Message processing method, attack defense device and computer readable storage medium

Abstract

The disclosure provides a message processing method, an attack defense device and a computer readable storage medium, and relates to the technical field of network security. The method comprises the following steps: in the case that the source Internet Protocol (IP) address of a received message exists in an exception list, performing a first query to query whether the five-tuple information of the message exists in a session table; in the case that the five-tuple information of the message exists in the session table, forwarding the message.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, and in particular to a message processing method, attack defense device, and computer-readable storage medium. Background Technology

[0002] With the continuous development of network technology, network attacks (such as DDoS attacks) are gradually increasing.

[0003] Currently, attackers' Internet Protocol (IP) addresses are typically added to anomaly lists to prevent network attacks originating from those IP addresses. Summary of the Invention

[0004] The inventors noted that in related technologies, attackers often use fake (e.g., impersonating others) IP addresses to carry out attacks.

[0005] When an attacker impersonates a legitimate user's IP address to launch an attack, the legitimate user's IP address will be mistakenly added to the anomaly list. This will prevent the legitimate user's packets from being forwarded, thus affecting the legitimate user's business operations.

[0006] To address the aforementioned problems, the present disclosure proposes the following solutions.

[0007] According to one aspect of the present disclosure, a packet processing method is provided, executed by an attack defense device, the method comprising: if the source IP address of a received packet exists in an anomaly list, performing a first query to query whether the packet's five-tuple information exists in a session table; and if the packet's five-tuple information exists in the session table, forwarding the packet.

[0008] In some embodiments, the method further includes: if the 5-tuple information of the packet does not exist in the session table, performing a first detection to detect whether the source IP address is an attacking IP address; if the result of the first detection is that the source IP address is not an attacking IP address, forwarding the packet and storing the 5-tuple information of the packet in the session table.

[0009] In some embodiments, the method further includes: if the source IP address exists in the anomaly list, performing a second query to query whether the source IP address exists in a preset secure IP list; wherein, if the source IP address exists in the preset secure IP list, performing the first query; and if the source IP address does not exist in the preset secure IP list, discarding the packet.

[0010] In some embodiments, the preset secure IP list includes the source IP addresses of packets received when no attack event has occurred.

[0011] In some embodiments, the preset secure IP list is generated through the following steps: upon receiving a first packet and without an attack event, a third query is performed to check whether the source IP address of the first packet exists in the preset secure IP list; if the result of the third query is that the source IP address of the first packet does not exist in the preset secure IP list, the source IP address of the first packet is added to the preset secure IP list and the aging time of the source IP address of the first packet is set; or if the result of the third query is that the source IP address of the first packet exists in the preset secure IP list, the aging time of the source IP address of the first packet in the preset secure IP list is updated.

[0012] In some embodiments, if the number of multiple packets with the source IP address that are forwarded exceeds a preset number, the aging time of the source IP address in the abnormal list is reduced.

[0013] In some embodiments, the method further includes: performing a fourth query to check whether the source IP address exists in a whitelist; if the source IP address exists in the whitelist, performing a second detection to detect whether the data traffic corresponding to the packet exceeds a preset threshold; if the result of the second detection is that the data traffic corresponding to the packet exceeds the preset threshold, performing a third detection to detect whether the source IP address is an attack IP address; if the result of the third detection is that the source IP address is an attack IP address, adding the source IP address to the abnormal list and discarding the packet; or if the result of the third detection is that the source IP address is not an attack IP address, forwarding the packet.

[0014] In some embodiments, the method further includes: performing a fourth query to check whether the source IP address exists in a whitelist; if the source IP address does not exist in the whitelist, performing a fifth query to check whether the source IP address exists in the anomaly list; if the result of the fifth query is that the source IP address does not exist in the anomaly list, performing a fourth detection to detect whether the source IP address is an attack IP address; if the result of the fourth detection is that the source IP address is an attack IP address, adding the source IP address to the anomaly list and discarding the packet; or if the result of the fourth detection is that the source IP address is not an attack IP address, adding the source IP address to the whitelist and forwarding the packet.

[0015] In some embodiments, if the result of the first detection indicates that the source IP address is an attacking IP address, the packet is discarded.

[0016] According to another aspect of the present disclosure, an attack defense device is provided, comprising: a query module configured to perform a first query to query whether the five-tuple information of the packet exists in a session table when the source Internet Protocol IP address of the received packet exists in an anomaly list; and a forwarding module configured to forward the packet when the five-tuple information of the packet exists in the session table.

[0017] According to another aspect of the present disclosure, an attack defense device is provided, comprising: a memory; and a processor coupled to the memory, the processor being configured to execute the method described in any of the above embodiments based on instructions stored in the memory.

[0018] According to another aspect of the present disclosure, a computer-readable storage medium is provided, including computer program instructions, wherein the computer program instructions, when executed by a processor, implement the method described in any of the above embodiments.

[0019] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, wherein the computer program, when executed by a processor, implements the method described in any of the above embodiments.

[0020] In this embodiment of the disclosure, if the source IP address of the received packet exists in the anomaly list, the session table is queried. If the five-tuple information of the packet exists in the session table, the packet is forwarded normally. Thus, even if the IP address of a normal user is mistakenly added to the anomaly list, the service implementation of normal users can still be guaranteed.

[0021] The technical solutions of this disclosure will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a schematic flowchart illustrating a message processing method according to some embodiments of this disclosure;

[0024] Figure 2This is a schematic flowchart illustrating a message processing method according to other embodiments of this disclosure;

[0025] Figure 3 This is a schematic diagram of the structure of an attack defense device according to some embodiments of the present disclosure;

[0026] Figure 4 This is a schematic diagram of the attack defense device according to other embodiments of this disclosure;

[0027] Figure 5 This is a schematic diagram illustrating an application scenario of an attack defense device according to some embodiments of the present disclosure. Detailed Implementation

[0028] The technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0029] Unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps set forth in these embodiments do not limit the scope of this disclosure.

[0030] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.

[0031] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and equipment should be considered part of the specification.

[0032] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values.

[0033] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0034] Furthermore, in the description of this disclosure, the terms "first," "second," "third," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or order. Similarly, although operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring such operations to be performed in the specific order shown or in sequential order, or requiring the execution of all illustrated operations to achieve the desired result. In some cases, multitasking and parallel processing can be advantageous.

[0035] Figure 1 This is a flowchart illustrating a message processing method according to some embodiments of the present disclosure.

[0036] In step 102, if the source IP address of the received packet exists in the anomaly list, a first query is performed to check if the packet's 5-tuple information exists in the session table.

[0037] In some embodiments, each IP address in the anomaly list may have an aging time, after which the IP address can be removed from the anomaly list.

[0038] As one implementation method, each IP address in the anomaly list can have the same aging time or different aging times. For example, the aging time for all IP addresses in the anomaly list can be 30 minutes; or, for another example, some IP addresses can have an aging time of 30 minutes, while the remaining IP addresses can have an aging time of 40 minutes.

[0039] In step 104, if the five-tuple information of the message exists in the session table, the message is forwarded.

[0040] If the packet's 5-tuple information exists in the session table, it indicates that a session with the packet's source IP address was previously established, meaning that packets from that source IP address were forwarded normally. In this case, although the source IP address is on the exception list, it is a legitimate IP address.

[0041] In this way, if the source IP address of the received packet exists in the anomaly list, the session table is queried. If the five-tuple information of the packet exists in the session table, the packet is forwarded normally. This ensures that normal users' business operations can still be guaranteed even if the IP address of a normal user is mistakenly added to the anomaly list.

[0042] In some embodiments, if the packet's 5-tuple information is not found in the session table, a first detection can be performed to detect whether the source IP address is an attacking IP address; if the result of the first detection is that the source IP address is not an attacking IP address, the packet can be forwarded and the packet's 5-tuple information can be stored in the session table.

[0043] Thus, if the source IP address of the received packet exists in the anomaly list, the session table can be queried to detect whether the source IP address is an attacking IP address if the five-tuple information of the packet is not found in the session table. Then, if the source IP address is not an attacking IP address, the packet from the source IP address in the anomaly list can be forwarded, thereby further reducing the possibility that normal users' services cannot be implemented.

[0044] At the same time, the five-tuple information of the message can be stored, so that if a message with the same five-tuple information is received again, the same message can be forwarded without performing the first detection again, thus improving the efficiency of message forwarding.

[0045] In some embodiments, if the result of the first detection is that the source IP address is an attacking IP address, the packet is dropped.

[0046] In this way, by discarding packets when the source IP address is identified as an attacking IP address in the first detection, it is possible to avoid forwarding packets corresponding to source IP addresses in the abnormal list that failed the first detection, thereby preventing network attacks.

[0047] In some embodiments, if the source IP address exists in the anomaly list, a second query is performed to check if the source IP address exists in a preset secure IP list. Here, if the source IP address exists in the preset secure IP list, the first query is then performed; if the source IP address does not exist in the preset secure IP list, the packet is discarded.

[0048] In some embodiments, the preset secure IP list includes the source IP addresses of packets received when no attack event has occurred.

[0049] In some embodiments, a preset list of secure IPs can be configured manually (e.g., manually entered), or it can be configured according to preset rules (e.g., according to at least one of the IPs’ access date, frequency, and duration).

[0050] Thus, by performing the first query only when the source IP address exists in both the anomaly list and the preset secure IP list, and discarding the packet when the source IP address does not exist in the preset secure IP list, the number of first queries can be reduced and packets can be discarded more quickly. This allows for a faster determination of whether to forward the packet, thereby improving packet processing efficiency and preventing network attacks.

[0051] In some embodiments, a preset list of secure IPs can be generated through the following steps:

[0052] If the first packet is received and no attack event occurs, a third query is executed to check whether the source IP address of the first packet exists in the preset secure IP list; if the result of the third query is that the source IP address of the first packet does not exist in the preset secure IP list, the source IP address of the first packet is added to the preset secure IP list and the aging time of the source IP address of the first packet is set; or, if the result of the third query is that the source IP address of the first packet exists in the preset secure IP list, the aging time of the source IP address of the first packet in the preset secure IP list is updated.

[0053] As some implementation methods, each IP address in the preset secure IP list may have the same aging time or different aging times. For example, the aging time for all IP addresses in the preset secure IP list may be 7 days; or, for another example, some IP addresses may have an aging time of 7 days, while the remaining IP addresses may have an aging time of 5 days.

[0054] In other implementations, updating the aging time of the source IP address in the first message in the preset secure IP list can be done by resetting the aging time of that IP address. For example, if the aging time of an IP address is 7 days, and the aging time of that IP address is updated on the 5th day when the IP address exists in the preset secure IP list (at this time, the aging time of the IP address still has 2 days remaining), then the aging time of the IP address will change back to 7 days.

[0055] As another implementation, updating the aging time of the source IP address in the preset secure IP list can be achieved by resetting the aging time of that IP address. For example, if the aging time of an IP address is 7 days, and the aging time of that IP address is updated on the 5th day when the IP address exists in the preset secure IP list (at this time, the aging time of the IP address has 2 days remaining), then the aging time of that IP address can be reset to another time, such as 5 days.

[0056] In this way, by adding the source IP address of packets in the absence of an attack to the preset secure IP list, the IP addresses of normal users in the absence of an attack can be associated with the settings of the preset secure IP list, thereby making the settings of the preset secure IP list more reasonable and improving the efficiency of packet processing.

[0057] In some embodiments, if the number of packets forwarded from multiple sources with an IP address in the anomaly list exceeds a preset number, the aging time of that source IP address in the anomaly list is reduced. The preset number can be set, for example, based on manual experience or actual needs.

[0058] For example, if a packet corresponding to an IP address in the anomaly list passes the first query multiple times, the corresponding packet is forwarded multiple times, which can reduce the aging time of that IP address in the anomaly list.

[0059] In this way, by reducing the aging time of the source IP address corresponding to the number of packets forwarded in the anomaly list exceeding the preset number, the IP address that is spoofed and added to the anomaly list can get rid of the anomaly list constraint as soon as possible, thereby reducing the packet processing time and improving the efficiency of packet processing.

[0060] In some embodiments, a fourth query can be performed to check if the source IP address exists in the whitelist; if the source IP address exists in the whitelist, a second detection is performed to check if the data traffic corresponding to the packet exceeds a preset threshold; if the result of the second detection is that the data traffic corresponding to the packet exceeds the preset threshold, a third detection is performed to check if the source IP address is an attacking IP address; if the result of the third detection is that the source IP address is an attacking IP address, the source IP address is added to the abnormal list and the packet is dropped; or, if the result of the third detection is that the source IP address is not an attacking IP address, the packet is forwarded. Here, the preset threshold can be set, for example, based on manual experience or actual needs.

[0061] Thus, by performing the fourth query, second detection, and third detection, packets from source IP addresses in the whitelist can be verified. Specifically, if the data traffic corresponding to a packet from a source IP address in the whitelist exceeds a preset threshold, it can be checked whether the source IP address is an attacking IP address. If the source IP address is an attacking IP address, the packet is dropped, thereby preventing attackers from spoofing source IP addresses in the whitelist to launch network attacks. Forwarding packets if the source IP address is not an attacking IP address avoids the erroneous dropping of packets with excessive data traffic corresponding to source IP addresses in the whitelist, improving the success rate of user service implementation.

[0062] In some embodiments, a fourth query may be performed to check if the source IP address exists in the whitelist; if the source IP address does not exist in the whitelist, a fifth query may be performed to check if the source IP address exists in the abnormal list; if the result of the fifth query is that the source IP address does not exist in the abnormal list, a fourth detection may be performed to detect whether the source IP address is an attack IP address; if the result of the fourth detection is that the source IP address is an attack IP address, the source IP address may be added to the abnormal list and the packet may be dropped; or, if the result of the fourth detection is that the source IP address is not an attack IP address, the source IP address may be added to the whitelist and the packet may be forwarded.

[0063] Thus, by performing the fourth query, fifth check, and fourth check, packets originating from source IP addresses that are neither in the whitelist nor the anomaly list can be examined, i.e., it can be determined whether the source IP address is an attacking IP address. If the source IP address is an attacking IP address, the packet is discarded and the source IP address is added to the anomaly list, thereby preventing network attacks originating from that source IP address. If the source IP address is not an attacking IP address, the packet is forwarded and the source IP address is added to the whitelist, which can reduce the subsequent processing time for packets corresponding to that source IP address, thereby improving packet processing efficiency.

[0064] In some embodiments, two or three of the first, third, and fourth detections can be performed using the same detection method, or the first, third, and fourth detections can be performed using different detection methods respectively.

[0065] As one implementation method, the detection method can be a DDoS defense algorithm.

[0066] As one implementation method, the access party can be verified as a legitimate user by sending and receiving verification messages.

[0067] For example, a verification message is sent to the source IP address. If the source IP address returns a correct message, the verification succeeds; if the source IP address does not return a message or returns an error message, the verification fails. Another example is human-computer interaction verification in the form of inputting an image verification code or a numeric verification code.

[0068] Next, combined Figure 2 Methods for processing messages according to other embodiments of this disclosure are described.

[0069] Figure 2 This is a flowchart illustrating a message processing method according to other embodiments of this disclosure.

[0070] In step 202, a message is received.

[0071] In step 204, a fourth query is performed to check whether the source IP address corresponding to the packet exists in the whitelist. Here, if the corresponding source IP address exists in the whitelist, a second check is performed (i.e., jump to step 206); if the corresponding source IP address does not exist in the whitelist, a fifth query is performed (i.e., jump to step 216).

[0072] Next, we will introduce step 206 and the corresponding follow-up process.

[0073] In step 206, a second detection is performed to check whether the data traffic of the packet exceeds a preset threshold. Here, if the data traffic of the packet does not exceed the preset threshold, the packet is forwarded (i.e., jump to step 214); if the data traffic of the packet exceeds the preset threshold, a third detection is performed (i.e., jump to step 208).

[0074] In step 208, a third detection is performed to check whether the source IP address is an attacking IP address. Here, if the source IP address is an attacking IP address, the source IP address is added to the anomaly list (i.e., jump to step 210) and the corresponding packet is dropped (i.e., jump to step 212); if the source IP address is not an attacking IP address, the corresponding packet is forwarded (i.e., jump to step 214).

[0075] Next, we will introduce step 216 and the corresponding follow-up process.

[0076] In step 216, a fifth query is performed to check if the source IP address exists in the anomaly list. Here, if the source IP address does not exist in the anomaly list, a fourth check is performed (i.e., jump to step 218); if the source IP address exists in the anomaly list, a second query is performed (i.e., jump to step 226).

[0077] In step 218, a fourth detection is performed to check whether the source IP address is an attacking IP address. Here, if the source IP address is an attacking IP address, the source IP address is added to the anomaly list (i.e., jump to step 210) and the corresponding packet is dropped (i.e., jump to step 212); if the source IP address is not an attacking IP address, the source IP address is added to the whitelist (i.e., jump to step 220) and the corresponding packet is forwarded (i.e., jump to step 214).

[0078] In step 226, a second query is performed to check if the source IP address exists in a preset security list. Here, if the source IP address does not exist in the preset security list, the packet is discarded (i.e., jump to step 228); if the source IP address exists in the preset security list, a first query is performed (i.e., jump to step 102).

[0079] In step 102, a first query is performed to check if the packet's 5-tuple information exists in the session table. Here, if the packet's 5-tuple information exists in the session table, the packet is forwarded (i.e., jump to step 104); if the packet's 5-tuple information does not exist in the session table, a first check is performed (i.e., jump to step 222).

[0080] In step 222, a first detection is performed to check whether the source IP address is an attacking IP address. Here, if the source IP address is an attacking IP address, the packet is discarded (i.e., jump to step 228); if the source IP address is not an attacking IP address, the packet's five-tuple information is stored (i.e., jump to step 224) and the packet is forwarded (i.e., jump to step 104).

[0081] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the device embodiments, since they largely correspond to the method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0082] Figure 3 This is a schematic diagram of the structure of an attack defense device according to some embodiments of the present disclosure.

[0083] like Figure 3 As shown, the attack defense device includes a query module 301 and a forwarding module 302.

[0084] The query module 301 is configured to perform a first query to check whether the packet's 5-tuple information exists in the session table if the source IP address of the received packet exists in the exception list.

[0085] Forwarding module 302 is configured to forward packets if the packet's five-tuple information exists in the session table.

[0086] In some embodiments, the attack defense device may also include other modules to perform the message processing method of any of the above embodiments.

[0087] Figure 4 This is a schematic diagram of the structure of an attack defense device according to some embodiments of the present disclosure.

[0088] like Figure 4 As shown, the attack defense device 400 includes a memory 401 and a processor 402 coupled to the memory 401. The processor 402 is configured to execute the method of any of the foregoing embodiments based on instructions stored in the memory 401.

[0089] The memory 401 may include, for example, system memory, fixed non-volatile storage media, etc. The system memory may store, for example, an operating system, application programs, a boot loader, and other programs.

[0090] The attack defense device 400 may also include input / output interfaces 403, network interfaces 404, and storage interfaces 405. These interfaces 403, 404, and 405, as well as the memory 401 and processor 402, can be connected via, for example, a bus 406. Input / output interface 403 provides a connection interface for input / output devices such as monitors, mice, keyboards, and touchscreens. Network interface 404 provides a connection interface for various networked devices. Storage interface 405 provides a connection interface for external storage devices such as SD cards and USB flash drives.

[0091] Next, combined Figure 5 This paper introduces application scenarios of DDoS defense devices according to some embodiments of the present disclosure.

[0092] Figure 5 This is a schematic diagram illustrating an application scenario of an attack defense device according to some embodiments of the present disclosure. Here, the attack defense device 508 is deployed between the Internet 506 and the switch 510.

[0093] exist Figure 5 In this scenario, attacker 504 impersonates user 502's IP address, intending to launch a DDoS attack against server 512 and / or server 514.

[0094] During the process of the message sent by attacker 504 being sent to server 512 and / or server 514 via Internet 506, the message sent by attacker 504 is discarded after being detected by attack defense device 508, and the IP address of attacker 504 (at this time, the IP address is the IP address of user 502) is added to the abnormal list.

[0095] If user 502 intends to send a message to server 512 and / or server 514, the attack defense device 508 needs to determine the IP address because user 502's IP address is in the abnormal list to prevent normal users' messages from being unable to be forwarded, thus affecting the normal users' business operations.

[0096] After the judgment was made, the user's 502 message was forwarded normally.

[0097] In some embodiments, the attack defense device 508 may be a firewall.

[0098] In other embodiments, the attack defense device 508 may be a device with traffic scrubbing (e.g., firewall) capabilities, such as a routing device with traffic scrubbing capabilities.

[0099] In some embodiments, the attack defense device 508 can be deployed in either a direct-path or bypass configuration. For example, in a bypass configuration, the firewall may not be directly connected to the network transmission path of the packets, but rather detection may be performed by analyzing data (e.g., packets) copied from a mirror port.

[0100] This disclosure also provides a computer-readable storage medium including computer program instructions that, when executed by a processor, implement the method of any of the above embodiments.

[0101] This disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the method of any of the above embodiments.

[0102] The embodiments of this disclosure have now been described in detail. To avoid obscuring the concept of this disclosure, some details known in the art have not been described. Those skilled in the art can fully understand how to implement the technical solutions disclosed herein based on the above description.

[0103] Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, systems, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable non-transitory storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0104] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that the functions specified in one or more flowchart illustrations and / or one or more blocks in a block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate functions for implementing the functions in the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0105] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The function specified in one or more boxes.

[0106] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0107] While specific embodiments of this disclosure have been described in detail by way of examples, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of this disclosure. Those skilled in the art should understand that modifications can be made to the above embodiments or equivalent substitutions can be made to some technical features without departing from the scope and spirit of this disclosure. The scope of this disclosure is defined by the appended claims.

Claims

1. A message processing method, executed by an attack defense device, the method comprising: Perform the fourth query to check if the source Internet Protocol IP address of the received message exists in the whitelist; If the source IP address does not exist in the whitelist, a fifth query is performed to check if the source IP address exists in the abnormal list; if the source IP address exists in the abnormal list, a second query is performed to check if the source IP address exists in the preset secure IP list; if the source IP address exists in the preset secure IP list, a first query is performed to check if the packet's five-tuple information exists in the session table. If the packet's five-tuple information exists in the session table, the packet is forwarded; if the source IP address does not exist in the preset secure IP list, the packet is discarded. If the source IP address exists in the whitelist, a second detection is performed to check whether the data traffic corresponding to the packet exceeds a preset threshold. If the result of the second detection is that the data traffic corresponding to the packet exceeds the preset threshold, a third detection is performed to detect whether the source IP address is an attacking IP address. If the result of the third detection indicates that the source IP address is an attacking IP address, the source IP address is added to the anomaly list and the packet is dropped; or if the result of the third detection indicates that the source IP address is not an attacking IP address, the packet is forwarded. The preset secure IP list includes the source IP addresses of packets received when no attack event occurs. The preset secure IP list is generated through the following steps: upon receiving a first packet and without an attack event, a third query is performed to check if the source IP address of the first packet exists in the preset secure IP list; if the result of the third query is that the source IP address of the first packet does not exist in the preset secure IP list, the source IP address of the first packet is added to the preset secure IP list and its aging time is set; or if the result of the third query is that the source IP address of the first packet exists in the preset secure IP list, the aging time of the source IP address of the first packet in the preset secure IP list is updated. Each IP address in the anomaly list has an aging time. If the number of packets with the source IP address that are forwarded exceeds a preset number, the aging time of the source IP address in the anomaly list is reduced.

2. The method according to claim 1, further comprising: If the five-tuple information of the packet is not found in the session table, a first detection is performed to detect whether the source IP address is an attacking IP address; If the result of the first detection is that the source IP address is not the attacking IP address, the packet is forwarded and the five-tuple information of the packet is stored in the session table.

3. The method according to any one of claims 1-2, further comprising: If the result of the fifth query is that the source IP address does not exist in the abnormal list, a fourth detection is performed to detect whether the source IP address is an attacking IP address. If the result of the fourth detection is that the source IP address is an attacking IP address, the source IP address is added to the abnormal list and the packet is discarded; or If the result of the fourth detection is that the source IP address is not the attacking IP address, the source IP address is added to the whitelist and the packet is forwarded.

4. The method according to claim 2, wherein, If the result of the first detection indicates that the source IP address is an attacking IP address, the packet is discarded.

5. An attack defense device, comprising: The query module is configured to: perform a fourth query to check if the source Internet Protocol (IP) address of the received packet exists in the whitelist; if the source IP address does not exist in the whitelist, perform a fifth query to check if the source IP address exists in the abnormal list; if the source IP address exists in the abnormal list, perform a second query to check if the source IP address exists in the preset secure IP list; if the source IP address exists in the preset secure IP list, perform a first query to check if the packet's five-tuple information exists in the session table. The forwarding module is configured to forward the packet if the packet's five-tuple information exists in the session table; The attack defense device is configured to: discard the packet if the source IP address does not exist in the preset secure IP list; perform a second detection if the source IP address exists in the whitelist to check whether the data traffic corresponding to the packet exceeds a preset threshold; perform a third detection if the result of the second detection is that the data traffic corresponding to the packet exceeds the preset threshold to check whether the source IP address is an attack IP address; add the source IP address to the abnormal list and discard the packet if the result of the third detection is that the source IP address is not an attack IP address, or forward the packet if the result of the third detection is that the source IP address is not an attack IP address. The preset secure IP list includes the source IP addresses of packets received when no attack event occurs. The preset secure IP list is generated through the following steps: upon receiving a first packet and without an attack event, a third query is performed to check if the source IP address of the first packet exists in the preset secure IP list; if the result of the third query is that the source IP address of the first packet does not exist in the preset secure IP list, the source IP address of the first packet is added to the preset secure IP list and its aging time is set; or if the result of the third query is that the source IP address of the first packet exists in the preset secure IP list, the aging time of the source IP address of the first packet in the preset secure IP list is updated. Specifically, if the number of multiple packets with the source IP address that are forwarded exceeds a preset number, the aging time of the source IP address in the abnormal list is reduced.

6. An attack defense device, comprising: Memory; as well as A processor coupled to the memory is configured to execute the method of any one of claims 1-4 based on instructions stored in the memory.

7. A computer-readable storage medium comprising computer program instructions, wherein, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1-4.

8. A computer program product comprising a computer program, wherein, When the computer program is executed by a processor, it implements the method described in any one of claims 1-4.

Images