A dynamic anti-attack method, network device and storage medium under 5G network

Abstract

The present invention discloses a dynamic anti-attack method, network device and storage medium under a 5G network. The method parses a first message to obtain a first message type corresponding to the first message, further verifies whether the first message type matches a preset attack message type when the first message type matches a message support type, selects a preset discarding strategy according to the first message type so as to adaptively process the first message based on the discarding strategy, can select corresponding discarding strategies for different types of attack messages to improve the processing efficiency for different types of attack messages, and, by adaptively processing the first message of the attack message type, can automatically adjust the packet loss rate according to the current operation status of the network device to appropriately process the first message, thereby solving the problem of low operating efficiency caused by the inability to achieve dynamic adjustment of the packet loss rate in the prior art.

Description

Technical Field

[0001] The present invention relates to the field of communication technologies, and in particular to a dynamic anti-attack method, network equipment and storage medium in a 5G network. Background Art

[0002] At present, the User Plane Function (UPF) devices of 5G networks are deployed on the public Internet, so they are vulnerable to network attacks. The main methods for hackers to attack UPF devices are large-volume message attacks or forged messages to consume the system resources of the attacked device, such as increasing the CPU occupancy or memory usage of the UPF device. In response to such situations, the related technology sets up a network firewall on the UPF device to prevent hackers from intruding, and appropriately discards messages to ensure that the CPU occupancy and memory occupancy of the UPF will not be too high due to external attacks. However, the network firewall in the related technology needs to run on a separate processing module, and it is impossible to achieve dynamic adjustment of the packet loss rate, so its operating efficiency is low. Summary of the invention

[0003] In view of this, the present invention provides a dynamic anti-attack method, network device and storage medium in a 5G network, which is used to solve the problem of low operating efficiency caused by the network firewall of the network device in the prior art needing to run in a separate processing module and being unable to realize dynamic adjustment of the packet loss rate. In order to achieve one or part or all of the above purposes or other purposes, the specifics are as follows:

[0004] A first aspect of the present invention provides a dynamic anti-attack method under a 5G network, which is applied to a network port driver of a network device, wherein the network device is provided with a network port, and the network device runs an operating system kernel and the network port driver for driving the network port, and the method comprises: obtaining a first message from the network port; parsing the first message to obtain a first message type, and verifying whether the first message type matches a preset message support type; in the case that the first message type matches the message support type, verifying whether the first message type matches a preset attack message type; in the case that the first message type matches the attack message type, selecting a preset discarding strategy according to the first message type and adaptively processing the first message based on the discarding strategy to prevent the first message from attacking the network device.

[0005] Preferably, the selecting a preset discarding strategy according to the first message type and adaptively processing the first message based on the discarding strategy includes: when the discarding strategy is triggered, obtaining the current CPU occupancy and memory usage of the network device, wherein the execution time of the discarding strategy after being triggered is a preset first time period; obtaining the current current limiting parameter according to the first message type, the CPU occupancy and the memory usage; within the preset first time period, and if the current cumulative number of the first messages received is not greater than the current limiting parameter, sending the current first message to the operating system kernel.

[0006] Preferably, the selecting a preset discarding strategy according to the first message type and adaptively processing the first message based on the discarding strategy also includes: when the cumulative number of the first messages received within the first time period after the discarding strategy is triggered is greater than the current limiting parameter, the first messages received from the time when it is detected that the number of the first messages is greater than the current limiting parameter to the end of the first time period are discarded.

[0007] Preferably, obtaining the current current limiting parameter according to the first message type, the CPU occupancy rate and the memory usage rate includes: determining a packet receiving constant according to the first message type; and obtaining the current current limiting parameter according to the packet receiving constant, the CPU occupancy rate and the memory usage rate.

[0008] Preferably, the first time period is the time required for the number of interruptions triggered by the hardware timer of the network device to reach a preset first threshold.

[0009] Preferably, an embodiment of the present invention also includes: when the first message type does not match the message support type, discarding the first message; obtaining a new first message from the network port and updating the first message type according to the new first message, and processing the new first message based on the updated first message type to prevent the first message from attacking the network device.

[0010] Preferably, when the first message type matches the attack message type, and when the first message type does not match the attack message type, the first message is sent to the operating system kernel; a new first message is obtained from the network port and the first message type is updated according to the new first message, and the new first message is processed based on the updated first message type to prevent the first message from attacking the network device.

[0011] Preferably, an embodiment of the present invention also includes: after completing the discarding processing of the first message, obtaining a new first message from the network port and updating the first message type according to the new first message, and processing the new first message based on the updated first message type to prevent the first message from attacking the network device.

[0012] The second aspect of the present invention provides a network device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, a dynamic anti-attack method in a 5G network as described in any one of the embodiments of the first aspect of the present invention is implemented.

[0013] An embodiment of the third aspect of the present invention provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute a dynamic anti-attack method in a 5G network as described in any one of the embodiments of the first aspect of the present invention.

[0014] Implementing the embodiments of the present invention will have the following beneficial effects:

[0015] According to a dynamic anti-attack method, network device and storage medium under a 5G network in an embodiment of the present invention, since the dynamic anti-attack method under a 5G network in an embodiment of the present invention runs on a network port driver of a network device, by parsing a first message to obtain a first message type corresponding to the first message, and verifying whether the first message type matches a preset message support type, it is possible to directly determine whether the first message is supported in the network port driver, and unsupported messages can be directly discarded, thereby improving operation efficiency; in addition, by further verifying whether the first message type matches a preset attack message type when the first message type matches the message support type, and selecting a preset discarding strategy according to the first message type so as to adaptively process the first message based on the discarding strategy, it is possible to select corresponding discarding strategies for different types of attack messages to improve the processing efficiency for different types of attack messages, and by adaptively processing the first message of the attack message type, it is possible to automatically adjust the packet loss rate according to the current operation of the network device to appropriately process the first message. Furthermore, since a dynamic anti-attack method in a 5G network according to an embodiment of the present invention runs on a network port driver rather than on a separate processing module, the resource requirements for network devices can be reduced. In summary, the embodiment of the present invention can solve the problem of low operating efficiency caused by the need for the network firewall of the network device in the prior art to run on a separate processing module and the inability to achieve dynamic adjustment of the packet loss rate.

[0016] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the contents particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] in:

[0019] Figure 1 A schematic diagram of a network device provided by an embodiment of the present invention;

[0020] Figure 2 A flow chart of a dynamic anti-attack method in a 5G network provided by an embodiment of the present invention;

[0021] Figure 3 A specific flow chart of a dynamic anti-attack method in a 5G network provided by an embodiment of the present invention;

[0022] Figure 4 A specific flow chart of a dynamic anti-attack method in a 5G network provided by an embodiment of the present invention;

[0023] Figure 5 A specific flow chart of a dynamic anti-attack method in a 5G network provided by an embodiment of the present invention;

[0024] Figure 6 A specific flow chart of a dynamic anti-attack method in a 5G network provided by an embodiment of the present invention;

[0025] Figure 7 A schematic diagram of a discard strategy provided for a specific example of the present invention;

[0026] Figure 8 A schematic diagram of a network device provided according to another embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0028] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0029] The present invention provides a dynamic anti-attack method, network device and storage medium under a 5G network. The dynamic anti-attack method under a 5G network of an embodiment of the present invention is applied to a network port driver applied to a network device. The network device is provided with a network port, and the network device runs an operating system kernel and a network port driver for driving the network port. The method includes: obtaining a first message from the network port; parsing the first message to obtain a first message type, and verifying whether the first message type matches a preset message support type; when the first message type matches the message support type, verifying whether the first message type matches a preset attack message type; when the first message type matches the attack message type, selecting a preset discarding strategy according to the first message type and adaptively processing the first message based on the discarding strategy to prevent the first message from attacking the network device. Since the dynamic anti-attack method under the 5G network of the embodiment of the present invention runs on the network port driver of the network device, by parsing the first message to obtain the first message type corresponding to the first message, and verifying whether the first message type matches the preset message support type, it is possible to directly determine whether the first message is supported in the network port driver, and unsupported messages can be directly discarded, thereby improving the operating efficiency; in addition, by further verifying whether the first message type matches the preset attack message type when the first message type matches the message support type, and selecting a preset discarding strategy according to the first message type so as to adaptively process the first message based on the discarding strategy, it is possible to select corresponding discarding strategies for different types of attack messages to improve the processing efficiency for different categories of attack messages, and, by adaptively processing the first message of the attack message type, it is possible to automatically adjust the packet loss rate according to the current operating status of the network device to appropriately process the first message. Furthermore, since a dynamic anti-attack method in a 5G network according to an embodiment of the present invention runs on a network port driver rather than on a separate processing module, the resource requirements for network devices can be reduced. In summary, the embodiment of the present invention can solve the problem of low operating efficiency caused by the need for the network firewall of the network device in the prior art to run on a separate processing module and the inability to achieve dynamic adjustment of the packet loss rate.

[0030] The embodiments of the present invention are further described below in conjunction with the accompanying drawings.

[0031] like Figure 1 As shown, Figure 1 A schematic diagram of a network device 100 provided in an embodiment of the present invention is shown in FIG. Figure 1 In the example, the network device 100 is provided with a network port 102 and a CPU 101, wherein the network port 102 is connected to the CPU 101, the network port 102 can receive messages from outside the network device 100, and can forward the messages to the CPU 101 for processing.

[0032] Specifically, the network device 100 runs an operating system and a network port driver for driving a network port, and the operating system has an operating system kernel.

[0033] Specifically, network devices include UPF devices. UPF devices of 5G networks are deployed on the public network, so they are vulnerable to network attacks. Hackers attack UPF devices mainly by attacking with large-volume messages or forging messages to consume system resources of the attacked device, such as increasing the CPU occupancy rate or memory usage rate of the UPF device. In response to such situations, the relevant technology sets up a network firewall on the UPF device to prevent hackers from intruding, and appropriately discards messages to ensure that the CPU occupancy rate and memory occupancy rate of the UPF will not be too high due to external attacks.

[0034] Specifically, the CPU usage of a UPF device refers to the proportion of time that the CPU executes valid instructions within a period of time. The higher the CPU usage, the busier the device is, and it is difficult for the device to handle more tasks. If too many useless messages or attack messages are received at this time, the CPU will have to process these useless messages, and the real business messages will not be processed, which will cause delays or interruptions in normal business. The memory usage of the UPF system refers to the proportion of memory requested by the entire system to the total memory. Businesses need to apply for memory to run normally. If there is little memory left, the messages received from the network port cannot be distributed and copied normally.

[0035] Specifically, the network firewall in the related art runs on a separate network filtering (Netfilter) module. This network filtering module is not included in the network port driver, but runs on the network port driver, and the network filtering module cannot achieve dynamic adjustment of the packet loss rate.

[0036] It should be noted that the dynamic anti-attack method under a 5G network of an embodiment of the present invention runs on a network port driver rather than on a separate network screening module, thereby reducing the resource requirements for network equipment and improving operating efficiency.

[0037] The network equipment and application scenarios described in the embodiments of the present invention are intended to more clearly illustrate the technical solutions of the embodiments of the present invention, and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention. Those skilled in the art will appreciate that with the evolution of communication technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of the present invention are also applicable to similar technical problems.

[0038] It can be understood by those skilled in the art that Figure 1 The network device shown in the figure does not constitute a limitation on the embodiments of the present invention, and may include more or fewer components than those shown in the figure, or combine certain components, or arrange the components differently.

[0039] Based on the above network equipment, various embodiments of a dynamic anti-attack method in a 5G network of the present invention are proposed.

[0040] like Figure 2 As shown, Figure 2 A flowchart of a dynamic anti-attack method in a 5G network provided by an embodiment of the present invention, Figure 2 In the example, a dynamic anti-attack method in a 5G network according to an embodiment of the present invention includes but is not limited to step S100, step S200, step S300 and step S400;

[0041] Step S100, obtaining a first message from a network port;

[0042] Step S200, parsing the first message to obtain a first message type, and verifying whether the first message type matches a preset message support type;

[0043] Step S300, when the first message type matches the message support type, verify whether the first message type matches the preset attack message type;

[0044] Step S400, when the first message type matches the attack message type, a preset discarding strategy is selected according to the first message type and the first message is adaptively processed based on the discarding strategy to prevent the first message from attacking the network device.

[0045] Specifically, by parsing the first message to obtain the first message type corresponding to the first message, and verifying whether the first message type matches the preset message support type, it is possible to directly determine whether the first message is supported in the network port driver, and unsupported messages can be directly discarded, thereby improving operation efficiency;

[0046] Specifically, by further verifying whether the first message type matches the preset attack message type when the first message type matches the message support type, and selecting the preset discarding strategy according to the first message type so as to adaptively process the first message based on the discarding strategy, corresponding discarding strategies can be selected for different types of attack messages to improve the processing efficiency for different categories of attack messages, and, by adaptively processing the first message of the attack message type, the packet loss rate can be automatically adjusted according to the current operation status of the network device to appropriately process the first message.

[0047] Specifically, since a dynamic anti-attack method in a 5G network of an embodiment of the present invention runs on a network port driver rather than on a separate processing module, it is possible to reduce resource requirements on network devices.

[0048] Specifically, the attack message types include but are not limited to Address Resolution Protocol (ARP) message types and Internet Control Message Protocol (ICMP) message types.

[0049] Specifically, there are multiple discarding strategies, and each discarding strategy corresponds to an attack message type one by one.

[0050] like Figure 3 As shown, the above method step S300 includes but is not limited to step S310, step S320 and step S330:

[0051] Step S310, when the discarding strategy is triggered, obtaining the current CPU occupancy rate and memory usage rate of the network device, wherein the execution time of the discarding strategy after being triggered is a preset first time period;

[0052] Step S320, obtaining current current limiting parameters according to the first message type, CPU occupancy rate and memory usage rate;

[0053] Step S330: within a preset first time period, and when the number of first messages currently received cumulatively is not greater than the current limiting parameter, the current first message is sent to the operating system kernel.

[0054] Specifically, the current limiting parameters are generated only when the discarding strategy is triggered for the first time based on the current CPU occupancy and memory usage of the network device. That is, each time the discarding strategy is triggered due to the receipt of an attack message type, the current limiting parameters will be updated to adapt to the current operation of the network device.

[0055] Specifically, by acquiring the current CPU occupancy and memory usage of the network device and obtaining the current current limiting parameters based on the first message type, CPU occupancy and memory usage, the current limiting parameters can characterize the maximum processing capacity that the network device can allocate for attack type messages without affecting the normal processing of services by the network device. Therefore, within a preset first time period and when the current cumulative number of first messages received is not greater than the current limiting parameters, the current first message is sent to the operating system kernel.

[0056] In one embodiment, the method step S300 further includes but is not limited to step S340:

[0057] Step S340, when the cumulative number of first messages received within the first time period after the discard strategy is triggered is greater than the current limiting parameter, the first messages received from the time when it is detected that the number of first messages is greater than the current limiting parameter to the end of the first time period are discarded.

[0058] Specifically, by discarding the first messages received from the time when it is detected that the number of first messages is greater than the current limiting parameter to the end of the first time period, it is possible to avoid the CPU occupancy rate and memory occupancy rate of the network device being too high, resulting in the network device being unable to process services normally.

[0059] like Figure 4 As shown, the above method step S320 also includes but is not limited to step S321 and step S322:

[0060] Step S321, determining a packet receiving constant according to the first message type;

[0061] Step S322, obtaining the current current limiting parameters according to the packet receiving constant, CPU occupancy rate and memory usage rate.

[0062] Specifically, the packet receiving constant corresponds to the first message type one by one, so that the network device can make different discarding strategies for different messages to adapt to different processing loads required by different types of messages.

[0063] Specifically, the maximum number of packets allowed, that is, the current limiting parameter, refers to the following formula:

[0064] ulArpLimit = ARP packet receiving constant * (100-ulCpuRate) * (100-ulMemRate) / 10000

[0065] Among them, ulArpLimit is the maximum number of messages allowed, and the ARP packet receiving constant is set according to the actual situation. ulCpuRate is the current system CPU usage, which is updated in real time. ulMemRate is the memory usage, which is also updated in real time. Therefore, the ARP message rate limit is a variable between 0 and 100, which dynamically implements the rate limit of ARP messages and achieves the technical effect of reducing the amount of ARP messages entering when the CPU and memory usage are too high.

[0066] Specifically, a hardware timer is set inside the CPU of the network device. The hardware timer is a scale scheduled by the operating system running on the network device. Each triggering is a tick, that is, an interrupt. Each time an interrupt is triggered, the tick number increases by 1. A tick is generally set to 100 milliseconds.

[0067] Specifically, the first time period is the time required for the number of interruptions triggered by the hardware timer of the network device to reach a preset first threshold.

[0068] Specifically, in one embodiment, the first threshold is set to 100.

[0069] like Figure 5 As shown, the above method steps also include but are not limited to step S500 and step S600:

[0070] Step S500, when the first message type does not match the message support type, discard the first message;

[0071] Step S600, obtaining a new first message from the network port and updating the first message type according to the new first message, and processing the new first message based on the updated first message type to prevent the first message from attacking the network device.

[0072] like Figure 6 As shown, the above method steps also include but are not limited to step S700 and step S800:

[0073] Step S700, when the first message type matches the attack message type, and when the first message type does not match the attack message type, sending the first message to the operating system kernel;

[0074] Step S800, obtaining a new first message from the network port and updating the first message type according to the new first message, and processing the new first message based on the updated first message type to prevent the first message from attacking the network device.

[0075] Since the dynamic anti-attack method under the 5G network of the embodiment of the present invention runs on the network port driver of the network device, by parsing the first message to obtain the first message type corresponding to the first message, and verifying whether the first message type matches the preset message support type, it is possible to directly determine whether the first message is supported in the network port driver, and unsupported messages can be directly discarded, thereby improving the operation efficiency; in addition, by further verifying whether the first message type matches the preset attack message type when the first message type matches the message support type, and selecting a preset discarding strategy according to the first message type so as to adaptively process the first message based on the discarding strategy, it is possible to select corresponding discarding strategies for different types of attack messages to improve the processing efficiency for different types of attack messages.

[0076] In one embodiment, the above method steps further include but are not limited to step S900:

[0077] Step S900: after the first message is discarded, a new first message is obtained from the network port and the first message type is updated according to the new first message, and the new first message is processed based on the updated first message type to prevent the first message from attacking the network device.

[0078] Example 1:

[0079] Reference Figure 7 , Figure 7 A schematic diagram of a discard strategy provided for a specific example of the present invention, Figure 7 The discarding strategy shown is for ARP packets. The core idea is to allow a maximum number of ARP packets to be submitted to the operating system kernel within a specified time period, that is, 100 ticks, and directly discard the excess ARP packets.

[0080] The maximum number of messages allowed is based on the following formula:

[0081] ulArpLimit = ARP packet receiving constant * (100-ulCpuRate) * (100-ulMemRate) / 10000

[0082] Among them, ulArpLimit is the maximum number of messages allowed, and the ARP packet receiving constant is set according to the actual situation. ulCpuRate is the current system CPU usage, which is updated in real time. ulMemRate is the memory usage, which is also updated in real time. Therefore, the ARP message rate limit is a variable between 0 and 100, which dynamically implements the rate limit of ARP messages and achieves the technical effect of reducing the amount of ARP messages entering when the CPU and memory usage are too high.

[0083] Specifically, Figure 7 The drop policy flow shown is as follows:

[0084] Step 1, define two global static variables, ulArpCount represents the number of ARP packets received, initialized to 0. ulTick is the number of system ticks at the start of timing;

[0085] Step 2: After entering the current speed limit strategy process, ulArpCount is incremented by 1;

[0086] Step 3, if the current ulTick is 0, it means starting the timing count and proceeding to the next step, otherwise proceeding to step 9;

[0087] Step 4, ulTick = tickGet(), timing starts, and the starting tick time of this cycle is saved;

[0088] Step 5, obtain the CPU occupancy rate ulCpuRate and memory occupancy rate ulMemRate of the current system;

[0089] Step 6, calculate the current limit number within 100 ticks ulArpLimit = 100*(100-ulCpuRate)*(100-ulMemRate) / 10000;

[0090] Step 7, submit the current message to the operating system kernel;

[0091] Step 8, take the next message;

[0092] Step 9: If the number of ARP packets received ulArpCount is less than ulArpLimit, you can continue to receive ARP packets and go to step 7; otherwise, discard the packet and go to the next step.

[0093] Step 10, if the system time tickGet()-ulArpTick>100, it means that the 100-tick counting cycle is completed, and go to the next step, otherwise continue counting the timing packet loss and go to step 8;

[0094] Step 11, ulArpTick=0, clear ulArpCount=0, and go to step 8.

[0095] Specifically, the CPU occupancy rate ulCpuRate and the memory occupancy rate ulMemRate both have a value range of 0 to 100.

[0096] It should be noted that the discarding policy for ICMP messages can be the same as the discarding policy for ARP messages, and the only difference is that the conditions for triggering the discarding policy are different.

[0097] In addition, refer to Figure 8The embodiment of the present invention further provides a network device 200, which is provided with a processor 201 and a memory 202, and the processor 201 and the memory 202 are connected via a bus. Specifically, the processor 201 is used to provide computing and control capabilities to support the operation of the entire network device 200. The processor 201 can be a central processing unit (CPU), and the processor 201 can also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0098] Specifically, the memory 202 may be a Flash chip, a read-only memory (ROM) disk, an optical disk, a USB flash drive, or a mobile hard disk.

[0099] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a partial structure related to the embodiment of the present invention, and does not constitute a limitation on the network device 200 to which the embodiment of the present invention is applied. A specific server may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0100] The processor is used to run a computer program stored in the memory, and implement any one of the dynamic anti-attack methods under the 5G network provided by the embodiments of the present invention when executing the computer program.

[0101] In one embodiment, the processor is configured to execute a computer program stored in the memory.

[0102] It should be noted that technical personnel in the relevant field can clearly understand that, for the convenience and conciseness of description, the specific working process of the network device 200 described above can refer to the corresponding process in the aforementioned dynamic anti-attack method embodiment under the 5G network, and will not be repeated here.

[0103] In addition, an embodiment of the present invention also provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of any dynamic anti-attack method under a 5G network provided in the specification of the present invention.

[0104] The storage medium may be an internal storage unit of the electronic device of the aforementioned embodiment, such as a hard disk or memory of the electronic device. The storage medium may also be an external storage device of the electronic device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device.

[0105] It will be appreciated by those skilled in the art that all or some of the steps and systems in the disclosed method above may be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that may be used to store desired information and may be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0106] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the above-mentioned implementation mode. Technical personnel familiar with the field can also make various equivalent deformations or substitutions without violating the spirit of the present invention. These equivalent deformations or substitutions are all included in the scope defined by the claims of the present invention.

Claims

1. A dynamic anti-attack method in a 5G network, characterized in that: A network port driver applied to a network device, the network device being provided with a network port, the network device running an operating system kernel and the network port driver for driving the network port, the method comprising: Obtaining a first message from the network port; Parsing the first message to obtain a first message type, and verifying whether the first message type matches a preset message support type; In the case where the first message type matches the message support type, verifying whether the first message type matches a preset attack message type; In the case where the first message type matches the attack message type, selecting a preset discarding strategy according to the first message type and adaptively processing the first message based on the discarding strategy to prevent the first message from attacking the network device; The selecting a preset discarding strategy according to the first message type and adaptively processing the first message based on the discarding strategy includes: When the discarding strategy is triggered, the current CPU occupancy rate and memory usage rate of the network device are obtained, wherein the execution time of the discarding strategy after being triggered is a preset first time period; Obtaining a current current limiting parameter according to the first message type, the CPU occupancy rate, and the memory usage rate; Within a preset first time period, and when the number of the first messages currently received cumulatively is not greater than the current limiting parameter, sending the current first message to the operating system kernel; The method of selecting a preset discarding strategy according to the first message type and adaptively processing the first message based on the discarding strategy further includes: In a case where the cumulative number of the first messages received within the first time period after the discard strategy is triggered is greater than the current limiting parameter, discarding the first messages received from the time when it is detected that the number of the first messages is greater than the current limiting parameter to the end of the first time period; The obtaining the current current limiting parameter according to the first message type, the CPU occupancy rate, and the memory usage rate includes: Determine a packet receiving constant according to the first message type; Obtain the current current limiting parameter according to the packet receiving constant, the CPU occupancy rate and the memory usage rate; Specifically, the maximum number of packets allowed, that is, the current limiting parameter, refers to the following formula: ulArpLimit = ARP packet receiving constant * (100-ulCpuRate) * (100-ulMemRate) / 10000, where ulArpLimit is the maximum number of packets allowed, the ARP packet receiving constant is set according to the actual situation, ulCpuRate is the current system CPU occupancy, and ulMemRate is the memory usage.

2. According to claim 1, a dynamic anti-attack method in a 5G network is characterized in that: The first time period is the time required for the number of interrupts triggered by the hardware timer of the network device to reach a preset first threshold.

3. According to a 5G network dynamic attack prevention method according to claim 1, it is characterized in that: The method further comprises: If the first message type does not match the message support type, discard the first message; A new first message is obtained from the network port and the first message type is updated according to the new first message, and the new first message is processed based on the updated first message type to prevent the first message from attacking the network device.

4. The dynamic anti-attack method in a 5G network according to claim 1, characterized in that: The method further comprises: When the first message type matches the attack message type, and when the first message type does not match the attack message type, sending the first message to the operating system kernel; A new first message is obtained from the network port and the first message type is updated according to the new first message, and the new first message is processed based on the updated first message type to prevent the first message from attacking the network device.

5. The dynamic anti-attack method in a 5G network according to claim 1, characterized in that: The method further comprises: After completing the discarding process of the first message, a new first message is obtained from the network port and the first message type is updated according to the new first message, and the new first message is processed based on the updated first message type to prevent the first message from attacking the network device.

6. A network device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, a dynamic anti-attack method in a 5G network as described in any one of claims 1 to 5 is implemented.

7. A computer-readable storage medium, characterized in that: Computer executable instructions are stored, and the computer executable instructions are used to execute a dynamic anti-attack method in a 5G network as described in any one of claims 1 to 5.

Images