Reflection attack detection method, device and electronic equipment

Abstract

The disclosure provides a reflective attack detection method, device, electronic equipment, storage medium and computer program product, and relates to the technical field of network security. The method includes: obtaining the protocol load used by the response data packet and the address of the corresponding reflection server; obtaining the protocol name corresponding to the protocol load based on a preset protocol template library; according to the request protocol corresponding to the protocol name in the preset protocol template library The template generates a first request packet payload; constructs a second request packet payload based on the first request packet payload; uses the second request packet payload to perform UDP detection to obtain a UDP response packet; if the UDP response packet matches If the sampled response data packets are consistent, then the second request data packet payload is determined to be the request data packet payload subject to reflection attack. Utilizing the present disclosure can quickly restore the reflection attack technique.

Description

technical field [0001] The present disclosure relates to the technical field of network security, in particular to a reflective attack detection method, device, electronic equipment, storage medium and computer program product. Background technique [0002] DDoS (Distributed Denial of Service, Distributed Denial of Service attack) reflection amplification attack is a DDoS attack method with low cost, difficult source tracing, and great harm. Huge traffic is generated, which not only affects the normal use of users, but also may cause certain economic losses. For example, in the DNS (Domain Name System, Domain Name System) reflection attack method, it is assumed that the length of the data part of the DNS request message is about 40 bytes, and the length of the data part of the response message may be as high as 4000 bytes. That is to say, the use of reflection attack techniques can produce an amplification effect of about 100 times, so the attacker only needs to control a n...

AI Technical Summary

Problems solved by technology

[0002] DDoS (Distributed Denial of Service, Distributed Denial of Service attack) reflection amplification attack is a DDoS attack method with low cost, difficult source tracing, and great harm. Generate huge traffic, which not only affects the normal use of users, but may also cause certain economic losses

For example, in the DNS (Domain Name System, Domain Name System) reflection attack method, it is assumed that the length of the data part of the DNS request message is about 40 bytes, and the length of the data part of the response message may be as high as 4000 bytes. That is to say, the use of reflection attacks can produce about 100 times the amplification effect, so the attacker only needs to control a network that can generate 150M traffic to carry out large-scale (about 15G) DDoS attacks, which is extremely harmful

On the other hand, with the development of the Internet of Things and 5G communication technology, new protocols with security vulnerabilities have emerged one after another. The number of reflection source devices using these new protocols is huge, making the situation of network security defense increasingly severe.

Images