Method and equipment for obtaining attack message

Abstract

The invention discloses a method and equipment for obtaining an attack message. According to the technical scheme provided by the invention, a circular queue recording the storage position information of messages which are recently received is established in network equipment; a storage medium stores the messages recording the position information in the circular queue; thus, when an attack occurs, the messages which are recently received before the attack occurs are obtained according to the information which is recorded in the circular queue, and the attack message is identified from the messages; and under the condition that the normal message processing course of the network equipment is not influenced, the messages which are recently received are stilled stored, thus, when the attack occurs, the attack message is guaranteed to be stored in the storage medium, the complete content of the attack message can be accurately obtained, and the capturing of the attack message is finished under the condition that the network performance is not influenced.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a method and equipment for acquiring attack messages. Background technique [0002] At present, on the one hand, with the continuous increase in the number of network users and the rapid development of network applications, the number of network devices running on the network continues to increase; The complexity is also increasing. More and more network devices need to analyze the content of different layers of the message and take corresponding forwarding actions. [0003] As the forwarding decision of network devices depends more on packet content, the probability of devices being attacked will inevitably increase. Looking at the various attacks suffered by network devices, the most difficult to defend and analyze and locate is the DOS (Disk Operating System, Disk Operating System) attack. Attackers often send carefully constructed special packets to network devices, ...

AI Technical Summary

Problems solved by technology

[0008] (1) IDS equipment is generally expensive and cannot be widely deployed in the network. It is generally deployed at the egress of the network, and is often powerless against internal attacks on large networks.

[0009] (2) The distance between the IDS device and the attacked device will also have a great impact on the function of the IDS device. If the distance is too far, it cannot guarantee that the attack message can pass through the IDS device and be accurately recorded by the IDS device.

[0011] (4) For high-speed networks, too many IDS devices often affect the performance of the network

Images