Traffic-based network attack defense method and related equipment

Abstract

The disclosed embodiments provide a method and related equipment for network attack defense based on traffic. The method includes: obtaining the attacking network address and the network address characteristics of the attacking network address; determining that the attacking network address is a public type network address; obtaining the attacking network address and the network address characteristics of the attacking network address, the attacked network address, the service characteristics of the attacked network address, and the traffic characteristics between the attacking network address and the attacked network address; determining the traffic blocking method between the attacking network address and the attacked network address according to the service characteristics and traffic characteristics of the attacked network address; and blocking part of the traffic between the attacking network address and the attacked network address according to the traffic blocking method. Through the technical solution provided by the disclosed embodiments, for the scenario where the attacking network address is a public type network address, partial traffic blocking can be achieved according to the service characteristics and traffic characteristics.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a flow-based network attack defense method and device, a computer-readable storage medium, and an electronic device. Background Art

[0002] Among the existing network attack defense methods that are maturely applied in the market, the simplest defense solution on the traffic side is to input the attacker's IP (Internet Protocol) and then block the one-way or two-way traffic or the traffic to a certain port between the attacker's IP and the attacked IP.

[0003] However, the disadvantage of this method is that if the attacker's IP is a public IP (such as the attacker attacks through public WIFI or IDC rooms), on the one hand, the traffic between the attacker's IP and the attacked IP is directly blocked. Since the traffic has been blocked, other users under the public IP may not be able to access the attacked party's (defender's) business normally, which will have a great impact on the attacked party's business. On the other hand, it is difficult to avoid accidental damage to the business due to erroneous bans and business characteristics. At the same time, this method requires manual setting of the ban duration for the attacker's IP traffic. After the ban time is reached, it is still necessary to manually determine whether to continue the ban. If not, it is necessary to manually lift the ban.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure. Summary of the invention

[0005] The embodiments of the present disclosure provide a flow-based network attack defense method and device, a computer-readable storage medium, and an electronic device, which can solve the technical problem that flow blocking in the above-mentioned related technologies affects normal business.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] The disclosed embodiment provides a flow-based network attack defense method, the method comprising: obtaining an attacking network address and network address characteristics of the attacking network address; performing network address type analysis on the network address characteristics of the attacking network address to determine that the attacking network address is a public type network address; obtaining an attacked network address corresponding to the attacking network address, service characteristics of the attacked network address, and flow characteristics between the attacking network address and the attacked network address; determining a flow blocking method from the attacking network address to the attacked network address according to the service characteristics of the attacked network address and the flow characteristics between the attacking network address and the attacked network address; and blocking part of the flow from the attacking network address to the attacked network address according to the flow blocking method.

[0008] The embodiment of the present disclosure provides a flow-based network attack defense device, the device comprising: a network address feature acquisition unit, used to acquire an attack network address and the network address features of the attack network address; a public attack network determination unit, used to perform network address type analysis and processing on the network address features of the attack network address, and determine that the attack network address is a public type network address; a service traffic feature acquisition unit, used to acquire an attacked network address corresponding to the attack network address, the service features of the attacked network address, and the traffic features between the attack network address and the attacked network address; a blocking mode determination unit, used to determine a traffic blocking mode between the attack network address and the attacked network address according to the service features of the attacked network address and the traffic features between the attack network address and the attacked network address; and a partial traffic blocking unit, used to block partial traffic between the attack network address and the attacked network address according to the traffic blocking mode.

[0009] In some exemplary embodiments of the present disclosure, the network address feature of the attacking network address includes Internet data center information of the attacking network address, and the public type network address includes the network address of an Internet data center computer room.

[0010] Wherein, the public attack network determination unit includes: a central computer room network address determination unit, which is used to perform network address type analysis and processing on the attack network address according to the Internet data center information, and determine that the attack network address is the network address of the Internet data center computer room. The blocking mode determination unit includes: a short-term remote login protocol traffic blocking unit, which is used to determine that the traffic between the attack network address and the attacked network address adopts the remote login protocol according to the traffic characteristics, or adopts the remote login protocol and the network service protocol; determines that the remote login port is opened on the attacked network address according to the service characteristics of the attacked network address; and determines that the traffic blocking mode is to block the traffic corresponding to the remote login protocol between the attack network address and the attacked network address within a first preset time.

[0011] In some exemplary embodiments of the present disclosure, the blocking method determination unit includes: a computer room network application firewall attack traffic blocking unit, which is used to determine that the traffic between the attacking network address and the attacked network address adopts the network service protocol according to the traffic characteristics, or adopts the remote login protocol and the network service protocol; determines to open the network service port on the attacked network address according to the service characteristics of the attacked network address; and determines that the traffic blocking method is to use the network application firewall to block the attack traffic between the attacking network address and the attacked network address.

[0012] In some exemplary embodiments of the present disclosure, the blocking method determination unit includes: a short-term remote login protocol computer room network application firewall traffic blocking unit, which is used to determine that the traffic between the attacking network address and the attacked network address adopts the remote login protocol and the network service protocol according to the traffic characteristics; determine to open the remote login port and the network service port on the attacked network address according to the service characteristics of the attacked network address; determine that the traffic blocking method is to block the traffic corresponding to the remote login protocol between the attacking network address and the attacked network address within a first preset time, and use a network application firewall to block the attack traffic between the attacking network address and the attacked network address.

[0013] In some exemplary embodiments of the present disclosure, the network address characteristics of the attack network address include the physical location information, operator information and Internet data center information of the attack network address, and the public type network address includes the network address of the communication operator and is a data public exit. Among them, the public attack network determination unit includes: a data public exit determination unit, which is used to perform network address type analysis and processing on the attack network address according to the Internet data center information, and determine that the attack network address does not belong to the network address of the Internet data center computer room; determine that the attack network address belongs to the network address of the communication operator according to the operator information; determine that the attack network address is a data public exit according to the physical location information, and then determine that the attack network address is the network address of the communication operator and is a data public exit. The blocking mode determination unit includes: a long-term remote login protocol traffic blocking unit, which is used to determine that the traffic of the attack network address adopts the remote login protocol according to the traffic characteristics, or adopts the remote login protocol and the network service protocol; determine that the remote login port is opened on the attacked network address according to the service characteristics of the attacked network address; determine that the traffic blocking mode is to block the traffic corresponding to the remote login protocol between the attack network address and the attacked network address within a predetermined time.

[0014] In some exemplary embodiments of the present disclosure, the blocking method determination unit includes: a public network application firewall attack traffic blocking unit, which is used to determine that the traffic between the attacking network address and the attacked network address adopts a network service protocol according to the traffic characteristics, or adopts a remote login protocol and a network service protocol; determines that a network service port is opened on the attacked network address according to the service characteristics of the attacked network address; and determines that the traffic blocking method is to use a network application firewall to block the attack traffic between the attacking network address and the attacked network address.

[0015] In some exemplary embodiments of the present disclosure, the blocking method determination unit includes: a long-term remote login protocol public network application firewall traffic blocking unit, which is used to determine that the traffic between the attacking network address and the attacked network address adopts the remote login protocol and the network service protocol according to the traffic characteristics; determine to open the remote login port and the network service port on the attacked network address according to the service characteristics of the attacked network address; determine that the traffic blocking method is to block the traffic corresponding to the remote login protocol between the attacking network address and the attacked network address within a second preset time, and use a network application firewall to block the attack traffic between the attacking network address and the attacked network address.

[0016] In some exemplary embodiments of the present disclosure, the device also includes: an attack network service feature acquisition unit, used to acquire the service features of the attack network address; a non-public attack network determination unit, used to perform network address type analysis on the network address features of the attack network address, and determine that the attack network address is a non-public type network address; and a full traffic blocking unit, used to block the traffic between the attack network address and the attacked network address according to the service features of the attack network address and the traffic features between the attack network address and the attacked network address.

[0017] In some exemplary embodiments of the present disclosure, the full-flow blocking unit includes: an attack network unopened common port blocking unit, which is used to determine that a predetermined service port is not open on the attack network address according to the service characteristics of the attack network address; determine that the ratio of the attack traffic to the total traffic between the attack network address and the attacked network address within a specified time is greater than a ratio threshold according to the traffic characteristics; block the traffic between the attack network address and the attacked network address within a specified time period; if there is attack traffic in the traffic between the attack network address and the attacked network address within the specified time period, continue to block the traffic between the attack network address and the attacked network address within a predetermined time period.

[0018] In some exemplary embodiments of the present disclosure, the full-flow blocking unit includes: an attack network open common port blocking unit, which is used to determine the opening of a predetermined service port on the attack network address according to the service characteristics of the attack network address; determine according to the traffic characteristics that the proportion of traffic inflow and outflow between the attack network address and the attacked network address within a specified time is greater than the inflow and outflow threshold; use a network application firewall to intercept the traffic of the attack network address; monitor the traffic from the attack network address to the attacked network address, and if the ratio of the attack traffic from the attack network address to the attacked network address to the total traffic gradually increases, block the traffic from the attack network address to the attacked network address within a specified time period; if there is still attack traffic in the traffic from the attack network address to the attacked network address within the specified time period, continue to block the traffic from the attack network address to the attacked network address within the set time period.

[0019] In some exemplary embodiments of the present disclosure, the service traffic feature acquisition unit includes: an attacked network service port acquisition unit, which is used to acquire the open port on the attacked network address and the service name using the open port on the attacked network address, so as to determine the service port opened on the attacked network address, and use the service port opened on the attacked network address as the service feature of the attacked network address; a specified time traffic acquisition unit, which is used to acquire the traffic between the attacking network address and the attacked network address within the specified time; a specified time traffic parsing unit, which is used to parse the traffic between the attacking network address and the attacked network address within the specified time, and obtain the protocol used for the traffic between the attacking network address and the attacked network address within the specified time, the proportion of traffic in and out, and the proportion of the attack traffic between the attacking network address and the attacked network address to the total traffic within the specified time. Among them, the traffic feature between the attacking network address and the attacked network address includes the protocol used for the traffic between the attacking network address and the attacked network address within the specified time, the proportion of traffic in and out, and the proportion of the attack traffic between the attacking network address and the attacked network address within the specified time and the total traffic.

[0020] An embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the flow-based network attack defense method as described in the above embodiment is implemented.

[0021] An embodiment of the present disclosure provides an electronic device, comprising: at least one processor; and a storage device configured to store at least one program, so that when the at least one program is executed by the at least one processor, the at least one processor implements the flow-based network attack defense method as described in the above embodiments.

[0022] According to one aspect of the present disclosure, a computer program product or a computer program is provided, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the flow-based network attack defense method provided in various optional implementations of the above-mentioned embodiments.

[0023] In the technical solutions provided by some embodiments of the present disclosure, by obtaining the network address characteristics of the attacking network address, the network address type of the attacking network address can be analyzed according to the attacking network address characteristics, and it can be determined whether the attacking network address is a public type network address; when the attacking network address is a public type network address, it can be further determined which method to use to block the traffic between the attacking network address and the attacked network address according to the service characteristics of the attacked network address obtained and the traffic characteristics between the attacking network address and the attacked network address. On the one hand, the automation of determining which method to block the traffic is realized, reducing the workload of human participation, improving the efficiency of traffic blocking, and reducing costs; on the other hand, because the network address characteristics of the attacking network address itself are fully considered when determining the traffic blocking method, when the attacking network address is a public type network, part of the traffic between the attacked network address and the corresponding attacking network address is blocked instead of the whole traffic, which solves the problem of being difficult to handle caused by the attacker using the public type network address to mix the attack traffic with the same data public export network address, reduces the impact of the full traffic blocking on the business, and also reduces the possibility of the business being attacked in this case.

[0024] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0026] Figure 1 The flowchart of a flow-based network attack defense method according to an embodiment of the present disclosure is schematically shown.

[0027] Figure 2 The flowchart of a flow-based network attack defense method according to another embodiment of the present disclosure is schematically shown.

[0028] Figure 3 The flowchart of a flow-based network attack defense method according to another embodiment of the present disclosure is schematically shown.

[0029] Figure 4 Schematically shows Figure 3 The flowchart of step S901 and step S902 in the embodiment is in an exemplary embodiment.

[0030] Figure 5 Schematically shows Figure 3 Flowchart of step S903 in an exemplary embodiment.

[0031] Figure 6 A block diagram of a flow-based network attack defense device according to an embodiment of the present disclosure is schematically shown.

[0032] Figure 7 A schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0033] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be comprehensive and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The same reference numerals in the figures represent the same or similar parts, and thus their repeated description will be omitted.

[0034] The features, structures or characteristics described in the present disclosure may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known methods, devices, implementations or operations are not shown or described in detail to avoid blurring the various aspects of the present disclosure.

[0035] The accompanying drawings are only schematic diagrams of the present disclosure, and the same reference numerals in the drawings represent the same or similar parts, so their repeated description will be omitted. Some block diagrams shown in the accompanying drawings do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in at least one hardware module or integrated circuit, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0036] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and steps, nor must they be executed in the order described. For example, some steps can be decomposed, and some steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0037] In this specification, the terms "a", "an", "the", "said" and "at least one" are used to indicate the presence of at least one element / component / etc.; the terms "comprising", "including" and "having" are used to express an open-ended inclusion and mean that additional elements / components / etc. may exist in addition to the listed elements / components / etc.; the terms "first", "second" and "third" etc. are used only as labels and are not intended to limit the quantity of their objects.

[0038] The exemplary embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0039] Based on the technical problems existing in the above-mentioned related technologies, the embodiments of the present disclosure propose a traffic-based network attack defense method to at least partially solve the above-mentioned problems. The methods provided in the embodiments of the present disclosure can be executed by any electronic device, such as a server, or a terminal device, or an interaction between a server and a terminal device, and the present disclosure does not limit this.

[0040] The server mentioned in the embodiments of the present disclosure may be an independent server, a server cluster or a distributed system composed of multiple servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0041] In the embodiments of the present disclosure, the terminal device may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, a wearable smart device, a car computer, a smart TV, etc., but is not limited thereto. The terminal device and the server may be directly or indirectly connected via wired or wireless communication, which is not limited in the present disclosure.

[0042] The method and apparatus provided by the embodiments of the present disclosure can be applied to security products (devices / software) that provide traffic blocking capabilities, both on the host side and on the traffic side, and mainly serve scenarios where they need to block traffic to the attacking network address when they are attacked.

[0043] Figure 1 The flowchart of a flow-based network attack defense method according to an embodiment of the present disclosure is schematically shown.

[0044] like Figure 1 As shown, the method provided by the embodiment of the present disclosure may include the following steps.

[0045] In step S110, an attacking network address and a network address feature of the attacking network address are obtained.

[0046] In the disclosed embodiments, the attacking network address refers to the network address of the host (which can be a terminal device or a server) where the attacker is located. For example, the user end / service end corresponding to the network address is an illegal website, that is, a website whose domain name has not been registered and has illegal domain names; the attacked network address refers to the network address of the host (which can be a terminal device or a server) where the attacker is located. For example, the port of the network address is at risk of being attacked through port scanning or brute force. In the following examples, the network address is an IP address as an example for illustration. For example, the attacking network address is expressed as the attacking IP, the attacked network address is expressed as the attacked IP, and the network address characteristics of the attacking network address are expressed as the IP characteristics of the attacking IP.

[0047] In an exemplary embodiment, the IP feature of the attacking IP may also include Internet Data Center (IDC) information of the attacking IP.

[0048] In other embodiments, the IP characteristics of the attacking IP may include the physical location information, operator information, and IDC information of the attacking IP.

[0049] In an exemplary embodiment, obtaining the network address characteristics of the attacking network address may include: querying and obtaining the physical location information, operator information, and Internet data center information of the attacking network address, and using the physical location information, operator information, and Internet data center information of the attacking network address as the network address characteristics of the attacking network address.

[0050] In the disclosed embodiment, the IP characteristics of the attacking IP refer to the characteristics of the attacking IP itself that are related to its IP characteristics, such as one or more of the attacking IP's physical location information, its operator information, and its Internet data center information.

[0051] In the disclosed embodiments, the Internet data center refers to a service platform with complete equipment (including high-speed Internet access bandwidth, high-performance local area network, safe and reliable computer room environment, etc.), professional management, and complete applications. Based on this platform, the IDC service provider provides customers with Internet basic platform services (server hosting, virtual hosting, mail cache, virtual mail, etc.) and various value-added services (site rental services, domain name system services, load balancing systems, database systems, data backup services, etc.).

[0052] In step S120, a network address type analysis process is performed on the network address features of the attack network address to determine that the attack network address is a public type network address.

[0053] In the disclosed embodiments, a public IP (also referred to as a public IP) refers to, for example, an IP address received by an enterprise router from an ISP (Internet Service Provider). Publicly accessible network hardware requires a public IP address, such as a server hosting a website. Otherwise, it is a non-public IP. For example, if the attack IP belongs to an IP owned by a telecommunications operator and is a public data export, or the IP of an IDC computer room, it is a public IP. If the attack IP belongs to an IP of a cloud service provider, it is a non-public IP.

[0054] In an exemplary embodiment, the public type network address may include a network address of an Internet data center computer room. Wherein, performing a network address type analysis on the network address feature of the attack network address to determine that the attack network address is a public type network address may include: performing a network address type analysis on the attack network address according to the Internet data center information to determine that the attack network address is the network address of the Internet data center computer room.

[0055] In an exemplary embodiment, performing a network address type analysis on the network address characteristics of the attack network address to determine that the attack network address is a public type network address may include: performing a network address type analysis on the attack network address according to the Internet data center information to determine that the attack network address does not belong to the network address of the Internet data center computer room; determining that the attack network address belongs to the network address of the communication operator according to the operator information; and determining that the attack network address is a data public exit according to the physical location information, thereby determining that the attack network address is the network address of the communication operator and is a data public exit.

[0056] In the disclosed embodiment, the data public exit may also be referred to as the data Internet public exit, and the corresponding one is the data non-public exit, such as some temporarily opened ports, which also have data exit functions, but because they are generally for temporary use, they are of non-public type.

[0057] Specifically, it is possible to first determine whether the attacking IP belongs to the network address of the IDC computer room based on the IDC information of the attacking IP; if it is determined that the attacking IP does not belong to the network address of the IDC computer room, determine whether the attacking IP belongs to the network address of the communication operator based on the attacking IP operator information; if it is determined that the attacking IP belongs to the network address of the communication operator, determine whether the attacking IP belongs to the data public exit based on the physical location information of the attacking IP; if it is determined that the attacking IP belongs to the network address of the IDC computer room, or if it is determined that the attacking IP belongs to the network address of the communication operator and is a data public exit, determine that the attacking IP is the said public type network address.

[0058] In the following embodiments, the attacking IP is an IP owned by a communication operator and is a public data port, or an IP of an IDC computer room, and is judged as a public type IP. The attacking IP that does not belong to an IDC computer room, or an IP owned by a communication operator but is not a public data port, or an IP of a cloud service provider is called a non-public type IP.

[0059] It should be noted that, although in the embodiment of the present disclosure, the characteristics of the attacking IP's own attributes (such as physical location information, operator information, IDC information, etc.) are extracted and then used as the basis for judging whether the attacking IP is a public type IP, the present disclosure is not limited to this. For example, the traffic of the attacking IP during a part of the time can also be monitored, and the traffic of the attacking IP during this part of the time can be analyzed, and then its characteristics can be taken as the basis for judging whether the attacking IP is a public type IP.

[0060] In step S130, the attacked network address corresponding to the attacking network address, the service characteristics of the attacked network address, and the traffic characteristics between the attacking network address and the attacked network address are obtained.

[0061] In summary, in the embodiments of the present disclosure, the service characteristics of the attacked IP refer to the characteristics of the attacked IP in implementing business transactions, such as which ports are open on the attacking IP, what are the service names using these ports, etc.

[0062] Similarly, the service characteristics of the attacking IP mentioned below refer to the characteristics of the attacking IP in implementing business transactions, such as which ports are open on the attacking IP, what are the names of the services using these ports, etc.

[0063] In the disclosed embodiments, the traffic characteristics between the attacking IP and the attacked IP refer to the characteristics of the traffic between the attacking IP and the attacked IP, such as the total traffic of the attacking IP and the attacked IP within a specified time, the attack traffic, the ratio of the attack traffic to the total traffic, the proportion of inbound and outbound traffic, the protocol used by the attack traffic, the protocol used by the traffic, etc.

[0064] In the disclosed embodiment, the IP characteristics of the attacking IP, the service characteristics of the attacked IP, the service characteristics of the attacking IP, and the traffic characteristics between the attacking IP and the attacked IP may be referred to as business characteristics.

[0065] In an exemplary embodiment, obtaining the service characteristics of the attacked network address and the traffic characteristics between the attacking network address and the attacked network address may include: obtaining the open ports on the attacked network address and the service names using the open ports on the attacked network address, so as to determine the service ports opened on the attacked network address, and using the service ports opened on the attacked network address as the service characteristics of the attacked network address; obtaining the traffic between the attacking network address and the attacked network address within a specified time; parsing the traffic between the attacking network address and the attacked network address within the specified time, and obtaining the protocol used for the traffic between the attacking network address and the attacked network address within the specified time, the proportion of traffic inflow and outflow, and the ratio of attack traffic to total traffic between the attacking network address and the attacked network address within the specified time.

[0066] Among them, the traffic characteristics between the attacking network address and the attacked network address include the protocol used for the traffic between the attacking network address and the attacked network address within the specified time, the proportion of traffic in and out, and the ratio of the attack traffic to the total traffic between the attacking network address and the attacked network address within the specified time.

[0067] In the disclosed embodiment, based on the ports opened on the attacked IP and the service names using these ports, it is possible to determine which service ports are opened on the attacked IP, such as remote login ports, network (web) service ports, etc.

[0068] In the embodiment of the present disclosure, the specified time can be set by the user according to actual needs, for example, it can be set to one hour before and after the attacking IP attacks the attacked IP, but the present disclosure is not limited to this.

[0069] In the disclosed embodiment, the traffic between the attacking IP and the attacked IP within a specified time period is parsed and obtained, and the protocol used by the traffic, such as the remote login protocol, the network (web) service protocol, etc., can be obtained.

[0070] In the disclosed embodiment, the traffic sent from the attacking IP to the attacked IP within a specified time is called input traffic, the traffic sent from the attacked IP to the attacking IP is called output traffic, and the ratio of output traffic to input traffic is called traffic in-and-out ratio.

[0071] In the disclosed embodiment, any suitable scheme can be used to detect the attack flow in the flow between the attacking IP and the attacked IP within a specified time. After the attack flow is determined, the flow protocol of the attack flow can be determined according to the flow protocol determined by the above analysis. The ratio of the attack flow to the total flow is obtained by taking the ratio of the attack flow to the total flow between the attacking IP and the attacked IP within the specified time.

[0072] In step S140, a traffic blocking method between the attacking network address and the attacked network address is determined according to the service characteristics of the attacked network address and the traffic characteristics between the attacking network address and the attacked network address.

[0073] In an exemplary embodiment, when it is determined that the attacking network address belongs to the network address of an Internet data center computer room among the public type network addresses, a traffic blocking method between the attacking network address and the attacked network address is determined based on the service characteristics of the attacked network address and the traffic characteristics between the attacking network address and the attacked network address, which may include: determining that the traffic of the attacking network address adopts the remote login protocol, or adopts the remote login protocol and the network service protocol, based on the traffic characteristics; determining that a remote login port is opened on the attacked network address based on the service characteristics of the attacked network address; and determining that the traffic blocking method is to block the traffic corresponding to the remote login protocol between the attacking network address and the attacked network address within a first preset time.

[0074] In the disclosed embodiment, the first preset time can be set according to the actual scenario. In the following example, 10 minutes is used as an example. Since the first preset time is set to be less than the predetermined time mentioned below, it is referred to as issuing a short-term blocking of the corresponding remote login protocol traffic between the attacking IP and the attacked IP. This is because most IDC computer rooms are responsible for large-scale business. Therefore, by setting a short-term blocking of the corresponding remote login protocol traffic between the attacking IP and the attacked IP, it will not have a significant impact on the business.

[0075] In an exemplary embodiment, when it is determined that the attacking network address belongs to the network address of an Internet data center computer room among the public type network addresses, a traffic blocking method between the attacking network address and the attacked network address is determined based on the service characteristics of the attacked network address and the traffic characteristics between the attacking network address and the attacked network address, which may include: determining that the traffic between the attacking network address and the attacked network address adopts a network service protocol, or adopts a remote login protocol and a network service protocol, based on the traffic characteristics; determining that a network service port is opened on the attacked network address based on the service characteristics of the attacked network address; and determining that the traffic blocking method is to use a network (web) application firewall to block the attack traffic between the attacking network address and the attacked network address.

[0076] In the embodiments of the present disclosure, partial traffic blocking and full traffic blocking between the attacking IP and the attacked IP can be achieved through a web application firewall and a traffic blocking device, but the present disclosure is not limited to this. For example, a packet filtering firewall, a host security group setting, and other software and hardware devices with traffic filtering for the attacking IP and port can be used as replacements.

[0077] In an exemplary embodiment, when it is determined that the attacking network address belongs to the network address of an Internet data center computer room among the public type network addresses, a traffic blocking method between the attacking network address and the attacked network address is determined based on the service characteristics of the attacked network address and the traffic characteristics between the attacking network address and the attacked network address, which may include: determining that the traffic between the attacking network address and the attacked network address adopts the remote login protocol and the network service protocol based on the traffic characteristics; determining that the remote login port and the network service port are opened on the attacked network address based on the service characteristics of the attacked network address; determining that the traffic blocking method is to block the traffic corresponding to the remote login protocol between the attacking network address and the attacked network address within a first preset time, and using a network application firewall to block the attack traffic between the attacking network address and the attacked network address.

[0078] In an exemplary embodiment, when it is determined that the attacking network address belongs to the network address of the communication operator among the public type network addresses and is a public data export, the traffic blocking method between the attacking network address and the attacked network address is determined according to the service characteristics of the attacked network address and the traffic characteristics between the attacking network address and the attacked network address, which may include: determining that the traffic of the attacking network address adopts the remote login protocol, or adopts the remote login protocol and the network service protocol according to the traffic characteristics; determining that the remote login port is opened on the attacked network address according to the service characteristics of the attacked network address; and determining that the traffic blocking method is to block the traffic corresponding to the remote login protocol between the attacking network address and the attacked network address within a predetermined time.

[0079] In the embodiment of the present disclosure, the predetermined time can be set according to the actual scenario. In the following example, 1 hour is used as an example. Since the predetermined time is set to be greater than the first preset time mentioned above, it is called sending a relatively long time to block the corresponding remote login protocol traffic between the attacking IP and the attacked IP. This is because if the attacking IP adopts the data public export method, there may be multiple exports, so the impact on the business will be lower than that of the IDC room IP, and it can be set to block the corresponding remote login protocol traffic between the attacking IP and the attacked IP for a relatively long time.

[0080] In an exemplary embodiment, when it is determined that the attacking network address belongs to the network address of the communication operator among the public type network addresses and is a public data export, the traffic blocking method between the attacking network address and the attacked network address is determined according to the service characteristics of the attacked network address and the traffic characteristics between the attacking network address and the attacked network address, which may include: determining that the traffic between the attacking network address and the attacked network address adopts a network service protocol, or adopts a remote login protocol and a network service protocol according to the traffic characteristics; determining that a network service port is opened on the attacked network address according to the service characteristics of the attacked network address; and determining that the traffic blocking method is to use a network application firewall to block the attack traffic between the attacking network address and the attacked network address.

[0081] In an exemplary embodiment, when it is determined that the attacking network address belongs to the network address of the communication operator among the public type network addresses and is a public data export, the traffic blocking method between the attacking network address and the attacked network address is determined according to the service characteristics of the attacked network address and the traffic characteristics between the attacking network address and the attacked network address, which may include: determining that the traffic between the attacking network address and the attacked network address adopts the remote login protocol and the network service protocol according to the traffic characteristics; determining that the remote login port and the network service port are opened on the attacked network address according to the service characteristics of the attacked network address; determining that the traffic blocking method is to block the traffic corresponding to the remote login protocol between the attacking network address and the attacked network address within a second preset time, and using a network application firewall to block the attack traffic between the attacking network address and the attacked network address.

[0082] In the embodiment of the present disclosure, the second preset time is shorter than the above-mentioned preset time, and therefore can also be referred to as a short time, for example, it can be 10 minutes, but the present disclosure is not limited thereto. The second preset time can be the same as the first preset time, or it can be different.

[0083] In step S150, part of the traffic between the attacking network address and the attacked network address is blocked according to the traffic blocking method.

[0084] In the disclosed embodiment, when it is determined that the attacking IP is a public type IP, partial traffic blocking can be used to avoid problems affecting business caused by full traffic blocking. At the same time, the traffic blocking method determined based on the traffic characteristics between the attacking IP and the attacked IP and the service characteristics of the attacked IP can achieve accurate blocking of part of the traffic and prevent accidental damage to normal traffic.

[0085] In an exemplary embodiment, the method may further include: obtaining service characteristics of the attacking network address; performing network address type analysis on the network address characteristics of the attacking network address to determine that the attacking network address is a non-public type network address; and blocking the traffic between the attacking network address and the attacked network address based on the service characteristics of the attacking network address and the traffic characteristics between the attacking network address and the attacked network address.

[0086] In the disclosed embodiment, when the attacking IP is determined to be a non-public type IP, although a full-flow blocking method can be adopted, the specific full-flow blocking method adopted is also determined based on the service characteristics of the attacking IP and the flow characteristics between the attacking IP and the attacked IP, thereby improving the accuracy of flow blocking.

[0087] In an exemplary embodiment, blocking the traffic between the attacking network address and the attacked network address based on the service characteristics of the attacking network address and the traffic characteristics between the attacking network address and the attacked network address may include: determining that a predetermined service port is not open on the attacking network address based on the service characteristics of the attacking network address; determining that the ratio of the attack traffic to the total traffic between the attacking network address and the attacked network address within a specified time is greater than a ratio threshold based on the traffic characteristics; determining to block the traffic between the attacking network address and the attacked network address within a specified time period; and if attack traffic exists in the traffic between the attacking network address and the attacked network address within the specified time period, continuing to block the traffic between the attacking network address and the attacked network address within a predetermined time period.

[0088] In the embodiment of the present disclosure, the ratio threshold can be set according to actual conditions. In the following embodiment, 90% is taken as an example for illustration, but the present disclosure is not limited thereto.

[0089] In the embodiment of the present disclosure, the specified duration can be set according to actual needs. In the following examples, the specified duration is 5 minutes. The predetermined duration can be set according to actual needs. In the following examples, the predetermined duration is 1 hour.

[0090] In an exemplary embodiment, blocking the traffic from the attacking network address to the attacked network address based on the service characteristics of the attacking network address and the traffic characteristics between the attacking network address and the attacked network address may include: determining to open a predetermined service port on the attacking network address based on the service characteristics of the attacking network address; determining that the proportion of inbound and outbound traffic between the attacking network address and the attacked network address within a specified time is greater than an inbound and outbound threshold based on the traffic characteristics; intercepting the traffic of the attacking network address using a network application firewall; monitoring the traffic from the attacking network address to the attacked network address, and if the ratio of the attack traffic from the attacking network address to the attacked network address to the total traffic gradually increases, blocking the traffic from the attacking network address to the attacked network address within a specified time period; and continuing to block the traffic from the attacking network address to the attacked network address within a set time period if there is still attack traffic in the traffic from the attacking network address to the attacked network address within the specified time period.

[0091] In the embodiment of the present disclosure, the set duration can be set according to actual needs. In the following examples, the set duration is taken as 5 minutes.

[0092] It should be noted that the execution order of the above steps can be adjusted, for example, step S110 and S130 can be executed in parallel to improve efficiency, or step S130 can be executed before step S110, or step S120 and S130 can be executed in parallel.

[0093] The network attack defense method based on traffic provided by the embodiment of the present disclosure obtains the network address characteristics of the attack network address, thereby analyzing the network address type of the attack network address according to the attack network address characteristics, and determining whether the attack network address is a public type network address; when the attack network address is a public type network address, it can further determine which method to use to block the traffic between the attack network address and the attacked network address according to the service characteristics of the acquired attacked network address and the traffic characteristics between the attack network address and the attacked network address. On the one hand, the automation of determining which method to block the traffic is realized, reducing the workload of human participation, improving the efficiency of traffic blocking, and reducing the cost; on the other hand, because the network address characteristics of the attack network address itself are fully considered when determining the traffic blocking method, when the attack network address is a public type network, part of the traffic between the attacked network address and the corresponding attack network address is blocked instead of the whole traffic, which solves the problem of being difficult to handle caused by the attacker using the public type network address to mix the attack traffic with the same data public export network address, reduces the impact of the full traffic blocking on the business, and also reduces the possibility of the business being attacked in this case.

[0094] Combine the following Figures 2 to 5 right Figure 1 The methods provided in the embodiments are illustrative, but the present disclosure is not limited thereto.

[0095] Figure 2 The flowchart of the network attack defense method based on traffic according to another embodiment of the present disclosure is schematically shown. Figure 2 As shown, the method provided by the embodiment of the present disclosure may include the following steps.

[0096] In step S1, the attacking IP and the attacked IP that need to have traffic blocked are obtained from different sources.

[0097] Step S1 can be called the input step, which is used to obtain the attacking IP and the attacked IP that need to block traffic from different sources, where the attacked IP can be empty, and the attacking IP cannot be empty. The source may include but is not limited to user input, database reading, file reading, etc.

[0098] Steps S2 to S5 can be referred to as data preprocessing steps, which are used to query information about IP characteristics of the attacking IP, detect service characteristics of the attacked IP, and detect traffic characteristics between the two.

[0099] In step S2, the physical location information, operator information and IDC information of the attacking IP are queried through a public interface or a proprietary service.

[0100] Step S2 is used to query the IP feature information of the attacking IP. Figure 2 The embodiment takes the physical location information, operator information and IDC information of the attacking IP as its IP features as an example, and the physical location information, operator information and IDC information of the attacking IP can be obtained through a public interface or a proprietary service query.

[0101] In step S3, the open port on the attacked IP and the service name using the port are obtained.

[0102] Step S3 is used for service / business detection of the attacked IP: obtaining the open port information on the host where the attacked IP is located (which can be obtained by querying the ports found in the traffic communication, or by obtaining the open port information on the host on the host side), and obtaining the service names of the various ports open on the attacked IP on the host where the attacked IP is located, thereby determining which service ports are open on the attacked IP, for example, if the service name corresponding to the open port is remote login, then the port is called the remote login port; if the service name corresponding to the open port is web service, then the port is called the web service port, and so on.

[0103] In step S4, the open port on the attacking IP and the service name using the port are obtained.

[0104] Step S4 is used for service / business detection of the attacking IP: obtaining the port information opened on the host where the attacking IP is located (it can be obtained by querying the ports found in the traffic communication, or by obtaining the port information opened on the host on the host side), and obtaining the service names of the ports opened on the attacking IP on the host where the attacking IP is located, thereby determining which service ports are opened on the attacking IP, for example, if the service name corresponding to the open port is remote login, then the port is called the remote login port; if the service name corresponding to the open port is web service, then the port is called the web service port, etc. Common ports on the attacking IP can be set as predetermined service ports, such as remote login ports, web service ports, etc.

[0105] In step S5, the traffic between the attacking IP and the attacked IP within a specified time is obtained.

[0106] Step S5 is used to obtain the traffic between the attacking IP and the attacked IP to analyze and process it to obtain traffic characteristics: obtain the traffic between the attacking IP and the attacked IP within a specified time (which can be selected by the user, the default is within one hour before and after the time of the attack), and then analyze it to obtain traffic characteristics such as the protocol used by the traffic and the proportion of traffic in and out.

[0107] In step S6, the IP characteristics of the attacking IP are analyzed and verified.

[0108] Specifically, the above step S6 may further include the following steps S601 to S608.

[0109] In step S601, it is determined through IDC information whether the attacking IP belongs to the IP of the IDC computer room; if the attacking IP belongs to the IP of the IDC computer room, it proceeds to step S602; if the attacking IP does not belong to the IP of the IDC computer room, it jumps to step S604.

[0110] In the disclosed embodiment, the IDC information of the attacking IP is used to determine whether the attacking IP is an IP of the IDC computer room. If the IDC information of the attacking IP shows that the attacking IP is an IP of the IDC computer room, other services or interfaces are called for secondary confirmation. If the IDC information of the attacking IP shows that the attacking IP is not an IP of the IDC computer room, step S604 is executed.

[0111] In step S602, if the attacking IP belongs to the IP of the IDC computer room, other services or interfaces are called for secondary confirmation; if the secondary confirmation result is that the attacking IP belongs to the IP of the IDC computer room, step S603 is entered; if the secondary confirmation result is that the attacking IP does not belong to the IP of the IDC computer room, jump to step S604.

[0112] In step S603, if the secondary confirmation result is that the attacking IP belongs to the IP of the IDC computer room, it can be confirmed that the attacking IP belongs to the IP of the IDC computer room.

[0113] In step S604, if it is determined through the IDC information that the attacking IP does not belong to the IP of the IDC computer room, or the secondary confirmation result is that the attacking IP does not belong to the IP of the IDC computer room, then the operator information of the attacking IP is used to determine whether the attacking IP belongs to the IP owned by the communication operator; if it is determined through the operator information of the attacking IP that the attacking IP belongs to the IP owned by the communication operator, then step S605 is entered; if it is determined through the operator information of the attacking IP that the attacking IP does not belong to the IP owned by the communication operator, then step S608 is entered.

[0114] In step S605, if it is determined through the operator information of the attacking IP that the attacking IP is an IP owned by the communication operator, then the physical location information of the attacking IP is used to determine whether the attacking IP belongs to a public data exit; if it is determined through the physical location information of the attacking IP that the attacking IP belongs to a public data exit, then the process proceeds to step S606; if it is determined through the physical location information of the attacking IP that the attacking IP does not belong to a public data exit, then the process proceeds to step S607.

[0115] In step S606, if it is determined that the attacking IP belongs to a public data outlet through the physical location information of the attacking IP, it is confirmed that the attacking IP belongs to an IP owned by the communication operator and is a public data outlet.

[0116] In step S607, if it is determined through the physical location information of the attacking IP that the attacking IP does not belong to a public data outlet, it is confirmed that the attacking IP belongs to an IP owned by a communication operator and is not a public data outlet.

[0117] In the disclosed embodiment, if it is confirmed that the attacking IP belongs to an IP owned by a communication operator and is not a public data export, the traffic between the attacking IP and the attacked IP can be blocked on the traffic side.

[0118] In step S608, if it is determined through the operator information of the attacking IP that the attacking IP does not belong to the IP owned by the communication operator, it is confirmed that the attacking IP belongs to the cloud service provider IP.

[0119] In the disclosed embodiment, the attacking IP is judged whether it belongs to an IP owned by a communication operator by the operator information of the attacking IP. If the attacking IP belongs to a communication operator, the physical location information of the attacking IP is queried to judge whether it belongs to a public data outlet. If the IP does not belong to a communication operator, it is confirmed that it belongs to a cloud service provider.

[0120] In step S7, service feature analysis is performed on the ports and services opened on the attacking IP and the attacked IP.

[0121] Specifically, the above step S7 may further include the following steps S701 to S708, namely, analyzing the port and service of the attacked IP.

[0122] In step S701, it is determined whether only the remote login port is enabled on the attacked IP; if only the remote login port is enabled on the attacked IP, the process proceeds to step S702; otherwise, the process proceeds to step S703.

[0123] Determine whether only common remote login ports (such as 22, 3389, etc.) are open on the attacked IP.

[0124] In step S702, if only the remote login port is enabled on the attacked IP, it is confirmed that only the remote login port is enabled on the attacked IP.

[0125] In step S703, if the attacked IP does not have only the remote login port enabled, then continue to determine whether only the network service port is enabled on the attacked IP; if only the network service port is enabled on the attacked IP, proceed to step S704; otherwise, proceed to step S705.

[0126] Determine whether only common web service ports (such as 80, 8080, etc.) are enabled on the attacked IP.

[0127] In step S704, if only the network service port is enabled on the attacked IP, it is confirmed that only the network service port is enabled on the attacked IP.

[0128] In step S705, it is confirmed that both the network service port and the remote login port are enabled on the attacked IP.

[0129] Determine whether both the remote login port and the web service port (or other common service ports, such as 3389 of MySQL (a relational database management system) database) are enabled on the attacked IP.

[0130] Continue to refer Figure 2 The above step S7 may further include the following steps S707 to S708, that is, analyzing the port and service of the attacking IP.

[0131] In step S706, determine whether common ports are open on the attacking IP; if common ports are open on the attacking IP, proceed to step S707; if common ports are not open on the attacking IP, proceed to step S708.

[0132] In step S707, it is confirmed that common ports are opened on the attacking IP.

[0133] In step S708, it is confirmed that no common ports are opened on the attacking IP.

[0134] Determine whether at least one common port is open on the attacking IP, such as a remote login port, a web service port, etc. These common ports are called predetermined service ports.

[0135] refer to Figure 2 The embodiment of the present disclosure may further include step S8, for details, see the following Figure 3 Description.

[0136] like Figure 3 As shown, in step S8, the traffic of the attacking IP and the attacked IP within a specified time is analyzed to obtain traffic characteristics.

[0137] Specifically, the above step S8 may further include the following steps S801 to S804.

[0138] In step S801, the traffic between the attacking IP and the attacked IP within a specified time is parsed to obtain the adopted protocols, and the traffic is classified according to the protocols.

[0139] In the disclosed embodiment, all flows between the attacking IP and the attacked IP within a specified time are extracted (checked to be full flows), and these full flows are analyzed to obtain the protocols used by these full flows. These full flows can be classified according to the protocols of the flows, for example, flows using the remote login protocol are classified into one category, flows using the web service protocol are classified into another category, and so on.

[0140] In step S802, the traffic protocol corresponding to the attack traffic of the attack IP within the specified time is extracted.

[0141] From the above-extracted full traffic within the specified time, it is possible to determine which traffic is attack traffic, and the traffic protocol of the attack traffic can be determined.

[0142] In step S803, the proportion of inbound and outbound traffic between the attacking IP and the attacked IP within a specified time is counted.

[0143] The statistics are used to obtain the proportion of traffic in and out between the attacking IP and the attacked IP within a specified time. The traffic from the attacking IP to the attacked IP is defined as the input traffic, and the traffic from the attacked IP to the attacking IP is defined as the output traffic.

[0144] In step S804, the ratio of the attack traffic to the total traffic within the specified time is counted.

[0145] The proportion of the above attack traffic in the total traffic within the specified time period is counted as the ratio of attack traffic to total traffic within the specified time period.

[0146] refer to Figure 3 , the embodiment of the present disclosure may further include steps S9 to S11.

[0147] In step S9, a judgment is made based on the existing information, and a corresponding blocking command is issued.

[0148] Specifically, the above step S9 may further include the following steps S901 to S903.

[0149] In step S901, if the attacking IP is the IP of the IDC room, it is confirmed that the entire traffic cannot be blocked, and the corresponding blocking selection is made according to the service characteristics and traffic characteristics of the attacking IP and the attacked IP. Figure 4 .

[0150] In step S902, if the attacking IP is the IP of the communication operator and belongs to the public data outlet, the entire flow cannot be blocked. The corresponding blocking selection is made according to the service characteristics and flow characteristics of the attacking IP and the attacked IP. Figure 4 .

[0151] In step S903, if the attacking IP belongs to the cloud service provider IP, full traffic blocking can be considered, but the corresponding blocking selection is also made according to the service characteristics and traffic characteristics of the attacking IP and the attacked IP. Figure 5 .

[0152] The cloud service provider IP in the disclosed embodiment refers to the IP used by the tenant on the cloud, which refers to a single user / service. The IDC room IP is often the exit for multiple users / services.

[0153] In step S10, the traffic between the attacking IP and the attacked IP is monitored and provided to the above step S8.

[0154] Step S10 is used to implement traffic monitoring. This step is used to perform corresponding types of traffic detection (including monitoring of outbound and inbound traffic) on IPs (including attacking IPs and attacked IPs) that are set to perform traffic monitoring within a period of time (which may include the above-mentioned specified time, and may also include monitoring time such as a specified duration, a predetermined duration, and a set duration), and provide relevant data on the traffic within this period of time to the above-mentioned step S8 for corresponding traffic feature analysis, and continue this process until the monitoring time ends or no attack traffic is found.

[0155] In step S11, the data in the above steps are formatted and stored in a database.

[0156] Step S11 may be referred to as an output step, which is used to format the data in the above steps and then save them into a database so that they can be read and used by different devices / software. For example, the formatted data includes but is not limited to the following data:

[0157] 1) Attacking IP and attacked IP.

[0158] 2) IP characteristics of the attacking IP and traffic characteristics between the attacking IP and the attacked IP.

[0159] 3) Analyze the IP characteristics of the attacking IP to obtain the analysis results, such as the attacking IP is the IP of the IDC computer room among the public type IPs.

[0160] 4) Service characteristics of the attacking IP and the service characteristics of the attacked IP.

[0161] 5) Analysis results of traffic characteristics between the attacking IP and the attacked IP, such as determining that the traffic between the attacking IP and the attacked IP uses a web service protocol.

[0162] 6) The blocking judgment process of which traffic blocking method or full traffic blocking method to use and the corresponding judgment results.

[0163] 7) The status of the traffic monitoring process and the corresponding monitoring results, such as whether there is any attack traffic during the monitoring time.

[0164] Figure 4 Schematically shows Figure 3 Flowchart of step S901 and step S902 in an exemplary embodiment. Step S9 can be called a quasi-real-time blocking step, which is used to make a judgment based on the existing information and then issue a corresponding blocking command.

[0165] In step S901, if the attacking IP is the IP of the IDC computer room, it is confirmed that the entire traffic cannot be blocked, and corresponding blocking options are made according to the service characteristics and traffic characteristics of the attacking IP and the attacked IP.

[0166] like Figure 4 As shown, in the embodiment of the present disclosure, the above step S901 may further include the following steps S9011 to S9015.

[0167] In step S9011, if the traffic protocol of the attacking IP is only the common remote login protocol, and only the corresponding remote login port is opened on the attacked IP, a message is sent down to block the corresponding remote login protocol traffic between the attacking IP and the attacked IP for a short period of time.

[0168] If the traffic protocol of the attack traffic of the attacking IP (that is, the traffic protocol corresponding to the traffic when the attacking IP generates attack traffic) is only a common remote login protocol, and only the corresponding remote login port is opened on the attacked IP, then a short-term blockade of the corresponding remote login protocol traffic between the attacking IP and the attacked IP will be sent (the short-term default is 10 minutes, which can be adjusted by the user).

[0169] In step S9012, if the traffic between the attacking IP and the attacked IP is only the network service protocol traffic, and only the corresponding network service port is opened on the attacked IP, a network application firewall is sent down to block the attack traffic from the attacking IP to the attacked IP.

[0170] If the traffic between the attacking IP and the attacked IP is only the web service protocol, and only the corresponding web service port is opened on the attacked IP, then the web application firewall will be used to block the attack traffic from the attacking IP to the attacked IP.

[0171] In step S9013, if there is both network service protocol traffic and remote login protocol traffic between the attacking IP and the attacked IP, but only the remote login port is open on the attacked IP, a signal is sent to block the corresponding remote login protocol traffic between the attacking IP and the attacked IP for a short period of time.

[0172] If there is both web service protocol traffic and remote login protocol traffic between the attacking IP and the attacked IP, but only the remote login port is open on the attacked IP, the handling method is the same as the above step S9011.

[0173] In step S9014, if there is both network service protocol traffic and remote login protocol traffic between the attacking IP and the attacked IP, but only the network service port is open on the attacked IP, a network application firewall is sent down to block the attack traffic from the attacking IP to the attacked IP.

[0174] If there is both web service protocol traffic and remote login protocol traffic between the attacking IP and the attacked IP, but only the web service port is open on the attacked IP, the handling method is the same as the above step S9012.

[0175] In step S9015, if there is both network service protocol traffic and remote login protocol traffic between the attacking IP and the attacked IP, and the network service port and the remote login port are both open on the attacked IP, a message is sent to block the corresponding remote login protocol traffic between the attacking IP and the attacked IP for a short period of time, and a network application firewall is used to block the attack traffic from the attacking IP to the attacked IP.

[0176] If the attacked IP has both the web service port and the remote login port open, a message will be sent to block the corresponding remote login protocol traffic between the attacking IP and the attacked IP for a short period of time, and a web application firewall will be used to block the traffic from the web attack.

[0177] In step S902, if the attacking IP is the IP of the communication operator and belongs to the public data exit, the entire traffic cannot be blocked. The corresponding blocking selection is made according to the service characteristics and traffic characteristics of the attacking IP and the attacked IP.

[0178] like Figure 4As shown, in the embodiment of the present disclosure, the above step S902 may further include the following steps S9021 to S9025.

[0179] In step S9021, if the traffic protocol of the attacking IP is only the common remote login protocol, and only the corresponding remote login port is opened on the attacked IP, the corresponding remote login protocol traffic between the attacking IP and the attacked IP is blocked for a long time.

[0180] If the traffic protocol of the attack traffic of the attacking IP is only the common remote login protocol, and only the corresponding remote login port is opened on the attacked IP, then the corresponding remote login protocol traffic between the attacking IP and the attacked IP will be blocked for a long time (the default long time is one hour, which can be adjusted by the user).

[0181] In step S9022, if the traffic between the attacking IP and the attacked IP is only the network service protocol traffic, and only the corresponding network service port is opened on the attacked IP, a network application firewall is sent down to block the attack traffic from the attacking IP to the attacked IP.

[0182] If the traffic between the attacking IP and the attacked IP is only web service protocol traffic, and the corresponding web service port is also open on the attacked IP, then send a web application firewall to block the attack traffic from the attacking IP to the attacked IP.

[0183] In step S9023, if there is both network service protocol traffic and remote login protocol traffic between the attacking IP and the attacked IP, but only the remote login port is open on the attacked IP, then a signal is sent to block the corresponding remote login protocol traffic between the attacking IP and the attacked IP for a long time.

[0184] If there is both web service protocol traffic and remote login protocol traffic between the attacking IP and the attacked IP, but only the remote login port is open on the attacked IP, the handling method is the same as the above step S9021.

[0185] In step S9024, if there is both network service protocol traffic and remote login protocol traffic between the attacking IP and the attacked IP, but only the network service port is open on the attacked IP, a network application firewall is sent down to block the attack traffic from the attacking IP to the attacked IP.

[0186] If there is both web service protocol traffic and remote login protocol traffic between the attacking IP and the attacked IP, but only the web service port is open on the attacked IP, the handling method is the same as the above step S9022.

[0187] In step S9025, if there is both network service protocol traffic and remote login protocol traffic between the attacking IP and the attacked IP, and the network service port and the remote login port are both open on the attacked IP, a message is sent to block the corresponding remote login protocol traffic between the attacking IP and the attacked IP for a short period of time (for example, the second preset time mentioned above), and a network application firewall is used to block the attack traffic from the attacking IP to the attacked IP.

[0188] If there is both web service protocol traffic and remote login protocol traffic between the attacking IP and the attacked IP, and the web service port and remote login port are both open on the attacked IP, a message will be sent to block the corresponding remote login protocol traffic between the attacking IP and the attacked IP for a short period of time, and the web application firewall will be used to block the traffic from the web attack.

[0189] Figure 5 Schematically shows Figure 3 Flowchart of step S903 in an exemplary embodiment.

[0190] In step S903, if the attacking IP belongs to the cloud service provider IP, full traffic blocking can be considered, but corresponding blocking selection is also made based on the service characteristics and traffic characteristics of the attacking IP and the attacked IP.

[0191] like Figure 5 As shown, in the embodiment of the present disclosure, the above step S903 may further include the following steps S9031 to S9032.

[0192] In step S9031, if there are no common ports open on the attacking IP, and the proportion of attack traffic to total traffic is more than 90% within the specified time, all traffic will be blocked for 5 minutes. After 5 minutes, another test will be conducted. If attack traffic is still found, the full traffic blocking time will be extended by one hour, and the cycle will continue until no attack traffic is found within the monitoring time.

[0193] If there are no common ports open on the attacking IP, and the proportion of attack traffic to total traffic within the specified time is more than 90% (users can customize it), you can first block all traffic between the attacking IP and the attacked IP for 5 minutes. After 5 minutes, perform another test (monitor the traffic for 5 minutes). If it is found that there is still attack traffic between the attacking IP and the attacked IP, you can extend the full traffic blocking time by one hour, and repeat this cycle until no attack traffic is found within the monitoring time.

[0194] In step S9032, if the common port is opened on the attacking IP, and the proportion of traffic in and out between the attacking IP and the attacked IP within the specified time is greater than the in and out threshold, the network application firewall is used to intercept the traffic of the attacking IP, and then the traffic from the attacking IP is monitored. If the proportion of attack traffic in the total traffic is gradually increasing, the full traffic is blocked for 5 minutes. After 5 minutes, the test is performed again. If attack traffic is still found, the full traffic blocking time is extended by 5 minutes, and the cycle is repeated until no attack traffic is found within the monitoring time.

[0195] If a common port is opened on the attacking IP, and the proportion of traffic in and out between the attacking IP and the attacked IP within the specified time is greater than the in and out threshold (user-defined configuration, the default is 0.6), the web application firewall is used to intercept the traffic of the attacking IP, and then the traffic from the attacking IP is monitored. If it is found that the proportion of attack traffic between the attacking IP and the attacked IP in the total traffic is gradually increasing (it can be counted every 5 minutes), then a 5-minute full traffic block can be performed first, and then a test can be performed after 5 minutes (monitoring 5 minutes of traffic). If attack traffic is still found, the full traffic block time will be extended by 5 minutes, and this cycle will be repeated until no attack traffic is found within the monitoring time. In the disclosed embodiment, the gradual increase from 5 minutes of full traffic block can reduce the impact on the business.

[0196] The network attack defense method based on flow provided by the embodiment of the present disclosure determines whether flow blocking is needed, what method is used to block flow, and how long the duration of flow blocking should be according to the IP characteristics of the attacking IP, the service characteristics of the attacked IP, and the flow characteristics between the attacking IP and the attacked IP, and fully considers the inherent characteristics (IP characteristics) of the attacking IP, reduces the difficulty of the attacker using public type IPs such as IDC computer room IPs or communication operator IPs for data public exits, etc., which easily mix the attack flow with the same public exit IP and cause it to be unable to be processed, and reduces the possibility of the business being attacked in this case. For high-risk type IPs (public type IPs), the flow conditions between it and the attacked IP, such as the server where the attacked IP is located, dynamically adjust the blocking rules, and reduce the impact on the business caused by blocking the attack flow. In addition, by matching the attack flow with the attacking IP and the service characteristics on the attacked IP, the corresponding flow blocking is performed for the flow characteristics and service characteristics of both the attacking IP and the attacked IP, so that it can be realized according to the actual situation to make corresponding blocking methods for different types of attacks and attacked objects, and avoid the impact of a one-size-fits-all flow blocking method on normal business.

[0197] Figure 6The block diagram of the flow-based network attack defense device according to an embodiment of the present disclosure is schematically shown. Figure 6 As shown, the flow-based network attack defense device 100 provided in the embodiment of the present disclosure may include a network address feature acquisition unit 110, a public attack network determination unit 120, a service flow feature acquisition unit 130, a blocking method determination unit 140 and a partial flow blocking unit 150.

[0198] In the disclosed embodiment, the network address feature acquisition unit 110 can be used to acquire the attacking network address and the network address features of the attacking network address. The public attacking network determination unit 120 can be used to perform network address type analysis on the network address features of the attacking network address to determine that the attacking network address is a public type network address. The service traffic feature acquisition unit 130 can be used to acquire the attacked network address corresponding to the attacking network address, the service features of the attacked network address, and the traffic features between the attacking network address and the attacked network address. The blocking mode determination unit 140 can be used to determine the traffic blocking mode between the attacking network address and the attacked network address according to the service features of the attacked network address and the traffic features between the attacking network address and the attacked network address. The partial traffic blocking unit 150 can be used to block part of the traffic between the attacking network address and the attacked network address according to the traffic blocking mode.

[0199] In an exemplary embodiment, the network address feature of the attacking network address may include Internet data center information of the attacking network address, and the public type network address may include the network address of an Internet data center computer room.

[0200] The public attack network determination unit 120 may include: a central computer room network address determination unit, which may be used to perform network address type analysis and processing on the attack network address according to the Internet data center information, and determine that the attack network address is the network address of the Internet data center computer room. The blocking mode determination unit may include: a short-term remote login protocol traffic blocking unit, which may be used to determine that the traffic between the attack network address and the attacked network address adopts the remote login protocol according to the traffic characteristics, or adopts the remote login protocol and the network service protocol; determine that the remote login port is opened on the attacked network address according to the service characteristics of the attacked network address; and determine that the traffic blocking mode is to block the traffic corresponding to the remote login protocol between the attack network address and the attacked network address within a first preset time.

[0201] In an exemplary embodiment, the blocking method determination unit 140 may include: a computer room network application firewall attack traffic blocking unit, which can be used to determine that the traffic between the attacking network address and the attacked network address adopts the network service protocol according to the traffic characteristics, or adopts the remote login protocol and the network service protocol; determine to open the network service port on the attacked network address according to the service characteristics of the attacked network address; determine that the traffic blocking method is to use the network application firewall to block the attack traffic between the attacking network address and the attacked network address.

[0202] In an exemplary embodiment, the blocking method determination unit 140 may include: a short-term remote login protocol computer room network application firewall traffic blocking unit, which can be used to determine that the traffic between the attacking network address and the attacked network address adopts the remote login protocol and the network service protocol according to the traffic characteristics; determine to open the remote login port and the network service port on the attacked network address according to the service characteristics of the attacked network address; determine that the traffic blocking method is to block the traffic corresponding to the remote login protocol between the attacking network address and the attacked network address within a first preset time, and use a network application firewall to block the attack traffic between the attacking network address and the attacked network address.

[0203] In an exemplary embodiment, the network address characteristics of the attack network address may include the physical location information, operator information and Internet data center information of the attack network address, and the public type network address may include the network address of the communication operator and is a data public exit. Among them, the public attack network determination unit 120 may include: a data public exit determination unit, which can be used to perform network address type analysis and processing on the attack network address according to the Internet data center information, and determine that the attack network address does not belong to the network address of the Internet data center computer room; determine that the attack network address belongs to the network address of the communication operator according to the operator information; determine that the attack network address is a data public exit according to the physical location information, and then determine that the attack network address is the network address of the communication operator and is a data public exit. The blocking mode determination unit may include: a long-term remote login protocol traffic blocking unit, which can be used to determine that the traffic of the attack network address adopts the remote login protocol according to the traffic characteristics, or adopts the remote login protocol and the network service protocol; determine that the remote login port is opened on the attacked network address according to the service characteristics of the attacked network address; determine that the traffic blocking mode is to block the traffic corresponding to the remote login protocol between the attack network address and the attacked network address within a predetermined time.

[0204] In an exemplary embodiment, the blocking method determination unit 140 may include: a public network application firewall attack traffic blocking unit, which can be used to determine that the traffic between the attacking network address and the attacked network address adopts the network service protocol according to the traffic characteristics, or adopts the remote login protocol and the network service protocol; determine to open the network service port on the attacked network address according to the service characteristics of the attacked network address; determine that the traffic blocking method is to use a network application firewall to block the attack traffic between the attacking network address and the attacked network address.

[0205] In an exemplary embodiment, the blocking method determination unit 140 may include: a long-term remote login protocol public network application firewall traffic blocking unit, which can be used to determine that the traffic between the attacking network address and the attacked network address adopts the remote login protocol and the network service protocol according to the traffic characteristics; determine to open the remote login port and the network service port on the attacked network address according to the service characteristics of the attacked network address; determine that the traffic blocking method is to block the traffic corresponding to the remote login protocol between the attacking network address and the attacked network address within a second preset time, and use a network application firewall to block the attack traffic between the attacking network address and the attacked network address.

[0206] In an exemplary embodiment, the flow-based network attack defense device 100 may also include: an attack network service feature acquisition unit, which can be used to obtain the service features of the attack network address; a non-public attack network determination unit, which can be used to perform network address type analysis on the network address features of the attack network address to determine that the attack network address is a non-public type network address; and a full-flow blocking unit, which can be used to block the flow between the attack network address and the attacked network address based on the service features of the attack network address and the flow features between the attack network address and the attacked network address.

[0207] In an exemplary embodiment, the full-traffic blocking unit may include: an attack network unopened common port blocking unit, which can be used to determine that a predetermined service port is not open on the attack network address according to the service characteristics of the attack network address; determine that the ratio of the attack traffic to the total traffic between the attack network address and the attacked network address within a specified time is greater than a ratio threshold according to the traffic characteristics; block the traffic between the attack network address and the attacked network address within a specified time period; if there is attack traffic in the traffic between the attack network address and the attacked network address within the specified time period, continue to block the traffic between the attack network address and the attacked network address within a predetermined time period.

[0208] In an exemplary embodiment, the full-flow blocking unit may include: an attack network open common port blocking unit, which can be used to determine the opening of a predetermined service port on the attack network address according to the service characteristics of the attack network address; determine according to the traffic characteristics that the proportion of traffic inflow and outflow between the attack network address and the attacked network address within a specified time is greater than the inflow and outflow threshold; use a network application firewall to intercept the traffic of the attack network address; monitor the traffic from the attack network address to the attacked network address, if the ratio of the attack traffic from the attack network address to the attacked network address to the total traffic gradually increases, then block the traffic from the attack network address to the attacked network address within a specified time period; if there is still attack traffic in the traffic from the attack network address to the attacked network address within the specified time period, then continue to block the traffic from the attack network address to the attacked network address within the set time period.

[0209] In an exemplary embodiment, the service traffic feature acquisition unit 130 may include: an attacked network service port acquisition unit, which may be used to acquire the port opened on the attacked network address and the service name using the port opened on the attacked network address, so as to determine the service port opened on the attacked network address, and use the service port opened on the attacked network address as the service feature of the attacked network address; a specified time traffic acquisition unit, which may be used to acquire the traffic between the attacking network address and the attacked network address within the specified time; a specified time traffic parsing unit, which may be used to parse the traffic between the attacking network address and the attacked network address within the specified time, and obtain the protocol used for the traffic between the attacking network address and the attacked network address within the specified time, the traffic inflow and outflow ratio, and the ratio of the attack traffic to the total traffic between the attacking network address and the attacked network address within the specified time. The traffic feature between the attacking network address and the attacked network address may include the protocol used for the traffic between the attacking network address and the attacked network address within the specified time, the traffic inflow and outflow ratio, and the ratio of the attack traffic to the total traffic between the attacking network address and the attacked network address within the specified time.

[0210] Other contents of the flow-based network attack defense device of the embodiment of the present disclosure may refer to the above embodiment.

[0211] It should be noted that although several units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0212] Reference below Figure 7 , which shows a schematic diagram of the structure of an electronic device suitable for implementing an embodiment of the present application. Figure 7 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0213] Reference Figure 7 The electronic device provided by the embodiment of the present disclosure may include: a processor 701, a communication interface 702, a memory 703 and a communication bus 704.

[0214] The processor 701 , the communication interface 702 and the memory 703 communicate with each other via the communication bus 704 .

[0215] Optionally, the communication interface 702 may be an interface of a communication module, such as an interface of a GSM (Global System for Mobilecommunications) module. The processor 701 is used to execute a program. The memory 703 is used to store a program. The program may include a computer program, which includes computer operation instructions. Among them, the program may include: a game client program.

[0216] The processor 701 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present disclosure.

[0217] The memory 703 may include a high-speed RAM (random access memory) memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0218] Among them, the program can be specifically used to: obtain an attacking network address and network address characteristics of the attacking network address; perform network address type analysis on the network address characteristics of the attacking network address to determine that the attacking network address is a public type network address; obtain the attacked network address corresponding to the attacking network address, the service characteristics of the attacked network address, and the traffic characteristics between the attacking network address and the attacked network address; determine the traffic blocking method between the attacking network address and the attacked network address based on the service characteristics of the attacked network address and the traffic characteristics between the attacking network address and the attacked network address; and block part of the traffic between the attacking network address and the attacked network address based on the traffic blocking method.

[0219] According to one aspect of the present application, a computer program product or a computer program is provided, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method provided in various optional implementations of the above-mentioned embodiments.

[0220] It should be understood that any number of elements in the drawings of the present disclosure is for illustration rather than limitation, and any naming is only for distinction rather than having any limiting meaning.

[0221] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0222] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A network attack defense method based on traffic, characterized in that: include: Obtaining an attack network address and a network address feature of the attack network address; Performing network address type analysis on the network address features of the attack network address to determine that the attack network address is a public type network address; Acquire the attacked network address corresponding to the attacking network address, the service characteristics of the attacked network address, and the traffic characteristics between the attacking network address and the attacked network address; Determine a traffic blocking method from the attacking network address to the attacking network address according to the service characteristics of the attacked network address and the traffic characteristics between the attacking network address and the attacked network address, wherein the service port opened on the attacked network address is used as the service characteristic of the attacked network address, and the traffic characteristics between the attacking network address and the attacked network address include the protocol used by the traffic between the attacking network address and the attacked network address within a specified time; Block part of the traffic between the attacking network address and the attacked network address according to the traffic blocking method.

2. The method according to claim 1, characterized in that The network address feature of the attack network address includes the Internet data center information of the attack network address, and the public type network address includes the network address of the computer room of the Internet data center; The step of performing a network address type analysis on the network address feature of the attack network address to determine that the attack network address is a public type network address includes: Performing a network address type analysis on the attack network address according to the Internet data center information, and determining that the attack network address is the network address of the computer room of the Internet data center; Wherein, determining the traffic blocking mode between the attacking network address and the attacked network address according to the service characteristics of the attacked network address and the traffic characteristics between the attacking network address and the attacked network address includes: Determine, according to the traffic characteristics, that the traffic between the attacking network address and the attacked network address adopts a remote login protocol, or adopts a remote login protocol and a network service protocol; Determine, based on the service characteristics of the attacked network address, to enable a remote login port on the attacked network address; The traffic blocking method is determined to block the traffic corresponding to the remote login protocol between the attacking network address and the attacked network address within a first preset time.

3. The method according to claim 2, characterized in that Determining a traffic blocking method between the attacking network address and the attacked network address according to the service characteristics of the attacked network address and the traffic characteristics between the attacking network address and the attacked network address includes: Determine, based on the traffic characteristics, that the traffic between the attacking network address and the attacked network address adopts a network service protocol, or adopts a remote login protocol and a network service protocol; Determine, based on the service characteristics of the attacked network address, to open a network service port on the attacked network address; Determine the traffic blocking method as using a network application firewall to block the attack traffic between the attacking network address and the attacked network address.

4. The method according to claim 2, characterized in that: Determining a traffic blocking method between the attacking network address and the attacked network address according to the service characteristics of the attacked network address and the traffic characteristics between the attacking network address and the attacked network address includes: Determining, based on the traffic characteristics, that the traffic between the attacking network address and the attacked network address adopts the remote login protocol and the network service protocol; Determine, based on the service characteristics of the attacked network address, to enable a remote login port and a network service port on the attacked network address; Determine the traffic blocking method as blocking the traffic corresponding to the remote login protocol between the attacking network address and the attacked network address within the first preset time, and use a network application firewall to block the attack traffic between the attacking network address and the attacked network address.

5. The method according to claim 1, characterized in that The network address characteristics of the attack network address include the physical location information, operator information and Internet data center information of the attack network address, and the public type network address includes the network address of the communication operator and is a public data exit; The step of performing a network address type analysis on the network address feature of the attack network address to determine that the attack network address is a public type network address includes: Performing a network address type analysis on the attack network address according to the Internet data center information to determine that the attack network address does not belong to the network address of the Internet data center computer room; Determining, based on the operator information, that the attack network address belongs to a network address of a communication operator; Determining that the attack network address is a public data exit according to the physical location information, then determining that the attack network address is a network address of the communication operator and is a public data exit; Wherein, determining the traffic blocking mode between the attacking network address and the attacked network address according to the service characteristics of the attacked network address and the traffic characteristics between the attacking network address and the attacked network address includes: Determining, based on the traffic characteristics, that the traffic of the attack network address adopts the remote login protocol, or adopts the remote login protocol and the network service protocol; Determine, based on the service characteristics of the attacked network address, to enable a remote login port on the attacked network address; The traffic blocking method is determined to block the traffic corresponding to the remote login protocol between the attacking network address and the attacked network address within a predetermined time.

6. The method according to claim 5, characterized in that Determining a traffic blocking method between the attacking network address and the attacked network address according to the service characteristics of the attacked network address and the traffic characteristics between the attacking network address and the attacked network address includes: Determine, based on the traffic characteristics, that the traffic between the attacking network address and the attacked network address adopts a network service protocol, or adopts a remote login protocol and a network service protocol; Determine, based on the service characteristics of the attacked network address, to open a network service port on the attacked network address; Determine the traffic blocking method as using a network application firewall to block the attack traffic between the attacking network address and the attacked network address.

7. The method according to claim 5, characterized in that Determining a traffic blocking method between the attacking network address and the attacked network address according to the service characteristics of the attacked network address and the traffic characteristics between the attacking network address and the attacked network address includes: Determining, based on the traffic characteristics, that the traffic between the attacking network address and the attacked network address adopts the remote login protocol and the network service protocol; Determine, based on the service characteristics of the attacked network address, to enable a remote login port and a network service port on the attacked network address; Determine the traffic blocking method as blocking the traffic corresponding to the remote login protocol between the attacking network address and the attacked network address within a second preset time, and use a network application firewall to block the attack traffic between the attacking network address and the attacked network address.

8. The method according to claim 1, characterized in that Also includes: Obtaining service characteristics of the attack network address; Performing network address type analysis on the network address features of the attack network address to determine that the attack network address is a non-public type network address; According to the service characteristics of the attacking network address and the traffic characteristics between the attacking network address and the attacked network address, the traffic between the attacking network address and the attacked network address is blocked.

9. The method according to claim 8, characterized in that According to the service characteristics of the attacking network address and the traffic characteristics between the attacking network address and the attacked network address, blocking the traffic between the attacking network address and the attacked network address includes: Determining, based on the service characteristics of the attacking network address, that a predetermined service port is not open on the attacking network address; Determining, based on the traffic characteristics, that a ratio of the attack traffic to the total traffic between the attacking network address and the attacked network address within a specified time is greater than a ratio threshold; Blocking the traffic between the attacking network address and the attacked network address within a specified period of time; If attack traffic exists in the traffic between the attacking network address and the attacked network address within the specified time period, the traffic between the attacking network address and the attacked network address continues to be blocked within the predetermined time period.

10. The method according to claim 8, characterized in that According to the service characteristics of the attacking network address and the traffic characteristics between the attacking network address and the attacked network address, blocking the traffic between the attacking network address and the attacked network address includes: Determine, based on the service characteristics of the attack network address, to open a predetermined service port on the attack network address; Determining, based on the traffic characteristics, that the traffic inflow and outflow ratio between the attacking network address and the attacked network address within a specified time is greater than an inflow and outflow threshold; Use a network application firewall to intercept traffic from the attack network address; Monitoring the traffic from the attacking network address to the attacked network address, and if the ratio of the attack traffic from the attacking network address to the attacked network address to the total traffic gradually increases, blocking the traffic from the attacking network address to the attacked network address within a specified time period; If there is still attack traffic in the traffic between the attacking network address and the attacked network address within the specified time period, the traffic between the attacking network address and the attacked network address will continue to be blocked within the set time period.

11. The method according to any one of claims 1 to 10, characterized in that: Acquiring the service characteristics of the attacked network address and the traffic characteristics between the attacking network address and the attacked network address includes: Obtaining the open ports on the attacked network address and the service names using the open ports on the attacked network address, so as to determine the service ports opened on the attacked network address; Obtaining the traffic between the attacking network address and the attacked network address within the specified time; Analyze the traffic between the attacking network address and the attacked network address within the specified time, and obtain the protocol used by the traffic between the attacking network address and the attacked network address within the specified time, the proportion of traffic in and out, and the ratio of the attack traffic to the total traffic between the attacking network address and the attacked network address within the specified time; Among them, the traffic characteristics between the attacking network address and the attacked network address also include the proportion of traffic in and out between the attacking network address and the attacked network address within the specified time, and the ratio of attack traffic to total traffic between the attacking network address and the attacked network address within the specified time.

12. A flow-based network attack defense device, characterized in that: include: A network address feature acquisition unit, used to acquire an attack network address and a network address feature of the attack network address; A public attack network determination unit, configured to perform network address type analysis on the network address characteristics of the attack network address, and determine that the attack network address is a public type network address; A service traffic feature acquisition unit, used to acquire an attacked network address corresponding to the attacking network address, a service feature of the attacked network address, and a traffic feature between the attacking network address and the attacked network address; a blocking mode determining unit, configured to determine a traffic blocking mode between the attacking network address and the attacked network address according to a service feature of the attacked network address and a traffic feature between the attacking network address and the attacked network address, wherein the service port opened on the attacked network address is used as the service feature of the attacked network address, and the traffic feature between the attacking network address and the attacked network address includes a protocol used by the traffic between the attacking network address and the attacked network address within a specified time; A partial traffic blocking unit is used to block partial traffic between the attacking network address and the attacked network address according to the traffic blocking method.

13. The device according to claim 12, characterized in that The network address feature of the attack network address includes the Internet data center information of the attack network address, and the public type network address includes the network address of the computer room of the Internet data center; Wherein, the public attack network determination unit includes: A central computer room network address determination unit, configured to perform network address type analysis on the attack network address according to the Internet data center information, and determine that the attack network address is the network address of the Internet data center computer room; The blocking mode determination unit includes: A short-term remote login protocol traffic blocking unit is used to determine, based on the traffic characteristics, that the traffic between the attacking network address and the attacked network address adopts the remote login protocol, or adopts the remote login protocol and the network service protocol; determine, based on the service characteristics of the attacked network address, to open a remote login port on the attacked network address; and determine that the traffic blocking method is to block the traffic corresponding to the remote login protocol between the attacking network address and the attacked network address within a first preset time.

14. The device according to claim 13, characterized in that The blocking mode determination unit includes: The computer room network application firewall attack traffic blocking unit is used to determine that the traffic between the attacking network address and the attacked network address adopts the network service protocol according to the traffic characteristics, or adopts the remote login protocol and the network service protocol; determine to open the network service port on the attacked network address according to the service characteristics of the attacked network address; determine that the traffic blocking method is to use the network application firewall to block the attack traffic between the attacking network address and the attacked network address.

15. The device according to claim 13, characterized in that The blocking mode determination unit includes: The short-term remote login protocol computer room network application firewall traffic blocking unit is used to determine that the traffic between the attacking network address and the attacked network address adopts the remote login protocol and the network service protocol according to the traffic characteristics; determine to open the remote login port and the network service port on the attacked network address according to the service characteristics of the attacked network address; determine that the traffic blocking method is to block the traffic corresponding to the remote login protocol between the attacking network address and the attacked network address within a first preset time, and use the network application firewall to block the attack traffic between the attacking network address and the attacked network address.

16. The device according to claim 12, characterized in that The network address characteristics of the attack network address include the physical location information, operator information and Internet data center information of the attack network address, and the public type network address includes the network address of the communication operator and is a public data exit; Wherein, the public attack network determination unit includes: a data public exit determination unit, configured to perform a network address type analysis on the attack network address according to the Internet data center information, and determine that the attack network address does not belong to the network address of the Internet data center computer room; determine that the attack network address belongs to the network address of the communication operator according to the operator information; determine that the attack network address is a data public exit according to the physical location information, and determine that the attack network address is the network address of the communication operator and is a data public exit; The blocking mode determination unit includes: A long-term remote login protocol traffic blocking unit is used to determine that the traffic of the attacking network address adopts the remote login protocol according to the traffic characteristics, or adopts the remote login protocol and the network service protocol; determine to open the remote login port on the attacked network address according to the service characteristics of the attacked network address; determine that the traffic blocking method is to block the traffic corresponding to the remote login protocol between the attacking network address and the attacked network address within a predetermined time.

17. The device according to claim 16, characterized in that The blocking mode determination unit includes: The public network application firewall attack traffic blocking unit is used to determine that the traffic between the attacking network address and the attacked network address adopts the network service protocol according to the traffic characteristics, or adopts the remote login protocol and the network service protocol; determine to open the network service port on the attacked network address according to the service characteristics of the attacked network address; determine that the traffic blocking method is to use the network application firewall to block the attack traffic between the attacking network address and the attacked network address.

18. The device according to claim 16, characterized in that The blocking mode determination unit includes: The long-term remote login protocol public network application firewall traffic blocking unit is used to determine that the traffic between the attacking network address and the attacked network address adopts the remote login protocol and the network service protocol according to the traffic characteristics; determine to open the remote login port and the network service port on the attacked network address according to the service characteristics of the attacked network address; determine that the traffic blocking method is to block the traffic corresponding to the remote login protocol between the attacking network address and the attacked network address within a second preset time, and use the network application firewall to block the attack traffic between the attacking network address and the attacked network address.

19. The device according to claim 12, characterized in that Also includes: An attack network service feature acquisition unit, used to acquire the service feature of the attack network address; a non-public attack network determination unit, configured to perform network address type analysis on the network address characteristics of the attack network address, and determine that the attack network address is a non-public type network address; The full traffic blocking unit is used to block the traffic between the attacking network address and the attacked network address according to the service characteristics of the attacking network address and the traffic characteristics between the attacking network address and the attacked network address.

20. The device according to claim 19, characterized in that The full flow blocking unit comprises: The attack network has unopened common ports blocking unit, which is used to determine that a predetermined service port is not open on the attack network address according to the service characteristics of the attack network address; determine that the ratio of the attack traffic to the total traffic between the attack network address and the attacked network address within a specified time is greater than a ratio threshold according to the traffic characteristics; block the traffic between the attack network address and the attacked network address within a specified time period; if there is attack traffic in the traffic between the attack network address and the attacked network address within the specified time period, continue to block the traffic between the attack network address and the attacked network address within a predetermined time period.

21. The device according to claim 19, characterized in that The full flow blocking unit comprises: The attack network open common port blocking unit is used to determine the opening of a predetermined service port on the attack network address according to the service characteristics of the attack network address; determine according to the traffic characteristics that the proportion of traffic inflow and outflow between the attack network address and the attacked network address within a specified time is greater than the inflow and outflow threshold; use a network application firewall to intercept the traffic of the attack network address; monitor the traffic from the attack network address to the attacked network address, if the ratio of the attack traffic from the attack network address to the attacked network address to the total traffic gradually increases, block the traffic from the attack network address to the attacked network address within a specified time period; if there is still attack traffic in the traffic from the attack network address to the attacked network address within the specified time period, continue to block the traffic from the attack network address to the attacked network address within a set time period.

22. The device according to any one of claims 12 to 21, characterized in that The service flow characteristic acquisition unit includes: An attacked network service port acquisition unit, used to acquire the open port on the attacked network address and the service name using the open port on the attacked network address, so as to determine the service port opened on the attacked network address; A flow acquisition unit within a specified time, used to acquire the flow between the attacking network address and the attacked network address within a specified time; A traffic parsing unit within a specified time is used to parse the traffic between the attacking network address and the attacked network address within the specified time, and obtain the protocol used for the traffic between the attacking network address and the attacked network address within the specified time, the proportion of traffic in and out, and the ratio of the attack traffic to the total traffic between the attacking network address and the attacked network address within the specified time; Among them, the traffic characteristics between the attacking network address and the attacked network address also include the proportion of traffic in and out between the attacking network address and the attacked network address within the specified time, and the ratio of attack traffic to total traffic between the attacking network address and the attacked network address within the specified time.

23. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the program is executed by a processor, the method according to any one of claims 1 to 11 is implemented.

24. An electronic device, characterized in that: include: at least one processor; A storage device configured to store at least one program, when the at least one program is executed by the at least one processor, enables the at least one processor to implement the method according to any one of claims 1 to 11.

25. A computer program product, characterized in that The computer program product comprises computer instructions, and a processor executes the computer instructions to perform the method according to any one of claims 1 to 11.

Images