False alarm judgment method and device, product, equipment and storage medium

Abstract

The invention discloses a false alarm judgment method and device, a product, equipment and a storage medium. The method comprises the following steps: acquiring a link state updating message in open shortest path first protocol data; analyzing the link state updating message to obtain a serial number value of each link state advertisement (LSA) in the link state updating message; and according to the serial number value and the marking state of the LSA, determining whether the LSA has a maximum serial number minus one attack. According to the method, whether the LSA is attacked or not is determined by combining the mark state of the LSA, and misjudgment can be prevented when the attack is identified.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of network security operation and maintenance technology, and in particular, to a false alarm judgment method, device, product, equipment and storage medium. Background Art

[0002] In the self-counterattack mechanism of the Open Shortest Path First (OSPF) protocol, when a router receives a Link State Advertisement (LSA) whose link state identifier is its own, it increases the sequence number of the received LSA by one, fills in the correct data information, and then sends the LSA out, thereby achieving the purpose of correcting the data information.

[0003] The attacker exploits the flaw in the self-counterattack mechanism in the implementation of the maximum sequence number mechanism to launch a maximum sequence number minus one attack. First, the attacker sends an LSA with a sequence number of 0x7FFFFFFE to the OSPF network, triggering the self-counterattack mechanism of the target router. The target router sends a self-counterattack LSA. When other routers in the network receive the message, they delete the counterattack LSA (LSA carrying correct information is deleted). Then, the attacker sends an attack LSA message with a minimum sequence number of 0x80000001, which carries attack data. After receiving this attack LSA, the routers in the network will be infected, while the attacked target router believes that the sequence number is less than the current sequence number and does not process such LSA, so it will not trigger the self-counterattack mechanism. Therefore, the infected router mistakenly deletes the attacked route because it "hears" the wrong instruction. Since the minimum sequence number LSA initiated by the attack can carry malicious attack data, it will cause abnormal routing data in the entire domain.

[0004] The existing solution is to deploy network monitoring tools and intrusion detection systems to monitor network traffic and behavior in real time. These systems can be configured to identify and alert suspicious OSPF traffic, but may identify packets that increment to 0x7FFFFFFE in normal order, resulting in false positives. Summary of the invention

[0005] The present invention provides a false alarm judgment method, device, product, equipment and storage medium to solve the problem of false judgment when performing attack detection on LSA messages in the prior art.

[0006] According to one aspect of the present invention, a false alarm judgment method is provided, the method comprising:

[0007] Obtaining a link state update message in the Open Shortest Path First protocol data;

[0008] Parsing the link state update message to obtain a sequence number value of each link state advertisement LSA in the link state update message;

[0009] It is determined whether a maximum sequence number minus one attack occurs in the LSA according to the sequence number value and the tag status of the LSA.

[0010] According to another aspect of the present invention, a false alarm judgment device is provided, the device comprising:

[0011] An acquisition module, used for acquiring a link state update message in the open shortest path first protocol data;

[0012] A parsing module, used to parse the link state update message to obtain the sequence number value of each link state advertisement LSA in the link state update message;

[0013] The determination module is used to determine whether the LSA has a maximum sequence number minus one attack according to the sequence number value and the tag status of the LSA.

[0014] According to another aspect of the present invention, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the false alarm judgment method according to any one of the embodiments of the present invention is implemented.

[0015] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising: at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the false alarm judgment method described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the false alarm judgment method described in any embodiment of the present invention when executed.

[0019] A false alarm judgment method, device, product, equipment and storage medium of an embodiment of the present invention, the method includes: obtaining a link state update message in the open shortest path first protocol data; parsing the link state update message to obtain the sequence number value of each link state notification LSA in the link state update message; and determining whether the LSA has a maximum sequence number minus one attack based on the sequence number value and the tag state of the LSA. The method determines whether the LSA has an attack by combining the tag state of the LSA, which can prevent misjudgment when identifying an attack, and solves the problem of misjudgment when performing attack detection on the LSA message in the prior art.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A schematic diagram of a flow chart of a false alarm determination method provided in Embodiment 1 of the present invention;

[0023] Figure 2 A schematic diagram of the structure of a false alarm judgment device provided in Embodiment 2 of the present invention;

[0024] Figure 3 Schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is only an embodiment of a part of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work should belong to the scope of protection of the present invention. It should be understood that the various steps recorded in the method implementation of the present invention can be performed in different orders and / or in parallel. In addition, the method implementation may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0026] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, any variations of the terms "including" and "having" are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] It should be noted that the modifications of "one" and "plurality" mentioned in the present invention are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0029] The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only used for illustrative purposes, and are not used to limit the scope of these messages or information.

[0030] Embodiment 1

[0031] Figure 1 A flow chart of a false alarm judgment method provided in Embodiment 1 of the present invention is applicable to preventing the misjudgment of LSAs with normally increasing sequence numbers as malicious attacks when monitoring malicious attacks in a network. The method can be executed by a false alarm judgment device, wherein the device can be implemented by software and / or hardware and is generally integrated on an electronic device. In this embodiment, the electronic device includes but is not limited to: computers and other devices.

[0032] like Figure 1 As shown, a false alarm judgment method provided in Embodiment 1 of the present invention includes the following steps:

[0033] S110: Obtain a link state update message in the Open Shortest Path First protocol data.

[0034] Among them, the Open Shortest Path First protocol data can be network data that satisfies the Open Shortest Path First protocol. The Open Shortest Path First protocol OSPF is a dynamic, highly reliable and scalable routing protocol that is widely used in dynamic routing systems in large networks. The Link State Update packet (LSU) is an important message type in the OSPF protocol, which is used to send link state update information to adjacent routers. When the link state of a router changes, such as when the network connection is disconnected or restored, the router generates an LSU message and sends it to its adjacent routers. After receiving the LSU message, the adjacent router will update its own link state database, and then forward the LSU message to the adjacent router until all routers have completed the link state update.

[0035] In this embodiment, a link state update message of the open shortest path first protocol data may be obtained.

[0036] In one embodiment, the step of obtaining a link state update message in the open shortest path first protocol data includes:

[0037] Get the link state update message within the set time in the Open Shortest Path First protocol data.

[0038] In this embodiment, the set time can be set according to actual conditions. For example, at least 30 minutes of OSPF LSU messages can be obtained.

[0039] S120: Parse the link state update message to obtain a sequence number value of each link state advertisement LSA in the link state update message.

[0040] Among them, the link state advertisement can be a carrier of link state information between routers, and the link state update message can include multiple LSAs. The sequence number value can be used to identify the version of each LSA in the OSPF LSA database, which is a 32-bit unsigned integer. Whenever a change is made to the network topology, LSAs will be propagated between routers within the OSPF domain, and the latest version of the update will be determined by comparing the LSA sequence number. If the sequence number of the received LSA is greater than the locally stored version number, it is considered an update and stored in the OSPF database.

[0041] In this embodiment, the link state update message may be parsed to obtain the sequence number value of each LSA in the link state update message.

[0042] S130: Determine whether the LSA has a maximum sequence number minus one attack according to the sequence number value and the marking state of the LSA.

[0043] The tag state can be used to indicate whether the jump of the sequence number value of the LSA is within the tolerance range. The maximum sequence number minus one attack is a network attack against the Open Shortest Path First protocol. The attacker uses the sequence number mechanism of OSPF to send forged routing update information to routers in the network, thereby interfering with or manipulating network routing.

[0044] In this embodiment, when the sequence number value of the LSA reaches 0x7FFFFFFE, it indicates that the LSA may be subjected to a maximum sequence number minus one attack. At this time, the LSA tag state may be combined to determine whether the LSA is subjected to a maximum sequence number minus one attack.

[0045] In one embodiment, determining whether the LSA has a maximum sequence number minus one attack according to the sequence number value and the tag status of the LSA includes:

[0046] When the LSA is in the marked state, it is considered that the LSA does not have a maximum sequence number minus one attack;

[0047] When the LSA does not have a marking state, the sequence number value is analyzed to determine whether the LSA has a maximum sequence number minus one attack.

[0048] In this embodiment, when the LSA is in the marked state, it means that the sequence number value of the LSA jumping to the maximum sequence number minus one 0x7FFFFFFE is tolerable. At this time, no matter whether the sequence number value of the LSA increases to 0x7FFFFFFE, it is considered that the LSA does not have a maximum sequence number minus one attack. When the LSA does not have a marked state, the sequence number value can be further analyzed to determine whether the LSA has a maximum sequence number minus one attack.

[0049] A false alarm judgment method provided in the first embodiment of the present invention includes: obtaining a link state update message in the open shortest path first protocol data; parsing the link state update message to obtain the sequence number value of each link state notification LSA in the link state update message; and determining whether the LSA has a maximum sequence number minus one attack according to the sequence number value and the tag state of the LSA. The method determines whether the LSA has an attack by combining the tag state of the LSA, which can prevent misjudgment when identifying an attack, and solves the problem of misjudgment when performing attack detection on the LSA message in the prior art.

[0050] Based on the above embodiment, a variant embodiment of the above embodiment is proposed. It should be noted that in order to make the description concise, only the differences from the above embodiment are described in the variant embodiment.

[0051] In one embodiment, analyzing the sequence number value to determine whether the LSA has a maximum sequence number minus one attack includes:

[0052] When the sequence number value reaches the maximum sequence number minus one, it is considered that the LSA has a maximum sequence number minus one attack;

[0053] When the sequence number value does not reach the maximum sequence number minus one value, it is considered that there is no maximum sequence number minus one attack on the LSA.

[0054] In this embodiment, when the sequence number value of the LSA reaches the maximum sequence number minus one value 0x7FFFFFFE, since the LSA is in an unmarked state at this time, it can be considered that the LSA has a maximum sequence number minus one attack; when the sequence number value does not reach the maximum sequence number minus one value, it is considered that the LSA does not have a maximum sequence number minus one attack.

[0055] In one embodiment, when the sequence number value of the LSA does not reach the maximum sequence number minus one, the method further includes:

[0056] When the sequence number value reaches a specified sequence number value, a marking state is added to the LSA.

[0057] The specified serial number value can be customized. For example, if the tolerance for the serial number directly jumping to the maximum serial number minus one is 10, the specified serial number value can be set to 0x7FFFFFF4.

[0058] In this embodiment, when it is determined that the sequence number value of the LSA has not reached the maximum sequence number minus one, it can be further determined whether the sequence number value has reached a specified sequence number value. If so, a mark state can be added to the LSA, so that in subsequent judgments, the mark state can be used to prevent the LSA from being misjudged as an attack message.

[0059] This embodiment adds a marking state according to a specified sequence number value, which can take into account network shock, transmission packet loss, etc., and prevent an LSA that normally increases to a maximum sequence number minus one from being considered an abnormal message.

[0060] The embodiment of the present invention provides a specific implementation method based on the technical solutions of the above embodiments.

[0061] As a specific implementation method of this embodiment, the following steps are included:

[0062] 1. Collect at least 30 minutes of OSPF LSU messages and analyze the message contents;

[0063] 2. Parse the sequence number value in each LSA;

[0064] 3. When an LSA with a sequence number value of 0x7FFFFFF4 is found, the LSA is specially marked and recorded;

[0065] 4. Track the update status of this LSA. If, by default, it is updated every 30 minutes in sequence, and the sudden jump value is less than or equal to 10, and finally reaches 0x7FFFFFFE, it is considered to be in normal status.

[0066] 5. The LSA in step 4 is not considered to be subject to the maximum sequence number minus one attack;

[0067] 6. In other cases, if the LSA whose sequence number reaches 0x7FFFFFFE directly is found, it is judged to be attacked by the maximum sequence number minus one.

[0068] This embodiment continuously collects OSPF message data, parses OSPF protocol content, reads the status information of each LSA sequence, and begins to specially mark and record only the LSA whose sequence number value is about to reach 0x7FFFFFFE, which is 0x7FFFFFF4 by default, so as to reduce the resource consumption caused by storing a large amount of LSA information. Under normal circumstances, if an LSA information with a sequence number value reaching 0x7FFFFFFE is received, it will be considered to be attacked by the maximum sequence number minus one, but the LSA with a sequence number value reaching 0x7FFFFFF4 that is specially marked and increases to 0x7FFFFFFE in a 30-minute interval sequence will be judged as a normal message.

[0069] Embodiment 2

[0070] Figure 2 A structural schematic diagram of a false alarm judgment device provided in Embodiment 2 of the present invention, which can be used to prevent the misjudgment of LSAs with normally increasing sequence numbers as malicious attacks when monitoring malicious attacks in a network, wherein the device can be implemented by software and / or hardware and is generally integrated on an electronic device.

[0071] like Figure 3 As shown, the device comprises:

[0072] An acquisition module 210, configured to acquire a link state update message in the Open Shortest Path First protocol data;

[0073] A parsing module 220, configured to parse the link state update message to obtain a sequence number value of each link state advertisement LSA in the link state update message;

[0074] The determination module 230 is used to determine whether the LSA has a maximum sequence number minus one attack according to the sequence number value and the tag status of the LSA.

[0075] This embodiment provides a false alarm judgment device, including: an acquisition module, used to obtain a link state update message in the open shortest path first protocol data; a parsing module, used to parse the link state update message to obtain the sequence number value of each link state notification LSA in the link state update message; a determination module, used to determine whether the LSA has a maximum sequence number minus one attack based on the sequence number value and the tag state of the LSA. By determining whether the LSA has an attack in combination with the tag state of the LSA, it is possible to prevent misjudgment when identifying an attack, solving the problem of misjudgment when performing attack detection on the LSA message in the prior art.

[0076] Furthermore, the determination module 230 is specifically configured to:

[0077] When the LSA is in the marked state, it is considered that the LSA does not have a maximum sequence number minus one attack;

[0078] When the LSA does not have a marking state, the sequence number value is analyzed to determine whether the LSA has a maximum sequence number minus one attack.

[0079] Further, the analyzing the sequence number value to determine whether the LSA has a maximum sequence number minus one attack includes:

[0080] When the sequence number value reaches the maximum sequence number minus one, it is considered that the LSA has a maximum sequence number minus one attack;

[0081] When the sequence number value does not reach the maximum sequence number minus one value, it is considered that there is no maximum sequence number minus one attack on the LSA.

[0082] Further, when the sequence number value of the LSA does not reach the maximum sequence number minus one, the method further includes:

[0083] When the sequence number value reaches a specified sequence number value, a marking state is added to the LSA.

[0084] Furthermore, the acquisition module 210 is specifically used for:

[0085] Get the link state update message within the set time in the Open Shortest Path First protocol data.

[0086] The above-mentioned false alarm judgment device can execute the false alarm judgment method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0087] Embodiment 3

[0088] Figure 3A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0089] like Figure 3 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0090] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0091] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the false alarm judgment method.

[0092] In some embodiments, the false alarm determination method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the false alarm determination method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the false alarm determination method in any other appropriate manner (e.g., by means of firmware).

[0093] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0094] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0095] An embodiment of the present invention further provides a computer program product, including a computer program. When the computer program is executed by a processor, the false alarm judgment method described in any embodiment of the present invention can be implemented.

[0096] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0097] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0098] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0099] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0100] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0101] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A false alarm judgment method, characterized in that: The method comprises: Obtaining a link state update message in the Open Shortest Path First protocol data; Parsing the link state update message to obtain a sequence number value of each link state advertisement LSA in the link state update message; It is determined whether a maximum sequence number minus one attack occurs in the LSA according to the sequence number value and the tag status of the LSA.

2. The method according to claim 1, characterized in that The determining, according to the sequence number value and the tag status of the LSA, whether the LSA has a maximum sequence number minus one attack includes: When the LSA is in the marked state, it is considered that the LSA does not have a maximum sequence number minus one attack; When the LSA does not have a marking state, the sequence number value is analyzed to determine whether the LSA has a maximum sequence number minus one attack.

3. The method according to claim 2, characterized in that The analyzing the sequence number value to determine whether the LSA has a maximum sequence number minus one attack includes: When the sequence number value reaches the maximum sequence number minus one, it is considered that the LSA has a maximum sequence number minus one attack; When the sequence number value does not reach the maximum sequence number minus one value, it is considered that there is no maximum sequence number minus one attack on the LSA.

4. The method according to claim 2 or 3, characterized in that: When the sequence number value of the LSA does not reach the maximum sequence number minus one, the method further includes: When the sequence number value reaches a specified sequence number value, a marking state is added to the LSA.

5. The method according to claim 1, characterized in that The step of obtaining the link state update message in the open shortest path first protocol data includes: Get the link state update message within the set time in the Open Shortest Path First protocol data.

6. A false alarm judgment device, characterized in that: The device comprises: An acquisition module, used for acquiring a link state update message in the open shortest path first protocol data; A parsing module, used to parse the link state update message to obtain the sequence number value of each link state advertisement LSA in the link state update message; The determination module is used to determine whether the LSA has a maximum sequence number minus one attack according to the sequence number value and the tag status of the LSA.

7. The device according to claim 6, characterized in that The determination module is specifically used for: When the LSA is in the marked state, it is considered that the LSA does not have a maximum sequence number minus one attack; When the LSA does not have a marking state, the sequence number value is analyzed to determine whether the LSA has a maximum sequence number minus one attack.

8. A computer program product, characterized in that The invention comprises a computer program, which, when executed by a processor, implements the false alarm judgment method according to any one of claims 1 to 5.

9. An electronic device, characterized in that: The device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the false alarm judgment method according to any one of claims 1 to 5.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the false alarm judgment method according to any one of claims 1 to 5 when executed.

Images