Automatic attack protection method, device and equipment based on protocol session

Abstract

The invention discloses an automatic attack protection method, device and equipment based on protocol sessions. The method comprises the following steps: counting the flow of each protocol session in a preset dynamic white list in a preset flow counting period; identifying an attacked target protocol session according to the traffic of each protocol session in the dynamic white list; and deleting the target protocol session in the dynamic white list, and performing speed-limiting forwarding or direct discarding processing on the message of the target protocol session, thereby realizing automatic identification of the attack behavior of the protocol session level according to the flow of the protocol session, improving the identification efficiency and accuracy of the attack, and improving the success rate of the attack identification. And automatic attack protection of the protocol session level is realized, the speed of the protocol session with the attack is limited, and the protocol session without the attack under the same protocol is ensured not to be influenced by the attack and the speed limit.

Description

Technical Field

[0001] The present application relates to the technical field of network attack protection, and in particular to a method, device and equipment for automatic attack protection based on protocol sessions. Background Art

[0002] Routers and other devices in the network have a large number of service packets and malicious attack packets that need to be sent to the CPU. Too many packets sent to the CPU will cause the CPU usage to be too high, which will in turn cause CPU performance to decline, affecting normal services. In addition, malicious attack packets targeting the CPU will cause the CPU to be busy processing attack packets for a long time, causing other services to be interrupted or even the system to be interrupted.

[0003] In order to protect the CPU, in the related technology, after the user discovers the existence of attack behavior, the protocol upload bandwidth is usually set to limit the message flow sent from the data forwarding plane to the control plane, so as to ensure that the CPU can process normal business.

[0004] However, the related technologies have the following limitations:

[0005] First, it is necessary to manually identify whether an attack behavior occurs and manually configure an anti-attack speed limit policy when an attack occurs. It is also necessary to manually cancel the anti-attack speed limit policy after identifying that the attack has disappeared, so the user operation requirements are very high.

[0006] Secondly, it is impossible to accurately identify the protocol session where the attack message is located. Therefore, only protocol-level speed limiting is currently supported, that is, all protocol sessions under the protocol are speed-limited. As a result, normal protocol sessions that do not contain attacks may have messages discarded during the speed limiting process. Therefore, the attack processing method in the relevant technology will affect other neighbor sessions under the protocol. Summary of the invention

[0007] The present application provides a method, device, equipment and medium for automatic attack protection based on protocol sessions, which can solve the technical problem in the prior art that when there are malicious attack messages in the messages sent from the router to the CPU, it is necessary to manually limit the speed of the attack flow, and only the speed limit can be performed at the protocol level, resulting in complicated operation and affecting other neighbor sessions under the protocol.

[0008] In a first aspect, an embodiment of the present application provides an automatic attack protection method based on a protocol session, and the automatic attack protection method based on a protocol session includes:

[0009] Collect statistics on the traffic of each protocol session in the preset dynamic whitelist within the preset traffic statistics period;

[0010] Identify the target protocol session under attack based on the traffic size of each protocol session in the dynamic whitelist;

[0011] The target protocol session is deleted from the dynamic whitelist, and the messages of the target protocol session are forwarded at a limited speed or are directly discarded.

[0012] In combination with the first aspect, in one implementation, before counting the traffic of each protocol session in the preset dynamic whitelist within the preset traffic statistics period, the method further includes:

[0013] Acquire the establishment status of each protocol session under each protocol, and generate the dynamic whitelist in the form of an N-tuple according to the identification information of the protocol sessions that have been successfully established under each protocol;

[0014] A static whitelist is generated in the form of an N-tuple according to the identification information of each configuration session.

[0015] In one implementation, deleting the target protocol session from the dynamic whitelist, forwarding the message of the target protocol session at a limited rate or directly discarding the message, further comprising:

[0016] The identification information of the target protocol session is deleted from the dynamic whitelist, and the identification information of the target protocol session is added to a preset blacklist, and the message of the target protocol session is forwarded at a limited speed or directly discarded.

[0017] In one implementation, forwarding the target protocol session message at a limited speed or directly discarding the message includes:

[0018] If a message to be forwarded is received, identifying identification information of the message to be forwarded;

[0019] If the identification information of the message to be forwarded matches the identification information of the protocol session in the dynamic whitelist, forwarding the message to be forwarded through a preset first bandwidth;

[0020] If the identification information of the message to be forwarded matches the identification information of the target protocol session in the blacklist, the message to be forwarded is forwarded or directly discarded through a preset second bandwidth, wherein the second bandwidth is smaller than the first bandwidth;

[0021] If the identification information of the message to be forwarded matches the identification information of the session configured in the static whitelist, the message to be forwarded is forwarded according to the preset third bandwidth.

[0022] In one implementation, if the identification information of the message to be forwarded matches the identification information of the target protocol session in the blacklist, the message to be forwarded is forwarded or directly discarded through a preset second bandwidth, including:

[0023] If the target protocol session is a preset mandatory session, forwarding the message to be forwarded through a preset second bandwidth;

[0024] If the target protocol session is a non-mandatory session, the message to be forwarded is directly discarded.

[0025] In one embodiment, after deleting the target protocol session from the dynamic whitelist and adding the identification information of the target protocol session to a preset blacklist, the method further includes:

[0026] If the duration of the target protocol session being in the blacklist reaches a preset aging duration, the target protocol session is restored to the dynamic whitelist.

[0027] In one implementation, identifying a target protocol session under attack based on the traffic size of each protocol session in the dynamic whitelist includes:

[0028] Determine whether the traffic of each protocol session in the dynamic whitelist counted within the traffic statistics period is greater than a preset traffic detection threshold;

[0029] If the flow rate of any protocol session is greater than the flow rate detection threshold, the corresponding protocol session is determined to be a target protocol session where an attack occurs.

[0030] In one embodiment, after identifying the target protocol session where the attack exists according to the traffic size of each protocol session in the dynamic whitelist, the method further includes:

[0031] The traffic of each protocol session in the dynamic whitelist is cleared to zero, and the traffic of each protocol session in the dynamic whitelist is counted again within the traffic statistics period.

[0032] In a second aspect, an embodiment of the present application provides an automatic attack protection device based on a protocol session, and the automatic attack protection device based on a protocol session includes:

[0033] A statistics module, which is used to count the traffic of each protocol session in a preset dynamic whitelist within a preset traffic statistics period;

[0034] An identification module, which is used to identify the target protocol session under attack according to the traffic size of each protocol session in the dynamic whitelist;

[0035] The protection module is used to delete the target protocol session from the dynamic whitelist, and to forward the message of the target protocol session at a limited speed or directly discard it.

[0036] In the third aspect, an embodiment of the present application provides an automatic attack protection device based on a protocol session, wherein the automatic attack protection device based on a protocol session comprises a processor, a memory, and an automatic attack protection program based on a protocol session stored on the memory and executable by the processor, wherein when the automatic attack protection program based on a protocol session is executed by the processor, the steps of the automatic attack protection method based on a protocol session as described in any one of the above items are implemented.

[0037] The embodiments of the present application provide a method, apparatus and device for automatic attack protection based on protocol sessions, which count the traffic of each protocol session in a preset dynamic whitelist within a preset traffic statistics period; identify the target protocol session under attack according to the traffic size of each protocol session in the dynamic whitelist; delete the target protocol session from the dynamic whitelist, and forward the message of the target protocol session at a limited speed or directly discard it, thereby realizing automatic identification of attack behaviors at the protocol session level according to the traffic size of the protocol session, improving the efficiency and accuracy of attack identification, and realizing automatic attack protection at the protocol session level, limiting the speed of the protocol session under attack, and ensuring that the protocol session under the same protocol without attack is not affected by the attack and speed limit. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 This is a flow chart of an embodiment of an automatic attack protection method based on a protocol session of the present application;

[0039] Figure 2 This is a schematic diagram of the specific process of the automatic attack protection method based on the protocol session of this application;

[0040] Figure 3 A flowchart of the method for generating a dynamic whitelist for this application;

[0041] Figure 4 A flow chart of a method for determining the forwarding bandwidth of a message to be forwarded for this application;

[0042] Figure 5 This is a functional module diagram of an embodiment of an automatic attack protection device based on protocol sessions of the present application;

[0043] Figure 6 This is a schematic diagram of the hardware structure of the automatic attack protection device based on protocol sessions involved in the embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0045] It is worth noting that in the network, the router can support multiple communication protocols for communication, and each communication protocol includes multiple protocol sessions SESSION. The protocol sessions are used to send various messages to the CPU, and the protocol sessions under the same communication protocol are neighboring sessions. In the related art, when a malicious attack message is found, it can only be identified under which communication protocol the attack exists, so only the communication of the entire protocol can be speed-limited, that is, all protocol sessions under the protocol are speed-limited, which will cause the speed limit to affect other neighboring sessions in the protocol, resulting in the loss of messages in the protocol session without attack. Therefore, the embodiment of the present application provides an automatic attack protection method based on protocol sessions to solve the above technical problems.

[0046] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0047] In a first aspect, an embodiment of the present application provides an automatic attack protection method based on a protocol session.

[0048] In one embodiment, referring to Figure 1 , Figure 1 This is a flow chart of an embodiment of an automatic attack protection method based on a protocol session of the present application. Figure 1 As shown, the automatic attack protection method based on the protocol session includes:

[0049] Step S101: Count the traffic of each protocol session in a preset dynamic whitelist within a preset traffic statistics period.

[0050] Step S102: Identify the target protocol session under attack according to the traffic size of each protocol session in the dynamic whitelist.

[0051] Step S103: deleting the target protocol session from the dynamic whitelist, and forwarding the messages of the target protocol session at a limited speed or directly discarding them.

[0052] In this embodiment, by counting the traffic of the protocol session, the attack at the protocol session level is automatically identified according to the size of the traffic, and a penalty strategy is automatically generated to limit the forwarding speed or directly discard the messages of the protocol session with attacks, thereby realizing automatic protection against attacks at the protocol session level. Through this function, the message channel isolation between protocol sessions can be realized, ensuring that the bandwidth of each normal protocol session without attacks is not occupied by other traffic, nor is it lost due to speed limit. Among them, other traffic includes other session traffic under the same protocol, and also includes session traffic under any other protocol.

[0053] It is worth noting that the automatic attack protection method based on the protocol session in this embodiment can be used in a router, and can be implemented specifically through a control plane and a data forwarding plane in the router, wherein the control plane can be provided with a protocol module, a traffic statistics analysis module, an attack penalty module, etc. to implement automatic attack protection based on the protocol session. The automatic attack protection method based on the protocol session of this application is described below in conjunction with specific embodiments.

[0054] In one embodiment, before counting the traffic of each protocol session in a preset dynamic whitelist within a preset traffic statistics period in step S101, the method also includes: obtaining the establishment status of each protocol session under each protocol, and generating the dynamic whitelist in the form of an N-tuple according to the identification information of the protocol sessions that have been successfully established under each protocol; generating a static whitelist in the form of an N-tuple according to the identification information of each configuration session.

[0055] Exemplary, such as Figure 2 As shown, the establishment status of each protocol session under each protocol is determined by the protocol module in the control plane, and each protocol session under the same protocol is a neighbor session. The establishment status of the protocol session includes successfully established and not established. Then the protocol module sends the identification information of the successfully established protocol session in the form of N-tuples to the traffic statistics analysis module in the control plane. The traffic statistics analysis module receives the N-tuple of identification information of all successfully established protocol sessions in the control plane sent by the protocol module, and sends the N-tuple of identification information of the protocol session to the data forwarding plane, and the data forwarding plane generates a dynamic link protocol session whitelist, that is, a dynamic whitelist. It can be understood that the initially generated dynamic whitelist includes the identification information of all protocol sessions in the state of successfully established. The dynamic whitelist is the core basis for automatic identification and punishment of attack flows.

[0056] Similarly, the protocol module can also send the identification information of the configuration session in the form of N-tuple to the traffic statistics analysis module, and then the traffic statistics analysis module sends the identification information N-tuple of the configuration session to the data forwarding plane, and the data forwarding plane generates a static whitelist.

[0057] It can be understood that the protocol session is used to implement the sending of service messages, and the configuration session is used to set, modify or query the configuration of the device. In this embodiment, the identification information of each protocol session uniquely corresponds to the protocol session, and the identification information of each configuration session uniquely corresponds to the configuration session. And the composition of the identification information can be set according to the needs, and can be the establishment rules of the session, or the exclusive content of the session, etc. The identification information in this embodiment is a five-tuple.

[0058] Specifically, if Figure 3 The step S101 counts the traffic of each protocol session in the preset dynamic whitelist within the preset traffic statistics period, including: parsing the protocol message through the traffic statistics analysis module in the control plane to determine the identification information of the protocol message, and counting the traffic of each protocol session within the traffic statistics period based on the identification information of each protocol session in the dynamic whitelist. When counting, a traffic statistics timer is started based on each protocol session corresponding to the dynamic whitelist, and the statistical traffic of each protocol session in the whitelist can be obtained after the duration of the traffic statistics timer reaches the duration of the traffic statistics period.

[0059] Furthermore, step S102 identifies the target protocol session under attack based on the traffic size of each protocol session in the dynamic whitelist, specifically including: determining whether the traffic of each protocol session in the dynamic whitelist counted within the traffic statistics period is greater than a preset traffic detection threshold; if the traffic of any protocol session is greater than the traffic detection threshold, determining that the corresponding protocol session is the target protocol session under attack.

[0060] Exemplarily, after the traffic statistics analysis module in the control plane obtains the traffic of each protocol session in the whitelist, it compares the traffic of each protocol session with the traffic detection threshold configured based on the anti-attack policy; if the traffic of the protocol session is greater than the traffic detection threshold, it is considered that the user corresponding to the protocol session has launched an attack on the terminal device based on the protocol session, and the traffic statistics analysis module records the attack event and sends the identification information of the target protocol session under attack to the attack penalty module in the control plane. If the traffic of the protocol session is less than or equal to the traffic detection threshold, it is determined that there is no attack on the protocol session. Among them, the traffic detection threshold can be reasonably set according to the network environment.

[0061] In one embodiment, after identifying the target protocol session under attack based on the traffic size of each protocol session in the dynamic whitelist, it also includes: clearing the traffic of each protocol session in the dynamic whitelist, and starting to count the traffic of each protocol session in the dynamic whitelist again within the traffic statistics cycle, that is, restarting the traffic statistics of the next cycle, for subsequent repetition of the above steps to automatically identify attacks.

[0062] Further, step S103 sets the target protocol session in the dynamic whitelist to a whitelist disabled state, and performs speed-limited forwarding or direct discarding processing on the message of the target protocol session, specifically including: after receiving the identification information of the target protocol session under attack from the traffic statistics analysis module, the attack penalty module in the control plane generates an attack penalty strategy notification, and the data forwarding plane deletes the identification information of the target protocol session in the dynamic whitelist, and at the same time adds the identification information of the deleted target protocol session to the preset blacklist. Among them, the dynamic whitelist, the blacklist and the static whitelist are all set with corresponding forwarding bandwidths, and the forwarding bandwidth of the blacklist is less than the forwarding bandwidth of the dynamic whitelist.

[0063] Furthermore, if Figure 4 As shown, the message to be forwarded is forwarded through the data forwarding plane. When the data forwarding plane receives the message to be forwarded, it identifies the identification information of the message to be forwarded, wherein the identification information of the message to be forwarded corresponds to the identification information of the session that transmits the message. If the identification information of the message to be forwarded matches the identification information of the protocol session in the dynamic whitelist, the message to be forwarded is forwarded to the control plane CPU via the preset first bandwidth; if the identification information of the message to be forwarded matches the identification information of the target protocol session in the blacklist, the message to be forwarded is forwarded to the control plane CPU via the preset second bandwidth or directly discarded, wherein the second bandwidth is less than the first bandwidth.

[0064] Specifically, in this embodiment, when the protocol message transmitted in the target protocol session is a necessary protocol message that must be sent to the control plane CPU, the protocol session can be set as a mandatory session. If the identification information of the message to be forwarded matches the identification information of the target protocol session in the blacklist, the message to be forwarded is forwarded or directly discarded through the preset second bandwidth, including: if the target protocol session is a preset mandatory session, the forwarded message is forwarded through the preset second bandwidth; if the target protocol session is a non-mandatory session, the message to be forwarded is directly discarded, so that even if there is an attack message in the target protocol session, the necessary message can be sent to the control plane CPU with a low bandwidth, and the bandwidth preemption of other normal protocol sessions caused by the attack message can be avoided.

[0065] In one embodiment, the message to be forwarded may include a configuration message in addition to the protocol message. If the identification information of the message to be forwarded matches the identification information of the configuration session in the static whitelist, indicating that the message to be forwarded is a configuration message, the message to be forwarded is forwarded according to the preset third bandwidth.

[0066] The values ​​of the first bandwidth, the second bandwidth and the third bandwidth can be set according to the network environment and the message forwarding requirements.

[0067] It is worth noting that, in this embodiment, the protocol messages matching the whitelist are sent to the control plane with high priority and high bandwidth, and the protocol messages of the target protocol sessions under attack in the blacklist are subject to protocol speed limit according to the anti-attack strategy and sent to the control plane with extremely small bandwidth or directly discarded, thereby avoiding the attack messages from occupying the traffic of the protocol sessions without attack, realizing automatic identification and protection of attacks at the protocol session level, and isolating the message sending channels between protocol sessions, thereby avoiding mutual influence between protocol sessions under the same protocol.

[0068] In one embodiment, after deleting the target protocol session from the dynamic whitelist and adding the identification information of the target protocol session to a preset blacklist, it also includes: if the time the target protocol session has been in the blacklist reaches a preset aging time, restoring the target protocol session to the dynamic whitelist.

[0069] Exemplarily, after the target protocol session identification information is added to the preset blacklist, the aging detection timer starts timing. When the timing duration reaches the preset aging duration, the attack penalty module in the control plane deletes the identification information of the target protocol session in the blacklist from the blacklist, and sends the identification information of the target protocol session to the data forwarding plane. The data forwarding plane adds the identification information of the target protocol session to the whitelist, so that subsequent protocol messages that can match the target protocol session identification information can be sent to the control plane CPU through high bandwidth (first bandwidth), and the traffic statistics analysis module continues to perform periodic traffic statistics analysis to automatically identify attacks.

[0070] The present invention provides an automatic attack protection method based on protocol sessions. The method comprises the following steps: counting the traffic of each protocol session in a preset dynamic whitelist within a preset traffic statistics period, identifying a target protocol session under attack according to the traffic size of each protocol session in the dynamic whitelist, deleting the target protocol session in the dynamic whitelist, and forwarding or directly discarding the message of the target protocol session at a limited speed, thereby realizing automatic attack identification at the protocol session level, limiting the speed or discarding the message of the protocol session under attack, realizing automatic attack protection at the protocol session level, avoiding the attack message from occupying the traffic of other protocol sessions not under attack, realizing isolation of the sending channels between protocol sessions, and avoiding mutual influence between protocol sessions under the same protocol.

[0071] In a second aspect, an embodiment of the present application also provides an automatic attack protection device based on a protocol session.

[0072] In one embodiment, referring to Figure 5 , Figure 5 This is a functional module diagram of an embodiment of an automatic attack protection device based on protocol session of the present application. Figure 5 As shown, the automatic attack protection device based on the protocol session includes:

[0073] A statistics module, which is used to count the traffic of each protocol session in a preset dynamic whitelist within a preset traffic statistics period;

[0074] An identification module, which is used to identify the target protocol session under attack according to the traffic size of each protocol session in the dynamic whitelist;

[0075] The protection module is used to delete the target protocol session from the dynamic whitelist, and to forward the message of the target protocol session at a limited speed or directly discard it.

[0076] Furthermore, in one embodiment, the device is also used for:

[0077] Acquire the establishment status of each protocol session under each protocol, and generate the dynamic whitelist in the form of an N-tuple according to the identification information of the protocol sessions that have been successfully established under each protocol;

[0078] A static whitelist is generated in the form of an N-tuple according to the identification information of each configuration session.

[0079] Furthermore, in one embodiment, the device is also used for:

[0080] The identification information of the target protocol session is deleted from the dynamic whitelist, and the identification information of the target protocol session is added to a preset blacklist, and the message of the target protocol session is forwarded at a limited speed or directly discarded.

[0081] Furthermore, in one embodiment, the device is also used for:

[0082] If a message to be forwarded is received, identifying identification information of the message to be forwarded;

[0083] If the identification information of the message to be forwarded matches the identification information of the protocol session in the dynamic whitelist, forwarding the message to be forwarded through a preset first bandwidth;

[0084] If the identification information of the message to be forwarded matches the identification information of the target protocol session in the blacklist, the message to be forwarded is forwarded or directly discarded through a preset second bandwidth, wherein the second bandwidth is smaller than the first bandwidth;

[0085] If the identification information of the message to be forwarded matches the identification information of the session configured in the static whitelist, the message to be forwarded is forwarded according to the preset third bandwidth.

[0086] Furthermore, in one embodiment, the device is also used for:

[0087] If the target protocol session is a preset mandatory session, forwarding the message to be forwarded through a preset second bandwidth;

[0088] If the target protocol session is a non-mandatory session, the message to be forwarded is directly discarded.

[0089] Furthermore, in one embodiment, the device is also used for:

[0090] If the duration of the target protocol session being in the blacklist reaches a preset aging duration, the target protocol session is restored to the dynamic whitelist.

[0091] Furthermore, in one embodiment, the device is also used for:

[0092] Determine whether the traffic of each protocol session in the dynamic whitelist counted within the traffic statistics period is greater than a preset traffic detection threshold;

[0093] If the flow rate of any protocol session is greater than the flow rate detection threshold, the corresponding protocol session is determined to be a target protocol session where an attack occurs.

[0094] Furthermore, in one embodiment,

[0095] The traffic of each protocol session in the dynamic whitelist is cleared to zero, and the traffic of each protocol session in the dynamic whitelist is counted again within the traffic statistics period.

[0096] Among them, the functional implementation of each module in the above-mentioned automatic attack protection device based on protocol session corresponds to the various steps in the above-mentioned automatic attack protection method embodiment based on protocol session, and its functions and implementation processes will not be repeated here one by one.

[0097] In a third aspect, an embodiment of the present application provides an automatic attack protection device based on a protocol session, and the automatic attack protection device based on a protocol session may be a router.

[0098] Reference Figure 6 , Figure 6 The hardware structure diagram of the automatic attack protection device based on the protocol session involved in the embodiment of the present application is shown in FIG. In the embodiment of the present application, the automatic attack protection device based on the protocol session may include a processor, a memory, a communication interface, and a communication bus.

[0099] The communication bus may be of any type and is used to interconnect the processor, the memory, and the communication interface.

[0100] The communication interface includes input / output (I / O) interface, physical interface and logical interface, etc., which are used to realize the interconnection of devices inside the automatic attack protection device based on protocol session, and the interface used to realize the interconnection between the automatic attack protection device based on protocol session and other devices (such as other computing devices or user devices). The physical interface can be an Ethernet interface, a fiber optic interface, an ATM interface, etc.; the user device can be a display, a keyboard, etc.

[0101] The memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0102] The processor may be a general-purpose processor, which may call the automatic attack protection program based on the protocol session stored in the memory and execute the automatic attack protection method based on the protocol session provided in the embodiment of the present application. For example, the general-purpose processor may be a central processing unit (CPU). The method executed when the automatic attack protection program based on the protocol session is called may refer to the various embodiments of the automatic attack protection method based on the protocol session of the present application, which will not be repeated here.

[0103] Those skilled in the art will understand that Figure 6 The hardware structure shown in the figure does not constitute a limitation on the present application, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0104] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.

[0105] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit "first", "second" and "third" to different types.

[0106] In the description of the embodiments of the present application, "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.

[0107] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; the “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0108] In some processes described in the embodiments of the present application, multiple operations or steps that appear in a specific order are included, but it should be understood that these operations or steps may not be executed in the order in which they appear in the embodiments of the present application or in parallel, and the sequence number of the operation is only used to distinguish the different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed in sequence or in parallel, and these operations or steps may be combined.

[0109] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present application.

[0110] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. An automatic attack protection method based on protocol session, characterized in that: The automatic attack protection method based on the protocol session includes: Collect statistics on the traffic of each protocol session in the preset dynamic whitelist within the preset traffic statistics period; Identify the target protocol session under attack based on the traffic size of each protocol session in the dynamic whitelist; The target protocol session is deleted from the dynamic whitelist, and the messages of the target protocol session are forwarded at a limited speed or are directly discarded.

2. The automatic attack protection method based on protocol session as claimed in claim 1, characterized in that: Before collecting statistics on the traffic of each protocol session in the preset dynamic whitelist within the preset traffic statistics period, the following steps are also included: Acquire the establishment status of each protocol session under each protocol, and generate the dynamic whitelist in the form of an N-tuple according to the identification information of the protocol sessions that have been successfully established under each protocol; A static whitelist is generated in the form of an N-tuple according to the identification information of each configuration session.

3. The automatic attack protection method based on protocol session as claimed in claim 2, characterized in that: The method further comprises: deleting the target protocol session from the dynamic whitelist, forwarding the message of the target protocol session at a limited speed or directly discarding the message; and The identification information of the target protocol session is deleted from the dynamic whitelist, and the identification information of the target protocol session is added to a preset blacklist, and the message of the target protocol session is forwarded at a limited speed or directly discarded.

4. The automatic attack protection method based on protocol session as claimed in claim 3, characterized in that: The packets of the target protocol session are forwarded at a limited speed or directly discarded, including: If a message to be forwarded is received, identifying identification information of the message to be forwarded; If the identification information of the message to be forwarded matches the identification information of the protocol session in the dynamic whitelist, forwarding the message to be forwarded through a preset first bandwidth; If the identification information of the message to be forwarded matches the identification information of the target protocol session in the blacklist, the message to be forwarded is forwarded or directly discarded through a preset second bandwidth, wherein the second bandwidth is smaller than the first bandwidth; If the identification information of the message to be forwarded matches the identification information of the session configured in the static whitelist, the message to be forwarded is forwarded according to the preset third bandwidth.

5. The automatic attack protection method based on protocol session as claimed in claim 4, characterized in that: If the identification information of the message to be forwarded matches the identification information of the target protocol session in the blacklist, the message to be forwarded is forwarded or directly discarded through a preset second bandwidth, including: If the target protocol session is a preset mandatory session, forwarding the message to be forwarded through a preset second bandwidth; If the target protocol session is a non-mandatory session, the message to be forwarded is directly discarded.

6. The automatic attack protection method based on protocol session as claimed in claim 3, characterized in that: After deleting the target protocol session from the dynamic whitelist and adding the identification information of the target protocol session to a preset blacklist, the method further includes: If the duration of the target protocol session being in the blacklist reaches a preset aging duration, the target protocol session is restored to the dynamic whitelist.

7. The automatic attack protection method based on protocol session as claimed in claim 1, characterized in that: Identify the target protocol sessions for attack based on the traffic size of each protocol session in the dynamic whitelist, including: Determine whether the traffic of each protocol session in the dynamic whitelist counted within the traffic statistics period is greater than a preset traffic detection threshold; If the flow rate of any protocol session is greater than the flow rate detection threshold, the corresponding protocol session is determined to be a target protocol session where an attack occurs.

8. The automatic attack protection method based on protocol session as claimed in claim 1, characterized in that: After identifying the target protocol session under attack based on the traffic size of each protocol session in the dynamic whitelist, the following steps are also included: The traffic of each protocol session in the dynamic whitelist is cleared to zero, and the traffic of each protocol session in the dynamic whitelist is counted again within the traffic statistics period.

9. An automatic attack protection device based on protocol session, characterized in that: The automatic attack protection device based on the protocol session includes: A statistics module, which is used to count the traffic of each protocol session in a preset dynamic whitelist within a preset traffic statistics period; An identification module, which is used to identify the target protocol session under attack according to the traffic size of each protocol session in the dynamic whitelist; The protection module is used to delete the target protocol session from the dynamic whitelist, and to forward the message of the target protocol session at a limited speed or directly discard it.

10. An automatic attack protection device based on protocol session, characterized in that: The protocol session-based automatic attack protection device includes a processor, a memory, and a protocol session-based automatic attack protection program stored in the memory and executable by the processor, wherein when the protocol session-based automatic attack protection program is executed by the processor, the steps of the protocol session-based automatic attack protection method as described in any one of claims 1 to 8 are implemented.

Images