Method and apparatus for blocking malicious scanning traffic

Abstract

The application relates to the technical field of network security, and provides a malicious scanning traffic blocking method and device. The method comprises the following steps: acquiring the scanning times of a source IP address on a device port within a first preset time period according to an initial node for counting target data packets sent by the source IP address; determining that the scanning times exceed a preset number of times; expanding the initial node into a scanning behavior node; and blocking the current target data packet sent by the source IP address according to each preset packet type recorded in the scanning behavior node; wherein the target data packet is a data packet for port scanning. The malicious scanning traffic blocking method provided in the application can improve the blocking efficiency of malicious port scanning traffic and reduce the memory occupation.

Description

Technical Field

[0001] This application relates to the field of network security technology, specifically to a method and apparatus for blocking malicious scanning traffic. Background Technology

[0002] With the increasing number of devices connecting to the internet, malicious port scanning traffic is becoming more prevalent, posing a pressing network security challenge. One technique for blocking malicious port scanning traffic involves establishing multiple nodes in memory, each corresponding to a source IP address. These nodes detect port scanning traffic from the source IPs and block malicious traffic based on the detection results. However, each node consumes memory. Improving the blocking efficiency requires more processes per node to handle the data packets obtained from port scanning, leading to excessive memory usage and impacting device throughput. Therefore, improving the blocking efficiency of malicious port scanning traffic while reducing memory consumption is a crucial technical challenge. Summary of the Invention

[0003] This application aims to address at least one of the technical problems existing in related technologies. To this end, this application proposes a method for blocking malicious scanning traffic, which can improve the efficiency of blocking malicious port scanning traffic while reducing memory usage.

[0004] This application also proposes a device for blocking malicious scanning traffic.

[0005] This application also proposes an electronic device.

[0006] This application also proposes a computer-readable storage medium.

[0007] A method for blocking malicious scanning traffic according to an embodiment of the first aspect of this application includes:

[0008] Based on the initial node used to count the target data packets sent by the source IP address, obtain the number of times the source IP address scans the device port within a first preset time period;

[0009] If the number of scans exceeds a preset number, the initial node is expanded into a scanning behavior node, so as to block the current target data packet sent by the source IP address according to the preset packet types recorded in the scanning behavior node;

[0010] The target data packet is the data packet used for port scanning.

[0011] The malicious scanning traffic blocking method provided in this application embodiment uses an initial node for counting target data packets sent by a source IP address. After obtaining the number of times the source IP address scans the device port within a preset time period, if the number of scans exceeds a preset number, the initial node is expanded into a scanning behavior node. This allows the scanning behavior node to utilize the preset packet types recorded in the node to block the target data packets sent by the source IP address. Thus, when the number of scans is below the preset number, only the initial node is used for data packet counting, minimizing memory usage. Only when the number of scans exceeds the preset number is the initial node expanded into a scanning behavior node that includes preset packet types to block and detect data packets. This prevents the node from consuming excessive memory throughout the process, thereby improving the efficiency of blocking malicious port scanning traffic while reducing memory usage.

[0012] According to one embodiment of this application, based on the initial node used to count the target data packets sent by the source IP address, the number of times the source IP address scans the device port within a first preset time period is obtained, including:

[0013] Upon receiving the target data packet, the port information of the device port scanned by the target data packet is recorded as a log entry to the initial node;

[0014] Based on the number of log messages recorded by the initial node within the first preset time period, the number of times the source IP address scanned the device port within the first preset time period is determined.

[0015] According to one embodiment of this application, the log information is in bitmap format.

[0016] According to one embodiment of this application, it also includes:

[0017] If the number of scans does not exceed a preset number, delete the initial node to release the system memory occupied by the initial node.

[0018] According to one embodiment of this application, blocking the current target data packet sent by the source IP address based on each preset packet type recorded in the scanning behavior node includes:

[0019] Based on each of the preset message types, detect the current target data packet sent by the source IP address;

[0020] If the message type of the current target data packet is determined to be the same as any of the preset message types, the current target data packet is blocked.

[0021] According to one embodiment of this application, it also includes:

[0022] If, within a second preset time period, the message type of each of the received target data packets does not match the target message type in each of the preset message types, then the target message type and the matching record for that target message type are deleted to release the system memory required by the scanning behavior node to perform the target message type matching; or,

[0023] If, within a second preset time period, the number of target data packets whose message types do not match the target message types in each of the preset message types reaches a preset threshold, the target message type and the matching record of the target message type are deleted to release the system memory required by the scanning behavior node to perform the target message type matching.

[0024] The target message type is any of the preset message types.

[0025] According to one embodiment of this application, it also includes:

[0026] If the preset message type in the scanning behavior node is determined to be empty, the scanning behavior node is converted into the initial node.

[0027] A malicious scanning traffic blocking device according to a second aspect embodiment of this application includes:

[0028] The scanning traffic statistics module is used to obtain the number of times the source IP address scans the device port within a first preset time period, based on the initial node used to count the target data packets sent by the source IP address.

[0029] The malicious traffic blocking module is used to determine that the number of scans exceeds a preset number, expand the initial node into a scanning behavior node, and block the current target data packet sent by the source IP address according to the preset packet types recorded in the scanning behavior node;

[0030] The target data packet is the data packet used for port scanning.

[0031] An electronic device according to a third aspect of this application includes a processor and a memory storing a computer program, wherein the processor executes the computer program to implement the method for blocking malicious scanning traffic as described in any of the above embodiments.

[0032] A computer-readable storage medium according to a fourth aspect of this application stores a computer program thereon, which, when executed by a processor, implements the method for blocking malicious scanning traffic as described in any of the above embodiments.

[0033] A computer program product according to a fifth aspect of this application includes: when the computer program is executed by a processor, it implements a method for blocking malicious scanning traffic as described in any of the above embodiments.

[0034] The above-described one or more technical solutions in the embodiments of this application have at least one of the following technical effects:

[0035] An initial node, used to count target data packets sent from a source IP address, obtains the number of times the source IP address scans the device port within a preset time period. If the number of scans exceeds a preset limit, the initial node is expanded into a scanning behavior node. This node uses the preset packet types recorded in the scanning behavior node to block the target data packets sent from the source IP address. Thus, when the number of scans is below the preset limit, only the initial node counts data packets, minimizing memory usage. Only when the number of scans exceeds the preset limit is the initial node expanded into a scanning behavior node that includes preset packet types to block and detect data packets. This prevents the node from consuming excessive memory throughout the process, thereby improving the efficiency of blocking malicious port scan traffic while reducing memory consumption. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 This is a flowchart illustrating the method for blocking malicious scanning traffic provided in an embodiment of this application;

[0038] Figure 2 Yes Figure 1 A flowchart further detailing the statistics of the number of scans in the method for blocking malicious scanning traffic;

[0039] Figure 3 Yes Figure 1 The flowchart further details the blocking of data packets in the method for blocking malicious scanning traffic;

[0040] Figure 4 This is a schematic diagram of the structure of the malicious scanning traffic blocking device provided in the embodiments of this application;

[0041] Figure 5 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0043] The following will provide a detailed description and explanation of the method and apparatus for blocking malicious scanning traffic provided in this application through several specific embodiments.

[0044] In one embodiment, a method for blocking malicious scanning traffic is provided. This method is applied to a network device to block malicious scanning traffic. The network device can be a user terminal, a cluster of terminal devices consisting of multiple user terminals, or a server. The user terminal can be a desktop or portable terminal, such as a desktop computer or a laptop. The server can be a standalone server or a server cluster composed of multiple servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence sampling point devices.

[0045] like Figure 1 As shown, this embodiment provides a method for blocking malicious scanning traffic, which includes:

[0046] Step 101: Based on the initial node used to count the target data packets sent by the source IP address, obtain the number of times the source IP address scans the device port within a first preset time period;

[0047] Step 102: If the number of scans exceeds a preset number, the initial node is expanded into a scanning behavior node, so as to block the current target data packet sent by the source IP address according to the preset packet types recorded in the scanning behavior node;

[0048] The target data packet is the data packet used for port scanning.

[0049] An initial node, used to count target data packets sent from a source IP address, obtains the number of times the source IP address scans the device port within a preset time period. If the number of scans exceeds a preset limit, the initial node is expanded into a scanning behavior node. This node uses the preset packet types recorded in the scanning behavior node to block the target data packets sent from the source IP address. Thus, when the number of scans is below the preset limit, only the initial node counts data packets, minimizing memory usage. Only when the number of scans exceeds the preset limit is the initial node expanded into a scanning behavior node that includes preset packet types to block and detect data packets. This prevents the node from consuming excessive memory throughout the process, thereby improving the efficiency of blocking malicious port scan traffic while reducing memory consumption.

[0050] In one embodiment, the network device pre-establishes multiple nodes, each of which can be a memory block or storage structure occupying a certain amount of memory. Each node is responsible for processing a target data packet sent from a source IP address. The source IP address corresponding to each node can be pre-set or randomly assigned when a target data packet from a certain source IP address is first received. If a target data packet from a certain source IP address is randomly assigned to a node upon its first reception, then that source IP address is bound to that node. This ensures that subsequent target data packets from that source IP address are assigned to that node for processing, and that node only processes target data packets from that specific source IP address.

[0051] Upon receiving a data packet, the network device determines whether it is the target data packet based on different data packet types, such as TCP packets, UDP packets, and ICMP packets. Specifically, for TCP packets, if the TCP packet is a connect scan (i.e., after a complete three-way handshake), a SYN scan (i.e., when the device port receives a SUN data frame), a FIN scan (i.e., when a FIN frame is received), or a Christmas tree scan (i.e., when TCP receives all packets with the flag set to 1), then the TCP packet is considered a target data packet for port scanning. For UDP packets, receiving an empty UDP data packet indicates that the UDP packet is a target data packet for port scanning. For ICMP packets, all received ping packets are considered target data packets.

[0052] Once the received data packet is identified as the target data packet, the source IP address that sent the target data packet is determined based on the tuple of the target data packet. Then, based on the source IP address, the initial node corresponding to the source IP address is located, and the target data packet is recorded in the initial node. Simultaneously, to facilitate timing the first preset time period, the moment when the target data packet is first received from the source IP address can also be recorded as the start time of the first preset time period in the initial node.

[0053] After the initial node first records the source IP address and sends the target data packet, the number of target data packets recorded by the initial node within the first preset time period is counted, starting from the time when the initial node records the target data packet. The counted number of target data packets is then used as the number of times the source IP address scans the device port within the first preset time period.

[0054] To further reduce the memory occupied by the initial node, in one embodiment, such as Figure 2 As shown, based on the initial node used to count the target data packets sent by the source IP address, the number of times the source IP address scans the device port within a first preset time period is obtained, including:

[0055] Step 201: Upon receiving the target data packet, record the port information of the device port scanned by the target data packet as a log message to the initial node;

[0056] Step 202: Determine the number of times the source IP address scans the device port within the first preset time period based on the number of log information recorded by the initial node within the first preset time period.

[0057] In one embodiment, after receiving a target data packet sent by a source IP address, the port information of the device ports scanned by the target data packet is extracted from the five-tuple of the target data packet. This port information is then recorded as a log entry in the initial node corresponding to the source IP address. Simultaneously, the moment when the target data packet is first received from the source IP address is recorded as the start time of a first preset time period in the initial node.

[0058] In this way, after the first preset time period, the initial node will have recorded N log messages. At this point, the number of log messages N can be counted, and this number of log messages N can be used as the number of times the source IP address scanned the device port during the first preset time period.

[0059] By recording the port information of the device port scanned by the target data packet as a log message to the initial node, the number of scans can be determined based on the number of log messages recorded by the initial node within the first preset time period. This eliminates the need to record the complete target data packet in the initial node, thereby reducing the memory space required by the initial node.

[0060] To further save memory space occupied by the initial node, log information can be recorded in bitmap format.

[0061] In addition, based on the number of log messages recorded by the initial node within the first preset time period, the number of times the source IP address scans the device port within the first preset time period is determined. This can be done by directly using the number of log messages as the number of times the source IP address scans the device port within the first preset time period, or by deleting duplicate log messages that scan the same device port from the total number of log messages and using the number of log messages remaining after deletion as the number of scans.

[0062] If, within the first preset time period, two data packets are recorded scanning device port A, three data packets are recorded scanning device port B, and four data packets are recorded scanning device port C, then the total number of log messages is 2 + 3 + 4. If duplicate log messages scanning the same device port are deleted, the remaining number of log messages is the total number of scanned device ports, which is 3.

[0063] After obtaining the number of times the source IP address scans the device port within a first preset time period, this number of scans is compared with a preset number. This preset number can be set according to actual needs, such as 30 scans. If the number of scans of the device port by the source IP address within the first preset time period does not exceed the preset number, it indicates that the connection under that source IP address is a normal network access connection.

[0064] To further reduce the memory usage of nodes, in one embodiment, if the number of scans does not exceed a preset number, that is, if the connection under the source IP address is a normal network access connection, the initial node is deleted to release the occupied system memory in a timely manner, so as to provide memory for subsequent network connections to other source IP addresses to establish new initial nodes, thereby reducing the usage of system memory.

[0065] In one embodiment, if the number of scans exceeds a preset number, it indicates that the source IP address has performed abnormally frequent port scans. In this case, it can be determined that the scan traffic sent by the source IP address is malicious scan traffic, and the source IP address is a malicious scanning IP. After determining that the source IP address is a malicious scanning IP, the initial node corresponding to the source IP address is expanded into a scanning behavior node used to block malicious scan traffic sent by the source IP address. Preset packet types are added to this scanning behavior node to block the current target data packets sent by the source IP address in real time using these preset packet types.

[0066] The preset message types can include TCP scan, UDP scan, and ICMP scan, among others.

[0067] Specifically, such as Figure 3 As shown, based on the preset message types recorded in the scanning behavior node, the current target data packet sent by the source IP address is blocked, including:

[0068] Step 301: Detect the current target data packet sent by the source IP address according to each of the preset message types;

[0069] Step 302: Determine the message type of the current target data message. If it is the same as any of the preset message types, block the current target data message.

[0070] In one embodiment, when the initial node is expanded into a scanning behavior node, if the target data packet received from the source IP address is the same as one of the preset packet types, the scanning behavior node will block the target data packet.

[0071] For example, when the initial node is expanded into a scanning behavior node, if the target data packet sent by the source IP address is a TCP packet, it means that the target data packet is a packet type for TCP scanning, which is the same as TCP scanning in the preset packet types. At this time, the scanning behavior node will block the target data packet.

[0072] To ensure the accuracy of blocking, when blocking the current target data packet sent by the source IP address based on the preset packet types recorded in the scanning behavior node, each preset packet type is matched with the packet type of the current target data packet sent by the source IP address to avoid missing any target data packets.

[0073] To further reduce the node's memory footprint, in one embodiment, after blocking the current target data packet sent by the source IP address according to the preset packet types recorded in the scanning behavior node, the method further includes:

[0074] If, within a second preset time period, the message type of each of the received target data packets does not match the target message type in each of the preset message types, then the target message type and the matching record for that target message type are deleted to release the system memory required by the scanning behavior node to perform the target message type matching; or,

[0075] If, within a second preset time period, the number of target data packets whose message types do not match the target message types in each of the preset message types reaches a preset threshold, the target message type and the matching record of the target message type are deleted to release the system memory required by the scanning behavior node to perform the target message type matching.

[0076] The target message type is any of the preset message types.

[0077] In one embodiment, each preset message type can be pre-set with a corresponding second preset time period. This second preset time period can be set according to actual conditions. For any target message type, when the initial node is expanded into a scanning behavior node, the time when the initial node is expanded into a scanning behavior node is taken as the start time of the second preset time period for that target message type. Then, it is detected whether a target data packet with a message type matching the target message type is received within the second preset time period. If a target data packet with a message type matching the target message type is received, the target data packet is blocked, and the time when the target data packet was received is updated to the start time of the second preset time period for that target message type. Then, it is re-detected whether a target data packet with a message type matching the target message type is received within the second preset time period.

[0078] If no target data packet matching the target data packet type is received within the second preset time period, it indicates that no target data packet of that type exists. At this point, the target data packet type and the matching record used for target data packet matching are deleted. This prevents the scanning node from performing target data packet type matching on subsequent data packets, thereby releasing the system memory required by the scanning node to perform target data packet type matching.

[0079] In one embodiment, each preset message type can have a corresponding preset threshold in addition to a pre-defined second preset time period. This preset threshold can be set according to actual conditions. For any target message type, when the initial node is expanded into a scanning behavior node, the time when the initial node is expanded into a scanning behavior node is taken as the start time of the second preset time period for that target message type. Then, the number of target data packets whose message type does not match the target message type received within the second preset time period is detected. If a target data packet whose message type matches the target message type is received, the target data packet is blocked. Then, the time when the target data packet was received is updated to the start time of the second preset time period for that target message type, and the number of target data packets whose message type does not match the target message type within the second preset time period is detected again.

[0080] If, within the second preset time period, the number of target data packets whose message types do not match the target message type reaches a preset threshold (e.g., 20 consecutive target data packets whose message types do not match the target message type within the second preset time period), it indicates that no target data packets of that target message type exist. At this point, the target message type and the matching records used for target data packet matching are deleted. This prevents the scanning node from performing target message type matching on subsequent target data packets, thereby releasing the system memory required by the scanning node when performing target message type matching.

[0081] By determining that within a second preset time period, if the message type of each target data packet received does not match the target message type in each preset message type, or if the number of target data packets whose message type does not match the target message type in each preset message type reaches a preset threshold, the target message type and the target message type matching record are deleted to release the system memory required by the scanning behavior node to perform target message type matching. This allows the system memory usage of the scanning behavior node to be reduced in a timely manner according to the actual situation.

[0082] To further reduce system memory usage, in one embodiment, the following is also included:

[0083] If the preset message type in the scanning behavior node is determined to be empty, the scanning behavior node is converted into the initial node.

[0084] In one embodiment, when all preset message types are deleted, the preset message types in the scanning behavior node are empty, indicating that there is no need to block the target data packets sent by the source IP address. At this time, the scanning behavior node can be converted back into an initial node for statistical analysis of the target data packets sent by the source IP address, thereby converting the scanning behavior node into an initial node that occupies less system memory, further reducing system memory usage. At the same time, it is also possible to re-detect whether the scanning traffic sent by the source IP address is malicious scanning traffic.

[0085] The malicious scanning traffic blocking device provided in this application is described below. The malicious scanning traffic blocking device described below can be referred to in correspondence with the malicious scanning traffic blocking method described above.

[0086] In one embodiment, such as Figure 4 As shown, a device for blocking malicious scanning traffic is provided, comprising:

[0087] The scanning traffic statistics module 210 is used to obtain the number of times the source IP address scans the device port within a first preset time period based on the initial node used to count the target data packets sent by the source IP address.

[0088] The malicious traffic blocking module 220 is used to determine that the number of scans exceeds a preset number, expand the initial node into a scanning behavior node, and block the current target data packet sent by the source IP address according to each preset packet type recorded in the scanning behavior node;

[0089] The target data packet is the data packet used for port scanning.

[0090] An initial node, used to count target data packets sent from a source IP address, obtains the number of times the source IP address scans the device port within a preset time period. If the number of scans exceeds a preset limit, the initial node is expanded into a scanning behavior node. This node uses the preset packet types recorded in the scanning behavior node to block the target data packets sent from the source IP address. Thus, when the number of scans is below the preset limit, only the initial node counts data packets, minimizing memory usage. Only when the number of scans exceeds the preset limit is the initial node expanded into a scanning behavior node that includes preset packet types to block and detect data packets. This prevents the node from consuming excessive memory throughout the process, thereby improving the efficiency of blocking malicious port scan traffic while reducing memory consumption.

[0091] In one embodiment, the scan traffic statistics module 210 is specifically used for:

[0092] Upon receiving the target data packet, the port information of the device port scanned by the target data packet is recorded as a log entry to the initial node;

[0093] Based on the number of log messages recorded by the initial node within the first preset time period, the number of times the source IP address scanned the device port within the first preset time period is determined.

[0094] In one embodiment, the log information is in bitmap format.

[0095] In one embodiment, the malicious traffic blocking module 220 is further configured to:

[0096] If the number of scans does not exceed a preset number, delete the initial node to release the system memory occupied by the initial node.

[0097] In one embodiment, the malicious traffic blocking module 220 is specifically used for:

[0098] Based on each of the preset message types, detect the current target data packet sent by the source IP address;

[0099] If the message type of the current target data packet is determined to be the same as any of the preset message types, the current target data packet is blocked.

[0100] In one embodiment, the malicious traffic blocking module 220 is further configured to:

[0101] If, within a second preset time period, the message type of each of the received target data packets does not match the target message type in each of the preset message types, then the target message type and the matching record for that target message type are deleted to release the system memory required by the scanning behavior node to perform the target message type matching; or,

[0102] If, within a second preset time period, the number of target data packets whose message types do not match the target message types in each of the preset message types reaches a preset threshold, the target message type and the matching record of the target message type are deleted to release the system memory required by the scanning behavior node to perform the target message type matching.

[0103] The target message type is any of the preset message types.

[0104] In one embodiment, the malicious traffic blocking module 220 is further configured to:

[0105] If the preset message type in the scanning behavior node is determined to be empty, the scanning behavior node is converted into the initial node.

[0106] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830, and a communication bus 840, wherein the processor 810, the communication interface 820, and the memory 830 communicate with each other via the communication bus 840. The processor 810 can call a computer program in the memory 830 to execute a method for blocking malicious scanning traffic, such as including:

[0107] Based on the initial node used to count the target data packets sent by the source IP address, obtain the number of times the source IP address scans the device port within a first preset time period;

[0108] If the number of scans exceeds a preset number, the initial node is expanded into a scanning behavior node, so as to block the current target data packet sent by the source IP address according to the preset packet types recorded in the scanning behavior node;

[0109] The target data packet is the data packet used for port scanning.

[0110] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0111] On the other hand, embodiments of this application also provide a storage medium, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the malicious scanning traffic blocking methods provided in the above embodiments, such as including:

[0112] Based on the initial node used to count the target data packets sent by the source IP address, obtain the number of times the source IP address scans the device port within a first preset time period;

[0113] If the number of scans exceeds a preset number, the initial node is expanded into a scanning behavior node, so as to block the current target data packet sent by the source IP address according to the preset packet types recorded in the scanning behavior node;

[0114] The target data packet is the data packet used for port scanning.

[0115] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0116] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for blocking malicious scanning traffic, characterized in that, include: Based on the initial node used to count the target data packets sent by the source IP address, obtain the number of times the source IP address scans the device port within a first preset time period; If the number of scans exceeds a preset number, the initial node is expanded into a scanning behavior node, so as to block the current target data packet sent by the source IP address according to the preset packet types recorded in the scanning behavior node; The target data packet is a data packet used for port scanning; Based on the preset message types recorded in the scanning behavior node, the current target data packet sent by the source IP address is blocked, including: Based on each of the preset message types, detect the current target data packet sent by the source IP address; If the message type of the current target data packet is determined to be the same as any of the preset message types, the current target data packet is blocked. If, within a second preset time period, the message type of each of the received target data packets does not match the target message type in each of the preset message types, then the target message type and the matching record for that target message type are deleted to release the system memory required by the scanning behavior node to perform the target message type matching; or, If, within a second preset time period, the number of target data packets whose message types do not match the target message types in each of the preset message types reaches a preset threshold, the target message type and the matching record of the target message type are deleted to release the system memory required by the scanning behavior node to perform the target message type matching. The target message type is any of the preset message types.

2. The method for blocking malicious scanning traffic according to claim 1, characterized in that, Based on the initial node used to count the target data packets sent by the source IP address, the number of times the source IP address scans the device port within a first preset time period is obtained, including: Upon receiving the target data packet, the port information of the device port scanned by the target data packet is recorded as a log entry to the initial node; Based on the number of log messages recorded by the initial node within the first preset time period, the number of times the source IP address scanned the device port within the first preset time period is determined.

3. The method for blocking malicious scanning traffic according to claim 2, characterized in that, The log information is in bitmap format.

4. The method for blocking malicious scanning traffic according to claim 1, characterized in that, Also includes: If the number of scans does not exceed a preset number, delete the initial node to release the system memory occupied by the initial node.

5. The method for blocking malicious scanning traffic according to claim 1, characterized in that, Also includes: If the preset message type in the scanning behavior node is determined to be empty, the scanning behavior node is converted into the initial node.

6. A device for blocking malicious scanning traffic, characterized in that, include: The scanning traffic statistics module is used to obtain the number of times the source IP address scans the device port within a first preset time period, based on the initial node used to count the target data packets sent by the source IP address. The malicious traffic blocking module is used to determine that the number of scans exceeds a preset number, expand the initial node into a scanning behavior node, and block the current target data packet sent by the source IP address according to the preset packet types recorded in the scanning behavior node; The target data packet is a data packet used for port scanning; The malicious traffic blocking module is also used for: Based on each of the preset message types, detect the current target data packet sent by the source IP address; If the message type of the current target data packet is determined to be the same as any of the preset message types, the current target data packet is blocked. If, within a second preset time period, the message type of each of the received target data packets does not match the target message type in each of the preset message types, then the target message type and the matching record for that target message type are deleted to release the system memory required by the scanning behavior node to perform the target message type matching; or, If, within a second preset time period, the number of target data packets whose message types do not match the target message types in each of the preset message types reaches a preset threshold, the target message type and the matching record of the target message type are deleted to release the system memory required by the scanning behavior node to perform the target message type matching. The target message type is any of the preset message types.

7. An electronic device comprising a processor and a memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the method for blocking malicious scanning traffic as described in any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the method for blocking malicious scanning traffic as described in any one of claims 1 to 5.

Images