Firewall attack defense method

Abstract

The invention provides a firewall attack defense method which achieves a network attack detection function and can accurately detect a single-packet attack, a scanning attack and a flood attack by applying an attack defense module to a firewall with functions of configuration management, message management, session management and the like based on a security zone. The single-packet attack particularly comprises: an ICMP redirection attack, an ICMP inaccessible attack, an IP source routing option attack, a route record option attack, a Land attack, a Smurf attack, a Fraggle attack and a WinNukeattack. The scanning attack particularly comprises: an address scanning attack and a port scanning attack. The flood attack comprises: a TCP SYN Flood attack, an ICMP Flood attack and a UDPFlood attack. After a network attack is detected out, corresponding defense measures of abandoning a message, adding into a blacklist, outputting an alarm log and the like for example are adopted according to configuration. A Safe Reset technology under a TCP agent linkage mechanism is implemented, and the TCP SYN Flood attack is effectively defended.

Description

technical field [0001] The invention belongs to the field of network security, and in particular relates to a firewall attack defense method. Background technique [0002] A network attack refers to an attack on the hardware, software and data in the network system by using the loopholes and security flaws in the network. With the widespread application of computer networks, network attack techniques are also developing. The way and method of network attack has developed from the early rough and single attack method to today's refined and comprehensive attack method. Currently, common network attacks on the Internet are divided into the following three categories: single packet attack, scanning attack and flood attack: [0003] (1) Single packet attack [0004] Single packet attack is also called malformed packet attack. The attacker sends defective IP packets (such as IP packets with overlapping fragments, TCP packets with illegal flags, etc.) to the target machine,...

AI Technical Summary

Problems solved by technology

[0006] (3) Flooding attack

[0013] Although the existing firewalls have functions such as configuration management, packet management, and session management based on security zones, they all lack comprehensive defense functions that can detect various types of attacks and take reasonable preventive measures against them. Defense technology actively defends against various common network attacks, and cannot guarantee the normal operation of the network under more and more frequent attacks

That is, the overall security solution of the firewall is still lacking in the prior art

Images