Reflection attack detection method and device and electronic equipment

Abstract

The invention provides a reflection attack detection method and device, electronic equipment, a storage medium and a computer program product, and relates to the technical field of network security. The method comprises the following steps: acquiring a protocol load used by a response data packet and an address of a corresponding reflection server; obtaining a protocol name corresponding to the protocol load based on a preset protocol template library; generating a first request data packet load according to a request protocol template corresponding to the protocol name in the preset protocol template library; constructing a second request data packet load based on the first request data packet load; performing UDP detection by using the second request data packet load to obtain a UDP response data packet; and if the UDP response data packet is consistent with the sampled response data packet, determining the second request data packet load as the request data packet load subjected to the reflection attack. According to the invention, the reflection attack technique can be quickly restored.

Description

technical field [0001] The present disclosure relates to the technical field of network security, in particular to a reflective attack detection method, device, electronic equipment, storage medium and computer program product. Background technique [0002] DDoS (Distributed Denial of Service, Distributed Denial of Service attack) reflection amplification attack is a DDoS attack method with low cost, difficult source tracing, and great harm. Huge traffic is generated, which not only affects the normal use of users, but also may cause certain economic losses. For example, in the DNS (Domain Name System, Domain Name System) reflection attack method, it is assumed that the length of the data part of the DNS request message is about 40 bytes, and the length of the data part of the response message may be as high as 4000 bytes. That is to say, the use of reflection attack techniques can produce an amplification effect of about 100 times, so the attacker only needs to control a n...

AI Technical Summary

Problems solved by technology

[0002] DDoS (Distributed Denial of Service, Distributed Denial of Service attack) reflection amplification attack is a DDoS attack method with low cost, difficult source tracing, and great harm. Generate huge traffic, which not only affects the normal use of users, but may also cause certain economic losses

For example, in the DNS (Domain Name System, Domain Name System) reflection attack method, it is assumed that the length of the data part of the DNS request message is about 40 bytes, and the length of the data part of the response message may be as high as 4000 bytes. That is to say, the use of reflection attacks can produce about 100 times the amplification effect, so the attacker only needs to control a network that can generate 150M traffic to carry out large-scale (about 15G) DDoS attacks, which is extremely harmful

On the other hand, with the development of the Internet of Things and 5G communication technology, new protocols with security vulnerabilities have emerged one after another. The number of reflection source devices using these new protocols is huge, making the situation of network security defense increasingly severe.

Images