Self-adaptive anti-attack method and device

Abstract

The invention discloses a self-adaptive anti-attack method and device. The self-adaptive anti-attack method comprises the steps of matching nodes passed by a message received from a port in a network element system according to time order with a node passed through by a second message of which the business type is the same as that of the message, thus acquiring matching degree of a path, wherein the second message passes the network element system for the first time; determining whether the received message is an abnormal message or not according to the matching degree, reducing the allowed access flow of the port from which the message is received if the message is the abnormal message, so as to realize the self-adaptive anti-attack to the abnormal message, thereby eliminating the trouble operation step of firewall artificial configuration, and effectively improving the dynamic identification and intercept effects on network attack.

Description

technical field [0001] The invention relates to the technical field of communication security, in particular to an adaptive attack defense method and device. Background technique [0002] In telecommunication equipment, different network elements are realized through devices / ports such as routers, switches, Fast Ethernet (English: Fast Ethernet, FE for short), and Gigabit Ethernet (English: Gigabit Ethernet, GE for short) interfaces. Interconnection, to provide users with a variety of telecommunications services. With the continuous integration of IT and CT networking, the telecom network encounters external abnormal packet attacks, causing problems such as board reset and service congestion. [0003] A common network attack defense solution is to deploy a firewall at the network element entrance. The incoming data packets are screened through the preset policies of the firewall. The packets that meet the preset policies are allowed to access the network, and the packets ...

AI Technical Summary

Problems solved by technology

And because the firewall unit is independent of the business unit, it does not have the ability to identify and analyze business types. Therefore, the ability to identify abnormal business packets disguised by "exquisite design" is relatively weak. For this type of attack, the firewall will Behavioral, fragmented message identification and other technologies can only achieve partial protection capabilities

Images