The invention discloses an XDP-based
edge node network spoofing defense method and
system, and the method comprises the steps: intercepting an inbound message through a fast
data path XDP, carrying out the black and white
list check, and transmitting the message to a kernel
protocol stack if the message is matched with the white
list; if the message is not in the black and white lists, if the message is a message requested for the first time, generating a deception response message according to the key and returning the deception response message, otherwise, according to the current key stored in the eBPF mapping table, judging whether the message conforms to a high-interaction
attack source judgment condition, if the message conforms to the high-interaction
attack source judgment condition, putting the message into the
black list, and if the message conforms to the high-interaction
attack source judgment condition, putting the message into the white
list. And discarding if the judgment condition of the high-interaction attack source is not met. The invention aims to realize a light-weight and low-cost
active defense mechanism, attack is quickly intercepted at the bottom layer of a
protocol stack, interception of reconnaissance traffic and deception response are realized in a kernel mode so as to reduce deception defense cost, meanwhile, a deception state is dynamically maintained so as to cope with complex scanning behaviors, and defensive performance and effect are improved.