An attack attribution system and method

Abstract

Embodiments of the present application provide an attack tracing system and method, which are used to solve the problem that the prior art cannot accurately and effectively obtain a detection packet, and thus cannot accurately perform attack tracing. In the embodiments of the present application, the control device controls the attack device to forge a source IP address when sending an attack packet, and the control device does not forge a source IP address when sending a detection packet. The second TTL in the attack packet and the detection packet is the TTL between the attack device or the control device and a virtual reflector. After reverse detection, the first TTL in a response packet returned by a device corresponding to a target source IP address is the TTL between the device corresponding to the target source IP address and the virtual reflector. If the deviation between the first TTL and the second TTL is less than a threshold, the target source IP address is not forged, which indicates that the packet is a detection packet. Thus, the detection packet can be accurately identified, and the accuracy of attack tracing is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of security protection, in particular to an attack tracing system and method. BACKGROUND

[0002] Distributed Denial of Service (DDoS) reflection attack is a common attack method in DDoS attack activities. Attackers use reflectors in public networks to reflect and amplify attack traffic, causing instability, unavailability or even paralysis of target networks. Specifically, the attacker's device (hereinafter referred to as the control device) will usually detect reflectors through detection packets. After detecting the reflector, the attacker sends attack packets to the reflector and sets the source IP address of the attack packet as the IP address of the victim. After receiving the attack packet, the reflector reflects the attack packet to the device corresponding to the source IP address, thereby attacking the victim. As an old attack method, DDoS reflection attack is still widely used by attackers so far. The victim can only obtain the address of the reflector, but cannot obtain the address of the control device that actually initiates the attack. Although the protection technology against DDoS reflection attack is relatively mature and has a high degree of commercialization, it is still difficult to trace the control device because the DDoS reflection attack uses a fake source IP address to deceive the reflector and attack the victim.

[0003] The DDoS reflection attack tracing process is to find the reflector control IP, i.e., the IP address of the control device, so as to trace the control device. In order to perform attack tracing, global intelligence, including intelligence in the pre-attack detection phase, needs to be obtained. To obtain such intelligence, multiple resources need to be coordinated, for example, the attack packets and detection packets sent by the control device will pass through the operator and the gateway, so the operator packets and the gateway packets need to be obtained to obtain the detection packets. However, this process requires the cooperation of multiple external parties, and there are many other packets involved in the operator packets and the gateway packets, so it is difficult to accurately obtain the detection packets, and thus it is difficult to accurately perform attack tracing. In addition, due to geographical restrictions, only the detection packets for domestic reflectors can be obtained from these packets, and the detection packets for foreign reflectors cannot be obtained, which results in that the reflection attack tracing can only be performed in the domestic, and the reflection attack by foreign attackers against foreign targets cannot be traced. SUMMARY

[0004] The attack tracing system and method provided by the embodiments of the present application can accurately and effectively obtain the detection packets, and thus accurately perform attack tracing.

[0005] In a first aspect, the embodiments of the present application provide an attack tracing system, the system comprising: a virtual reflector with reflector function and a server;

[0006] The virtual reflector is configured to receive a packet, acquire a first time to live (TTL) in a response packet returned by a device corresponding to a target source Internet Protocol (IP) address in the packet according to reverse probing based on the target source IP address, and send the packet and the first TTL to the server.

[0007] The server is configured to acquire a second TTL in the packet, determine that the packet is a probe packet and determine that the target source IP address is an IP address of a control device if a deviation between the first TTL and the second TTL is less than a threshold.

[0008] In a second aspect, the embodiments of the present application further provide an attack tracing method, the method comprising:

[0009] receiving a packet;

[0010] acquiring a first time to live (TTL) in a response packet returned by a device corresponding to a target source Internet Protocol (IP) address in the packet according to reverse probing based on the target source IP address, and sending the packet and the first TTL to a server, so that the server identifies whether the packet is a probe packet based on the first TTL and a second TTL in the packet, and determines an IP address of a control device.

[0011] In a third aspect, the embodiments of the present application further provide an attack tracing method, the method comprising:

[0012] receiving a packet and a first TTL sent by a virtual reflector;

[0013] acquiring a second TTL in the packet, and determining that the packet is a probe packet and determining that the target source IP address is an IP address of a control device if a deviation between the first TTL and the second TTL is less than a threshold.

[0014] In the embodiment of the present application, the virtual reflector with the reflector function receives a packet, acquires a first TTL in a response packet returned by a device corresponding to a target source IP address in the packet according to the target source IP address, and sends the packet and the first TTL to a server. The server acquires a second TTL in the received packet. If the deviation between the first TTL and the second TTL is less than a threshold, it is determined that the packet is a detection packet, and the target source IP address is the IP address of the control device. In the embodiment of the present application, the control device controls the attack device to forge the source IP address when sending the attack packet, and does not forge the source IP address when sending the detection packet. That is, the second TTL in the attack packet and the detection packet is the TTL between the attack device or the control device and the virtual reflector, and after the reverse detection, the first TTL in the response packet returned by the device corresponding to the target source IP address is the TTL between the device corresponding to the target source IP address and the virtual reflector. If the deviation between the first TTL and the second TTL is less than the threshold, the target source IP address is not forged, and it can be determined that the packet is a detection packet, so that the detection packet can be accurately identified, and the accuracy of attack tracing can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0015] In order to more clearly illustrate the technical solutions of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0016] Figure 1 A schematic diagram of an attack tracing system provided by the embodiment of the present application;

[0017] Figure 2 A process schematic diagram of deploying a virtual reflector provided by the embodiment of the present application;

[0018] Figure 3 A process schematic diagram of attack tracing provided by the embodiment of the present application;

[0019] Figure 4 A process schematic diagram executed by a virtual reflector provided by the embodiment of the present application;

[0020] Figure 5 A schematic diagram of accessing a log corresponding to a packet provided by the embodiment of the present application;

[0021] Figure 6 A schematic diagram of a log corresponding to a response packet provided by the embodiment of the present application;

[0022] Figure 7A process diagram for generating a log corresponding to a packet provided by an embodiment of the present application is shown in FIG. 1.

[0023] Figure 8 A diagram for aggregating logs provided by an embodiment of the present application is shown in FIG. 2.

[0024] Figure 9 A process diagram for obtaining a first TTL provided by an embodiment of the present application is shown in FIG. 3.

[0025] Figure 10 A detailed process diagram for determining attack tracing provided by an embodiment of the present application is shown in FIG. 4.

[0026] Figure 11 A process diagram for processing a packet provided by an embodiment of the present application is shown in FIG. 5.

[0027] Figure 12 A process diagram for attack tracing provided by an embodiment of the present application is shown in FIG. 6.

[0028] Figure 13 A process diagram for an attack tracing method provided by an embodiment of the present application is shown in FIG. 7.

[0029] Figure 14 A process diagram for another attack tracing method provided by an embodiment of the present application is shown in FIG. 8.

[0030] Figure 15 A structure diagram of an attack tracing device provided by an embodiment of the present application is shown in FIG. 9.

[0031] Figure 16 A structure diagram of another attack tracing device provided by an embodiment of the present application is shown in FIG. 10.

[0032] Figure 17 A structure diagram of an electronic device provided by an embodiment of the present application is shown in FIG. 11. DETAILED DESCRIPTION

[0033] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0034] In order to accurately and effectively obtain a detection packet, and further trace a control device of a DDoS reflector, an attack tracing system and method are provided by an embodiment of the present application.

[0035] The virtual reflector with reflector function receives a packet, acquires a first TTL in a response packet returned by a device corresponding to a target source IP address in the packet according to the target source IP address, and sends the packet and the first TTL to a server.

[0036] Figure 1 A schematic diagram of an attack tracing system provided by an embodiment of the present application is shown in the figure. The system comprises a virtual reflector 101 with reflector function and a server 102.

[0037] The virtual reflector 101 is configured to receive a packet, acquire a first TTL in a response packet returned by a device corresponding to a target source IP address in the packet according to the target source IP address, and send the packet and the first TTL to the server 102.

[0038] The server 102 is configured to acquire a second TTL in the packet. If a deviation between the first TTL and the second TTL is less than a threshold, it is determined that the packet is a probe packet, and it is determined that the target source IP address is an IP address of a control device.

[0039] To forge reflectors, business personnel can pre-collect common reflectors, such as Network Time Protocol (NTP) reflectors and Domain Name System (DNS) reflectors. Business personnel study the interactive messages that can trigger reflection for various types of reflectors, such as the NTP monitoring list (monlist) function interactive message. When responding to this monlist function interactive message, the NTP reflector returns the IP addresses of the last 600 clients that have synchronized with its time. This response packet is much larger than the request packet. Based on the interactive messages that can trigger reflection described above, business personnel can simulate reflection interactions. They can first identify the interactive messages that can trigger reflection for the corresponding type of reflector, and use the Request for Comments (RFC) standard to validate each field, focusing on validating request characteristics. For example, the monlist characteristic request code of the NTP server is "Get Monitoring Server List 1 (MON_GETLIST_1)". After the validation is successful, the response packet is constructed according to the RFC standard. For example, the NTP reflection response packet will contain multiple Monlist item addresses, where the Monlist item address is a description of the client's IP address. Based on this, simulated reflection interaction messages are obtained, and virtual reflector honeypots are created using these messages. Once created, the virtual reflector honeypot is packaged into a container (Docker) image and uploaded to an image repository. During deployment, the server pulls the image and runs the container to deploy the virtual reflector. These servers are located in several regions around the world.

[0040] Figure 2 This is a schematic diagram illustrating the process of deploying a virtual reflector, as provided in an embodiment of this application.

[0041] Depend on Figure 2 It is known that business personnel can collect various reflectors, obtain message interactions that can trigger reflection, simulate reflection interaction messages, create virtual reflector honeypots based on simulated reflection interaction messages, and package the virtual reflector honeypots into Docker images.

[0042] It should be noted that the virtual reflector implements the corresponding interaction process according to the RFC standard, so that the virtual reflector has the ability to return the reflected packet, thereby deceiving the control device. That is, the virtual reflector can pretend to be a real reflector, and when the control device probes or the attack device attacks, that is, when the control device sends a probe packet or the attack device sends an attack packet, the virtual reflector cannot be distinguished from a real reflector, so that the virtual reflector can collect the packets sent by the control device and the attack device. Whether the attacker performs a probing activity on the virtual reflector or uses the virtual reflector to perform an attack activity, the virtual reflector can capture traffic, that is, receive packets.

[0043] The virtual reflector receives the packet, which includes the packet sent by the attack device and the control device, and also includes the packet sent by other devices.

[0044] In order to accurately perform attack tracing, the target source IP address is included in the packet, and the virtual reflector can parse and obtain the IP address of the access host. Specifically, the target source IP address in the packet can be obtained, and a reverse probe data packet is constructed according to the obtained target source IP address to measure the distance between itself and the access host and record. Specifically, the virtual reflector can obtain the TTL in the response packet returned by the device corresponding to the target source IP address. In order to facilitate distinction, the TTL can be referred to as a first TTL. After obtaining the first TTL, the virtual reflector sends the packet and the first TTL to the server. The virtual reflector can return the packet to the server at a regular time.

[0045] The server obtains the TTL in the received packet, which can be referred to as a second TTL for ease of distinction.

[0046] Since the attack device will fake the source IP address of the attack packet when sending the attack packet, if the packet is an attack packet, the target source IP address in the packet is the IP address after being faked by the attack device, and is not the IP address of the attack device. The first TTL can be considered as the distance between the device corresponding to the target source IP address and the virtual reflector, and the second TTL in the packet is the TTL of the packet sent by the attack device, that is, the distance between the attack device and the virtual reflector.

[0047] Based on this, the electronic device can determine whether the deviation between the first TTL and the second TTL is less than a threshold. The deviation between the first TTL and the second TTL is the absolute value of the difference between the first TTL and the second TTL. The threshold can be 3. If the deviation between the first TTL and the second TTL is less than the threshold, it can be considered that the distance between the device corresponding to the target source IP address and the virtual reflector is consistent with the distance between the attacking device and the virtual reflector. In this case, the device corresponding to the target source IP address can be considered the control device, the packet is a probe packet, and the target source IP address is the IP address of the control device. If the deviation between the first TTL and the second TTL is not less than the threshold, then the packet is determined to be an attack packet. This application provides a method for tracing the source of a DDoS reflection attack based on a honeypot.

[0048] This embodiment utilizes a simulated virtual reflector, deployed across different domains via a rented Virtual Private Server (VPS), to capture both probe and attack packets without relying on external packets from ISPs or gateways. This solves the problems of traditional DDoS reflection attack attribution reliance on external resources and the inability to perform cross-domain attribution.

[0049] Figure 3 This is a schematic diagram illustrating an attack tracing process provided in an embodiment of this application.

[0050] Depend on Figure 3 It is known that business personnel can create and deploy virtual reflector honeypots, and the virtual reflector can collect packets and perform reverse probing. Based on the second TTL in the packet and the first TTL obtained by reverse probing, the packet can be identified and traced.

[0051] Figure 4 This is a schematic diagram illustrating the execution process of a virtual reflector as provided in an embodiment of this application.

[0052] Depend on Figure 4 It is known that the virtual reflector can acquire packets, extract the target source IP address from the packets, obtain the first TTL in the response packet returned by the device corresponding to the target source IP address through reverse probing, and send back the first TTL and the packet. The server then stores the received data.

[0053] Since in the embodiment of the present application, the control device controls the attack device to forge the source IP address when sending the attack packet, and the control device does not forge the source IP address when sending the probe packet, that is, the second TTL in the attack packet and the probe packet is the TTL between the attack device or the control device and the virtual reflector, and after the reverse probe, the first TTL in the response packet returned by the device corresponding to the target source IP address is the TTL between the device corresponding to the target source IP address and the virtual reflector, if the deviation between the first TTL and the second TTL is less than the threshold, the target source IP address is not forged, and it can be indicated that the packet is a probe packet, and then the probe packet can be accurately identified, and the accuracy of attack tracing is improved.

[0054] In order to improve the accuracy of attack tracing, on the basis of the above embodiment, in the embodiment of the present application, the server 102 is further configured to acquire the protocol type in the packet, if the protocol type is the type of a preset reflector protocol, and the packet length of the packet is within a preset length range, it is determined that the packet is an access packet, wherein the access packet includes an attack packet and a probe packet, and the subsequent step of acquiring the second TTL in the packet is performed.

[0055] Since the packets received by the virtual reflector include attack packets, probe packets and garbage packets, wherein the garbage packets can be response packets returned by the device corresponding to the target source IP address, and the attack packets and the probe packets both comply with the reflector protocol, and the packet lengths of the attack packets and the probe packets are both within the preset length range, in order to filter the garbage packets, the server can acquire the protocol type in the received packet, judge whether the protocol type is the type of a preset reflector protocol, and judge whether the packet length of the packet is within a preset length range, wherein the type of the preset reflector protocol can be a user datagram protocol (UDP), if the protocol type is the type of the preset reflector protocol, and the packet length of the packet is within the preset length range, it can be indicated that the packet is an access packet, wherein the access packet includes an attack packet and a probe packet, and the second TTL in the packet can be acquired. If the protocol type is not the type of the preset reflector protocol, or the packet length of the packet is not within the preset length range, it is indicated that the packet is a garbage packet. In a possible implementation manner, the packet contains the packet length.

[0056] Wherein, the business personnel can construct the packet filtering rule based on the Berkeley Packet Filter (BPF) BPF rule in advance, use the Sniff sniffing data packet (i.e. packet), and filter the packet by using the constructed rule.

[0057] For ease of management, on the basis of the above embodiments, in the embodiments of the present application, the server 102 is further configured to perform structural processing on the message, generate a log corresponding to the message and record.

[0058] For ease of management, the server can perform unified structural processing on the received message after receiving the message, generate a log corresponding to the message and record. Through traffic processing, the messages sent by the attack device and the control device and the response message of the reverse probe are formatted, which reduces the storage space consumption and facilitates subsequent traceability analysis.

[0059] Table 1 is a content included in a received access message provided by the embodiments of the present application:

[0060]

[0061]

[0062] Table 1

[0063] The first column in Table 1 is the field name of the field included in the message, the second column in Table 1 is the field description corresponding to the field name, and the third column in Table 1 is the field included in the message. As can be seen from Table 1, the message includes a source IP address, the source IP address is an access source IP address, and the corresponding field is src_ip; the message includes a destination IP address, the destination IP address is a virtual reflector IP address, and the corresponding field is dst_ip; the message includes a source port, the source port is an access source port, and the corresponding field is src_port; the message includes a destination port, the destination port is an access destination port, and the corresponding field is dst_port; the message includes a packet length, the packet length is a message length, and the corresponding field is pkt_len; the message includes a packet Payload, the packet Payload is a message Payload, and the corresponding field is pkt_payload. The message includes a timestamp, the timestamp is an access timestamp, and the corresponding field is timestamp; the message includes a TTL, the TTL is an access packet TTL, and the corresponding field is ttl.

[0064] Figure 5 A schematic diagram of a log corresponding to an access message provided by the embodiments of the present application.

[0065] From Figure 5It can be seen that the source IP address in the log is 1.1.1.1, the destination IP address is 2.2.2.2, the source port is 54332, the destination port is 53, the packet length is 85, the packet payload is 000201000001000000000000005626169647503636f6d0000010001, the timestamp is 1704250126.4745564, and the TTL is 241.

[0066] Table 2 illustrates the contents of a received response message provided in an embodiment of this application:

[0067]

[0068]

[0069] Table 2

[0070] The first column of Table 2 lists the field names of the fields contained in the message; the second column lists the field descriptions corresponding to the field names; and the third column lists the fields contained in the message. As shown in Table 2, the message contains the source IP address (the IP address of the access source), with the corresponding field being src_ip; the destination IP address (the IP address of the virtual reflector), with the corresponding field being dst_ip; the timestamp (the timestamp of the access), with the corresponding field being timestamp; the TTL (Time-To-Live), with the corresponding field being ttl; and the Internet Control Message Protocol (ICMP) type, with the corresponding field being type.

[0071] Figure 6 This is a schematic diagram of a log corresponding to a response message provided in an embodiment of this application.

[0072] Depend on Figure 6 It can be seen that the source IP address in the log is 1.1.1.1, the destination IP address is 2.2.2.2, the timestamp is 1704250126.4745564, the TTL is 241, and the ICMP type is 0.

[0073] Table 1 shows a partial illustration of the logs corresponding to attack and probe packets, while Table 2 shows a partial illustration of the logs corresponding to response packets. Tables 1 and 2 also help to standardize the field specifications of the packets.

[0074] In a possible implementation, the server can perform traffic processing on the received packet, and the traffic processing is to parse the packet accessing the false reflector node and the corresponding response packet of the reverse probe, and save them as standard logs for trace analysis. If the protocol type is UDP, and the packet length of the packet is within a preset length range, the packet is an access packet, and the virtual reflector can parse the access packet using an access parser and record it according to the access packet standard log format formulated in Table 1. If the protocol type is an ICMP echo reply (Echo reply), it is a response packet returned by the reverse probe packet, that is, a garbage packet, which is parsed using a reverse probe parser and recorded according to the reverse probe packet standard log format formulated in Table 2.

[0075] Figure 7 A process diagram for generating a log corresponding to a packet is provided for the embodiments of the present application.

[0076] By Figure 7 It can be seen that the business personnel can preform the log format of the access packet and the response packet. The packet filtering rule is constructed, the server uses Sniff to sniff the packet and filter the packet, judges whether the packet is an access packet, if yes, the packet is parsed by the access parser to generate the corresponding log, if not, the packet is parsed by the reverse probe parser to generate the corresponding log.

[0077] In order to accurately perform attack trace, on the basis of the above embodiments, in the embodiments of the present application, the server 102 is specifically configured to obtain a first packet group containing the packet; wherein the first packet group is obtained by dividing each received packet according to a first preset time interval;

[0078] Obtain an aggregated packet with the target source IP address in the first packet group; wherein the aggregated packet is obtained by removing the third TTL in each candidate packet containing the same aggregation information in the first packet group, and aggregating; wherein the same aggregation information includes that the timestamp is within a preset sub-time period, and the source IP address and the destination port are the same;

[0079] Obtain each second TTL in the aggregated packet.

[0080] Since in actual scenarios, the DDoS reflection attack has the characteristic of large traffic, the record of a single data packet, that is, a single packet, will occupy a large amount of space, and when the number of false reflector nodes increases, the packet in a day can reach several hundred G, which will occupy a large amount of storage space. Therefore, the characteristics of the packets sent by the attack device and the control device are basically the same during the DDoS reflection attack, and thus the access traffic log preprocessing can be used to aggregate the packets.

[0081] Specifically, the server can divide each received packet according to a first preset time interval to obtain a plurality of packet groups, the first preset time interval can be 1 second, in order to facilitate the distinction, the packet group here can be referred to as a first packet group, and when aggregating, since the characteristics of the packets sent by the attack device and the control device are basically the same during the DDoS reflection attack, the server can use a timestamp, a source IP address and a destination port triplet for aggregation, the timestamp, the source IP address and the destination port can be referred to as aggregation information, the server can obtain each candidate packet containing the same aggregation information in the first packet group, and perform deduplication on a third TTL, a source port and a packet length in each candidate packet containing the same aggregation information, to realize aggregation of the each candidate packet. It should be noted that the same aggregation information includes that the timestamp is within a preset sub-time period, and the source IP address and the destination port are all the same.

[0082] Since the characteristics of the packets sent by the attack device and the control device are basically the same, that is, there are packets with basically the same characteristics in the access packets received by the virtual reflector, the server can identify the access packets from the received packets, and aggregate the identified access packets.

[0083] Table 3 is a schematic of the aggregated fields:

[0084] Field Name Field Description Field Source IP Address Access Source IP Address src_ip Destination IP Address Virtual Reflector IP Address dst_ip Source Port Access Source Port List src_port Destination Port Access Destination Port dst_port Timestamp Timestamp timestamp TTL Access Packet TTL List ttl Packet Length Packet Length pkt_len Packet Count Packet Count in First Packet Group pkt_count

[0085] Table 3

[0086] The first column in Table 3 is the field name contained after aggregation, the second column in Table 3 is the field description corresponding to the field name, and the third column in Table 3 is the corresponding field. As can be seen from Table 3, the source IP address is contained after aggregation, the source IP address is the access source IP address, and the corresponding field is src_ip; the destination IP address is contained after aggregation, the destination IP address is the virtual reflector IP address, and the corresponding field is dst_ip; the source port is contained after aggregation, the source port is the access source port list, and the corresponding field is src_port; the destination port is contained after aggregation, the destination port is the access destination port, and the corresponding field is dst_port; the timestamp is contained after aggregation, and the corresponding field is timestamp; the TTL is contained after aggregation, the TTL is the access packet TTL list, and the corresponding field is ttl; the packet length is contained after aggregation, the packet length is the packet length, and the corresponding field is pkt_len; the packet quantity is contained after aggregation, the packet quantity is the number of packets within one second, and the corresponding field is pkt_count.

[0087] In the embodiment of the application, the server can also obtain an aggregated packet containing a source IP address as a target source IP address, and obtain each second TTL in the aggregated packet.

[0088] In a possible implementation, after receiving the packet, the virtual reflector can convert the packet into a log, where the log includes the source IP address, TTL and other information in the packet. The virtual reflector sends the log to the server, and the server aggregates the log to generate an aggregated packet, which is the aggregated packet described in the embodiments of the present application. The server can identify, for each aggregated packet, whether the device corresponding to the source IP address in the aggregated packet is a control device. The business personnel can predefine the log record format and fields after aggregation, and the server stores the aggregated log according to the standard fields.

[0089] Figure 8 A schematic diagram of an aggregated log provided in the embodiments of the present application.

[0090] From Figure 8 It can be known that the source IP address in the aggregated log is 1.1.1.1, the destination IP address is 2.2.2.2, the source port is 80 and 443, the destination port is 53, the timestamp is 1704250126, the TTL is 241 and 240, the packet length is 85, and the packet quantity is 20.

[0091] In order to accurately trace the attack, on the basis of the above embodiments, in the embodiments of the present application, the server 102 is specifically configured to determine that the packet is a probe packet if the deviation of each first TTL from each second TTL is less than a threshold.

[0092] After obtaining each second TTL, in order to accurately determine whether the packet is a probe packet, the server can determine the deviation of each first TTL from each second TTL, and determine whether each deviation is less than a threshold. If each deviation is less than the threshold, it can be determined that the packet is a probe packet.

[0093] In order to accurately determine the first TTL in the response packet returned by the device corresponding to the target source IP address, on the basis of the above embodiments, in the embodiments of the present application, the virtual reflector 101 is specifically configured to determine whether a corresponding TTL is saved for the target source IP address, and whether the saved TTL is within a valid time limit;

[0094] If any of them is no, the target source IP address is reverse probed, the first TTL in the response packet returned by the device corresponding to the target source IP address is received, and the first TTL is saved for the target source IP address, and the valid time limit of the first TTL is set to a preset time limit;

[0095] If both are yes, the TTL saved for the target source IP address is determined as the first TTL in the response packet returned by the device corresponding to the target source IP address.

[0096] In order to determine the real network location of the device corresponding to the target source IP address and determine the network distance between the target source IP address and the virtual reflector. The virtual reflector can perform reverse detection on the device corresponding to the target source IP address, however, the virtual reflector receives a large number of messages, if each message is detected, it will cause resource waste, in order to save resources, the virtual reflector can locally save the correspondence between the source IP address and the TTL, and the TTL corresponding to the same source IP address may change over time, therefore, the TTL saved by the virtual reflector has a corresponding effective time limit.

[0097] The virtual reflector determines whether the corresponding TTL for the target source IP address is saved, and whether the saved TTL is within the effective time limit, if the corresponding TTL for the target source IP address is not saved, or the saved TTL is not within the effective time limit, in order to obtain the corresponding TTL, the virtual reflector performs reverse detection on the target source IP address, specifically, the virtual reflector can perform reverse detection based on the packet internet groper (ping), the third generation hyper text transfer protocol (hping3), and the traceroute, after the device corresponding to the target source IP address receives the reverse detection message, the virtual reflector returns a response message to the virtual reflector, and the virtual reflector receives the first TTL in the response message returned by the device corresponding to the target source IP address. And in order to improve the speed of subsequent TTL acquisition and save resources, the virtual reflector can save the first TTL for the target source IP address, and set the effective time limit of the first TTL as a preset time limit.

[0098] If the corresponding TTL for the target source IP address is saved, and the saved TTL is within the effective time limit, the TTL saved for the target source IP address can be determined as the first TTL in the response message returned by the device corresponding to the target source IP address.

[0099] The correspondence between the source IP address and the TTL, and the effective time limit of the TTL can be saved in the historical access record table, and the historical access record table records all accessed source IP addresses since the virtual reflector honeypot (i.e. the virtual reflector) starts running.

[0100] Figure 9 A process diagram for obtaining the first TTL provided by an embodiment of the present application, the process includes the following steps:

[0101] S901: Obtain the target source IP address in the message.

[0102] S902: Determine whether a corresponding TTL is saved in the historical access record table for the target source IP address, if yes, execute S903, if no, execute S904.

[0103] S903: Determine whether the TTL saved for the target source IP address is within a valid time limit, if yes, execute S905, if no, execute S904.

[0104] S904: Perform reverse detection to the target source IP address; receive the first TTL in the response message returned by the device corresponding to the target source IP address; save the first TTL for the target source IP address, and set the valid time limit of the first TTL as a preset time limit. And end.

[0105] S905: Determine the TTL saved for the target source IP address as the first TTL in the response message returned by the device corresponding to the target source IP address. And end.

[0106] In the embodiments of the present application, the reverse detection can determine whether the target source IP address really exists, and detect the real network location, which is a key clue for DDoS reflection attack tracing.

[0107] In order to accurately perform attack tracing, on the basis of the above embodiments, in the embodiments of the present application, the server 102 is further configured to determine whether the target source IP address is a content delivery network (CDN) address, if no, determine the target source IP address as the address of the candidate attack device, and execute the subsequent step of acquiring the second TTL in the message.

[0108] Since in actual scenarios, the device corresponding to the CDN address will not actively initiate an attack to the outside, and the attack device may attack a domain name when performing an attack, since now there is CDN technology, after resolving to the corresponding address, the corresponding address is a CDN address, that is, the forged source IP address may be a CDN address, and the address of the attack device will not be a CDN address, therefore, the server can also determine whether the target source IP address is a CDN address, if the target source IP address is not a CDN address, the target source IP address may be the address of the attacked device, therefore, the server acquires the second TTL in the message, and continues to perform subsequent attack tracing.

[0109] In order to accurately perform attack tracing, on the basis of the above embodiments, in the embodiments of the present application, the server 102 is further configured to determine that the message is an attack message if the target source IP address is a CDN address.

[0110] Since in actual scenarios, the device corresponding to the CDN address will not actively launch an attack to the outside, if the target source IP address is a CDN address, it can be determined that the target source IP address is fake, and it can be determined that the packet is an attack packet.

[0111] In order to accurately perform attack tracing, on the basis of the above embodiments, in the embodiments of the present application, the server 102 is further configured to obtain a second packet group containing the packet; wherein the second packet group is obtained by dividing according to a second preset time interval; wherein the second time interval is greater than the first time interval;

[0112] According to the timestamp of each second packet in the second packet group, the frequency of packet arrival is determined.

[0113] It is judged whether the frequency is higher than a preset frequency; if yes, the subsequent step of obtaining the second TTL in the packet is executed.

[0114] Since in actual scenarios, the attack device will continuously send many attack packets when performing an attack, and the control device will not continuously send many probe packets, the server can also determine the IP address of the control device according to the frequency of the received packets.

[0115] Specifically, the server can obtain a second packet group containing the packet, wherein the server can divide the packets according to a second preset time interval to obtain a plurality of packet groups, in order to facilitate distinction, the packet group here is referred to as a second packet group, wherein the second preset time interval is greater than the first preset time interval.

[0116] The server can determine the frequency of packet arrival according to the timestamp of each second packet in the second packet group. In a possible implementation, the server can determine a plurality of numbers of packets arriving per second according to the timestamp of each second packet in the second packet group, determine the maximum value in the plurality of numbers of packets arriving per second as the frequency of packet arrival, and judge whether the frequency is higher than a preset frequency. If the frequency is higher than the preset frequency, it means that the packet can be an attack packet or a probe packet, then the server obtains the second TTL in the packet, and performs the subsequent attack tracing step based on the obtained second TTL.

[0117] In order to accurately perform attack tracing, on the basis of the above embodiments, in the embodiments of the present application, the server 102 is further configured to determine that the packet is a probe packet if the frequency is not higher than a preset frequency, and determine the target source IP address in the packet as the IP address of the control device.

[0118] Since in actual scenarios, the attack device continuously sends many attack packets when attacking, and the control device does not continuously send many packets, if the frequency at which the obtained packet arrives is not higher than the preset frequency, it is indicated that the packet is not an attack packet, so it can be determined that the packet is a probe packet, and the target source IP address in the packet is determined as the IP address of the control device.

[0119] Figure 10 A detailed process diagram for determining attack tracing is provided for the embodiments of the present application, and the process includes the following steps:

[0120] S1001: Obtain the target source IP address in the packet.

[0121] S1002: Determine whether the protocol type in the packet is the type of the preset reflector protocol, and whether the packet length of the packet is within the preset range, if both are yes, execute S1003, if any is no, execute S1004.

[0122] S1003: Determine whether the target source IP address is a CDN address, if yes, execute S1005, if no, execute S1006.

[0123] S1004: Determine that the packet is a junk packet, and end.

[0124] S1005: Determine that the packet is an attack packet, and end.

[0125] S1006: Obtain a second packet group containing the packet, and determine the frequency at which the packet arrives according to the time stamp of each packet in the second packet group.

[0126] S1007: Determine whether the frequency is higher than the preset threshold, if yes, execute S1008, if no, execute S1009.

[0127] S1008: Obtain each second TTL in the aggregated packet corresponding to the packet, and execute S1010.

[0128] S1009: Determine that the packet is a probe packet, and the target source IP address in the packet is the IP address of the control device, and end.

[0129] S1010: Determine whether the deviation of each second TTL and the first TTL in the response packet returned by the device corresponding to the target source IP address is less than the threshold, if yes, execute S1009, if no, execute S1005.

[0130] Specifically, the server can input the message payload, message frequency, domain name resolution, IP attribution, network distance and other information into the message identification engine. The message identification engine implements the message identification algorithm using various methods described above, and identifies the message type according to the identification algorithm. In a possible implementation, after generating the message corresponding log, the server can preliminarily clean the data and delete incomplete and inaccurate data.

[0131] In the embodiments of the present application, the server analyzes the messages collected by the virtual reflector, identifies the types of the messages, including garbage messages, probe messages, attack messages, and then obtains the reflector control IP address (i.e. the IP address of the control device) from the probe messages. Specifically, in combination with the message characteristics, reverse domain name lookup, domain name resolution, CDN address, network distance, message frequency and other multi-dimensional information, an identification algorithm is designed to identify the messages, classify the messages into garbage messages, attack messages and probe messages, and finally extract the reflector control IP address, i.e. the IP address of the control device, from the probe messages, to achieve the tracing effect. Through the message identification and tracing technology, without relying on external data such as operators and gateway messages, only by effectively identifying and classifying the messages of the virtual reflector, the garbage messages can be eliminated, and then the attack messages and probe messages can be obtained. By analyzing the attack messages, the DDoS reflection attack activities can be monitored and identified, and the reflection control IP address can be extracted from the probe messages, which provides key information for further tracing of the attacker and promotes the tracing process of the reflection attack.

[0132] In order to accurately trace the attack, on the basis of the above embodiments, in the embodiments of the present application, the virtual reflector 101 is further configured to obtain the number of messages containing the target source IP address received within a preset time period before the current time, determine whether the number reaches a set number threshold, if yes, not respond to the message; if no, respond to the message.

[0133] In actual scenarios, the reflector will respond to each message it receives. Since the attack device will send multiple attack messages when initiating a DDoS attack, if the virtual reflector responds to each attack message, the virtual reflector will participate in the DDoS reflection attack. Moreover, relevant laws and regulations require that when a real DDoS reflection attack is implemented, the false reflector cannot really participate in the attack and cause damage to the target, that is, the false reflector cannot have real reflection attack capability. Therefore, in the embodiments of the present application, in order to avoid the virtual reflector participating in the DDoS reflection attack, the false reflector needs to be rate limited, that is, the traffic of the virtual reflector needs to be limited, and the rate limitation can be realized by controlling the reflection return packet.

[0134] Specifically, the virtual reflector acquires the number of packets containing the target source IP address received in a preset time period before the current time after receiving a packet, judges whether the number reaches a set number threshold, if yes, the virtual reflector does not respond to the packet, wherein the not responding to the packet can also be referred to as not replying, if no, the virtual reflector responds to the packet, wherein the responding to the packet can also be referred to as replying.

[0135] The virtual reflector prevents the virtual reflector from really participating in the DDoS reflection attack while collecting access traffic (i.e. packets containing access packets) through the rate limiting technology.

[0136] Figure 11 A processing process of a packet provided by an embodiment of the present application is shown in a schematic diagram, and the process specifically includes the following steps.

[0137] S1101: receiving a packet.

[0138] S1102: acquiring a target source IP address in the packet.

[0139] S1103: judging whether a packet containing the target source IP address is received for the first time in a preset time period before the current time, if yes, performing S1104, if no, performing S1106.

[0140] S1104: recording the target source IP address and marking the request number of the target source IP address as 1.

[0141] S1105: responding to the packet, and ending.

[0142] S1106: increasing the request number of the target source IP address by 1.

[0143] S1107: judging whether the request number of the target source IP address reaches a set number threshold, if yes, performing S1108, if no, performing S1105.

[0144] S1108: not responding to the packet.

[0145] Figure 12 A process schematic diagram of attack tracing provided by an embodiment of the present application.

[0146] From Figure 12 It can be known that the attack device can access a host (i.e. a virtual reflector) first, the virtual reflector performs rate limiting, a server performs traffic processing on received packets, generates corresponding packets, stores the packets in local data, and performs reverse detection by the virtual reflector, the server returns logs, and a database stores the logs.

[0147] Figure 13 A process schematic diagram of an attack tracing method provided by an embodiment of the present application; the process includes the following steps:

[0148] S1301: receiving a packet;

[0149] S1302: according to a target source IP address in the packet, reversely detecting a first TTL in a response packet returned by a device corresponding to the target source IP address; and sending the packet and the first TTL to a server; so that the server identifies whether the packet is a probe packet based on the first TTL and a second TTL in the packet, and determines an IP address of a control device.

[0150] In a possible implementation, the reverse detection of the first TTL in the response packet returned by the device corresponding to the target source IP address according to the target source IP address in the packet includes:

[0151] determining whether a TTL corresponding to the target source IP address is saved, and whether the saved TTL is within a valid time limit;

[0152] if any of the two is no, performing reverse detection on the target source IP address; receiving the first TTL in the response packet returned by the device corresponding to the target source IP address; and saving the first TTL for the target source IP address, and a valid time limit for saving the first TTL is a preset time limit;

[0153] if both are yes, the TTL saved for the target source IP address is determined as the first TTL in the response packet returned by the device corresponding to the target source IP address.

[0154] In a possible implementation, the method further includes:

[0155] acquiring a number of packets containing the target source IP address received in a preset time period before a current time, determining whether the number reaches a set number threshold, if yes, not responding to the packet; and if no, responding to the packet.

[0156] Specifically, how the virtual reflector executes the attack tracing method has been described in the above embodiments, and will not be repeated here.

[0157] Figure 14 A process schematic diagram of an attack tracing method provided by an embodiment of the present application; the process includes the following steps:

[0158] S1401: receiving a packet and a first TTL sent by a virtual reflector;

[0159] S1402: Obtain the second TTL in the message; if the deviation between the first TTL and the second TTL is less than a threshold, then determine that the message is a probe message, and determine that the target source IP address is the IP address of the control device.

[0160] In one possible implementation, after receiving the message and the first TTL sent by the virtual reflector, and before obtaining the second TTL in the message, the method further includes:

[0161] Obtain the protocol type in the message. If the protocol type is a preset reflector protocol type and the message length is within a preset length range, then determine that the message is an access message. The access message includes attack messages and probe messages. Then, perform the following step: based on the target source IP address in the message, reverse probe to obtain the first TTL in the response message returned by the device corresponding to the target source IP address.

[0162] In one possible implementation, obtaining the second TTL in the message includes:

[0163] Obtain a first message group containing the message; wherein the first message group is obtained by dividing each received message according to a first preset time interval;

[0164] Obtain aggregated packets in the first packet group whose source IP address is the target source IP address; wherein, the aggregated packet is obtained by deduplicating the third TTL contained in each candidate packet with the same aggregation information contained in the first packet group and aggregating them; wherein, the same aggregation information includes timestamps within a preset sub-time period, and the source IP address and destination port are the same.

[0165] Obtain each second TTL in the aggregated message.

[0166] In one possible implementation, determining that the message is a probe message if the deviation between the first TTL and the second TTL is less than a threshold includes:

[0167] If the deviation between each first TTL and each second TTL is less than a threshold, then the message is determined to be a probe message.

[0168] In one possible implementation, after receiving the message and the first TTL sent by the virtual reflector, and before obtaining the second TTL in the message, the method further includes:

[0169] Determine whether the target source IP address is a Content Delivery Network (CDN) address. If not, proceed with the step of obtaining the second TTL from the packet.

[0170] In a possible implementation, the method further includes:

[0171] If the target source IP address is a CDN address, it is determined that the message is an attack message.

[0172] In a possible implementation, after the receiving module receives the message sent by the virtual reflector and the first TTL, the method further includes:

[0173] obtaining a second message group containing the message; wherein the second message group is obtained by dividing according to a second preset time interval; and wherein the second time interval is greater than the first time interval.

[0174] determining a frequency of message arrival according to the time stamp of each second message in the second message group;

[0175] determining whether the frequency is higher than a preset frequency; and if so, performing the subsequent step of obtaining the second TTL in the message.

[0176] In a possible implementation, the method further includes:

[0177] If the frequency is not higher than the preset frequency, it is determined that the message is a probe message, and the target source IP address in the message is determined to be the IP address of the control device.

[0178] In a possible implementation, the method further includes:

[0179] performing structural processing on the message, generating a log corresponding to the message, and recording.

[0180] Specifically, how the server performs the attack tracing method has been described in the above embodiments, and will not be repeated here.

[0181] Figure 15 Another attack tracing device structure provided by the embodiments of the present application is shown in the schematic diagram, and the device includes:

[0182] The first receiving module 1501 is configured to receive a message.

[0183] The first processing module 1502 is configured to reversely probe to obtain a first time to live TTL in a response message returned by a device corresponding to a target source IP address in the message according to the target source IP address, and send the message and the first TTL to a server, so that the server identifies whether the message is a probe message based on the first TTL and a second TTL in the message, and determines an IP address of a control device.

[0184] In a possible implementation, the first processing module 1501 is specifically configured to determine whether a TTL corresponding to the target source IP address is saved and whether the saved TTL is within a valid time limit; if either is no, perform reverse detection on the target source IP address; receive a first TTL in a response message returned by a device corresponding to the target source IP address; and save the first TTL for the target source IP address, and the valid time limit for saving the first TTL is a preset time limit; if both are yes, determine the TTL saved for the target source IP address as the first TTL in the response message returned by the device corresponding to the target source IP address.

[0185] In a possible implementation, the first processing module 1501 is further configured to acquire a number of packets containing the target source IP address received in a preset time period before a current time, determine whether the number reaches a set number threshold, if yes, not respond to the packet, and if no, respond to the packet.

[0186] Figure 16 Another attack tracing device structure provided by the embodiment of the application is provided, and the device includes:

[0187] The second receiving module 1601 is configured to receive a packet and a first TTL sent by a virtual reflector.

[0188] The second processing module 1602 is configured to acquire a second TTL in the packet; if a deviation between the first TTL and the second TTL is less than a threshold, determine that the packet is a detection packet, and determine that the target source IP address is an IP address of a control device.

[0189] In a possible implementation, the second processing module 1602 is further configured to acquire a protocol type in the packet; if the protocol type is a type of a preset reflector protocol, and a packet length of the packet is within a preset length range, determine that the packet is an access packet, wherein the access packet includes an attack packet and a detection packet, and perform a subsequent step of acquiring a first TTL in a response message returned by a device corresponding to the target source IP address according to the target source IP address in the packet.

[0190] In a possible implementation, the second processing module 1602 is further configured to obtain a first message group containing the message; the first message group is obtained by dividing each message received according to a first preset time interval; obtain an aggregated message in the first message group, the source IP address of which is the target source IP address; the aggregated message is obtained by removing the third TTL in each candidate message containing the same aggregation information in the first message group and aggregating the third TTL; the same aggregation information includes that the time stamp is within a preset sub-time period, and the source IP address and the destination port are the same; and obtain each second TTL in the aggregated message.

[0191] In a possible implementation, the second processing module 1602 is specifically configured to determine that the message is a detection message if the deviation of each first TTL from each second TTL is less than a threshold.

[0192] In a possible implementation, the second processing module 1602 is further configured to determine whether the target source IP address is a content distribution network (CDN) address, and if not, perform a subsequent step of obtaining the second TTL in the message.

[0193] In a possible implementation, the second processing module 1602 is further configured to determine that the message is an attack message if the target source IP address is a CDN address.

[0194] In a possible implementation, the second processing module 1602 is further configured to obtain a second message group containing the message; the second message group is obtained by dividing according to a second preset time interval; the second time interval is greater than the first time interval; determine the frequency of message arrival according to the time stamp of each second message in the second message group; determine whether the frequency is higher than a preset frequency; and if so, perform a subsequent step of obtaining the second TTL in the message.

[0195] In a possible implementation, the second processing module 1602 is further configured to determine that the message is a detection message if the frequency is not higher than the preset frequency, and determine that the target source IP address in the message is the IP address of the control device.

[0196] In a possible implementation, the second processing module 1602 is further configured to perform a structured processing on the message, and generate and record a log corresponding to the message.

[0197] Figure 17 An electronic device structure schematic diagram is provided in the embodiments of the present application, and on the basis of the above embodiments, the embodiments of the present application further provide an electronic device, such as Figure 17As shown, it comprises a processor 1701, a communication interface 1702, a memory 1703 and a communication bus 1704, wherein the processor 1701, the communication interface 1702 and the memory 1703 complete the communication among each other through the communication bus 1704.

[0198] The memory 1703 stores a computer program, which, when executed by the processor 1701, causes the processor 1701 to perform the following steps:

[0199] receiving a packet;

[0200] According to the target source IP address in the packet, the first time to live TTL in the response packet returned by the device corresponding to the target source IP address is acquired through reverse detection; and the packet and the first TTL are sent to a server; so that the server identifies whether the packet is a detection packet based on the first TTL and a second TTL in the packet, and determines the IP address of the control device.

[0201] Further, the processor 1701 is specifically configured to judge whether the TTL corresponding to the target source IP address is saved, and whether the saved TTL is within a valid time limit;

[0202] If any of them is no, reverse detection is performed on the target source IP address; the first TTL in the response packet returned by the device corresponding to the target source IP address is received; and the first TTL is saved for the target source IP address, and the valid time limit for saving the first TTL is a preset time limit;

[0203] If all of them are yes, the TTL saved for the target source IP address is determined as the first TTL in the response packet returned by the device corresponding to the target source IP address.

[0204] Further, the processor 1701 is further configured to acquire the number of packets containing the target source IP address received within a preset time period before the current time, judge whether the number reaches a set number threshold, if yes, do not respond to the packet; if no, respond to the packet.

[0205] On the basis of the above embodiments, the embodiments of the present application further provide an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete the communication among each other through the communication bus.

[0206] The memory stores a computer program, which, when executed by the processor 1701, causes the processor to perform the following steps:

[0207] receiving a packet and a first TTL sent by a virtual reflector;

[0208] obtaining a second TTL in the packet; if a deviation between the first TTL and the second TTL is less than a threshold, determining that the packet is a probe packet, and determining that the target source IP address is an IP address of a control device.

[0209] Further, the processor 1701 is further configured to obtain a protocol type in the packet, and if the protocol type is a type of a preset reflector protocol and a packet length of the packet is within a preset length range, determine that the packet is an access packet, wherein the access packet includes an attack packet and a probe packet, and perform a subsequent step of reversely probing to obtain a first TTL in a response packet returned by a device corresponding to the target source IP address according to the target source IP address in the packet.

[0210] Further, the processor 1701 is specifically configured to obtain a first packet group containing the packet; wherein the first packet group is obtained by dividing each received packet according to a first preset time interval.

[0211] obtaining an aggregated packet with a source IP address being the target source IP address in the first packet group; wherein the aggregated packet is obtained by removing duplication of a third TTL in each candidate packet containing the same aggregated information in the first packet group and aggregating the third TTL; wherein the same aggregated information includes that a timestamp is within a preset sub-time period, and a source IP address and a destination port are both the same;

[0212] obtaining each second TTL in the aggregated packet.

[0213] Further, the processor 1701 is specifically configured to determine that the packet is a probe packet if a deviation between each first TTL and each second TTL is less than a threshold.

[0214] Further, the processor 1701 is further configured to determine whether the target source IP address is a content distribution network (CDN) address, and if not, perform a subsequent step of obtaining a second TTL in the packet.

[0215] Further, the processor 1701 is further configured to determine that the packet is an attack packet if the target source IP address is a CDN address.

[0216] Further, the processor 1701 is further configured to obtain a second packet group containing the packet; wherein the second packet group is obtained by dividing according to a second preset time interval; wherein the second time interval is greater than the first time interval.

[0217] determining a frequency of packet arrival according to a timestamp of each second packet in the second packet group.

[0218] determining whether the frequency is higher than a preset frequency; if yes, performing a subsequent step of acquiring a second TTL in the packet.

[0219] Further, the processor 1701 is further configured to determine that the packet is a detection packet if the frequency is not higher than the preset frequency, and determine a target source IP address in the packet as an IP address of the control device.

[0220] Further, the processor 1701 is further configured to perform structural processing on the packet, and generate and record a log corresponding to the packet.

[0221] The communication bus mentioned in the above server can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or only one type of bus.

[0222] The communication interface is used for communication between the above electronic device and other devices.

[0223] The memory can include a Random Access Memory (RAM) and can also include a Non-Volatile Memory (NVM), for example, at least one disk memory. Optionally, the memory can also be at least one storage device located away from the aforementioned processor.

[0224] The above processor can be a general-purpose processor, including a central processing unit, a network processing unit (NP), etc.; can also be a Digital Signal Processing (DSP) processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0225] On the basis of the above embodiments, the embodiments of the present application further provide a computer readable storage medium, the computer readable storage medium stores a computer program executable by an electronic device, when the program runs on the electronic device, the program causes the electronic device to perform the following steps:

[0226] The memory stores a computer program, when the program is executed by the processor, the program causes the processor to perform the following steps:

[0227] receiving the packet;

[0228] obtaining a first time-to-live TTL in a response packet returned by a device corresponding to the target source IP address according to the target source IP address in the packet, and sending the packet and the first TTL to a server, so that the server identifies whether the packet is a probe packet based on the first TTL and a second TTL in the packet, and determines an IP address of a control device.

[0229] In a possible implementation, the obtaining the first TTL in the response packet returned by the device corresponding to the target source IP address according to the target source IP address in the packet includes:

[0230] determining whether a TTL corresponding to the target source IP address is saved, and whether the saved TTL is within a valid time limit;

[0231] if any of the determinations is negative, performing reverse detection on the target source IP address, receiving the first TTL in the response packet returned by the device corresponding to the target source IP address, and saving the first TTL for the target source IP address, and a valid time limit for saving the first TTL is a preset time limit;

[0232] if both of the determinations are positive, determining the TTL saved for the target source IP address as the first TTL in the response packet returned by the device corresponding to the target source IP address.

[0233] In a possible implementation, the method further includes:

[0234] obtaining a number of packets containing the target source IP address received in a preset time period before a current time, determining whether the number reaches a set number threshold, if yes, not responding to the packet, and if no, responding to the packet.

[0235] On the basis of the above embodiments, the embodiment of the application further provides a computer readable storage medium, the computer readable storage medium stores a computer program executable by a processor, and when the program runs on the processor, the processor performs the following steps:

[0236] receiving the packet and the first TTL sent by the virtual reflector;

[0237] obtaining a second TTL in the packet, and if a deviation between the first TTL and the second TTL is less than a threshold, determining that the packet is a probe packet, and determining that the target source IP address is an IP address of a control device.

[0238] In a possible implementation, after receiving the message and the first TTL sent by the virtual reflector, and before obtaining the second TTL in the message, the method further includes:

[0239] obtaining a protocol type in the message, and determining the message as an access message if the protocol type is a type of a preset reflector protocol and a message length of the message is within a preset length range, wherein the access message includes an attack message and a probe message, and performing a subsequent step of reversely probing to obtain the first TTL in a response message returned by a device corresponding to the target source IP address according to a target source IP address in the message.

[0240] In a possible implementation, the obtaining the second TTL in the message includes:

[0241] obtaining a first message group containing the message, wherein the first message group is obtained by dividing each received message according to a first preset time interval;

[0242] obtaining an aggregated message with a source IP address being the target source IP address in the first message group, wherein the aggregated message is obtained by removing duplication of and aggregating third TTLs in each candidate message containing same aggregation information in the first message group, and wherein the same aggregation information includes that a time stamp is within a preset sub-time period, and a source IP address and a destination port are same;

[0243] obtaining each second TTL in the aggregated message.

[0244] In a possible implementation, the determining the message as a probe message if a deviation between the first TTL and the second TTL is less than a threshold value includes:

[0245] determining the message as a probe message if deviations between each first TTL and each second TTL are less than a threshold value.

[0246] In a possible implementation, after receiving the message and the first TTL sent by the virtual reflector, and before obtaining the second TTL in the message, the method further includes:

[0247] determining whether the target source IP address is a content distribution network (CDN) address, and performing a subsequent step of obtaining the second TTL in the message if the target source IP address is not the CDN address.

[0248] In a possible implementation, the method further includes:

[0249] determining the message as an attack message if the target source IP address is the CDN address.

[0250] In a possible implementation, after receiving the message sent by the virtual reflector and the first TTL, and before obtaining the second TTL in the message, the method further comprises:

[0251] obtaining a second message group containing the message; wherein the second message group is obtained according to a second preset time interval; and wherein the second time interval is greater than the first time interval;

[0252] determining a frequency of message arrival according to the time stamp of each second message in the second message group;

[0253] determining whether the frequency is higher than a preset frequency; and if yes, performing the subsequent step of obtaining the second TTL in the message.

[0254] In a possible implementation, the method further comprises:

[0255] if the frequency is not higher than the preset frequency, determining that the message is a probe message, and determining the target source IP address in the message as the IP address of the control device.

[0256] In a possible implementation, the method further comprises:

[0257] performing structural processing on the message, generating a log corresponding to the message, and recording.

[0258] Those skilled in the art should understand that embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage, etc.) containing computer-usable program code.

[0259] The present application is described with reference to flowcharts and / or block diagrams of the method, device (system), and computer program product according to the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to produce a machine, so that the instructions executed by the computer or other programmable data processing devices produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in one or more flows and / or blocks Figure 1 The functions specified in one or more flows and / or blocks

[0260] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the flow Figure 1 The flow or flows and / or blocks Figure 1 The flow or flows and / or blocks

[0261] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions that execute on the computer or other programmable apparatus provide steps for implementing the flow Figure 1 The flow or flows and / or blocks Figure 1 The flow or flows and / or blocks

[0262] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. An attack attribution system, characterized by, The system comprises a virtual reflector with reflector function and a server; The virtual reflector is configured to receive a packet, acquire a first time to live TTL in a response packet returned by a device corresponding to a target source IP address in the packet according to reverse detection of the target source IP address, and send the packet and the first TTL to the server; The server is configured to acquire a second TTL in the packet, determine that the packet is a detection packet and the target source IP address is an IP address of a control device if a deviation between the first TTL and the second TTL is less than a threshold value; The server is specifically configured to acquire a first packet group comprising the packet, the first packet group being obtained by dividing each received packet according to a first preset time interval; acquire an aggregated packet with the target source IP address in the first packet group, the aggregated packet being obtained by removing a third TTL in each candidate packet comprising the same aggregated information in the first packet group and aggregating the third TTL, and the same aggregated information comprising the same source IP address and destination port within a preset sub-time period; acquire each second TTL in the aggregated packet.

2. The system of claim 1, wherein, The server is further configured to acquire a protocol type in the packet, determine that the packet is an access packet if the protocol type is a type of a preset reflector protocol and a packet length of the packet is within a preset length range, wherein the access packet comprises an attack packet and a detection packet, and perform a subsequent step of acquiring the second TTL in the packet.

3. The system of claim 1, wherein, The server is specifically configured to determine that the packet is a detection packet if a deviation between each first TTL and each second TTL is less than a threshold value.

4. The system of claim 1, wherein, The virtual reflector is specifically configured to determine whether a TTL corresponding to the target source IP address is saved and whether the saved TTL is within a valid time limit; if either is no, perform reverse detection on the target source IP address; acquire a first TTL in a response packet returned by a device corresponding to the target source IP address; save the first TTL for the target source IP address, and set a valid time limit of the first TTL as a preset time limit; if both are yes, determine a TTL corresponding to the target source IP address as the first TTL in the response packet returned by the device corresponding to the target source IP address.

5. The system of claim 1, wherein, The server is further configured to determine whether the target source IP address is a content distribution network CDN address, and perform a subsequent step of acquiring the second TTL in the packet if the target source IP address is not a CDN address.

6. The system of claim 5, wherein, The server is further configured to determine that the packet is an attack packet if the target source IP address is a CDN address.

7. The system of claim 1, wherein, The server is further configured to acquire a second packet group comprising the packet, the second packet group being obtained by dividing according to a second preset time interval, wherein the second preset time interval is greater than the first preset time interval; determine a frequency of packet arrival according to a timestamp of each second packet in the second packet group; and determine whether the packet is a detection packet according to a deviation between each first TTL and each second TTL. determining whether the frequency is higher than a preset frequency; if yes, performing a subsequent step of acquiring a second TTL in the packet.

8. The system of claim 7, wherein, The server is further configured to: if the frequency is not higher than the preset frequency, determine that the packet is a detection packet, and determine the target source IP address in the packet as the IP address of the control device.

9. The system of claim 1, wherein, The virtual reflector is further configured to: acquire a number of packets containing the target source IP address received within a preset time period before a current time, determine whether the number reaches a set number threshold, if yes, not respond to the packet, and if no, respond to the packet.

10. The system of any of claims 1-9, wherein, The server is further configured to: perform structural processing on the packet, and generate a log corresponding to the packet and record the log.

11. An attack attribution method, characterized in that, The method is applied to a server, and the method comprises: receiving a packet and a first time to live TTL sent by a virtual reflector, wherein the packet contains a target source IP address; acquiring a second TTL in the packet; if a deviation between the first TTL and the second TTL is less than a threshold, determining that the packet is a detection packet, and determining that the target source IP address is an IP address of a control device; The acquiring of the second TTL in the packet comprises: acquiring a first packet group containing the packet; wherein the first packet group is obtained by dividing each received packet according to a first preset time interval; acquiring an aggregated packet with a source IP address being the target source IP address in the first packet group; wherein the aggregated packet is obtained by removing a third TTL in each candidate packet containing the same aggregation information in the first packet group, and aggregating the third TTL; wherein the same aggregation information comprises a same time stamp within a preset sub-time period, and same source IP address and destination port; acquiring each second TTL in the aggregated packet.

Images