、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
实施例1
根据本申请实施例，还提供了一种报文清洗方法的方法实施例，需要说明的是，在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机***中执行，并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
本申请实施例一所提供的方法实施例可以在移动终端、计算机终端或者类似的运算装置中执行。以运行在计算机终端上为例，图1是本申请实施例的一种报文清洗方法的计算机终端的硬件结构框图。如图1所示，计算机终端10可以包括一个或多个(图中仅示出一个)处理器102(处理器 102可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)、用于存储数据的存储器104、以及用于通信功能的传输装置106。本领域普通技术人员可以理解，图1所示的结构仅为示意，其并不对上述电子装置的结构造成限定。例如，计算机终端10还可包括比图1中所示更多或者更少的组件，或者具有与图1所示不同的配置。
存储器104可用于存储应用软件的软件程序以及模块，如本申请实施例中的报文清洗方法对应的程序指令/模块，处理器102通过运行存储在存储器104内的软件程序以及模块，从而执行各种功能应用以及数据处理，即实现上述的报文清洗方法。存储器104可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器104可进一步包括相对于处理器102远程设置的存储器，这些远程存储器可以通过网络连接至计算机终端10。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
传输装置106用于经由一个网络接收或者发送数据。上述的网络具体实例可包括计算机终端10的通信供应商提供的无线网络。在一个实例中，传输装置106包括一个网络适配器(Network Interface Controller，NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输装置106可以为射频(Radio Frequency，RF)模块，其用于通过无线方式与互联网进行通讯。
在上述运行环境下，本申请提供了如图2所示的报文清洗方法。图2是根据本申请实施例一的报文清洗方法的流程图。
步骤S202，获取待清洗报文的报文类型以及目的地址。
本申请步骤S202中，报文类型包括以下一种或几种：TCP SYN(Transmission Control Protocol synchronous，传输控制协议同步)报文、传输控制协议确认TCP ACK(Transmission Control Protocol acknowledge，传输控制协议确认)报文以及传输控制协议复位TCP RST(Transmission Control Protocol reset，传输控制协议复位)报文。目的地址用于指示所述 待清洗报文需发送到达的设备。
可选地，步骤S202，获取待清洗报文的报文类型以及目的地址可以包括：
步骤S10，解析待清洗报文的报头。
本申请步骤S10中，为了获取待清洗报文的报文类型和目的地址，首先需要解析出该待清洗报文的报头。
步骤S12，基于报文类型对应的字段的偏移量，从待清洗报文中提取报文类型，以及基于目的地址对应的字段的偏移量，从待清洗报文中提取目的地址。
本申请步骤S12中，在解析出待清洗报文的报头之后，基于报文类型对应的字段的偏移量，从待清洗报文中提取报文类型，以及基于目的地址对应的字段的偏移量，从待清洗报文中提取目的地址，其中，报文类型对应的字段的偏移量与目的地址对应的字段的偏移量可以从协议中确定。
步骤S204，根据报文类型，从预设的配置文件中获取与报文类型对应的第一攻击类型集合，并根据目的地址获取第二攻击类型集合。
本申请步骤S204中，对于进入的每个待清洗报文，分析出待清洗报文的报文类型，进而获取到与报文类型对应的第一攻击类型集合(记为AttackSet_1)。需要说明的是，每种攻击类型使用何种报文是确定的，因此，把攻击类型和报文类型的映射关系整理成一份配置文件，即可以在报文清洗时根据待清洗报文的报文类型，反向推测出该待清洗报文可能造成哪些攻击。
其中，第一攻击类型集合包含与报文类型对应的攻击类型，攻击类型包括以下一种或几种：syn报文泛洪攻击SYN flood、ack报文泛洪攻击ACK flood、rst报文泛洪攻击RST flood以及udp报文泛洪攻击UDP flood。
例如，如表1所示，为上述预设的配置文件，配置文件中包含有报文类型、攻击类型以及报文类型与攻击类型的对应关系：
表1
序号 报文类型 攻击类型
1 TCP SYN报文 SYN flood
2 TCP ACK报文 ACK flood
3 TCP RST报文 RST flood
可选地，根据报文类型，从预设的配置文件中获取与报文类型对应的第一攻击类型集合可以包括：
步骤S20，从预设的配置文件中，查找报文类型对应的攻击类型。
本申请步骤S20中，预设的配置文件中包含有报文类型与攻击类型之间的对应关系，以待清洗报文的报文类型为TCP ACK报文为例，在表1中查找出报文类型为TCP ACK报文对应的攻击类型ACK flood。
步骤S22，生成包含报文类型对应的攻击类型的第一攻击类型集合。
本申请步骤S22中，仍以待清洗报文的报文类型为TCP ACK报文为例，基于从表1查找出的攻击类型ACK flood，生成第一攻击类型集合，即AttackSet_1＝{ACK flood}。
进一步地，第二攻击类型集合包含目的地址所指向的设备在预设时间段内受到的攻击类型。
例如，对于目的地址所指向的设备，黑客正在实施DDOS攻击(Distributed Denial of Service，是指攻击者通过控制大量的僵尸主机，向被攻击目标发送大量精心构造的攻击报文，造成被攻击者所在网络的链路拥塞、***资源耗尽，从而使被攻击者产生拒绝向正常用户的请求提供服务的效果)，而且黑客同时发动了多种类型的DDOS攻击，例如有SYN flood、RST flood以及UDP flood，那么，第二攻击类型集合(记为AttackSet_2)中就会有{SYN flood，RST flood，UDP flood}。
需要补充的是，第一攻击类型集合的权重值可以是从报文清洗装置获取到的，第二攻击类型集合的权重值可以是预先设置的，也可以不预先设 置，而使用默认值，其中，权重值可以用来指示后续生成的清洗策略链的排列组成，后续实施例中会进行详细描述，此处不作赘述。
步骤S206，根据第一攻击类型集合和第二攻击类型集合，生成对应于待清洗报文的清洗策略链。
本申请步骤S206中，在获取到第一攻击类型集合和第二攻击类型集合之后，可以根据第一攻击类型集合和第二攻击类型集合，生成对应于待清洗报文的清洗策略链。
可选地，步骤S206，根据第一攻击类型集合和第二攻击类型集合，生成对应于待清洗报文的清洗策略链可以包括：
步骤S30，计算第一攻击类型集合与第二攻击类型集合的交集，得到第三攻击类型集合。
本申请步骤S30中，第三攻击类型集合中包含第一攻击类型集合与第二攻击类型集合中相同的攻击类型。
仍以待清洗报文的报文类型为TCP ACK报文为例，AttackSet_1＝{ACKflood}，AttackSet_2＝{SYN flood，RST flood，ACK flood}，计算AttackSet_1与AttackSet_2的交集，得到第三攻击类型集合(记为AttackSet_3)为{ACK flood}。
步骤S32，根据第三攻击类型集合，生成清洗策略链。
本申请步骤S32中，在得到第三攻击类型集合之后，可以基于第三攻击类型集合中每个攻击类型的权重值，生成针对于待清洗报文的清洗策略链。
可选地，步骤S32，根据第三攻击类型集合，生成清洗策略链可以包括：
步骤S40，获取第三攻击类型集合中各个攻击类型的权重值。
本申请步骤S40中，权重值可以是用来衡量某个攻击类型在第一攻击类型集合和第二攻击类型集合中所占比例的一个指标。例如，假设造成 SYN flood的TCP SYN报文PPS(Packets per Second，数据包每秒)是10000，造成RST flood的TCP RST报文PPS是5000，造成UDP flood的UDP报文TCP PPS是20000，那么，SYN flood的权重就是2，RST flood的权重就是1，UDP flood的权重是4。权重值也可以是预先设定的，例如设定第一攻击类型集合中的ACK flood的权重是3。
步骤S42，按照权重值的大小，对各个攻击类型进行排序。
步骤S44，获取排序后的各个攻击类型对应的清洗策略，其中，各个清洗策略的排列顺序与排序后的各个攻击类型的排列顺序一致。
本申请步骤S44中，在对各个攻击类型进行排序的基础上，获取排序后的各个攻击类型对应的清洗策略，例如Rule_a，Rule_b，Rule_c，Rule_d。
步骤S46，生成包含排序后的各个攻击类型对应的清洗策略的清洗策略链。
本申请步骤S46中，最终得到清洗策略链(记为RuleList)，RuleList＝{Rule_a，Rule_b，Rule_c，Rule_d}。
又例如，AttackSet_3包含的攻击类型是Attack_1和Attack_2。根据配置文件，Attack_1的清洗策略集合是RuleSet_1，RuleSet_1中包含的清洗策略是Rule_a、Rule_b，Attack_2的清洗策略集合是RuleSet_2，RuleSet_2中包含的清洗策略是Rule_b、Rule_c。
1、如果Attack_1的权重高于Attack_2，那么最终策略链RuleList的生成逻辑可以用如下公式来表示：
RuleList＝{RuleSet_1、RuleSet_2}＝{Rule_a、Rule_b、Rule_b、Rule_c}＝{Rule_a、Rule_b、Rule_c}
2、如果Attack_2的权重高于Attack_1，那么最终策略链RuleList的生成逻辑可以用如下公式来表示：
RuleList＝{RuleSet_2、RuleSet_1}＝{Rule_b、Rule_c、Rule_a、Rule_b}＝{Rule_b、Rule_c、Rule_a}
此处需要说明的是，攻击类型的取集合动作是交集，清洗策略的取集合动作是并集。
需要补充的是，如果清洗设备不支持权重值，则使用默认权重值，RuleList中的策略Rule_a、Rule_b、Rule_c，就不需要有先后顺序，只需要简单取交集即可。
步骤S208，依据清洗策略链，清洗待清洗报文。
本申请步骤S208中，待清洗报文进入清洗策略链时，根据上一步骤生成的清洗策略链，顺序调用每个清洗策略。如果待清洗报文被“丢弃”，则结束清洗策略链，丢弃待清洗报文。如果待清洗报文被“通过”，则根据清洗策略的顺序，调用后续的清洗策略。如果待清洗报文被“接受”，或者通过所有清洗策略后，未被“丢弃”，则将待清洗报文送入出方向通道，转发至原始目的地(即目的地址所指向的设备)。
需要补充说明的是，本实施例的报文清洗方法中，所有清洗策略的输入、输出需要保持一致。例如，所有的输入统一为报文的指针，所有的输出统一为针对报文的动作(比如：“接受”、“通过”、“拒绝”)。所有清洗策略统一注册。比如将所有清洗策略的函数指针统一注册到某个全部变量。对所有清洗策略统一编号，程序内部通过编号来引用某个清洗策略，清洗策略链，本质上就是一个元素为策略编号的向量。
由上可知，本申请上述实施例一所提供的方案，通过基于待清洗报文的报文类型以及目的地址得到一条对应于待清洗报文的动态的清洗策略链，达到了有针对性地进行报文清洗的目的，从而实现了提高报文清洗效率的技术效果，进而解决了由于策略是事先配置好的造成的清洗设备的清洗效率较低的技术问题。
可选地，所述依据所述清洗策略链，清洗所述待清洗报文包括：按照所述清洗策略链中各个清洗策略的顺序，依次调用各个清洗策略对所述待清洗报文进行清洗，以确定是否丢弃所述待清洗报文。
进一步地，在确定不丢弃所述待清洗报文的情况下，本实施例的报文 清洗方法还可以包括：将所述待清洗报文发送至所述目的地址所指向的设备。
由上可知，现有技术存在的由于策略是事先配置好的，即，针对某个被保护的IP，预测其可能遭受的攻击类型，然后把所有对应的策略都查询出，使得报文会进入一些完全不需要进入的策略，造成误清洗，降低清洗设备的清洗效率的问题，本申请提出一种报文清洗方法，通过基于待清洗报文的报文类型以及目的地址得到一条对应于待清洗报文的动态的清洗策略链，达到了有针对性地进行报文清洗的目的，从而实现了提高报文清洗效率的技术效果。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本申请并不受所描述的动作顺序的限制，因为依据本申请，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本申请所必须的。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本申请各个实施例所述的方法。
实施例2
根据本申请实施例，还提供了一种用于实施上述方法实施例的装置实施例，本申请上述实施例所提供的装置可以在计算机终端上运行。
图3是根据本申请实施例的报文清洗装置的结构示意图。
如图3所示，该报文清洗装置可以包括第一获取单元302、第二获取单元304、生成单元306以及清洗单元308。
其中，第一获取单元302，用于获取待清洗报文的报文类型以及目的地址；第二获取单元304，用于根据所述报文类型，从预设的配置文件中获取与所述报文类型对应的第一攻击类型集合，并根据所述目的地址获取第二攻击类型集合，其中，所述第二攻击类型集合包含所述目的地址所指向的设备在预设时间段内受到的攻击类型；生成单元306，用于根据所述第一攻击类型集合和所述第二攻击类型集合，生成对应于所述待清洗报文的清洗策略链；清洗单元308，用于依据所述清洗策略链，清洗所述待清洗报文。
由上可知，本申请上述实施例二所提供的方案，通过基于待清洗报文的报文类型以及目的地址得到一条对应于待清洗报文的动态的清洗策略链，达到了有针对性地进行报文清洗的目的，从而实现了提高报文清洗效率的技术效果，进而解决了由于策略是事先配置好的造成的清洗设备的清洗效率较低的技术问题。
此处需要说明的是，上述第一获取单元302、第二获取单元304、生成单元306以及清洗单元308对应于实施例一中的步骤S202至步骤S208，四个模块与对应的步骤所实现的示例和应用场景相同，但不限于上述实施例一所公开的内容。需要说明的是，上述模块作为装置的一部分可以运行在实施例一提供的计算机终端10中，可以通过软件实现，也可以通过硬件实现。
可选地，如图4所示，所述生成单元306包括：计算模块402和生成模块404。
其中，计算模块402，用于计算所述第一攻击类型集合与所述第二攻击类型集合的交集，得到第三攻击类型集合，其中，所述第三攻击类型集合中包含所述第一攻击类型集合与所述第二攻击类型集合中相同的攻击类型；生成模块404，用于根据所述第三攻击类型集合，生成所述清洗策略链。
此处需要说明的是，上述计算模块402和生成模块404对应于实施例一中的步骤S30至步骤S32，两个模块与对应的步骤所实现的示例和应用场景相同，但不限于上述实施例一所公开的内容。需要说明的是，上述模块作为装置的一部分可以运行在实施例一提供的计算机终端10中，可以通过软件实现，也可以通过硬件实现。
可选地，生成模块404用于执行以下步骤根据所述第三攻击类型集合，生成所述清洗策略链：获取所述第三攻击类型集合中各个攻击类型的权重值；按照所述权重值的大小，对各个攻击类型进行排序；获取排序后的各个攻击类型对应的清洗策略，其中，各个清洗策略的排列顺序与排序后的各个攻击类型的排列顺序一致；生成包含排序后的各个攻击类型对应的清洗策略的所述清洗策略链。
可选地，清洗单元308用于执行以下步骤依据所述清洗策略链，清洗所述待清洗报文：按照所述清洗策略链中各个清洗策略的顺序，依次调用各个清洗策略对所述待清洗报文进行清洗，以确定是否丢弃所述待清洗报文。
可选地，如图5所示，报文清洗装置还包括：发送单元502，用于在确定不丢弃所述待清洗报文的情况下，将所述待清洗报文发送至所述目的地址所指向的设备。
可选地，如图6所示，所述第一获取单元302包括：解析模块602和提取模块604。
其中，解析模块602，用于解析所述待清洗报文的报头；提取模块604，用于基于所述报文类型对应的字段的偏移量，从所述待清洗报文中提取所述报文类型，以及基于所述目的地址对应的字段的偏移量，从所述待清洗报文中提取所述目的地址。
此处需要说明的是，上述解析模块602和提取模块604对应于实施例一中的步骤S10至步骤S12，两个模块与对应的步骤所实现的示例和应用场景相同，但不限于上述实施例一所公开的内容。需要说明的是，上述模 块作为装置的一部分可以运行在实施例一提供的计算机终端10中，可以通过软件实现，也可以通过硬件实现。
可选地，所述第二获取单元304用于执行以下步骤根据所述报文类型，从预设的配置文件中获取与所述报文类型对应的第一攻击类型集合：从所述预设的配置文件中，查找所述报文类型对应的攻击类型，其中，所述预设的配置文件中包含有所述报文类型与攻击类型之间的对应关系；生成包含所述报文类型对应的攻击类型的所述第一攻击类型集合。
可选地，所述报文类型包括以下一种或几种：传输控制协议同步TCPSYN报文、传输控制协议确认TCP ACK报文以及传输控制协议复位TCPRST报文；所述攻击类型包括以下一种或几种：syn报文泛洪攻击SYN flood、ack报文泛洪攻击ACK flood、rst报文泛洪攻击RST flood以及udp报文泛洪攻击UDP flood。
实施例3
本申请的实施例可以提供一种计算机终端，该计算机终端可以是计算机终端群中的任意一个计算机终端设备。可选地，在本实施例中，上述计算机终端也可以替换为移动终端等终端设备。
可选地，在本实施例中，上述计算机终端可以位于计算机网络的多个网络设备中的至少一个网络设备。
在本实施例中，上述计算机终端可以执行报文清洗方法中以下步骤的程序代码：获取待清洗报文的报文类型以及目的地址；根据所述报文类型，从预设的配置文件中获取与所述报文类型对应的第一攻击类型集合，并根据所述目的地址获取第二攻击类型集合，其中，所述第二攻击类型集合包含所述目的地址所指向的设备在预设时间段内受到的攻击类型；根据所述第一攻击类型集合和所述第二攻击类型集合，生成对应于所述待清洗报文的清洗策略链；依据所述清洗策略链，清洗所述待清洗报文。
可选地，图7是根据本申请实施例的一种计算机终端的结构框图。如 图7所示，该计算机终端A可以包括：一个或多个(图中仅示出一个)处理器702、存储器704、以及传输装置706。
其中，存储器704可用于存储软件程序以及模程序块，如本申请实施例中的报文清洗方法及装置对应的程序指令/模程序块，处理器702通过运行存储在存储器704内的软件程序以及模程序块，从而执行各种功能应用以及数据处理，即实现上述的报文清洗方法。存储器704可包括高速随机存储器，还可以包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器704可进一步包括相对于处理器远程设置的存储器，这些远程存储器可以通过网络连接至终端A。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
上述的传输装置706用于经由一个网络接收或者发送数据。上述的网络具体实例可包括有线网络及无线网络。在一个实例中，传输装置706包括一个网络适配器(Network Interface Controller，NIC)，其可通过网线与其他网络设备与路由器相连从而可与互联网或局域网进行通讯。在一个实例中，传输装置706为射频(Radio Frequency，RF)模块，其用于通过无线方式与互联网进行通讯。
其中，具体地，存储器704用于存储预设动作条件和预设权限用户的信息、以及应用程序。
处理器702可以通过传输装置调用存储器存储的信息及应用程序，以执行下述步骤：获取待清洗报文的报文类型以及目的地址；根据所述报文类型，从预设的配置文件中获取与所述报文类型对应的第一攻击类型集合，并根据所述目的地址获取第二攻击类型集合，其中，所述第二攻击类型集合包含所述目的地址所指向的设备在预设时间段内受到的攻击类型；根据所述第一攻击类型集合和所述第二攻击类型集合，生成对应于所述待清洗报文的清洗策略链；依据所述清洗策略链，清洗所述待清洗报文。
由上可知，本申请上述实施例三所提供的方案，通过基于待清洗报文的报文类型以及目的地址得到一条对应于待清洗报文的动态的清洗策略 链，达到了有针对性地进行报文清洗的目的，从而实现了提高报文清洗效率的技术效果，进而解决了由于策略是事先配置好的造成的清洗设备的清洗效率较低的技术问题。
可选的，上述处理器702还可以执行如下步骤的程序代码：计算所述第一攻击类型集合与所述第二攻击类型集合的交集，得到第三攻击类型集合，其中，所述第三攻击类型集合中包含所述第一攻击类型集合与所述第二攻击类型集合中相同的攻击类型；根据所述第三攻击类型集合，生成所述清洗策略链。
可选的，上述处理器702还可以执行如下步骤的程序代码：获取所述第三攻击类型集合中各个攻击类型的权重值；按照所述权重值的大小，对各个攻击类型进行排序；获取排序后的各个攻击类型对应的清洗策略，其中，各个清洗策略的排列顺序与排序后的各个攻击类型的排列顺序一致；生成包含排序后的各个攻击类型对应的清洗策略的所述清洗策略链。
可选的，上述处理器702还可以执行如下步骤的程序代码：按照所述清洗策略链中各个清洗策略的顺序，依次调用各个清洗策略对所述待清洗报文进行清洗，以确定是否丢弃所述待清洗报文。
可选的，上述处理器702还可以执行如下步骤的程序代码：将所述待清洗报文发送至所述目的地址所指向的设备。
可选的，上述处理器702还可以执行如下步骤的程序代码：解析所述待清洗报文的报头；基于所述报文类型对应的字段的偏移量，从所述待清洗报文中提取所述报文类型，以及基于所述目的地址对应的字段的偏移量，从所述待清洗报文中提取所述目的地址。
可选的，上述处理器702还可以执行如下步骤的程序代码：从所述预设的配置文件中，查找所述报文类型对应的攻击类型，其中，所述预设的配置文件中包含有所述报文类型与攻击类型之间的对应关系；生成包含所述报文类型对应的攻击类型的所述第一攻击类型集合。
本领域普通技术人员可以理解，图7所示的结构仅为示意，计算机终 端也可以是智能手机(如Android手机、iOS手机等)、平板电脑、掌声电脑以及移动互联网设备(Mobile Internet Devices，MID)、PAD等终端设备。图7其并不对上述电子装置的结构造成限定。例如，计算机终端10还可包括比图7中所示更多或者更少的组件(如网络接口、显示装置等)，或者具有与图7所示不同的配置。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令终端设备相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质可以包括：闪存盘、只读存储器(Read-Only Memory，ROM)、随机存取器(Random Access Memory，RAM)、磁盘或光盘等。
实施例4
本申请的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以用于保存上述实施例一所提供的报文清洗方法所执行的程序代码。
可选地，在本实施例中，上述存储介质可以位于计算机网络中计算机终端群中的任意一个计算机终端中，或者位于移动终端群中的任意一个移动终端中。
可选地，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：获取待清洗报文的报文类型以及目的地址；根据所述报文类型，从预设的配置文件中获取与所述报文类型对应的第一攻击类型集合，并根据所述目的地址获取第二攻击类型集合，其中，所述第二攻击类型集合包含所述目的地址所指向的设备在预设时间段内受到的攻击类型；根据所述第一攻击类型集合和所述第二攻击类型集合，生成对应于所述待清洗报文的清洗策略链；依据所述清洗策略链，清洗所述待清洗报文。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：计算所述第一攻击类型集合与所述第二攻击类型集合的交集，得到第三攻击 类型集合，其中，所述第三攻击类型集合中包含所述第一攻击类型集合与所述第二攻击类型集合中相同的攻击类型；根据所述第三攻击类型集合，生成所述清洗策略链。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：获取所述第三攻击类型集合中各个攻击类型的权重值；按照所述权重值的大小，对各个攻击类型进行排序；获取排序后的各个攻击类型对应的清洗策略，其中，各个清洗策略的排列顺序与排序后的各个攻击类型的排列顺序一致；生成包含排序后的各个攻击类型对应的清洗策略的所述清洗策略链。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：按照所述清洗策略链中各个清洗策略的顺序，依次调用各个清洗策略对所述待清洗报文进行清洗，以确定是否丢弃所述待清洗报文。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：将所述待清洗报文发送至所述目的地址所指向的设备。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：解析所述待清洗报文的报头；基于所述报文类型对应的字段的偏移量，从所述待清洗报文中提取所述报文类型，以及基于所述目的地址对应的字段的偏移量，从所述待清洗报文中提取所述目的地址。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：从所述预设的配置文件中，查找所述报文类型对应的攻击类型，其中，所述预设的配置文件中包含有所述报文类型与攻击类型之间的对应关系；生成包含所述报文类型对应的攻击类型的所述第一攻击类型集合。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
可选地，本实施例中的具体示例可以参考上述实施例1中所描述的示例，本实施例在此不再赘述。
上述本申请实施例序号仅仅为了描述，不代表实施例的优劣。
在本申请的上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的订单信息的处理装置，可通过其它的方式实现。其中，以上所描述的装置实施例仅仅是示意性的，例如所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个***，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，单元或模块的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述仅是本申请的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本申请原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本申请的保护范围。

Claims (16)

  1. 一种报文清洗方法，其特征在于，包括：
    获取待清洗报文的报文类型以及目的地址；
    根据所述报文类型，从预设的配置文件中获取与所述报文类型对应的第一攻击类型集合，并根据所述目的地址获取第二攻击类型集合，其中，所述第二攻击类型集合包含所述目的地址所指向的设备在预设时间段内受到的攻击类型；
    根据所述第一攻击类型集合和所述第二攻击类型集合，生成对应于所述待清洗报文的清洗策略链；
    依据所述清洗策略链，清洗所述待清洗报文。
  2. 根据权利要求1所述的方法，其特征在于，所述根据所述第一攻击类型集合和所述第二攻击类型集合，生成对应于所述待清洗报文的清洗策略链包括：
    计算所述第一攻击类型集合与所述第二攻击类型集合的交集，得到第三攻击类型集合，其中，所述第三攻击类型集合中包含所述第一攻击类型集合与所述第二攻击类型集合中相同的攻击类型；
    根据所述第三攻击类型集合，生成所述清洗策略链。
  3. 根据权利要求2所述的方法，其特征在于，所述根据所述第三攻击类型结合，生成所述清洗策略链包括：
    获取所述第三攻击类型集合中各个攻击类型的权重值；
    按照所述权重值的大小，对各个攻击类型进行排序；
    获取排序后的各个攻击类型对应的清洗策略，其中，各个清洗策略的排列顺序与排序后的各个攻击类型的排列顺序一致；
    生成包含排序后的各个攻击类型对应的清洗策略的所述清洗策略链。
  4. 根据权利要求3所述的方法，其特征在于，所述依据所述清洗策略链， 清洗所述待清洗报文包括：
    按照所述清洗策略链中各个清洗策略的顺序，依次调用各个清洗策略对所述待清洗报文进行清洗，以确定是否丢弃所述待清洗报文。
  5. 根据权利要求4所述的方法，其特征在于，在确定不丢弃所述待清洗报文的情况下，所述方法还包括：
    将所述待清洗报文发送至所述目的地址所指向的设备。
  6. 根据权利要求1所述的方法，其特征在于，所述获取待清洗报文的报文类型以及目的地址包括：
    解析所述待清洗报文的报头；
    基于所述报文类型对应的字段的偏移量，从所述待清洗报文中提取所述报文类型，以及基于所述目的地址对应的字段的偏移量，从所述待清洗报文中提取所述目的地址。
  7. 根据权利要求1所述的方法，其特征在于，所述根据所述报文类型，从预设的配置文件中获取与所述报文类型对应的第一攻击类型集合包括：
    从所述预设的配置文件中，查找所述报文类型对应的攻击类型，其中，所述预设的配置文件中包含有所述报文类型与攻击类型之间的对应关系；
    生成包含所述报文类型对应的攻击类型的所述第一攻击类型集合。
  8. 根据权利要求1至7中任一项所述的方法，其特征在于，所述报文类型包括以下一种或几种：传输控制协议同步TCP SYN报文、传输控制协议确认TCP ACK报文以及传输控制协议复位TCP RST报文；所述攻击类型包括以下一种或几种：syn报文泛洪攻击SYN flood、ack报文泛洪攻击ACK flood、rst报文泛洪攻击RST flood以及udp报文泛洪攻击UDP flood。
  9. 一种报文清洗装置，其特征在于，包括：
    第一获取单元，用于获取待清洗报文的报文类型以及目的地址；
    第二获取单元，用于根据所述报文类型，从预设的配置文件中获取与所述报文类型对应的第一攻击类型集合，并根据所述目的地址获取第二攻击类型集合，其中，所述第二攻击类型集合包含所述目的地址所指向的设备在预设时间段内受到的攻击类型；
    生成单元，用于根据所述第一攻击类型集合和所述第二攻击类型集合，生成对应于所述待清洗报文的清洗策略链；
    清洗单元，用于依据所述清洗策略链，清洗所述待清洗报文。
  10. 根据权利要求9所述的装置，其特征在于，所述生成单元包括：
    计算模块，用于计算所述第一攻击类型集合与所述第二攻击类型集合的交集，得到第三攻击类型集合，其中，所述第三攻击类型集合中包含所述第一攻击类型集合与所述第二攻击类型集合中相同的攻击类型；
    生成模块，用于根据所述第三攻击类型集合，生成所述清洗策略链。
  11. 根据权利要求10所述的装置，其特征在于，所述生成模块用于执行以下步骤根据所述第三攻击类型集合，生成所述清洗策略链：
    获取所述第三攻击类型集合中各个攻击类型的权重值；
    按照所述权重值的大小，对各个攻击类型进行排序；
    获取排序后的各个攻击类型对应的清洗策略，其中，各个清洗策略的排列顺序与排序后的各个攻击类型的排列顺序一致；
    生成包含排序后的各个攻击类型对应的清洗策略的所述清洗策略链。
  12. 根据权利要求11所述的装置，其特征在于，所述清洗单元用于执行以下步骤依据所述清洗策略链，清洗所述待清洗报文：
    按照所述清洗策略链中各个清洗策略的顺序，依次调用各个清洗 策略对所述待清洗报文进行清洗，以确定是否丢弃所述待清洗报文。
  13. 根据权利要求12所述的装置，其特征在于，所述装置还包括：
    发送单元，用于在确定不丢弃所述待清洗报文的情况下，将所述待清洗报文发送至所述目的地址所指向的设备。
  14. 根据权利要求9所述的装置，其特征在于，所述第一获取单元包括：
    解析模块，用于解析所述待清洗报文的报头；
    提取模块，用于基于所述报文类型对应的字段的偏移量，从所述待清洗报文中提取所述报文类型，以及基于所述目的地址对应的字段的偏移量，从所述待清洗报文中提取所述目的地址。
  15. 根据权利要求9所述的装置，其特征在于，所述第二获取单元用于执行以下步骤根据所述报文类型，从预设的配置文件中获取与所述报文类型对应的第一攻击类型集合：
    从所述预设的配置文件中，查找所述报文类型对应的攻击类型，其中，所述预设的配置文件中包含有所述报文类型与攻击类型之间的对应关系；
    生成包含所述报文类型对应的攻击类型的所述第一攻击类型集合。
  16. 根据权利要求9至15中任一项所述的装置，其特征在于，所述报文类型包括以下一种或几种：传输控制协议同步TCP SYN报文、传输控制协议确认TCP ACK报文以及传输控制协议复位TCP RST报文；所述攻击类型包括以下一种或几种：syn报文泛洪攻击SYN flood、ack报文泛洪攻击ACK flood、rst报文泛洪攻击RST flood以及udp报文泛洪攻击UDP flood。
PCT/CN2016/110659 2015-12-31 2016-12-19 报文清洗方法及装置 WO2017114200A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/024,523 US10924457B2 (en) 2015-12-31 2018-06-29 Packet cleaning method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201511030202.1A CN106936799B (zh) 2015-12-31 2015-12-31 报文清洗方法及装置
CN201511030202.1 2015-12-31

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/024,523 Continuation US10924457B2 (en) 2015-12-31 2018-06-29 Packet cleaning method and apparatus

Publications (1)

Publication Number Publication Date
WO2017114200A1 true WO2017114200A1 (zh) 2017-07-06

Family

ID=59224501

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/110659 WO2017114200A1 (zh) 2015-12-31 2016-12-19 报文清洗方法及装置

Country Status (3)

Country Link
US (1) US10924457B2 (zh)
CN (1) CN106936799B (zh)
WO (1) WO2017114200A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107483425A (zh) * 2017-08-08 2017-12-15 北京盛华安信息技术有限公司 基于攻击链的复合攻击检测方法
CN108121783A (zh) * 2017-12-19 2018-06-05 深圳创维数字技术有限公司 一种存储数据的自动清理方法、装置、计算机和存储介质
US10924457B2 (en) 2015-12-31 2021-02-16 Alibaba Group Holding Limited Packet cleaning method and apparatus
CN114625929A (zh) * 2022-03-17 2022-06-14 北京启明星辰信息安全技术有限公司 一种抽样采集报文的方法和装置

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107395632B (zh) * 2017-08-25 2020-09-22 北京神州绿盟信息安全科技股份有限公司 SYN Flood防护方法、装置、清洗设备及介质
JP7014125B2 (ja) * 2018-10-12 2022-02-01 日本電信電話株式会社 検知装置、検知方法および検知プログラム
CN115118464A (zh) * 2022-06-10 2022-09-27 深信服科技股份有限公司 一种失陷主机检测方法、装置、电子设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1972297A (zh) * 2005-11-22 2007-05-30 飞塔信息科技（北京）有限公司 用于基于策略的内容过滤的计算机***与方法
CN101309150A (zh) * 2008-06-30 2008-11-19 华为技术有限公司 分布式拒绝服务攻击的防御方法、装置和***
US20120185585A1 (en) * 2011-01-19 2012-07-19 Cisco Technology, Inc. Adaptive Idle Timeout for TCP Connections in ESTAB State
CN104539594A (zh) * 2014-12-17 2015-04-22 南京晓庄学院 融合DDoS威胁过滤与路由优化的SDN架构、***及工作方法

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101431449B (zh) * 2008-11-04 2011-05-04 中国科学院计算技术研究所 一种网络流量清洗***
CN101741633B (zh) * 2008-11-06 2011-12-28 北京启明星辰信息技术股份有限公司 一种海量日志关联分析方法及***
KR101442020B1 (ko) * 2010-11-04 2014-09-24 한국전자통신연구원 송신 제어 프로토콜 플러딩 공격 방어 방법 및 장치
CN102043917B (zh) * 2010-12-07 2012-10-17 成都市华为赛门铁克科技有限公司 云***分布式拒绝服务攻击防护方法以及装置和***
US9027137B2 (en) * 2013-04-22 2015-05-05 Imperva, Inc. Automatic generation of different attribute values for detecting a same type of web application layer attack
CN104753863B (zh) * 2013-12-26 2018-10-26 ***通信集团公司 一种分布式拒绝服务攻击的防御方法、设备及***
CN106936799B (zh) 2015-12-31 2021-05-04 阿里巴巴集团控股有限公司 报文清洗方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1972297A (zh) * 2005-11-22 2007-05-30 飞塔信息科技（北京）有限公司 用于基于策略的内容过滤的计算机***与方法
CN101309150A (zh) * 2008-06-30 2008-11-19 华为技术有限公司 分布式拒绝服务攻击的防御方法、装置和***
US20120185585A1 (en) * 2011-01-19 2012-07-19 Cisco Technology, Inc. Adaptive Idle Timeout for TCP Connections in ESTAB State
CN104539594A (zh) * 2014-12-17 2015-04-22 南京晓庄学院 融合DDoS威胁过滤与路由优化的SDN架构、***及工作方法

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10924457B2 (en) 2015-12-31 2021-02-16 Alibaba Group Holding Limited Packet cleaning method and apparatus
CN107483425A (zh) * 2017-08-08 2017-12-15 北京盛华安信息技术有限公司 基于攻击链的复合攻击检测方法
CN107483425B (zh) * 2017-08-08 2020-12-18 北京盛华安信息技术有限公司 基于攻击链的复合攻击检测方法
CN108121783A (zh) * 2017-12-19 2018-06-05 深圳创维数字技术有限公司 一种存储数据的自动清理方法、装置、计算机和存储介质
CN114625929A (zh) * 2022-03-17 2022-06-14 北京启明星辰信息安全技术有限公司 一种抽样采集报文的方法和装置

Also Published As

Publication number Publication date
US10924457B2 (en) 2021-02-16
CN106936799B (zh) 2021-05-04
CN106936799A (zh) 2017-07-07
US20180309726A1 (en) 2018-10-25

Similar Documents

Publication Publication Date Title
WO2017114200A1 (zh) 报文清洗方法及装置
US10148573B2 (en) Packet processing method, node, and system
CN107547507B (zh) 一种防攻击方法、装置、路由器设备及机器可读存储介质
CN104768139B (zh) 一种短信发送的方法及装置
CN110417717B (zh) 登录行为的识别方法及装置
CN107395632B (zh) SYN Flood防护方法、装置、清洗设备及介质
CN110266650B (zh) Conpot工控蜜罐的识别方法
CN102404741B (zh) 移动终端上网异常检测方法和装置
CN103931162B (zh) 处理业务的方法和网络设备
CN106657126B (zh) 检测及防御DDoS攻击的装置及方法
CN102571579B (zh) Arp报文处理方法及装置
WO2020037781A1 (zh) 一种实现服务器防攻击方法及装置
CN103227777B (zh) 一种防止dpd探测失败导致ipsec隧道震荡的方法
CN108667829B (zh) 一种网络攻击的防护方法、装置及存储介质
CN111049781A (zh) 一种反弹式网络攻击的检测方法、装置、设备及存储介质
Shah et al. Mitigating TCP SYN flooding based EDOS attack in cloud computing environment using binomial distribution in SDN
CN106961414B (zh) 一种基于蜜罐的数据处理方法、装置及***
CN107454065B (zh) 一种UDP Flood攻击的防护方法及装置
CN104506559B (zh) 一种基于Android***的DDoS防御***和方法
CN106487790A (zh) 一种ack flood攻击的清洗方法及***
Wang et al. Credibility-based countermeasure against slow HTTP DoS attacks by using SDN
WO2016008212A1 (zh) 一种终端及检测终端数据交互的安全性的方法、存储介质
CN114338120A (zh) 一种扫段攻击检测方法、装置、介质和电子设备
JP2014023143A (ja) 偽装トラフィック検知を目的としたｂｇｐルートを基にしたネットワークトラフィックプロファイルを作成するシステム及び方法
TWI784938B (zh) 電文清理方法及裝置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16880989

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16880989

Country of ref document: EP

Kind code of ref document: A1