Data processing method, device, equipment and storage medium

Abstract

The disclosed embodiment provides a data processing method, apparatus, device and storage medium, the method comprising: in response to receiving a data message sent by a client, detecting whether the destination server corresponding to the data message is under a network attack by a security detection device; if under a network attack, the data message is pulled to the security protection device, and a test message is sent to the client by the security protection device, wherein the sequence number of the test message is outside the sliding window of the client to trigger the client to return a verification message; the verification message returned by the client is verified by the security protection device, if the verification passes, the client is determined to be a legitimate client, and the data message is sent to the destination server, if the verification fails, the client is determined to be an attacking client, and the data message is discarded. The present application can improve the quality of network connection during network protection.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of network security technology, and in particular to a data processing method, apparatus, device, and storage medium. Background Art

[0002] ACKFlood is one of the more common DDoS (Distributed denial of service attack) attacks. Its main principle is to forge a large number of false source IPs and send a large number of ACK (Acknowledge character) messages to the server through the forged false source IPs, so that the server is blocked by these malicious ACK messages, thereby causing the server to deny service.

[0003] In the prior art, the timeout retransmission mechanism of TCP (Transmission Control Protocol) can be used to verify whether the source IP of the client is legitimate. The specific steps are as follows: when an ACKFlood attack occurs, the protection system discards the ACK message. If the client retransmits the ACK message within the specified time, the source IP of the client is judged to be legitimate. If the client does not retransmit the ACK message within the specified time, the source IP of the client is judged to be illegal.

[0004] However, the inventors have found that the prior art has at least the following technical problems: since the session timeout retransmission is required after the ACK retransmission algorithm is enabled, the client's network connection will be stuck for a short period of time, especially for delay-sensitive services (such as games), which will cause a poor user experience. Summary of the invention

[0005] The embodiments of the present disclosure provide a data processing method, apparatus, device, and storage medium, which can improve the quality of network connection during network security protection, thereby improving user experience.

[0006] In a first aspect, an embodiment of the present disclosure provides a data processing method, which is applied to a network protection system, wherein the network protection system includes a security detection device and a security protection device, and the method includes:

[0007] In response to receiving a data message sent by a client, detecting, by the security detection device, whether a destination server corresponding to the data message is under a network attack;

[0008] If it is detected that the destination server is under a network attack, the data message is pulled to the security protection device, and a test message is sent to the client through the security protection device, wherein the sequence number of the test message is outside the sliding window of the client, so as to trigger the client to return a verification message to the security protection device;

[0009] The verification message returned by the client is verified by the security protection device. If the verification passes, the client is determined to be a legitimate client and the data message is sent to the destination server. If the verification fails, the client is determined to be an attacking client and the data message is discarded.

[0010] In a second aspect, an embodiment of the present disclosure provides a data processing device, which is applied to a network protection system, wherein the network protection system includes a security detection device and a security protection device, and the device includes:

[0011] A detection module, configured to detect, in response to receiving a data message sent by a client, whether a destination server corresponding to the data message is under a network attack through the security detection device;

[0012] A sending module, configured to, if it is detected that the destination server is under a network attack, pull the data message to the security protection device, and send a test message to the client through the security protection device, wherein the sequence number of the test message is outside the sliding window of the client, so as to trigger the client to return a verification message to the security protection device;

[0013] The verification module is used to verify the verification message returned by the client through the security protection device. If the verification passes, the client is determined to be a legitimate client and the data message is sent to the destination server. If the verification fails, the client is determined to be an attacking client and the data message is discarded.

[0014] In a third aspect, an embodiment of the present disclosure provides an electronic device, including:

[0015] A processor, and a memory communicatively connected to the processor;

[0016] The memory stores computer-executable instructions;

[0017] The processor executes the computer-executable instructions stored in the memory to implement the data processing method as described in the first aspect above.

[0018] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions. When a processor executes the computer-executable instructions, the data processing method described in the first aspect above is implemented.

[0019] In a fifth aspect, an embodiment of the present disclosure provides a computer program product, including a computer program, which, when executed by a processor, implements the data processing method as described in the first aspect above.

[0020] The data processing method, apparatus, device and storage medium provided in the present embodiment include: in response to receiving a data message sent by a client, detecting whether a destination server corresponding to the data message is under a network attack by a security detection device; if it is detected that the destination server is under a network attack, the data message is pulled to the security protection device, and a test message is sent to the client by the security protection device, wherein the sequence number of the test message is outside the sliding window of the client, so as to trigger the client to return a verification message to the security protection device; the verification message returned by the client is verified by the security protection device, and if the verification passes, the client is determined to be a legitimate client, and the data message is sent to the destination server; if the verification fails, the client is determined to be an attacking client, and the data message is discarded. In an embodiment of the present application, when the destination server is attacked by a network attack, a test message can be sent to the client by a security protection device instead of the server, and the serial number of the test message is outside the client's sliding window, which can trigger the client to return a verification message. In this way, the verification message can be verified by the security protection device to determine whether the client is legitimate. In the process of verifying the verification message by the security protection device, there is no need to stop the network connection between the server and the client, which improves the quality of the network connection during network security protection and thus improves the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0022] Figure 1 A schematic diagram of an application scenario of a data processing method provided by an embodiment of the present disclosure;

[0023] Figure 2 A flowchart of a data processing method provided by an embodiment of the present disclosure;

[0024] Figure 3A schematic diagram of verification of a normal client provided in an embodiment of the present disclosure;

[0025] Figure 4 A schematic diagram of attacking a client terminal provided by an embodiment of the present disclosure;

[0026] Figure 5 A schematic diagram of the structure of a safety protection system provided in an embodiment of the present disclosure;

[0027] Figure 6 A structural block diagram of a data processing device provided in an embodiment of the present disclosure;

[0028] Figure 7 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0030] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0031] ACKFlood is one of the more common DDoS (Distributed denial of service attack) attacks. Its main principle is to forge a large number of false source IPs and send a large number of ACK (Acknowledge character) messages to the server through the forged false source IPs, so that the server is blocked by these malicious ACK messages, thereby causing the server to deny service.

[0032] In the prior art, the timeout retransmission mechanism of TCP (Transmission Control Protocol) can be used to verify whether the source IP of the client is legitimate. The specific steps are as follows: when an ACKFlood attack occurs, the protection system discards the ACK message. If the client retransmits the ACK message within the specified time, the source IP of the client is judged to be legitimate. If the client does not retransmit the ACK message within the specified time, the source IP of the client is judged to be illegal.

[0033] However, since the ACK retransmission algorithm requires session timeout retransmission after it is enabled, the client's network connection will be temporarily blocked, which will cause a poor user experience, especially for delay-sensitive services (such as games). In addition, for different clients, the timeout retransmission interval may be very fast or very slow, so the ACK message may be mistakenly deleted due to the long retransmission time, which will also reduce the user experience.

[0034] It can be seen that how to improve the quality of network connection on the basis of ensuring network security is an urgent problem to be solved.

[0035] In order to solve the above problems, this embodiment provides the following technical concept: when the client and the server transmit data via TCP, TCP can use a sliding window for transmission control. That is, the receiving end of the message has a sliding window of a specific size. As the messages are received in order, the sliding window moves continuously. However, if the receiving end receives a message whose sequence number is not within the sliding window range, it is called out of window (that is, oow), where window refers to the sliding window. According to the TCP protocol stack, when the receiving end (such as the client) receives an oow message, it will discard the message and return an ack message to the other end (such as the server).

[0036] This application can verify whether the source IP of the client is legitimate by using the out of window mechanism to protect against ACKFlood attacks. When a legitimate client receives an oow message, it can trigger the out of window mechanism and return an ack message, while an illegal client (or attacking client) will not trigger the out of window mechanism and will not return an ack message when receiving an oow message. Accordingly, the specific steps are as follows: first, in response to receiving a data message sent by a client, a security detection device is used to detect whether a destination server corresponding to the data message is under a network attack; then, if it is detected that the destination server is under a network attack, the data message is pulled to the security protection device, and a test message is sent to the client through the security protection device (that is, the security protection device can send a test message to the client instead of the server), wherein the sequence number of the test message is outside the sliding window of the client, which can trigger an out of window mechanism, causing the client to return a verification message to the security protection device; finally, the verification message returned by the client is verified by the security protection device. If the verification passes, the client is determined to be a legitimate client, and the data message is sent to the destination server. If the verification fails, the client is determined to be an attacking client, and the data message is discarded.

[0037] In this case, when the destination server is attacked by a network attack, the security protection device can send a test message to the client instead of the server, and the sequence number of the test message is outside the client's sliding window, which can trigger the client to return a verification message. In this way, the verification message can be verified by the security protection device to determine whether the client is legitimate. In the process of verifying the verification message by the security protection device, there is no need to stop the network connection between the server and the client, which improves the quality of the network connection during network security protection and thus improves the user experience.

[0038] The application scenarios of the embodiments of the present disclosure are explained below:

[0039] The data processing method provided by the embodiment of the present disclosure can be applied to the scenario of performing security protection on the server through the network protection system. Figure 1 The following is a schematic diagram of an application scenario of a data processing method provided by an embodiment of the present disclosure. Figure 1As shown, the network protection system includes a security detection device 101 and a security protection device 102. Among them, the security detection device 101 detects whether the destination server is under a network attack; if it is under a network attack, the data message is pulled to the security protection device 102, and the security protection device 102 verifies whether the client is legal. If the client is determined to be a legal client, the data message is sent to the destination server. If the client is determined to be an attacking client, the data message is discarded. The data processing method provided by the embodiment of the present disclosure is described in detail using a detailed embodiment.

[0040] Figure 2 The flowchart of a data processing method provided by the embodiment of the present disclosure. The information processing can be applied to a network protection system, which includes a security detection device and a security protection device. Figure 2 As shown, the method includes:

[0041] S201: In response to receiving a data message sent by a client, a security detection device is used to detect whether a destination server corresponding to the data message is under a network attack.

[0042] In the disclosed embodiment, the data message sent by the client may be a message in any format. For example, the data message may be an ACK message or a PUSHACK (PUSH Acknowledge character) message. Optionally, in a network connection, the data message sent by the client is also the traffic sent by the client. Optionally, the destination server corresponding to the data message is the server to which the client intends to send the data message, that is, the server that receives the data message.

[0043] In some embodiments, the security detection device can determine whether the server is under a network attack through information such as traffic, packet volume, and number of connections. Accordingly, the process of detecting whether the destination server corresponding to the data message is under a network attack by the security detection device includes: detecting the number of messages, the number of data packets, and the number of connected clients of the destination server corresponding to the data message by the security detection device; if the number of messages is greater than the first preset threshold and / or the number of data packets is greater than the second preset threshold and / or the number of connected clients is greater than the third preset threshold, it is determined that the destination server is under a network attack; if the number of messages is not greater than the first preset threshold and the number of data packets is not greater than the second preset threshold and the number of connected clients is not greater than the third preset threshold, it is determined that the destination server is not under a network attack.

[0044] The network attack may be a DDoS network attack including an ACKFlood attack. In the disclosed embodiment, the values ​​of the first preset threshold, the second preset threshold, and the third preset threshold are not specifically limited and can be set and modified as needed.

[0045] It should be noted that if Figure 5 As shown, the network protection system may further include a splitter; accordingly, in response to receiving a data packet sent by a client, the security detection device is used to detect whether the destination server corresponding to the data packet is under a network attack, including: in response to receiving a data packet sent by a client, the data packet is copied by an optical splitter, and the copied data packet is sent to the security detection device, and the security detection device is used to detect whether the destination server corresponding to the data packet is under a network attack.

[0046] The data message is copied through an optical splitter, and on the basis of not affecting the original transmission link of the data message, the data message sent by the client is detected and analyzed in real time through the security detection equipment.

[0047] Furthermore, the method may also include: if it is detected that the destination server is not attacked by the network, sending the data message sent by the client to the destination server.

[0048] Here, since the data message is copied by setting up a splitter, it is possible to transmit the data message normally while performing a security check on the copied data message. That is, it is possible to perform a security check on the destination server corresponding to the data message without affecting the normal transmission of the data message, thereby improving the transmission efficiency of the message data.

[0049] S202. If it is detected that the destination server is under a network attack, the data message is pulled to the security protection device, and a test message is sent to the client through the security protection device, wherein the sequence number of the test message is outside the client's sliding window to trigger the client to return a verification message to the security protection device.

[0050] In the disclosed embodiment, the sliding window may be a sliding window in a TCP connection. It should be noted that when the sequence number of the test message is outside the sliding window of the client, the test message is determined to be an oow (out of window) message. According to the TCP protocol stack, when the client receives an oow message, it will discard the message and return a verification message. Among them, the test message may be a keepalive (keepalive, heartbeat maintenance) message, and the verification message may be a keepalive_ack message.

[0051] Among them, in order to ensure that the client can receive the test message sent by the security protection device, before sending the test message to the client through the security protection device, some message information of the test message needs to be limited. Optionally, the step of constructing the test message through the security protection device includes: determining the confirmation number of the data message sent by the client, determining the sequence number of the test message as the confirmation number of the data message minus a preset value; and / or, determining the first session information of the data message sent by the client, wherein the first session information includes the source port, destination port, source address, destination address and protocol type, synchronizing the second session information of the test message to the first session information; and / or, setting the setting mode of the test message to only ACK setting; and / or, setting the test message to carry no payload data.

[0052] Among them, the sequence number of the test message is determined as the confirmation number of the data message minus the preset value, which can ensure that the sequence number of the test message is outside the sliding window of the client, so as to trigger the client to return a verification message to the security protection device. In the embodiment of the present disclosure, the numerical value of the preset value is not specifically limited and can be set and modified as needed. Exemplarily, the preset value is 1, the sequence number can be represented by seq, and the confirmation number can be represented by ack; wherein seq = ack-1. For example, the range of the sliding window is 33 to 40; the confirmation number of the data message is 32, and the sequence number of the test message is 31, which is outside the range of the sliding window, and can trigger the client to return a verification message to the security protection device.

[0053] The first session information includes a source port, a destination port, a source address, a destination address and a protocol type. Synchronizing the second session information of the test message with the first session information can ensure that the test message and the received data message are in the same TCP session.

[0054] The setting mode of the test message is set to only set ACK, which can ensure that the client receives the test message.

[0055] The test message is set not to carry effective load data, so as to avoid the test message interfering with the original data of the client.

[0056] It should be noted that if Figure 3 As shown in FIG. 1 , after receiving the test message (eg, keepalive message), the normal client will return a verification message to the security protection device. Figure 4As shown, since the attack client is not a real client, it does not have the TCP out-of-window mechanism. Therefore, after receiving the test message, the attack client will not return a verification message, but will continue to randomly send ACK messages or PUSHACK messages. In some embodiments, if the verification message returned by the client is not received within the preset time, the client is determined to be an attack client through the security protection device, and the data message is discarded. In the embodiments of the present disclosure, the value of the preset time is not specifically limited and can be set and modified as needed. For example, the preset time can be 1 second, 2 seconds or 3 seconds.

[0057] In some embodiments, Figure 5 As shown, the network protection system also includes a control center device; wherein the control center device can send protection instructions to the security protection device to control the security protection device to start the protection mechanism.

[0058] Optionally, the step of pulling the data message to the security protection device is: sending attack alarm information to the control center device through the security detection device, the control center device is used to respond to receiving the attack alarm information and send a protection instruction to the security protection device, wherein the protection instruction carries the IP address information of the destination server corresponding to the data message; the security protection device responds to receiving the protection instruction, determines the routing device corresponding to the IP address information of the destination server, and pulls the data message to the security protection device through the routing device. Here, after the data message is pulled to the security protection device, the attack message in the data message can be intercepted by the security protection device, and the normal message can be sent to the corresponding destination server.

[0059] S203. Verify the verification message returned by the client through the security protection device. If the verification passes, the client is determined to be a legitimate client and the data message is sent to the destination server. If the verification fails, the client is determined to be an attacking client and the data message is discarded.

[0060] In the disclosed embodiment, the verification message can be verified by the message information of the verification message. Accordingly, the step of verifying the verification message returned by the client by the security protection device includes: obtaining the message information of the verification message; determining whether the verification message is a heartbeat maintenance message by the security protection device according to the message information; if so, the verification is passed, and if not, the verification is failed.

[0061] The heartbeat hold message may be a Keepalive_ack message. After receiving the test message, a normal client will return a Keepalive_ack message to the security protection device. However, since the attack client is not a real client, it will not return a verification message, but will continue to randomly send ACK messages or PUSHACK messages. At this time, the message returned by the attack client is not a heartbeat hold message (Keepalive_ack message).

[0062] Optionally, the message information of the verification message includes one or more of the following: session information, lifetime information, setting mode, whether it carries payload data, confirmation number and sequence number; accordingly, determining whether the verification message is a heartbeat maintenance message based on the message information by the security protection device may include: determining whether the verification message is a heartbeat maintenance message based on at least one message information in the verification message by the security protection device.

[0063] It should be noted that when determining whether a verification message is a heartbeat hold message through multiple message information, if it is determined through any message information that the verification message is not a heartbeat hold message, then it is determined that the verification message is not a heartbeat hold message. Only when it is determined through each message information in the multiple message information that the verification message is a heartbeat hold message, can it be determined that the verification message is a heartbeat hold message.

[0064] Exemplarily, whether the verification message is a heartbeat maintenance message is determined through session information and lifetime information. When the verification message is determined to be a heartbeat maintenance message through session information, and the verification message is determined to be a heartbeat maintenance message through lifetime information, the verification message is determined to be a heartbeat maintenance message; when the verification message is determined to be not a heartbeat maintenance message through session information, or the verification message is determined to be not a heartbeat maintenance message through lifetime information, the verification message is determined to be not a heartbeat maintenance message.

[0065] The specific steps of determining whether a verification message is a heartbeat hold message through each message information are described in detail below.

[0066] Optionally, the specific steps for determining whether the verification message is a heartbeat maintenance message through session information are: determining the third session information of the verification message through the security protection device, if the third session information is the same as the second session information of the test message, then determining that the verification message is a heartbeat maintenance message, if different, then determining that the verification message is not a heartbeat maintenance message.

[0067] The second session information includes a source port, a destination port, a source address, a destination address and a protocol type. If the third session information is the same as the second session information, it can be ensured that the verification message and the test message are in the same TCP session.

[0068] Optionally, the specific steps of determining whether the verification message is a heartbeat maintenance message through the lifetime information are: determining the first lifetime information of the data message sent by the client and the second lifetime information of the verification message through the security protection device; if the first lifetime information is the same as the second lifetime information, it is determined that the verification message is a heartbeat maintenance message; if they are different, the verification fails.

[0069] The first survival time information of the data message can be represented by TTL. The message randomly sent by the attack client is random, and the session information may be the same as the test message. Therefore, in order to further improve security protection, the first survival time information and the second survival time information can be set. It should be noted that since the attack client sends messages randomly, the TTL of each message sent by the attack client is different.

[0070] Optionally, the specific steps of determining whether the verification message is a heartbeat hold message through the setting method are: determining the setting method of the verification message through the security protection device, if the setting method of the verification message is only ACK setting, the verification passes, if the setting method of the verification message is not only ACK setting, the verification fails.

[0071] The setting mode of the verification message is to set only ACK, which can ensure that the security protection device receives the verification message.

[0072] Optionally, the specific steps of determining whether the verification message is a heartbeat maintenance message by whether it carries payload data are: determining whether the verification message carries payload data through a security protection device; if the verification message does not carry payload data, the verification passes; if the verification message carries payload data, the verification fails.

[0073] The verification message is set not to carry effective load data, so as to avoid the verification message interfering with the original data of the client.

[0074] Optionally, the specific steps of determining whether the verification message is a heartbeat maintenance message through the confirmation number are: determining the confirmation number of the verification message through the security protection device, if the confirmation number of the verification message is equal to the sequence number of the test message plus 1, the verification passes, if not equal, the verification fails.

[0075] If the confirmation number of the verification message is equal to the sequence number of the test message plus 1, it can be ensured that the client has received the previous test message normally.

[0076] Optionally, the specific steps of determining whether the verification message is a heartbeat maintenance message through the serial number are: determining the serial number of the data message sent by the client, the length value of the payload data, and the serial number of the verification message through the security protection device; if the sequence number of the verification message is equal to the sum of the sequence number of the data message sent by the client and the length value of the payload data, the verification passes; if not equal, the verification fails.

[0077] If the sequence number of the verification message is equal to the sum of the sequence number of the data message sent by the client and the length value of the payload data, it can be ensured that the data message sent by the client is a payload, not an attack message.

[0078] One point that needs to be added is that the same client only needs to be verified once. Accordingly, the method also includes: if the verification is successful, the first IP address information of the client and the first life time information of the data message are associated and added to the white list; in response to receiving a new data message, the second IP address information of the client corresponding to the new data message and the third life time information of the new data message are determined; if the first IP address information that is the same as the second IP address information exists in the white list, and the first life time associated with the first IP address information is the same as the third life time information, the new data message is sent directly to the corresponding destination server.

[0079] The disclosed embodiment provides a data processing method: in response to receiving a data message sent by a client, a security detection device is used to detect whether the destination server corresponding to the data message is under a network attack; if it is detected that the destination server is under a network attack, the data message is pulled to the security protection device, and a test message is sent to the client through the security protection device, wherein the sequence number of the test message is outside the sliding window of the client, so as to trigger the client to return a verification message to the security protection device; the verification message returned by the client is verified by the security protection device, and if the verification passes, the client is determined to be a legitimate client, and the data message is sent to the destination server, and if the verification fails, the client is determined to be an attacking client, and the data message is discarded. In an embodiment of the present application, when the destination server is under a network attack, the security protection device can replace the server to send a test message to the client, and the sequence number of the test message is outside the sliding window of the client, which can trigger the client to return the verification message, so that the verification message can be verified by the security protection device, and then it is determined whether the client is legitimate, and in the process of verifying the verification message by the security protection device, the network connection between the server and the client does not need to be stopped, which improves the quality of the network connection during the network security protection process, thereby improving the user experience.

[0080] Figure 6This is a structural block diagram of a data processing device provided by an embodiment of the present disclosure. The data processing device is applied to a network protection system, and the network protection system includes a security detection device and a security protection device. Figure 6 The device includes: a detection module 601, a sending module 602 and a verification module 603.

[0081] The detection module 601 is used to detect, in response to receiving a data message sent by a client, whether the destination server corresponding to the data message is under a network attack through the security detection device;

[0082] A sending module 602 is used to pull the data message to the security protection device if it is detected that the destination server is under a network attack, and send a test message to the client through the security protection device, wherein the sequence number of the test message is outside the sliding window of the client, so as to trigger the client to return a verification message to the security protection device;

[0083] Verification module 603 is used to verify the verification message returned by the client through the security protection device. If the verification passes, the client is determined to be a legitimate client and the data message is sent to the destination server. If the verification fails, the client is determined to be an attacking client and the data message is discarded.

[0084] According to one or more embodiments of the present disclosure, the device also includes: a message generating module, the message generating module is used to determine the confirmation number of the data message sent by the client, and determine the sequence number of the test message as the confirmation number of the data message minus a preset value; and / or, determine the first session information of the data message sent by the client, wherein the first session information includes the source port, destination port, source address, destination address and protocol type, and synchronize the second session information of the test message to the first session information; and / or, set the setting mode of the test message to only ACK setting; and / or, set the test message to carry no payload data.

[0085] According to one or more embodiments of the present disclosure, the verification module 603 verifies the verification message returned by the client through the security protection device, specifically including: obtaining the message information of the verification message; determining whether the verification message is a heartbeat maintenance message according to the message information of the verification message through the security protection device; if so, the verification passes, and if not, the verification fails.

[0086] According to one or more embodiments of the present disclosure, the message information of the verification message includes one or more of the following: session information, lifetime information, setting mode, whether to carry payload data, confirmation number and sequence number; accordingly, the verification module 603 determines whether the verification message is a heartbeat maintenance message according to the message information of the verification message through the security protection device, specifically including: determining whether the verification message is a heartbeat maintenance message according to at least one message information in the verification message through the security protection device.

[0087] According to one or more embodiments of the present disclosure, the network protection system also includes a control center device; the sending module 602 pulls the data packet to the security protection device, specifically including: sending attack alarm information to the control center device through the security detection device, the control center device is used to send a protection instruction to the security protection device in response to receiving the attack alarm information, wherein the protection instruction carries the IP address information of the destination server corresponding to the data packet; the security protection device determines the routing device corresponding to the IP address information of the destination server in response to receiving the protection instruction, and pulls the data packet to the security protection device through the routing device.

[0088] According to one or more embodiments of the present disclosure, the detection module 601, the process of detecting whether the destination server corresponding to the data message is under a network attack through the security detection device, specifically includes: detecting the number of messages, the number of data packets and the number of connected clients of the destination server corresponding to the data message through the security detection device; if the number of messages is greater than a first preset threshold and / or the number of data packets is greater than a second preset threshold and / or the number of connected clients is greater than a third preset threshold, it is determined that the destination server is under a network attack; if the number of messages is not greater than the first preset threshold and the number of data packets is not greater than the second preset threshold and the number of connected clients is not greater than the third preset threshold, it is determined that the destination server is not under a network attack.

[0089] According to one or more embodiments of the present disclosure, the device also includes: an adding module; the adding module is used to associate the first IP address information of the client and the first lifetime information of the data packet, and add it to the whitelist if the verification is passed; in response to receiving a new data packet, determine the second IP address information of the client corresponding to the new data packet and the third lifetime information of the new data packet; if the whitelist contains the same first IP address information as the second IP address information, and the first lifetime associated with the first IP address information is the same as the third lifetime information, then the new data packet is sent directly to the corresponding destination server.

[0090] According to one or more embodiments of the present disclosure, the device also includes: a discarding module; the discarding module is used to determine that the client is an attacking client through the security protection device and discard the data message if the verification message returned by the client is not received within a preset time period.

[0091] According to one or more embodiments of the present disclosure, the network protection system also includes a splitter; the detection module 601, in response to receiving a data packet sent by the client, detects through the security detection device whether the destination server corresponding to the data packet is under a network attack, specifically including: in response to receiving a data packet sent by the client, copying the data packet through a splitter, and sending the copied data packet to the security detection device, and detecting through the security detection device whether the destination server corresponding to the data packet is under a network attack; the detection module 601 is also used to: if it is detected that the destination server is not under a network attack, send the data packet to the destination server.

[0092] The detection module 601, the sending module 602 and the verification module 603 are connected in sequence. The data processing device provided in this embodiment can execute the technical solution of the above method embodiment, and its implementation principle and technical effect are similar, which will not be described in detail in this embodiment.

[0093] Figure 7 A schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present disclosure. Figure 7 The electronic device 700 may be a terminal device or a server. The terminal device may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, personal digital assistants (PDAs), tablet computers (Portable Android Devices, PADs), portable multimedia players (PMPs), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0094] like Figure 7As shown, the electronic device 700 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage device 708 to a random access memory (RAM) 703. Various programs and data required for the operation of the electronic device 700 are also stored in the RAM 703. The processing device 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0095] Typically, the following devices may be connected to the I / O interface 705: input devices 706 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 707 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 708 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 709. The communication devices 709 may allow the electronic device 700 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 7 The electronic device 700 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0096] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 709, or installed from a storage device 708, or installed from a ROM 702. When the computer program is executed by the processing device 701, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0097] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0098] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0099] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device executes the method shown in the above embodiment.

[0100] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0101] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0102] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a unit does not limit the unit itself in some cases. For example, the first acquisition unit may also be described as a "unit for acquiring at least two Internet Protocol addresses".

[0103] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0104] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0105] In a first aspect, according to one or more embodiments of the present disclosure, a data processing method is provided, which is applied to a network protection system, wherein the network protection system includes a security detection device and a security protection device, and the method includes:

[0106] In response to receiving a data message sent by a client, detecting, by the security detection device, whether a destination server corresponding to the data message is under a network attack;

[0107] If it is detected that the destination server is under a network attack, the data message is pulled to the security protection device, and a test message is sent to the client through the security protection device, wherein the sequence number of the test message is outside the sliding window of the client, so as to trigger the client to return a verification message to the security protection device;

[0108] The verification message returned by the client is verified by the security protection device. If the verification passes, the client is determined to be a legitimate client and the data message is sent to the destination server. If the verification fails, the client is determined to be an attacking client and the data message is discarded.

[0109] According to one or more embodiments of the present disclosure, before sending the test message to the client through the security protection device, it also includes: determining the confirmation number of the data message sent by the client, and determining the sequence number of the test message as the confirmation number of the data message minus a preset value; and / or, determining the first session information of the data message sent by the client, wherein the first session information includes the source port, destination port, source address, destination address and protocol type, and synchronizing the second session information of the test message to the first session information; and / or, setting the setting mode of the test message to only ACK setting; and / or, setting the test message to carry no payload data.

[0110] According to one or more embodiments of the present disclosure, the verification of the verification message returned by the client by the security protection device includes: obtaining message information of the verification message; determining by the security protection device whether the verification message is a heartbeat maintenance message based on the message information of the verification message; if so, the verification passes, and if not, the verification fails.

[0111] According to one or more embodiments of the present disclosure, the message information of the verification message includes one or more of the following: session information, lifetime information, setting mode, whether to carry payload data, confirmation number and sequence number; accordingly, determining whether the verification message is a heartbeat maintenance message according to the message information of the verification message by the security protection device includes: determining whether the verification message is a heartbeat maintenance message according to at least one message information in the verification message by the security protection device.

[0112] According to one or more embodiments of the present disclosure, the network protection system also includes a control center device; the pulling of the data packet to the security protection device includes: sending attack alarm information to the control center device through the security detection device, the control center device is used to send a protection instruction to the security protection device in response to receiving the attack alarm information, wherein the protection instruction carries the IP address information of the destination server corresponding to the data packet; the security protection device determines the routing device corresponding to the IP address information of the destination server in response to receiving the protection instruction, and pulls the data packet to the security protection device through the routing device.

[0113] According to one or more embodiments of the present disclosure, the process of detecting whether the destination server corresponding to the data message is under a network attack by the security detection device includes: detecting the number of messages, the number of data packets and the number of connected clients of the destination server corresponding to the data message by the security detection device; if the number of messages is greater than a first preset threshold and / or the number of data packets is greater than a second preset threshold and / or the number of connected clients is greater than a third preset threshold, determining that the destination server is under a network attack; if the number of messages is not greater than the first preset threshold and the number of data packets is not greater than the second preset threshold and the number of connected clients is not greater than the third preset threshold, determining that the destination server is not under a network attack.

[0114] According to one or more embodiments of the present disclosure, it also includes: if the verification is passed, the first IP address information of the client and the first lifetime information of the data packet are associated and added to the whitelist; in response to receiving a new data packet, the second IP address information of the client corresponding to the new data packet and the third lifetime information of the new data packet are determined; if the whitelist contains the same first IP address information as the second IP address information, and the first lifetime associated with the first IP address information is the same as the third lifetime information, the new data packet is sent directly to the corresponding destination server.

[0115] According to one or more embodiments of the present disclosure, the method further includes: if no verification message returned by the client is received within a preset time period, determining that the client is an attacking client through the security protection device and discarding the data message.

[0116] According to one or more embodiments of the present disclosure, the network protection system further includes an optical splitter; accordingly, in response to receiving a data message sent by a client, detecting by the security detection device whether the destination server corresponding to the data message is under a network attack, comprises: in response to receiving a data message sent by a client, copying the data message by the optical splitter, and sending the copied data message to the security detection device, and detecting by the security detection device whether the destination server corresponding to the data message is under a network attack;

[0117] The method further includes: if it is detected that the destination server is not attacked by the network, sending the data message sent by the client to the destination server.

[0118] According to one or more embodiments of the present disclosure, the method further includes: if it is detected that the destination server is not attacked by a network, sending the data message to the destination server.

[0119] In a second aspect, according to one or more embodiments of the present disclosure, there is provided a data processing device, which is applied to a network protection system, the network protection system security detection device and the security protection device, and the device comprises:

[0120] A detection module, configured to detect, in response to receiving a data message sent by a client, whether a destination server corresponding to the data message is under a network attack through the security detection device;

[0121] A sending module, configured to, if it is detected that the destination server is under a network attack, pull the data message to the security protection device, and send a test message to the client through the security protection device, wherein the sequence number of the test message is outside the sliding window of the client, so as to trigger the client to return a verification message to the security protection device;

[0122] The verification module is used to verify the verification message returned by the client through the security protection device. If the verification passes, the client is determined to be a legitimate client and the data message is sent to the destination server. If the verification fails, the client is determined to be an attacking client and the data message is discarded.

[0123] According to one or more embodiments of the present disclosure, the device also includes: a message generating module, the message generating module is used to determine the confirmation number of the data message sent by the client, and determine the sequence number of the test message as the confirmation number of the data message minus a preset value; and / or, determine the first session information of the data message sent by the client, wherein the first session information includes the source port, destination port, source address, destination address and protocol type, and synchronize the second session information of the test message to the first session information; and / or, set the setting mode of the test message to only ACK setting; and / or, set the test message to carry no payload data.

[0124] According to one or more embodiments of the present disclosure, the verification module verifies the verification message returned by the client through the security protection device, specifically including: obtaining the message information of the verification message; determining whether the verification message is a heartbeat maintenance message according to the message information of the verification message through the security protection device; if so, the verification passes, and if not, the verification fails.

[0125] According to one or more embodiments of the present disclosure, the message information of the verification message includes one or more of the following: session information, lifetime information, setting mode, whether to carry payload data, confirmation number and sequence number; accordingly, the verification module determines whether the verification message is a heartbeat maintenance message according to the message information of the verification message through the security protection device, specifically including: determining whether the verification message is a heartbeat maintenance message according to at least one message information in the verification message through the security protection device.

[0126] According to one or more embodiments of the present disclosure, the network protection system also includes a control center device; the sending module pulls the data packet to the security protection device, specifically including: sending attack alarm information to the control center device through the security detection device, the control center device is used to send a protection instruction to the security protection device in response to receiving the attack alarm information, wherein the protection instruction carries the IP address information of the destination server corresponding to the data packet; the security protection device determines the routing device corresponding to the IP address information of the destination server in response to receiving the protection instruction, and pulls the data packet to the security protection device through the routing device.

[0127] According to one or more embodiments of the present disclosure, the detection module, the process of detecting whether the destination server corresponding to the data message is under a network attack through the security detection device, specifically includes: detecting the number of messages, the number of data packets and the number of connected clients of the destination server corresponding to the data message through the security detection device; if the number of messages is greater than a first preset threshold and / or the number of data packets is greater than a second preset threshold and / or the number of connected clients is greater than a third preset threshold, determining that the destination server is under a network attack; if the number of messages is not greater than the first preset threshold and the number of data packets is not greater than the second preset threshold and the number of connected clients is not greater than the third preset threshold, determining that the destination server is not under a network attack.

[0128] According to one or more embodiments of the present disclosure, the device also includes: an adding module; the adding module is used to associate the first IP address information of the client and the first lifetime information of the data packet, and add it to the whitelist if the verification is passed; in response to receiving a new data packet, determine the second IP address information of the client corresponding to the new data packet and the third lifetime information of the new data packet; if the whitelist contains the same first IP address information as the second IP address information, and the first lifetime associated with the first IP address information is the same as the third lifetime information, then the new data packet is sent directly to the corresponding destination server.

[0129] According to one or more embodiments of the present disclosure, the device also includes: a discarding module; the discarding module is used to determine that the client is an attacking client through the security protection device and discard the data message if the verification message returned by the client is not received within a preset time period.

[0130] According to one or more embodiments of the present disclosure, the network protection system further includes an optical splitter; the detection module detects whether the destination server corresponding to the data message is under network attack through the security detection device in response to receiving the data message sent by the client, specifically including: in response to receiving the data message sent by the client, copying the data message through the optical splitter, and sending the copied data message to the security detection device, and detecting whether the destination server corresponding to the data message is under network attack through the security detection device;

[0131] The detection module is also used for: if it is detected that the destination server is not attacked by the network, sending the data message to the destination server.

[0132] In a third aspect, according to one or more embodiments of the present disclosure, there is provided an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0133] The memory stores computer-executable instructions;

[0134] The processor executes the computer-executable instructions stored in the memory to implement the data processing method described in the first aspect and various possible designs of the first aspect.

[0135] In a fourth aspect, according to one or more embodiments of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer execution instructions. When a processor executes the computer execution instructions, the data processing method described in the first aspect and various possible designs of the first aspect is implemented.

[0136] In a fifth aspect, an embodiment of the present disclosure provides a computer program product, including a computer program, which, when executed by a processor, implements the data processing method described in the first aspect and various possible designs of the first aspect.

[0137] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0138] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0139] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A data processing method, It is characterized in that Applied to a network protection system, the network protection system includes a security detection device and a security protection device, and the method includes: In response to receiving a data message sent by a client, detecting, by the security detection device, whether a destination server corresponding to the data message is under a network attack; If it is detected that the destination server is under a network attack, the data message is pulled to the security protection device, and a test message is sent to the client through the security protection device, wherein the sequence number of the test message is outside the sliding window of the client, so as to trigger the client to return a verification message to the security protection device; Verify the verification message returned by the client through the security protection device. If the verification is successful, determine that the client is a legitimate client and send the data message to the destination server. If the verification is unsuccessful, determine that the client is an attacking client and discard the data message. Before sending a test message to the client through the security protection device, the method includes: constructing a test message through the security protection device; wherein, constructing the test message through the security protection device includes: determining the confirmation number of the data message sent by the client, determining the sequence number of the test message as the confirmation number of the data message minus a preset value; and, determining the first session information of the data message sent by the client, wherein the first session information includes a source port, a destination port, a source address, a destination address and a protocol type, synchronizing the second session information of the test message with the first session information; and, setting the setting mode of the test message to only ACK setting.

2. The method according to claim 1, It is characterized in that The constructing of the test message through the security protection device also includes: setting the test message not to carry effective load data.

3. The method according to claim 1, It is characterized in that The verifying the verification message returned by the client by the security protection device includes: Obtaining message information of the verification message; The security protection device determines whether the verification message is a heartbeat maintenance message based on the message information of the verification message; if so, the verification is successful, and if not, the verification is unsuccessful.

4. The method according to claim 3, It is characterized in that The message information of the verification message includes one or more of the following: session information, lifetime information, setting mode, whether to carry payload data, confirmation number and sequence number; Correspondingly, determining, by the security protection device, whether the verification message is a heartbeat hold message according to the message information of the verification message includes: The security protection device determines whether the verification message is a heartbeat maintenance message according to at least one message information in the verification message.

5. The method according to claim 1, It is characterized in that The network protection system also includes a control center device; the step of pulling the data message to the security protection device includes: Sending attack warning information to the control center device through the security detection device, and the control center device is used to send a protection instruction to the security protection device in response to receiving the attack warning information, wherein the protection instruction carries the IP address information of the destination server corresponding to the data message; In response to receiving the protection instruction, the security protection device determines the routing device corresponding to the IP address information of the destination server, and pulls the data message to the security protection device through the routing device.

6. The method according to claim 1, It is characterized in that The process of detecting whether the destination server corresponding to the data message is under network attack by the security detection device includes: Detecting the number of messages, the number of data packets and the number of connected clients of the destination server corresponding to the data message through the security detection device; If the number of messages is greater than a first preset threshold and / or the number of data packets is greater than a second preset threshold and / or the number of connected clients is greater than a third preset threshold, it is determined that the destination server is under a network attack; If the number of messages is not greater than the first preset threshold, the number of data packets is not greater than the second preset threshold, and the number of connected clients is not greater than the third preset threshold, it is determined that the destination server is not under a network attack.

7. The method according to claim 1, It is characterized in that Also includes: If the verification is successful, the first IP address information of the client and the first lifetime information of the data message are associated and added to the whitelist; In response to receiving a new data packet, determining second IP address information of a client corresponding to the new data packet and third lifetime information of the new data packet; If the whitelist contains the first IP address information that is the same as the second IP address information, and the first lifetime associated with the first IP address information is the same as the third lifetime information, the new data message is directly sent to the corresponding destination server.

8. The method according to any one of claims 1 to 7, It is characterized in that Also includes: If the verification message returned by the client is not received within a preset time period, the client is determined to be an attacking client through the security protection device, and the data message is discarded.

9. The method according to any one of claims 1 to 7, It is characterized in that The network protection system also includes an optical splitter; Accordingly, in response to receiving the data message sent by the client, detecting by the security detection device whether the destination server corresponding to the data message is under a network attack includes: In response to receiving a data message sent by a client, the data message is copied through an optical splitter, and the copied data message is sent to a security detection device, and the security detection device is used to detect whether a destination server corresponding to the data message is under a network attack; The method further includes: if it is detected that the destination server is not attacked by the network, sending the data message sent by the client to the destination server.

10. A data processing device, It is characterized in that Applied to a network protection system, the network protection system includes a security detection device and a security protection device, and the device includes: A detection module, configured to detect, in response to receiving a data message sent by a client, whether a destination server corresponding to the data message is under a network attack through the security detection device; A sending module, configured to, if it is detected that the destination server is under a network attack, pull the data message to the security protection device, and send a test message to the client through the security protection device, wherein the sequence number of the test message is outside the sliding window of the client, so as to trigger the client to return a verification message to the security protection device; A verification module, used to verify the verification message returned by the client through the security protection device, if the verification is successful, the client is determined to be a legitimate client, and the data message is sent to the destination server; if the verification is unsuccessful, the client is determined to be an attacking client, and the data message is discarded; The sending module is also used to construct a test message through a security protection device; wherein, constructing a test message through a security protection device includes: determining a confirmation number of a data message sent by the client, determining a sequence number of the test message as the confirmation number of the data message minus a preset value; and, determining first session information of the data message sent by the client, wherein the first session information includes a source port, a destination port, a source address, a destination address, and a protocol type, synchronizing the second session information of the test message with the first session information; and, setting the setting mode of the test message to only ACK setting.

11. An electronic device, It is characterized in that include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the data processing method according to any one of claims 1 to 9.

12. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores computer-executable instructions, and when the processor executes the computer-executable instructions, the data processing method according to any one of claims 1 to 9 is implemented.

13. A computer program product, It is characterized in that The invention comprises a computer program, which implements the data processing method according to any one of claims 1 to 9 when being executed by a processor.

Images