Attack detection method and device, electronic equipment and computer readable storage medium

Abstract

This application provides an attack detection method, apparatus, electronic device, and computer-readable storage medium, relating to the field of computer technology. The attack detection method includes: when the number of request packets received from the same client within a preset time period meets a preset condition, sending a retransmission instruction to the client, the retransmission instruction instructing the client to send a retransmission packet identical to the client's most recently sent request packet; after sending the retransmission instruction, when receiving the first request packet from a client with the same IP address as the client, comparing the first request packet with the most recently sent request packet to detect whether the client is engaging in attack behavior. A client launching a reflection amplification attack will forge the BACnet request source IP; it will not receive the retransmission instruction and therefore will not send a retransmission packet. Therefore, by comparing the first request packet with the most recently sent request packet, the presence of attack behavior by the client can be detected.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to an attack detection method, apparatus, electronic device, and computer-readable storage medium. Background Technology

[0002] The BACnet protocol is the only ISO (International Organization for Standardization) standard in the field of building automation, and its application is widespread. However, the BACnet (A Data Communication Protocol for Building Automation and Control Networks) protocol can be subjected to DDoS (Distributed Denial of Service) reflection amplification attacks on UDP port 47808. The specific process of a reflection amplification attack is as follows: a malicious attacker forges the source IP address (Internet Protocol) of BACnet requests and continuously sends BACnet protocol requests to the server. The server then sends response packets to the real source IP server. However, the data volume of the response packets is several times that of the malicious attacker's requests, causing congestion on the real source IP server and preventing it from providing normal service. Currently, it is difficult to detect and prevent BACnet protocol reflection amplification attacks. Summary of the Invention

[0003] This application provides an attack detection method, apparatus, electronic device, and computer-readable storage medium to solve the problem that existing technologies are unable to detect and prevent BACnet protocol reflection amplification attacks.

[0004] Firstly, this application provides an attack detection method, comprising: when the number of request packets received from the same client within a preset time period meets a preset condition, sending a retransmission instruction to the client, the retransmission instruction being used to instruct the client to send a retransmission packet identical to the request packet most recently sent by the client; after sending the retransmission instruction, when receiving the first request packet sent by a client with the same IP address as the client, comparing the first request packet with the most recently sent request packet to detect whether the client has engaged in attack behavior.

[0005] In this embodiment, since the client launching the reflection amplification attack forges the BACnet request source IP, if the client does not forge the BACnet request source IP, it will receive a retransmission instruction and send a retransmission message. If the client forges the BACnet request source IP, it will not receive a retransmission instruction and will not send a retransmission message identical to the most recently sent request message. Therefore, by comparing the retransmission message with the most recently sent request message, it is possible to detect whether the client is engaging in attack behavior.

[0006] In conjunction with the technical solution provided in the first aspect above, in some possible implementations, the preset condition is that the number of request messages sent by the same client within the preset time period is greater than a preset threshold.

[0007] In this embodiment of the application, by setting a preset threshold, it is possible to accurately identify clients that may be engaging in attack behavior among the clients that send request messages.

[0008] In conjunction with the technical solution provided in the first aspect above, in some possible implementations, the preset condition is that the client sends the most request messages within the preset time period.

[0009] In this embodiment of the application, by using the client that sends the most request messages within a preset time period as a preset condition, the client most likely to engage in attack behavior can be quickly identified.

[0010] In conjunction with the technical solution provided in the first aspect above, in some possible implementations, comparing the first request message with the most recently sent request message to detect whether the client is engaging in attack behavior includes: determining whether the most recently sent request message and the first request message are consistent; if the most recently sent request message and the first request message are inconsistent, confirming that the client is engaging in attack behavior.

[0011] In this embodiment of the application, since the client that receives the retransmission instruction will send its most recently sent request message, if the first request message sent by the client with the same IP address as the client is inconsistent with the most recently sent request message, it proves that the client that sent the most recently sent request message did not receive the retransmission instruction, or that the client that sent the most recently sent request message is not the client that sent the first request message.

[0012] In conjunction with the technical solution provided in the first aspect above, in some possible implementations, determining whether the most recently sent request message and the first request message are consistent includes: determining whether the contents corresponding to the Invoke ID, choice, object type, and instance num fields in the most recently sent request message are the same as the contents corresponding to the Invoke ID, choice, object type, and instance num fields in the first request message; if the contents corresponding to all fields are the same, it is confirmed that the most recently sent request message and the first request message are consistent.

[0013] In this embodiment of the application, since the request messages corresponding to the BACnet protocol all include fields such as Invoke ID, choice, object type, and instance num, and the Invoke ID, choice, object type, and instance num fields corresponding to different request messages will not be completely the same, it is possible to quickly determine whether the most recently sent request message and the first request message are consistent by judging whether the contents corresponding to the Invoke ID, choice, object type, and instance num fields in the most recently sent request message are the same as the contents corresponding to the Invoke ID, choice, object type, and instance num fields in the first request message.

[0014] In conjunction with the technical solution provided in the first aspect above, in some possible implementations, before sending the retransmission instruction representing the retransmission request message to the client, the method further includes: recording each received request message, as well as the sending time and sending object corresponding to each request message; and determining, based on the sending time and sending object corresponding to each request message, whether there exists a client that sends a number of request messages within a preset time period that meets the preset condition.

[0015] In this embodiment, by recording each received request message, it is possible to quickly determine whether the same client sends a number of request messages that meet a preset condition within a preset time period. Furthermore, since each received request message is recorded, when detecting whether a client is engaging in attack behavior based on the first request message and the most recently sent request message, the most recently sent request message can be directly retrieved locally, improving detection efficiency.

[0016] Secondly, this application provides an attack detection device, including a sending module and a processing module. The sending module is used to send a retransmission instruction to the client when the number of request packets received from the same client within a preset time period meets a preset condition. The retransmission instruction is used to instruct the client to send a retransmission packet that is the same as the request packet most recently sent by the client. The processing module is used to compare the first request packet with the most recently sent request packet when it receives the first request packet from the client with the same IP address as the client after sending the retransmission instruction, so as to detect whether the client has engaged in attack behavior.

[0017] In conjunction with the technical solution provided in the second aspect above, in some possible implementations, the processing module is specifically used to determine whether the most recently sent request message and the first request message are consistent; if the most recently sent request message and the first request message are inconsistent, it is confirmed that the client has engaged in attack behavior.

[0018] Thirdly, embodiments of this application also provide an electronic device, including: a memory and a processor, the memory and the processor being connected; the memory being used to store a program; the processor being used to invoke the program stored in the memory to perform a method provided as described in the first aspect embodiments and / or in combination with any possible implementation of the first aspect embodiments.

[0019] Fourthly, embodiments of this application also provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when run by a computer, performs the method provided by any possible implementation of the first aspect embodiments and / or in combination with the first aspect embodiments. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating the first attack detection method according to an embodiment of this application;

[0022] Figure 2 This is a flowchart illustrating the second attack detection method according to an embodiment of this application;

[0023] Figure 3 This is a structural block diagram of an attack detection device shown in an embodiment of this application;

[0024] Figure 4 This is a structural block diagram of an electronic device shown in an embodiment of this application. Detailed Implementation

[0025] The terms “first,” “second,” “third,” etc., are used only for distinguishing descriptions and do not indicate a sequence number, nor should they be interpreted as indicating or implying relative importance.

[0026] The technical solution of this application will now be described in detail with reference to the accompanying drawings.

[0027] Please see Figure 1 , Figure 1 This is a flowchart illustrating an attack detection method according to an embodiment of this application. This attack detection method is applied to a server's firewall or gateway, wherein all request packets sent from the client to the server need to be forwarded through the firewall or gateway. The following will combine... Figure 1 The steps involved are explained.

[0028] S100: When the number of request messages received from the same client within a preset time period meets the preset condition, a retransmission instruction is sent to the client.

[0029] The retransmission instruction is used to instruct the client to send a retransmission message that is the same as the request message most recently sent by the client.

[0030] For example, client A sends request message A, request message B, and request message C in sequence, with request message C being sent last. After a retransmission instruction is sent to client A, if client A receives the retransmission instruction, client A will retransmit request message C.

[0031] The preset duration can be set according to actual needs, such as 1 second, 2 seconds, 3 seconds, or 1 minute, 2 minutes, etc. The examples here are only for the purpose of understanding and should not be regarded as a limitation of this application.

[0032] In the first implementation, the preset condition can be that the number of request messages sent by the same client within a preset time period is greater than a preset threshold.

[0033] The preset threshold can be set according to the actual situation. It should be noted that the longer the preset duration, the larger the preset threshold will be. The specific value of the preset threshold is not limited here.

[0034] For ease of understanding, let's take a preset threshold of 3 and a preset duration of 5 seconds as an example. If client A sends request message 1 in the 1st second, request message 2 in the 4th second, request message 3 in the 7th second, and request message 4 in the 8th second, then client A has sent request messages 2, 3, and 4 between the 4th and 8th seconds—that is, three request messages within 5 seconds. Therefore, client A meets the preset condition. Request message 4 is the most recently sent request message by client A.

[0035] If client A has not forged the source IP of the BACnet request, then client A will receive a retransmission instruction, and accordingly, client A will send a retransmission message identical to request message 4. This example is for illustrative purposes only and should not be construed as a limitation of this application.

[0036] In the second implementation, the preset condition can be that the client sends the most request messages within a preset time period.

[0037] Taking a preset duration of 10 seconds as an example, if client A sends 5 request messages, client B sends 3 request messages, and client C sends 2 request messages within 10 seconds, then client A is confirmed to meet the preset conditions. The latest request message sent by client A is the most recent request message sent by client A.

[0038] If client A has not forged the source IP of the BACnet request, then client A will receive a retransmission instruction and, accordingly, send a retransmission message. This example is for illustrative purposes only and should not be construed as a limitation of this application.

[0039] Optionally, the preset condition can also be the preset number of clients that initiate the most request messages within a preset time period.

[0040] The preset quantity can be set according to the actual situation. The more clients that send request messages, the larger the preset quantity can be.

[0041] For example, the preset duration is 10 seconds, and the preset number is 3. If within 10 seconds, client A sends 5 request messages, client B sends 3 request messages, client C sends 2 request messages, client D sends 4 request messages, client E sends 6 request messages, client F sends 2 request messages, and client G sends 5 request messages, then the three clients that send the most request messages are client A, client E, and client G. It is confirmed that clients A, E, and G meet the preset conditions. The latest request message sent by client A is the most recent request message sent by client A; the latest request message sent by client E is the most recent request message sent by client E; and the latest request message sent by client G is the most recent request message sent by client G.

[0042] If clients A, E, and G have not forged the BACnet request source IP, then clients A, E, and G will all receive the corresponding retransmission instructions. Accordingly, client A sends a first retransmission message, which is identical to the request message most recently sent by client A; client E sends a first retransmission message, which is identical to the request message most recently sent by client E; and client G sends a first retransmission message, which is identical to the request message most recently sent by client G. This example is for illustrative purposes only and should not be construed as limiting the scope of this application.

[0043] If multiple clients send X request messages within a preset time period, and the number of clients sending more than X request messages within the preset time period is less than the preset number, but the number of clients sending more than or equal to X request messages within the preset time period is greater than the preset number, then multiple clients can be randomly selected from the clients that send X request messages within the preset time period, such that the number of selected clients equals the preset number.

[0044] For ease of understanding, let's take a preset duration of 10 seconds and a preset quantity of 2 as an example. If within 10 seconds, client A sends 5 request messages, client B sends 3 request messages, client C sends 2 request messages, client D sends 4 request messages, client E sends 6 request messages, client F sends 2 request messages, and client G sends 5 request messages.

[0045] Since client E sent 6 request messages, and clients A and G each sent 5 request messages, a client can be randomly selected from clients A and G to satisfy a preset condition, such that the number of clients satisfying the preset condition equals the preset number. For example, client A can be selected, and the clients satisfying the preset condition are clients A and E; or client G can be selected, and the clients satisfying the preset condition are clients G and E.

[0046] Optionally, if multiple clients send X request messages within a preset time period, and the number of clients sending more than X request messages within the preset time period is less than a preset number, but the number of clients sending X or more request messages within the preset time period is greater than the preset number, then all clients sending X request messages within the preset time period are considered to meet the preset condition. In this case, the number of clients meeting the preset condition can be greater than the preset number.

[0047] For ease of understanding, let's take a preset duration of 10 seconds and a preset quantity of 2 as an example. If within 10 seconds, client A sends 5 request messages, client B sends 3 request messages, client C sends 2 request messages, client D sends 4 request messages, client E sends 6 request messages, client F sends 2 request messages, and client G sends 5 request messages.

[0048] Since client E sent 6 request messages, and clients A and G each sent 5 request messages, it is assumed that clients A and G both meet the preset conditions. Therefore, the clients that meet the preset conditions are clients A, G, and E. This example is for illustrative purposes only and should not be construed as a limitation of this application.

[0049] S200: After sending a retransmission command, when the first request message sent by a client with the same IP address as the client is received, the first request message is compared with the most recently sent request message to detect whether the client has engaged in any attack behavior.

[0050] Hereinafter, the first request message sent by the client with the same IP address as the client will be referred to as the first request message.

[0051] Because the client launching the reflection amplification attack forges the BACnet request source IP, if the client does not forge the BACnet request source IP, it will receive a retransmission instruction and send a retransmission message. If the client sending the most recently sent request message forged the BACnet request source IP, the retransmission instruction will be sent to the client corresponding to the forged BACnet request source IP (the attacked client). The client sending the most recently sent request message will not receive the retransmission instruction and will not send a retransmission message identical to the most recently sent request message. Therefore, by comparing the first request message and the most recently sent request message, it is possible to detect whether the client is engaging in attack behavior.

[0052] In one implementation, comparing the first request message with the most recently sent request message to detect whether the client is engaging in an attack can be achieved by first determining whether the most recently sent request message and the first request message are consistent; if the most recently sent request message and the first request message are inconsistent, it is confirmed that the client is engaging in an attack.

[0053] Since the client receiving the retransmission command will send its most recently sent request message, after sending the retransmission command, when the first request message sent by the target client (a client with the same IP address as the client that sent the most recently sent request message) is received, if this first request message is inconsistent with the most recently sent request message, it proves that the client sending the first request message is not the same client as the client sending the most recently sent request message. In other words, the client that sent the most recently sent request message is engaging in attack behavior.

[0054] There are two ways to determine whether the most recently sent request message is the same as the first request message.

[0055] In the first implementation, the contents of the most recently sent request message and the first request message can be compared. If the contents of both are the same, the most recently sent request message and the first request message are considered to be consistent.

[0056] In the second implementation, the method to determine whether the most recently sent request message and the first request message are consistent can be to check whether the contents corresponding to the Invoke ID, choice, object type, and instancenum fields in the most recently sent request message are the same as the contents corresponding to the Invoke ID, choice, object type, and instancenum fields in the first request message. If the contents corresponding to all fields are the same, it is confirmed that the most recently sent request message and the first request message are consistent.

[0057] Since the request messages corresponding to the BACnet protocol all include fields such as Invoke ID, choice, object type, and instance num, and the Invoke ID, choice, object type, and instance num fields corresponding to different request messages will not be exactly the same, it is possible to quickly determine whether the most recently sent request message and the first request message are consistent by comparing the contents of the Invoke ID, choice, object type, and instance num fields in the most recently sent request message with the contents of the Invoke ID, choice, object type, and instance num fields in the first request message.

[0058] Specifically, the process compares the content corresponding to the Invoke ID field in the most recently sent request message with the content corresponding to the Invoke ID field in the first request message; it also compares the content corresponding to the choice field in the most recently sent request message with the content corresponding to the choice field in the first request message; the process further compares the content corresponding to the object type field in the most recently sent request message with the content corresponding to the object type field in the first request message; and the process further compares the content corresponding to the instance num field in the most recently sent request message with the content corresponding to the instance num field in the first request message. If all are the same, the most recently sent request message and the first request message are considered to be consistent. If any of the fields differ, the most recently sent request message and the first request message are considered to be inconsistent.

[0059] The most recently sent request message in S200 can be obtained from other devices, or it can be a locally pre-recorded request message that can be directly called when needed.

[0060] In one implementation, before S100, that is, before sending the retransmission instruction representing the retransmission request message to the client, each received request message, as well as the sending time and sending object corresponding to each request message, can be recorded. Therefore, when it is necessary to use the request message most recently sent by a client, it can be directly obtained from the recorded request messages.

[0061] Furthermore, since each received request message is recorded, along with the sending time and recipient of each request message, it is possible to determine whether the same client sends a number of request messages that meet the preset conditions within a preset time period, based on the sending time and recipient of each request message.

[0062] Optionally, since the consistency between the first and most recently sent request messages can be determined by comparing the contents of the Invoke ID, choice, object type, and instance num fields in the most recently sent request message with those in the first request message, only the contents of the Invoke ID, choice, object type, and instance num fields need to be recorded when recording request messages.

[0063] If, based on the first request message and the most recently sent request message, it is confirmed that the client has engaged in attack behavior, the forged BACnet request source IP corresponding to that client can be added to the blacklist, and request messages sent by the client corresponding to the forged BACnet request source IP will no longer be forwarded to the server.

[0064] To better understand the attack detection methods described above, please refer to [link / reference]. Figure 2 It is important to note that... Figure 2 The attack detection method shown is only one of many embodiments of the attack detection method provided in this application and should not be regarded as a limitation of this application.

[0065] like Figure 2 As shown, the system first receives request messages and records each received request message, along with the sending time and recipient for each message. Then, based on the sending time and recipient for each request message, it determines whether the same client sends a number of request messages within a preset time period that meets a preset condition.

[0066] If no client sends a number of request messages that meet the preset conditions within the preset time period, then continue to receive request messages.

[0067] If the same client sends a number of request packets within a preset time period that meet a preset condition, a retransmission command is sent to that client. It is determined whether the most recently sent request packet and the first request packet are identical. The first request packet is the first request packet sent by a client with the same IP address as the first client received after the retransmission command is sent.

[0068] If the most recently sent request message is the same as the first request message, the request message sent by the client will be forwarded normally.

[0069] If the most recently sent request message is inconsistent with the first request message, it confirms that the client has engaged in malicious activity. The forged BACnet request source IP corresponding to that client is blacklisted, and request messages sent by the client corresponding to that forged BACnet request source IP will no longer be forwarded to the server.

[0070] in, Figure 2 The specific implementation methods of each step shown have been clearly described above, and will not be repeated here for the sake of brevity.

[0071] Based on the same inventive concept, this application provides an attack detection device, such as... Figure 3 As shown, the attack detection device 100 includes a sending module 110 and a processing module 120.

[0072] The sending module 110 is used to send a retransmission instruction to the client when the number of request messages received from the same client within a preset time period meets a preset condition. The retransmission instruction is used to instruct the client to send a retransmission message that is the same as the request message most recently sent by the client.

[0073] The processing module 120 is used to compare the first request message with the most recently sent request message when it receives the first request message sent by a client with the same IP address as the client after sending the retransmission instruction, so as to detect whether the client has engaged in attack behavior.

[0074] The processing module 120 is specifically used to determine whether the most recently sent request message and the first request message are consistent; if the most recently sent request message and the first request message are inconsistent, it is confirmed that the client has engaged in attack behavior.

[0075] The processing module 120 is specifically used to determine whether the contents corresponding to the InvokeID, choice, object type, and instance num fields in the most recently sent request message are the same as the contents corresponding to the InvokeID, choice, object type, and instance num fields in the first request message; if the contents corresponding to all fields are the same, it is confirmed that the most recently sent request message and the first request message are consistent.

[0076] The processing module 120 is further configured to, before sending the retransmission instruction representing the retransmission request message to the client, record each received request message, as well as the sending time and sending object corresponding to each request message; and, based on the sending time and sending object corresponding to each request message, determine whether there is a client that sends a number of request messages within a preset time period that meet the preset condition.

[0077] The attack detection device 100 provided in this application embodiment has the same implementation principle and technical effect as the aforementioned attack detection method embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned attack detection method embodiment.

[0078] Please see Figure 4 This is an electronic device 200 provided in the embodiments of this application. The electronic device 200 includes: a transceiver 210, a memory 220, a communication bus 230, and a processor 240.

[0079] The transceiver 210, the memory 220, and the processor 240 are electrically connected directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses 230 or signal lines. The transceiver 210 is used to send and receive data. The memory 220 is used to store computer programs, such as... Figure 3 The software functional module shown is the attack detection device 100. The attack detection device 100 includes at least one software functional module that can be stored as software or firmware in the memory 220 or embedded in the operating system (OS) of the electronic device 200. The processor 240 is used to execute executable modules stored in the memory 220, such as the software functional modules or computer programs included in the attack detection device 100. In this case, the processor 240 is used to send a retransmission instruction to the client when the number of request messages received from the same client within a preset time period meets a preset condition. The retransmission instruction instructs the client to send a retransmission message identical to the client's most recently sent request message. After sending the retransmission instruction, when the processor receives the first request message from a client with the same IP address as the client, it compares the first request message with the most recently sent request message to detect whether the client is engaging in attack behavior.

[0080] The memory 220 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0081] Processor 240 may be an integrated circuit chip with signal processing capabilities. The aforementioned processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor, or processor 240 can be any conventional processor.

[0082] Among them, the aforementioned electronic devices 200 include, but are not limited to, personal computers, servers, etc.

[0083] This application also provides a non-volatile computer-readable storage medium (hereinafter referred to as the storage medium) storing a computer program. When the computer program is executed by a computer, such as the electronic device 200 described above, it performs the attack detection method described above. The computer-readable storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0084] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. An attack detection method, characterized in that, The method for detecting BACnet protocol reflection amplification attacks includes: When the number of request messages received from the same client within a preset time period meets a preset condition, a retransmission instruction is sent to the client. The retransmission instruction is used to instruct the client to send a retransmission message that is the same as the request message most recently sent by the client. The preset condition is that the number of request messages sent by the same client within the preset time period is greater than a preset threshold. After sending the retransmission command, when the first request message sent by a client with the same IP address as the client is received, it is determined whether the most recently sent request message and the first request message are consistent; if the most recently sent request message and the first request message are inconsistent, it is confirmed that the client has engaged in attack behavior. The step of determining whether the most recently sent request message and the first request message are consistent includes: Determine whether the contents of the Invoke ID, choice, object type, and instance num fields in the most recently sent request message are the same as the contents of the Invoke ID, choice, object type, and instance num fields in the first request message; If the content of all fields is the same, it is confirmed that the most recently sent request message is consistent with the first request message.

2. The attack detection method according to claim 1, characterized in that, The preset condition is that the client sends the most request messages within the preset time period.

3. The method according to claim 1, characterized in that, Before sending the retransmission instruction representing the retransmission request message to the client, the method further includes: Record each received request message, as well as the sending time and the sending object of each request message; Based on the sending time and sending object corresponding to each request message, determine whether there is a client that sends a number of request messages within a preset time period that meet the preset conditions.

4. An attack detection device, characterized in that, For detecting BACnet protocol reflection amplification attacks, the attack detection device includes: The sending module is used to send a retransmission instruction to the client when the number of request messages received from the same client within a preset time period meets a preset condition. The retransmission instruction is used to instruct the client to send a retransmission message that is the same as the request message most recently sent by the client. The preset condition is that the number of request messages sent by the same client within the preset time period is greater than a preset threshold. The processing module is used to compare the first request message with the most recently sent request message when it receives the first request message sent by a client with the same IP address as the client after sending the retransmission instruction, so as to detect whether the client has any attack behavior. The processing module is specifically used to determine whether the most recently sent request message and the first request message are consistent; if the most recently sent request message and the first request message are inconsistent, it is confirmed that the client has engaged in attack behavior. The processing module is specifically used to determine whether the contents corresponding to the Invoke ID, choice, object type, and instance num fields in the most recently sent request message are the same as the contents corresponding to the Invoke ID, choice, object type, and instance num fields in the first request message; if the contents corresponding to all fields are the same, it is confirmed that the most recently sent request message and the first request message are consistent.

5. An electronic device, characterized in that, include: A memory and a processor, wherein the memory and the processor are connected; The memory is used to store programs; The processor is configured to invoke a program stored in the memory to execute the method as described in any one of claims 1-3.

6. A computer-readable storage medium, characterized in that, It stores a computer program, which, when executed by a computer, performs the method as described in any one of claims 1-3.

Images