Detection method, system and device for defending network attack based on Netfilter framework

Abstract

The embodiment of the invention provides a detection method, system and device for defending network attacks based on a Netfilter framework, the detection method is applied to a defending system, a defending system client and a server to be accessed by the client, and the method comprises the following steps: sending access traffic from the client to an authentication tunnel module through a first detection point, performing authentication judgment, and after the authentication is passed, starting a flow of establishing a secure communication tunnel with the client by the defense system; sending the data packet uploaded to the application layer to an application firewall module through a second detection point, and carrying out Web attack class detection; the second detection point and the first detection point are respectively arranged on a PREROUTING chain of a Netfilter framework; sending the data packet detected by the application firewall module to a packet filtering module through a third detection point, and performing network layer detection; and the third detection point is arranged on an FORWARD chain of the Netfilter framework.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a detection method, system and device for defending against network attacks based on a Netfilter framework. Background Art

[0002] At present, the main means of defending against network attacks are network layer defense, application layer defense, and identity authentication and establishment of communication security tunnels before access. Among them, network layer defense runs at the 3rd and 4th layers of the Open System Interconnection (OSI) model, which can protect data transmission and network traffic; application layer defense runs at the 7th layer of the OSI model to defend against attacks such as cookie manipulation, SQL injection and URL. The usual defense method is to deploy the identity authentication system, traditional firewall and application layer firewall in the network environment in series. After the identity authentication is passed, the access traffic is allowed to pass the detection of the two firewall systems before accessing the subsequent services. When deploying and configuring these three types of devices, the administrator needs to switch platforms, and cannot dynamically and interactively adjust the rule configuration between devices according to the specific attack situation. In this case, it is difficult to establish a secure communication tunnel between the client and the three types of devices. Summary of the invention

[0003] The embodiments of the present application provide a detection method, system and device for defending against network attacks based on the Netfilter framework, which are used to achieve multiple detections and effective defenses against network attacks while improving the flexibility of defense system deployment.

[0004] In a first aspect, an embodiment of the present application provides a detection method for defending against network attacks based on a Netfilter framework, which is applied to a defense system, wherein the defense system is located between a client and a server to be accessed by the client, and the method comprises:

[0005] Sending the access traffic from the client to the authentication tunnel module through the first detection point and performing authentication judgment, and after the authentication is passed, the defense system starts the process of establishing a secure communication tunnel with the client;

[0006] The data packets sent to the application layer are sent to the application firewall module through the second detection point, and the Web attack type is detected; wherein the second detection point and the first detection point are respectively set on the PREROUTING chain of the Netfilter framework;

[0007] The data packet detected by the application firewall module is sent to the packet filtering module through the third detection point, and a network layer detection is performed; wherein the third detection point is set on the FORWARD chain of the Netfilter framework.

[0008] In one possible implementation, the defense system further includes a log analysis and dynamic policy generation module connected to the authentication tunnel module, the application firewall module, and the packet filtering module respectively, and the method further includes:

[0009] The dynamic policy module is generated by the log analysis to obtain the attack log from the application firewall module and the packet filtering log from the packet filtering module;

[0010] Analyze the attack log to generate a defense blocking strategy for the first detection point and the third detection point;

[0011] The packet filtering log is analyzed to generate a control strategy for the first detection point to block the attack at the very beginning of the kernel protocol stack for processing traffic.

[0012] In one possible implementation manner, analyzing the attack log to generate a defense blocking strategy for the first detection point and the third detection point includes one of the following:

[0013] Notifying the authentication tunnel module through the first detection point to kick out the access user to the client and disconnect the secure communication tunnel;

[0014] By generating a packet filtering blocking strategy for the network layer, the IP address of the accessing user is blocked at the third detection point;

[0015] Attack defense measures are strengthened at both the first detection point and the third detection point.

[0016] In one possible implementation, sending the access traffic from the client to the authentication tunnel module through the first detection point and performing authentication determination includes:

[0017] After the access traffic from the client hits the first detection point, the access traffic enters the authentication tunnel module;

[0018] authenticating the identity information of the access user from the client through the authentication tunnel module;

[0019] If the authentication fails, the login is denied;

[0020] If the authentication is successful, a virtual IP is assigned to the client, and the virtual IP and the defense system IP are sent to the client, so that a secure communication tunnel is established between the client and the defense system.

[0021] In one possible implementation, the application firewall module includes a limit_conn_zone module, a limit_request module, a core module, and a ModSecurity module based on Nginx, and the data packet sent to the application layer is sent to the application firewall module through the second detection point, and the detection of the Web attack class is performed, including:

[0022] Sending the data packet sent to the application layer to the limit_conn_zone module, the limit_request module, the core module and the ModSecurity module through the second detection point;

[0023] Limit the number of concurrent connections from the same IP address through the limit_conn_zone module;

[0024] Limit the number of visits from the same IP address in a specific time period through the limit_request module;

[0025] Limit the traffic of the same IP address through the limit_rate provided by the core module;

[0026] If it is detected that the access traffic triggers restrictions on the limit_conn_zone module, the limit_request module, and the core module, an alarm is issued and the corresponding log is recorded

[0027] The ModSecurity module is used to analyze the attack details of URLs passed by Nginx, and to record and prevent malicious activities and attack behaviors.

[0028] In one possible implementation, the sending of the data packet detected by the application firewall module to the packet filtering module through the third detection point and performing network layer detection includes:

[0029] Sending the data packet detected by the application firewall module to the packet filtering module through the third detection point;

[0030] The packet filtering module is used to detect whether there is a network layer DOS attack, and the five-tuple of the data packet detected by the application firewall module is filtered and controlled.

[0031] In one possible implementation, if the second detection point and the third detection point are both enabled, before the application firewall module performs Web attack detection, the method further includes:

[0032] If the server accessed by the client through the defense system is configured with an application firewall protection policy, the access traffic hits the second detection point, and the data packets sent to the application layer are filtered by the application firewall to obtain the filtered data packets;

[0033] By modifying the kernel code of the hook point of the PREROUTING chain, the packet filtering policy of the third detection point is re-called to filter the filtered data packets, which are then redirected to the local of the defense system so that the application firewall module can perform Web attack detection.

[0034] In one possible implementation, if the first detection point, the second detection point, and the third detection point are all turned on, before sending the data packet detected by the WAF module to the packet filtering module through the third detection point, the method further includes:

[0035] Sending the data packet detected by the application firewall module to the POSTROUTING chain, hitting the SNAT conversion rule, and obtaining the converted data packet; wherein the POSTROUTING chain is located on the Netfilter framework;

[0036] By modifying the kernel code of the hook point of the POSTROUTING chain, the converted data packet is sent to the packet filtering module so that the packet filtering module performs network layer detection.

[0037] In a second aspect, an embodiment of the present application provides a defense system for defending against network attacks based on a Netfilter framework, wherein the defense system is located between a client and a server to be accessed by the client, and the system includes:

[0038] A first detection point and a second detection point are respectively set on a PREROUTING chain, and a third detection point is set on a FORWARD chain; wherein the PREROUTING chain and the FORWARD chain are located on the Netfilter framework;

[0039] an authentication tunnel module connected to the Netfilter framework through the first detection point, the authentication tunnel module being configured to receive access traffic from the client through the first detection point and perform authentication determination, and after the authentication is passed, the defense system starts a process of establishing a secure communication tunnel with the client;

[0040] an application firewall module connected to the Netfilter framework via the second detection point, the application firewall module being configured to receive data packets sent to the application layer via the second detection point and perform Web attack detection;

[0041] A packet filtering module connected to the Netfilter framework via the third detection point, wherein the packet filtering module is configured to receive data packets detected by the application firewall module via the third detection point and perform network layer detection.

[0042] In one possible implementation, the system further includes:

[0043] A log analysis and dynamic policy generation module connected to the authentication tunnel module, the application firewall module and the packet filtering module respectively, wherein the log analysis and dynamic policy generation module is configured as follows:

[0044] The dynamic policy module is generated by the log analysis to obtain the attack log from the application firewall module and the packet filtering log from the packet filtering module;

[0045] Analyze the attack log to generate a defense blocking strategy for the first detection point and the third detection point;

[0046] The packet filtering log is analyzed to generate a control strategy for the first detection point to block the attack at the very beginning of the kernel protocol stack for processing traffic.

[0047] In a third aspect, an embodiment of the present application provides a detection device for defending against network attacks based on a Netfilter framework, which is applied to a defense system, and the device includes:

[0048] The authentication unit sends the access traffic from the client to the authentication tunnel module through the first detection point, and performs authentication judgment. After the authentication is passed, the defense system starts the process of establishing a secure communication tunnel with the client;

[0049] The first detection unit sends the data packet sent to the application layer to the application firewall module through the second detection point, and performs Web attack detection; wherein the second detection point and the first detection point are respectively set on the PREROUTING chain of the Netfilter framework;

[0050] The second detection unit sends the data packet detected by the application firewall module to the packet filtering module through the third detection point, and performs network layer detection; wherein the third detection point is set on the FORWARD chain of the Netfilter framework.

[0051] In one possible implementation manner, the device further includes a policy adjustment unit, and the policy adjustment unit is configured to:

[0052] The dynamic policy module is generated by the log analysis to obtain the attack log from the application firewall module and the packet filtering log from the packet filtering module;

[0053] Analyze the attack log to generate a defense blocking strategy for the first detection point and the third detection point;

[0054] The packet filtering log is analyzed to generate a control strategy for the first detection point to block the attack at the very beginning of the kernel protocol stack for processing traffic.

[0055] In a fourth aspect, an embodiment of the present application provides an electronic device, including:

[0056] Memory, used to store computer programs;

[0057] The processor is used to implement the method steps described in any one of the above items when executing the computer program stored in the memory.

[0058] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the method steps as described in any one of the above items are implemented.

[0059] The beneficial effects of the embodiments of the present application are as follows:

[0060] The embodiment of the present application provides a detection method, system and device for defending against network attacks based on the Netfilter framework, wherein the detection method is applied to a defense system, which is located between a client and a server to be accessed by the client. By setting a first detection point on the PREROUTING chain of the Netfilter framework, the access traffic from the client can be sent to the authentication tunnel module, and authentication judgment is performed. After the authentication is passed, the defense system starts the process of establishing a secure communication tunnel with the client. In this way, identity authentication and establishment of a secure communication tunnel can be performed through the defense system. Moreover, by setting a second detection point on the PREROUTING chain of the Netfilter framework, the data packet sent to the application layer can be sent to the application firewall module, and the detection of Web attack classes can be performed. In this way, the detection of the application layer can be achieved through the defense system. In addition, by setting a third detection point on the FORWARD chain of the Netfilter framework, the data packet detected by the application firewall module can be sent to the packet filtering module, and the network layer detection can be performed. In this way, the detection of the network layer can be achieved through the defense system.

[0061] In this way, under the premise of deploying the same defense system, the detection method for defending against network attacks based on the Netfilter framework provided in the embodiment of the present application can be used to implement security detection in three different dimensions: authentication judgment, application layer detection, and network layer detection for a network access, thereby improving the protection level against network attacks, reducing the network delay of traditional multi-faceted detection, and reducing the configuration complexity and workload of implementing multi-faceted security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 A schematic diagram of an application scenario provided for an embodiment of the present application;

[0063] Figure 2 A software architecture diagram applicable to the detection method for defending against network attacks based on the Netfilter framework provided in the embodiment of the present application;

[0064] Figure 3 A method flow chart of a detection method for defending against network attacks based on a Netfilter framework provided in an embodiment of the present application;

[0065] Figure 4 A method flow chart of a detection method for defending against network attacks based on a Netfilter framework provided in an embodiment of the present application;

[0066] Figure 5 for Figure 3 The method flow chart of step S101 in FIG.

[0067] Figure 6 for Figure 3 The method flow chart of step S102 in FIG.

[0068] Figure 7 for Figure 3 The method flow chart of step S103;

[0069] Figure 8 A method flow chart of a method in which both the second detection point and the third detection point are enabled in a detection method for defending against network attacks based on a Netfilter framework provided in an embodiment of the present application;

[0070] Fig. 9 A processing flow chart of application layer detection and network layer detection in a detection method for defending against network attacks based on a Netfilter framework provided in an embodiment of the present application;

[0071] Fig.10 In a detection method for defending network attacks based on a Netfilter framework provided in an embodiment of the present application, Figure 3 One of the method flow charts before step S103;

[0072] Fig.11 A processing flow chart of opening a first detection point, a second detection point, and a third detection point to deploy an authentication tunnel in a detection method for defending against network attacks based on a Netfilter framework provided in an embodiment of the present application;

[0073] Fig.12 A processing flow chart of opening the first detection point, the second detection point and the third detection point to deploy the WAF module and the packet filtering module in a detection method for defending against network attacks based on the Netfilter framework provided in an embodiment of the present application;

[0074] Fig.13 A processing flow chart of deploying a packet filtering module only at a third detection point in a detection method for defending against network attacks based on a Netfilter framework provided in an embodiment of the present application;

[0075] Fig.14 A structural block diagram of a defense system for defending against network attacks based on a Netfilter framework provided in an embodiment of the present application;

[0076] Fig.15 A structural block diagram of a detection device for defending against network attacks based on a Netfilter framework provided in an embodiment of the present application;

[0077] Fig.16 This is a structural block diagram of one of the electronic devices provided in the embodiments of the present application. DETAILED DESCRIPTION

[0078] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution of the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings of the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. And in the absence of conflict, the embodiments in the present disclosure and the features in the embodiments can be combined with each other. Based on the described embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present disclosure.

[0079] Unless otherwise defined, the technical terms or scientific terms used in the present disclosure should be understood by people with ordinary skills in the field to which the present disclosure belongs. The words "include" or "comprise" and the like used in the present disclosure mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, but do not exclude other elements or objects.

[0080] In related technologies, it is difficult to establish secure communication tunnels between clients and three types of devices. The current deployment and implementation methods for defending against network attacks have the following problems: when a single-system device is deployed, the function is single and the defense strength is weak; when a multi-system device is deployed, the investment cost is high, the access delay is large, the strategy cannot be adjusted dynamically, the problem is difficult to locate, and the operation and maintenance are difficult.

[0081] In view of this, the embodiment of the present application provides a detection method, system and device for defending against network attacks based on the Netfilter framework, wherein the detection method is applied to a defense system, which is located between a client and a server to be accessed by the client. By setting a first detection point on the PREROUTING chain of the Netfilter framework, the access traffic from the client can be sent to the authentication tunnel module, and an authentication judgment is performed. After the authentication is passed, the defense system starts the process of establishing a secure communication tunnel with the client. In this way, identity authentication and establishment of a secure communication tunnel can be performed through the defense system. Moreover, by setting a second detection point on the PREROUTING chain of the Netfilter framework, the data packet sent to the application layer can be sent to the application firewall module, and the detection of the Web attack class can be performed. In this way, the detection of the application layer can be achieved through the defense system. In addition, by setting a third detection point on the FORWARD chain of the Netfilter framework, the data packet detected by the application firewall module can be sent to the packet filtering module, and the network layer detection can be performed. In this way, the detection of the network layer can be achieved through the defense system.

[0082] Before explaining in detail the detection method, system and device for defending against network attacks based on the Netfilter framework provided in the embodiments of the present application, first, some concepts involved in the embodiments of the present application are introduced:

[0083] Netfilter: is part of the Linux kernel, it provides a framework that allows the kernel and other modules to intercept and manipulate network packets; Netfilter mainly inserts hooks at different points in the network protocol stack (such as packet reception, forwarding, and sending) to filter, modify, or discard packets as they pass through the protocol stack.

[0084] nf_hook: This is the main interface of Netfilter, which allows other kernel modules to register hook functions, which will be called at specific points.

[0085] PREROUTING: It is part of the Linux iptables firewall rule chain and belongs to the nat table. When a packet arrives at a Linux system, if the system is configured as a gateway or router, the packet passes through the PREROUTING chain before being routed to its destination. At this stage, the packet can be modified, such as port forwarding (DNAT), or some connection-based stateful checks can be performed.

[0086] POSTROUTING: It is part of the iptables rule chain in Linux and is also located in the nat table. When packets are ready to leave the system and are about to be sent to the network interface, they pass through the POSTROUTING chain. At this stage, some operations can be performed, such as source address translation (SNAT), which is used to change the source IP address of the packet.

[0087] FORWARD: It is part of the iptables rule chain in Linux and is located in the filter table. When packets enter the Linux system from one network interface and need to be routed to another network interface, they pass through the FORWARD chain. At this stage, rules can be set to decide whether to allow the packet to pass, such as filtering based on source IP, destination IP or protocol type.

[0088] SNAT: Source Network Address Translation is a technology that modifies the source address of IP packets on network edge devices.

[0089] DNAT: Destination Network Address Translation is a form of NAT (Network Address Translation) that is mainly used to convert the destination address of a data packet sent to a specific public IP address to a private IP address in the internal network. When a host on the external network tries to access a server in the internal network, the NAT device converts the destination address of the data packet from the public IP address to the actual private IP address of the internal server.

[0090] ModSecurity: is an open source Web Application Firewall (WAF) that can enhance the security of web servers and protect applications from common web attacks. ModSecurity can run as a module for web servers such as Apache, Nginx, and Microsoft IIS. It blocks malicious activities and attacks such as SQL injection, cross-site scripting (XSS), and directory traversal attacks by monitoring, analyzing, and filtering HTTP requests and responses in real time.

[0091] Nginx: is a widely used high-performance HTTP and reverse proxy server software developed by Russian programmer Igor Sysoev. It is known for its high stability, rich feature set, high performance and low resource consumption. Nginx can run independently as a web server or as a reverse proxy server for load balancing and caching.

[0092] OSI model: OSI is the abbreviation of Open System Interconnection. The International Organization for Standardization (ISO) has developed the OSI model, which defines the standards for interconnecting different computers and is the basic framework for designing and describing computer network communications. The OSI model divides network communication work into 7 layers, namely the physical layer, data link layer, network layer, transport layer, session layer, presentation layer, and application layer.

[0093] The following briefly introduces the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limited. In the specific implementation process, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0094] The technical solution provided in the embodiment of the present application can be applied to network attack detection scenarios of various network devices, such as Figure 1 The application scenario provided by the embodiment of the present application is shown as a schematic diagram, in which a defense system (DS) 100, a client 200 and a server 300 may be included. The application process of the client 200 may access the server 300 located at the back end. When the client 200 is accessing the server 300, the server 300 may perform relevant detection on the access traffic from the client 200. Only after the detection passes, the client 200 can successfully access the server 300.

[0095] It should be noted that Figure 1The figure is only an example. In fact, the number of clients 200 and servers 300 is not limited and can be deployed according to actual applications, which is not limited here.

[0096] like Figure 2 The figure shows a software architecture diagram applicable to the detection method for defending against network attacks based on the Netfilter framework provided in the embodiment of the present application. Specifically, the defense system 100 includes the following modules:

[0097] Netfilter framework 110: involves the configuration of rules for the first detection point, the second detection point, and the third detection point, and the modification of two nf_hook points, wherein the first detection point and the second detection point are respectively set on the PREROUTING chain of the Netfilter framework 110, and the third detection point is set on the FORWARD chain of the Netfilter framework 110; one of the nf_hook point modifications is to modify the implementation of the Netfilter kernel hook point in the PREROUTING chain, and the network layer packet filtering rules of the third detection point in the FORWARD chain are first followed before the request packet enters the local. Another nf_hook point modification is to modify the implementation of the hook point in the POSTROUTING chain, so that the egress traffic will re-follow the network layer packet filtering rules of the third detection point.

[0098] Authentication tunnel module 120: After the access traffic from the client 200 hits the first detection point, it is sent to the authentication tunnel module 120 for processing. The authentication tunnel module 120 first verifies the identity information. After the identity information is verified, a virtual IP is randomly generated; illustratively, the virtual IP algorithm ensures that the upper limit of the number of IPs is 10,000, and each IP address is not repeated. Then, the generated virtual IP and the defense system 100 IP are sent to the client 200, and the client 200 establishes a secure communication tunnel with the defense system 100 based on the received information. In the specific implementation process, the authenticity of the user accessing the backend service is guaranteed through the processing of the authentication tunnel module 120, and the identity hijacking attack is effectively prevented. The established secure communication tunnel provides a dedicated access channel for subsequent access, which improves the security of data transmission.

[0099] Application Firewall (WF) module 130: is configured to detect the access traffic sent from the second detection point to the application layer, limit the number of concurrent connections of the same IP address through the limit_conn_zone module based on Nginx, limit the access volume of the same IP in a certain period of time through the limit_request module, and limit the traffic of the same IP through the limit_rate provided by the core module; if the access triggers the three restrictions mentioned above, an alarm will be issued and a log will be recorded, and the HTTP request will be analyzed and filtered through the ModSecurity module embedded in Nginx, and malicious activities and attacks will be recorded and blocked.

[0100] Packet filtering module 140: It is a module deployed at the third detection point. The packet filtering module 140 is configured to detect various types of DoS attacks and filter and control the five-tuple (source and destination IP, source and destination port, and protocol) of the traffic detected by the WAF module.

[0101] Log analysis and generation of dynamic policy module 150: configured to collect alarm logs generated by WAF module and packet filtering module 140, conduct four-dimensional comprehensive analysis of the number of concurrent connections of the same IP, the number of visits of the same IP in a certain period of time, the traffic of the same IP, and the URL attack details of the same IP based on the logs generated by the three restriction points of Nginx and the attack logs recorded by Modsecurity, and determine whether to take measures to notify the first detection point authentication tunnel module 120 to kick out the user and disconnect the tunnel, or to generate a network layer packet filtering blocking strategy to ban the IP at the third detection point, or to strengthen attack defense measures from the first and third detection points at the same time according to the blocking threshold set by the administrator; determine whether there are typical attacks such as network layer DDoS in the network layer packet filtering log, and dynamically adjust the first detection point strategy based on the judgment result, directly kick out the user, disconnect the tunnel, and block the attack at the very beginning of the kernel protocol stack for processing traffic, effectively reducing the CPU load of the system. Through the above analysis of different attack situations, the minimum granularity strategy for effective defense against attacks is generated, and the effect of minimizing the impact on the network environment is achieved.

[0102] It should be noted that Figure 2 The components and structures of the functional module architecture diagram shown are merely exemplary and non-restrictive. In actual scenarios, other components and structures may be provided as needed.

[0103] The following describes the network attack detection method provided by the exemplary embodiment of the present application in combination with the application scenarios described above and with reference to the accompanying drawings. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principles of the present application, and the implementation methods of the present application are not limited in this regard.

[0104] like Figure 3The figure shows a method flow chart of a detection method for defending against network attacks based on the Netfilter framework 110 provided in an embodiment of the present application. The detection method is applied to the above-mentioned defense system 100, which is located between the client 200 and the server 300 to be accessed. Specifically, the detection method includes:

[0105] S101: sending the access traffic from the client to the authentication tunnel module through the first detection point, and performing authentication determination, and after the authentication is passed, the defense system starts the process of establishing a secure communication tunnel with the client;

[0106] In the specific implementation process, the process of the authentication tunnel module 120 processing the access traffic from the client 200 can refer to the description of the aforementioned relevant parts, which will not be described in detail here.

[0107] S102: Sending the data packet sent to the application layer to the application firewall module through the second detection point, and performing Web attack detection; wherein the second detection point and the first detection point are respectively set on the PREROUTING chain of the Netfilter framework;

[0108] In the specific implementation process, the process of the application firewall module 130 processing the data packet sent through the second detection point can refer to the description of the aforementioned related parts, which will not be described in detail here.

[0109] S103: Sending the data packet detected by the application firewall module to the packet filtering module through a third detection point, and performing network layer detection; wherein the third detection point is set on the FORWARD chain of the Netfilter framework.

[0110] In the specific implementation process, the packet filtering module 140 performs a network layer detection process on the data packet after passing through the third detection point and being detected by the application firewall module 130. The description of the aforementioned relevant parts can be referred to and will not be described in detail here.

[0111] In the embodiment of the present application, the first detection point, the second detection point and the third detection point are set at three important positions through the Netfilter framework 110, so that multi-dimensional defense detection can be achieved. In this way, in a set of defense system 100, the functions of defending against network layer and application layer network attacks and identity authentication security tunnels can be achieved at the same time, without the need to deploy multiple systems or devices, thereby saving defense costs.

[0112] In the embodiment of the present application, the defense system 100 further includes a log analysis and dynamic policy generation module 150 connected to the authentication tunnel module 120, the application firewall module 130 and the packet filtering module 140, respectively. Figure 4 As shown, the method also includes:

[0113] S201: acquiring the attack log from the application firewall module and the packet filtering log from the packet filtering module through the log analysis generation dynamic policy module;

[0114] S202: Analyze the attack log to generate a defense blocking strategy for the first detection point and the third detection point;

[0115] S203: Analyze the packet filtering log and generate a control strategy for the first detection point to block the attack at the very beginning of the traffic processing kernel protocol stack.

[0116] In the specific implementation process, the detection method for defending against network attacks based on the Netfilter framework 110 provided in the embodiment of the present application can not only detect network attacks, but also realize targeted defense against network attacks by generating a dynamic strategy module 150 through log analysis. Among them, the processing process of the log analysis generating dynamic strategy module 150 analyzing logs in multiple dimensions and generating linkage defense strategies for each module can refer to the description of the aforementioned relevant parts, and will not be described in detail here.

[0117] In the embodiment of the present application, step S202: analyzing the attack log to generate a defense blocking strategy for the first detection point and the third detection point includes one of the following:

[0118] Notifying the authentication tunnel module through the first detection point to kick out the access user to the client and disconnect the secure communication tunnel;

[0119] By generating a packet filtering blocking strategy for the network layer, the IP address of the accessing user is blocked at the third detection point;

[0120] Attack defense measures are strengthened at both the first detection point and the third detection point.

[0121] It should be noted that various defense strategies against network attacks can also be generated according to actual application needs, which will not be described in detail here.

[0122] In the embodiments of the present application, Figure 5 As shown, step S101: sending the access traffic from the client to the authentication tunnel module through the first detection point, and performing authentication determination, including:

[0123] S301: After the access traffic from the client hits the first detection point, the access traffic enters the authentication tunnel module;

[0124] S302: authenticating the identity information of the access user from the client through the authentication tunnel module;

[0125] S303: If the authentication fails, the login is rejected;

[0126] S304: If the authentication is successful, a virtual IP is allocated to the client, and the virtual IP and the defense system IP are sent to the client, so that a secure communication tunnel is established between the client and the defense system.

[0127] In the specific implementation process, the specific implementation process of step S301 to step S304 is as follows:

[0128] First, the client 200 process accesses the backend server 300. When the message arrives at the client 200, it is processed by the physical network card and then sent to the server 300. Then, the data stream of the access service is filtered through the first detection point for authentication. If the server 300 is configured with the "pass after authentication" policy, direct access to the server 300 is not allowed at this time, and local authentication is required. Specifically, after DNAT is performed, the data packet is sent to the local LOCAL_IN for authentication and secure communication tunnel establishment service processing through routing selection; then, the identity information of the access user from the client 200 is authenticated. After the identity information is authenticated, a virtual IP is randomly generated. The virtual IP algorithm ensures that the upper limit of the number of IPs is 10,000, and each IP address is not repeated. The generated virtual IP and the defense system 100 IP are sent to the client 200 to establish a secure communication tunnel between the client 200 and the defense system 100.

[0129] In the embodiment of the present application, the application firewall module includes a limit_conn_zone module, a limit_request module, a core module and a ModSecurity module based on Nginx, such as Figure 6 As shown, step S102: sending the data packet sent to the application layer to the application firewall module through the second detection point, and performing Web attack detection, including:

[0130] S401: Sending the data packet sent to the application layer to the limit_conn_zone module, the limit_request module, the core module and the ModSecurity module through the second detection point;

[0131] S402: Limit the number of concurrent connections of the same IP address through the limit_conn_zone module;

[0132] S403: Limiting the number of visits from the same IP address in a specific time period through the limit_request module;

[0133] S404: Limit the traffic of the same IP address through the limit_rate provided by the core module;

[0134] S405: If it is detected that the access traffic triggers restrictions on the limit_conn_zone module, the limit_request module, and the core module, an alarm is issued and a corresponding log is recorded;

[0135] S406: Analyze the attack details of the URLs that are passed through Nginx through the ModSecurity module, and record and prevent malicious activities and attack behaviors.

[0136] In the embodiments of the present application, Figure 7 As shown, step S103: sending the data packet detected by the application firewall module to the packet filtering module through the third detection point, and performing network layer detection, including:

[0137] S501: Sending the data packet detected by the application firewall module to the packet filtering module through the third detection point;

[0138] S502: Detect whether there is a network layer DOS attack through the packet filtering module, and filter and control the five-tuple of the data packet detected by the application firewall module.

[0139] In the embodiments of the present application, Figure 8 As shown, if the second detection point and the third detection point are both turned on, before the step of applying the firewall module to perform Web attack detection, the method further includes:

[0140] S601: If the server accessed by the client through the defense system is configured with an application firewall protection policy, the access traffic hits the second detection point, and the data packets sent to the application layer are filtered by the application firewall to obtain filtered data packets;

[0141] S602: By modifying the kernel code of the hook point of the PREROUTING chain, the packet filtering policy of the third detection point is re-invoked to filter the filtered data packets, which are then redirected to the local of the defense system so that the application firewall module can perform Web attack detection.

[0142] It should be noted that, in order to clearly explain the specific process of application layer detection and network layer detection, in one exemplary embodiment, Fig. 9The processing flow shown provides a detailed explanation of the method steps after both the second detection point and the third detection point are turned on.

[0143] In the specific implementation process, the WAF module can be deployed at the second detection point and the packet filtering module 140 can be deployed at the third detection point to achieve defense against network layer attacks and application layer attacks. Fig. 9 The exemplary embodiment shown, the detailed process is as follows:

[0144] ① The client 200 process (such as an APP process) accesses the server 300 in the "WAF Security Policy" list;

[0145] ② The request message is sent directly to the server 300 after passing through the physical network card of the client 200;

[0146] ③ The request packet passes through the defense system 100. At the second detection point, the request packet accessing the server 300 is filtered through the PREROUTING chain NAT table. If the server 300 is configured with the WAF protection policy, it will be hit. After hitting, the request packet first passes through the packet filtering policy (the third detection point, which is achieved here by modifying the Netfilter kernel hook point. Before the request packet enters the local, it first passes the policy of the third detection point on the FORWARD chain) and is redirected to the defense system 100. The redirection performs DNAT on the data packet: the destination IP (that is, the server IP) is converted to the defense system IP; if it does not hit, the request packet is directly forwarded to the FORWARD chain;

[0147] ④ The request packet that does not hit the WAF policy is forwarded to the backend server 300 after matching the packet filtering "allow" policy through the third detection point on the FORWARD chain;

[0148] ⑤ The request packet redirected to the local by the WAF policy is processed by the WAF process and the data packet is filtered; after the WAF process is filtered, the proxy accesses the server 300. At this time, the data packet is: source-client IP, destination-server IP;

[0149] ⑥The request packet is sent to server 300 after being routed.

[0150] It should be noted that in the embodiment of the present application, the key hook point code of Netfilter can be modified to achieve the same data packet passing through the network layer and application layer detection in sequence. When the second detection point and the third detection point are turned on, the kernel code of the hook point of the PREROUTING chain can be modified to re-call the packet filtering rules of the third detection point to filter and control the access data packet before sending the request packet to the local WAF module for detection, thereby breaking through the restriction of the flow direction of the traditional Netfilter framework 110, that is, the restriction that the data passing through the FORWARD chain can no longer be sent to the local processing. In this way, the same access data packet can be returned to the local after the packet filtering detection of the FORWARD chain for application layer WAF module detection.

[0151] In the embodiment of the present application, if the first detection point, the second detection point and the third detection point are all turned on, Fig.10 As shown, in step S103: before sending the data packet detected by the application firewall module to the packet filtering module through the third detection point, the method further includes:

[0152] S701: Send the data packet detected by the application firewall module to the POSTROUTING chain, hit the SNAT conversion rule, and obtain the converted data packet; wherein the POSTROUTING chain is located on the Netfilter framework;

[0153] S702: By modifying the hook point kernel code of the POSTROUTING chain, the converted data packet is sent to the packet filtering module so that the packet filtering module performs network layer detection.

[0154] It should be noted that, in order to clearly explain the specific process of identity authentication, application layer detection and network layer detection, in one exemplary embodiment, Fig.11 and Fig.12 The processing flow shown provides a detailed explanation of the method steps after the first detection point, the second detection point and the third detection point are all turned on.

[0155] In the specific implementation process, the authentication tunnel module 120 can be deployed at the first detection point, the WAF module can be deployed at the second detection point, and the packet filtering module 140 can be deployed at the third detection point to achieve the identity authentication security tunnel, network layer attack and application layer attack defense. Fig.11 and Fig.12 The exemplary embodiment shown, the detailed process is as follows:

[0156] First, follow Fig.11 To deploy the authentication tunnel, the specific process is as follows:

[0157] ① The client 200 process accesses the backend server 300;

[0158] ② After the message arrives at the physical network card of client 200, it is processed and then sent to server 300;

[0159] ③The PREROUTING chain (the first detection point) filters the data flow of the access service and performs an "authentication" judgment. The server 300 is configured with the "pass after authentication" policy. At this time, direct access to the server 300 is not allowed and local authentication is required.

[0160] ④ After DNAT, the data packet is sent to the local LOCALIN for authentication and secure channel establishment after routing selection;

[0161] ⑤ Verify the identity information. After the identity information is verified, a virtual IP is randomly generated. The virtual IP algorithm ensures that the upper limit of the number of IPs is 10,000, and each IP address is unique. The generated virtual IP and the IP of the defense system 100 are sent to the client 200. The client 200 establishes a secure tunnel with the defense system 100 based on the received information. When communicating through the tunnel later, the client 200 encapsulates the virtual IP, server IP and payload, and encapsulates the real IP and the defense system IP in the packet header when leaving the network card.

[0162] It should be noted that in the embodiment of the present application, the functions of identity authentication and establishing a secure tunnel can be realized through the policy access of the first detection point. In the specific implementation process, the first layer of defense can be performed at the access level, and the tunnel establishment conditions, the client 200 encapsulation of the message, and the defense system 100 decapsulation of the message are the core functions.

[0163] Secondly, after the identity is verified, the process of secure communication tunnel encapsulation, WAF filtering, and packet filtering is as follows Fig.12 As shown, specifically:

[0164] ① The client 200 process routes to the virtual network card: sets the source IP to the virtual IP and sends a request message;

[0165] ② Data packets that comply with the tunnel strategy are routed to the virtual network card for encapsulation;

[0166] ③ The message is encapsulated by the physical network card. After processing, the data packet is: source-client real IP, destination-defense system IP, and the virtual IP is encapsulated into the IP payload;

[0167] ④ After receiving the tunnel message, the defense system 100 sends it to the local protocol stack for processing through routing search;

[0168] ⑤ After the local protocol stack checks the legitimacy of the tunnel message, it decapsulates it and sends it back to the routing forwarding. At this time, the source IP is a virtual IP;

[0169] ⑥The data packet goes through PREROUTING again. If it does not match the "pass after authentication" policy, it passes. If it matches the WAF policy, the data packet is redirected (DNAT) to the local machine.

[0170] ⑦The data packet is sent to the WAF process for processing, and the data packet is filtered and tested at the application layer;

[0171] ⑧After the WAF process is processed, the proxy sends a request message to the server 300: source - virtual IP, destination - server IP;

[0172] ⑨The data packet passes through POSTROUTING and hits the source address translation rule (SNAT), source-client real IP, destination-server IP; after the translation, it passes through the packet filtering policy, hits the permission and is sent to the back-end server 300 (here it is necessary to modify the implementation of the Netfilter kernel hook point, and call the packet filtering policy of the third detection point before the request packet leaves the system);

[0173] ⑩The data packet is sent to the backend server 300.

[0174] It should be noted that in the embodiment of the present application, the key hook point code of Netfilter can be modified to achieve the same data packet passing through the secure tunnel, identity authentication, application layer detection and network layer detection in sequence. When the first detection point, the second detection point and the third detection point are turned on, by modifying the hook point kernel code of the POSTROUTING chain, the data packet after the local WAF module detection will be re-invoked to filter the third detection point packet filtering rules, breaking through the traditional Netfilter framework 110 flow direction restrictions, that is, the data entering the POSTROUTING chain can no longer be sent to the FORWARD chain for processing. In this way, the same access data packet can be detected by the network layer packet filtering rules after being detected by the application layer WAF module.

[0175] In one exemplary embodiment, the packet filtering module 140 may be deployed only at the third detection point to implement network layer attack defense. Fig.13 The schematic diagram shown in the figure provides a detailed explanation of the data transmission process when only the third detection point is enabled:

[0176] ① The client 200 process accesses the backend server 300;

[0177] ② The message arrives at the client 200, and after being processed by the physical network card, the processed data packet is sent to the server 300;

[0178] ③ After routing selection, the data packet with the destination address being the business IP is sent to the FORWARD node and passes through the packet filtering strategy;

[0179] ④ If the packet filtering policy configured for accessing the backend server 300 is the "allow" policy, the data packet is sent to the backend server 300.

[0180] It should be noted that in the embodiment of the present application, the first detection point, the second detection point and the third detection point can be combined differently according to the actual application requirements. For example, the three detection points can be selected to be fully or partially opened from various aspects such as network environment requirements, security level requirements, and basic resource requirements for the operation of the defense system 100. In one of the exemplary embodiments, only the authentication tunnel module 120 and the WAF module may be deployed. In one of the exemplary embodiments, only the authentication tunnel module 120 and the packet filtering module 140 may be deployed. Of course, other deployment methods can also be performed, which are not limited here. In this way, the defense system 100 provided in the embodiment of the present application has a highly coordinated and unified triple defense function, and can open a variety of combination modes according to actual application needs. Authentication tunnel, application layer protection, and network layer protection can be opened individually or in combination. During the entire implementation process, the defense mode is flexible and the deployment can be changed according to the defense requirements and actual changes in the network.

[0181] In the embodiment of the present application, under the same protection level requirements, the access service delay is effectively reduced. When an access data packet passes through the authentication tunnel, network layer and application layer defense detection points, it passes sequentially in the same detection framework. There is no forwarding of data packets by different system devices, and there is no copy and recovery process of traffic during the detection process, which effectively reduces the delay of accessing services.

[0182] Moreover, the detection method provided by the embodiment of the present application effectively reduces the difficulty of operation and maintenance and reduces the deployment workload; the three-in-one functional combination only requires one deployment point to provide three defense functions in the network that needs to be protected, reducing the difficulty and workload of network planning. In the same system, the defense strategies of the three detection points can be viewed and modified at any time, without the need to log in to different system devices to view and modify the strategies of different network nodes, reducing the difficulty of operation and maintenance.

[0183] Based on the same inventive concept, Fig.14 As shown, the embodiment of the present application also provides a defense system 100 for defending against network attacks based on the Netfilter framework 110, the defense system 100 is located between the client 200 and the server 300 to be accessed by the client 200, and the system includes:

[0184] A first detection point and a second detection point are respectively set on a PREROUTING chain, and a third detection point is set on a FORWARD chain; wherein the PREROUTING chain and the FORWARD chain are located on the Netfilter framework 110;

[0185] an authentication tunnel module 120 connected to the Netfilter framework 110 through the first detection point, the authentication tunnel module 120 being configured to receive access traffic from the client 200 through the first detection point and perform authentication determination, and after the authentication is passed, the defense system 100 starts a process of establishing a secure communication tunnel with the client 200;

[0186] An application firewall module 130 connected to the Netfilter framework 110 through the second detection point, the application firewall module 130 being configured to receive data packets sent to the application layer through the second detection point and perform Web attack detection;

[0187] The packet filtering module 140 connected to the Netfilter framework 110 through the third detection point is configured to receive data packets detected by the application firewall module 130 through the third detection point and perform network layer detection.

[0188] In the embodiment of the present application, the system further includes:

[0189] A log analysis and dynamic policy generation module 150 connected to the authentication tunnel module 120, the application firewall module 130 and the packet filtering module 140 respectively, wherein the log analysis and dynamic policy generation module 150 is configured as follows:

[0190] The dynamic policy generation module 150 acquires the attack log from the application firewall module 130 and the packet filtering log from the packet filtering module 140 through the log analysis;

[0191] Analyze the attack log to generate a defense blocking strategy for the first detection point and the third detection point;

[0192] The packet filtering log is analyzed to generate a control strategy for the first detection point to block the attack at the very beginning of the kernel protocol stack for processing traffic.

[0193] Of course, the principle of solving the problem by the defense system 100 is similar to the defense system 100 mentioned above. Therefore, the connection relationship between the various modules included in the defense system 100 and the specific functions of each module can refer to the description of the aforementioned relevant parts, and the repeated parts will not be repeated.

[0194] Based on the same inventive concept, Fig.15 As shown, the embodiment of the present application also provides a detection device for defending against network attacks based on the Netfilter framework 110, which is applied to a defense system 100, and the device includes:

[0195] The authentication unit 10 sends the access traffic from the client 200 to the authentication tunnel module 120 through the first detection point, and performs authentication judgment. After the authentication is passed, the defense system 100 starts the process of establishing a secure communication tunnel with the client 200;

[0196] The first detection unit 20 sends the data packet sent to the application layer to the application firewall module 130 through the second detection point, and performs Web attack detection; wherein the second detection point and the first detection point are respectively set on the PREROUTING chain of the Netfilter framework 110;

[0197] The second detection unit 30 sends the data packet detected by the application firewall module 130 to the packet filtering module 140 through the third detection point, and performs network layer detection; wherein the third detection point is set on the FORWARD chain of the Netfilter framework 110.

[0198] In the embodiment of the present application, the device further includes a policy adjustment unit 40, and the policy adjustment unit 40 is specifically used to:

[0199] The dynamic policy generation module 150 acquires the attack log from the application firewall module 130 and the packet filtering log from the packet filtering module 140 through the log analysis;

[0200] Analyze the attack log to generate a defense blocking strategy for the first detection point and the third detection point;

[0201] The packet filtering log is analyzed to generate a control strategy for the first detection point to block the attack at the very beginning of the kernel protocol stack for processing traffic.

[0202] It should be noted that for the defense system 100, client 200, server 300, Netfilter framework 110, authentication tunnel module 120, application firewall module 130, packet filtering module 140, and log analysis to generate dynamic policy module 150 mentioned in the embodiments of the present application, the specific structural connection relationship and corresponding functions can be referred to the description of the aforementioned relevant parts and will not be repeated here.

[0203] In the embodiment of the present application, the policy adjustment unit 40 is specifically configured to perform one of the following:

[0204] Notify the authentication tunnel module 120 through the first detection point to kick out the access user to the client 200 and disconnect the secure communication tunnel;

[0205] By generating a packet filtering blocking strategy for the network layer, the IP address of the accessing user is blocked at the third detection point;

[0206] Attack defense measures are strengthened at both the first detection point and the third detection point.

[0207] In the embodiment of the present application, the authentication unit 10 is specifically used for:

[0208] After the access traffic from the client 200 hits the first detection point, the access traffic enters the authentication tunnel module 120;

[0209] Authenticating the identity information of the access user from the client 200 through the authentication tunnel module 120;

[0210] If the authentication fails, the login is denied;

[0211] If the authentication is successful, a virtual IP is allocated to the client 200 , and the virtual IP and the IP of the defense system 100 are sent to the client 200 , so that a secure communication tunnel is established between the client 200 and the defense system 100 .

[0212] In the embodiment of the present application, the application firewall module includes a limit_conn_zone module, a limit_request module, a core module and a ModSecurity module based on Nginx, and the first detection unit 20 is specifically used for:

[0213] Sending the data packet sent to the application layer to the limit_conn_zone module, the limit_request module, the core module and the ModSecurity module through the second detection point;

[0214] Limit the number of concurrent connections from the same IP address through the limit_conn_zone module;

[0215] Limit the number of visits from the same IP address in a specific time period through the limit_request module;

[0216] Limit the traffic of the same IP address through the limit_rate provided by the core module;

[0217] If it is detected that the access traffic triggers restrictions on the limit_conn_zone module, the limit_request module, and the core module, an alarm is issued and the corresponding log is recorded

[0218] The ModSecurity module is used to analyze the attack details of URLs passed by Nginx, and to record and prevent malicious activities and attack behaviors.

[0219] In the embodiment of the present application, the second detection unit 30 is specifically used for:

[0220] Sending the data packet detected by the application firewall module 130 to the packet filtering module 140 through the third detection point;

[0221] The packet filtering module 140 detects whether there is a network layer DOS attack, and performs filtering control on the five-tuple of the data packet detected by the application firewall module 130.

[0222] In the embodiment of the present application, if the second detection point and the third detection point are both turned on, before the application firewall module 130 performs the detection of the Web attack class, the detection device includes a first processing unit, and the first processing unit is specifically used to:

[0223] If the server 300 accessed by the client 200 through the defense system 100 is configured with an application firewall protection policy, the access traffic hits the second detection point, and the data packets sent to the application layer are filtered by the application firewall to obtain the filtered data packets;

[0224] By modifying the kernel code of the hook point of the PREROUTING chain, the packet filtering policy of the third detection point is re-called to filter the filtered data packets, which are then redirected to the local of the defense system 100 so that the application firewall module 130 can perform Web attack detection.

[0225] In the embodiment of the present application, if the first detection point, the second detection point and the third detection point are all turned on, before the data packet detected by the application firewall module 130 is sent to the packet filtering module 140 through the third detection point, the detection device further includes a second processing unit, and the second processing unit is specifically used to:

[0226] Sending the data packet detected by the application firewall module 130 to the POSTROUTING chain, hitting the SNAT conversion rule, and obtaining the converted data packet; wherein the POSTROUTING chain is located on the Netfilter framework 110;

[0227] By modifying the kernel code of the hook point of the POSTROUTING chain, the converted data packet is sent to the packet filtering module 140 so that the packet filtering module 140 performs network layer detection.

[0228] Based on the same inventive concept, an electronic device is also provided in the embodiment of the present application, and the electronic device can realize the function of the aforementioned detection device for defending against network attacks based on the Netfilter framework 110, referring to Fig.16 , the electronic device comprises:

[0229] Memory 400, used for storing computer programs;

[0230] The processor 500 is used to implement the detection method steps for defending against network attacks based on the Netfilter framework 110 as described in any of the above items when executing the computer program stored in the memory 400.

[0231] The specific connection medium between the processor 500 and the memory 400 is not limited in the embodiment of the present application. Fig.16 In the example, the processor 500 and the memory 400 are connected via a bus 600. The bus 600 is connected to the memory 400 via a bus 600. Fig.16 The connection between other components is shown by bold lines, and is not intended to be limiting. The bus 600 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.16 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 500 can also be called a controller, and there is no limitation on the name.

[0232] In the embodiment of the present application, the memory 400 stores instructions that can be executed by the processor 500. When the processor 500 executes the computer program stored in the memory 400, the detection method for defending against network attacks based on the Netfilter framework 110 discussed above can be executed. The processor 500 can implement Fig.14 The functions of each module are shown in the figure.

[0233] Among them, the processor 500 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing the computer program stored in the memory 400 and calling the data stored in the memory 400, the various functions of the device and process data, the device can be monitored as a whole.

[0234] In one possible design, the processor 500 may include one or more processing units, and the processor 500 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. In some embodiments, the processor 500 and the memory 400 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0235] The memory 400, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 400 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. Alternatively, the memory 400 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 400 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0236] By designing and programming the processor 500, the code corresponding to the detection method for defending against network attacks based on the Netfilter framework described in the above embodiment can be fixed into the chip, so that the chip can execute the steps of the detection method for defending against network attacks based on the Netfilter framework 110 discussed above when running. How to design and program the processor 500 is a technology well known to those skilled in the art and will not be described in detail here.

[0237] Based on the same inventive concept, an embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by the processor 500, the detection method for defending against network attacks based on the Netfilter framework 110 discussed above is implemented.

[0238] In some possible implementations, various aspects of the detection method for defending against network attacks based on the Netfilter framework 110 provided in the present application can also be implemented in the form of a program product, which includes a program code. When the program product is run on the device, the program code is used to enable the control device to execute the steps of the detection method for defending against network attacks based on the Netfilter framework according to various exemplary implementations of the present application described above in this specification.

[0239] The embodiment of the present application provides a detection method, system and device for defending against network attacks based on the Netfilter framework 110, wherein the detection method is applied to a defense system 100, the defense system 100 is located between the client 200 and the server 300 to be accessed by the client 200, and the access traffic from the client 200 can be sent to the authentication tunnel module 120 through the first detection point set on the PREROUTING chain of the Netfilter framework 110, and the authentication judgment is performed. After the authentication is passed, the defense system 100 starts the process of establishing a secure communication tunnel with the client 200. In this way, identity authentication and establishment of a secure communication tunnel can be performed through the defense system 100. Moreover, through the second detection point set on the PREROUTING chain of the Netfilter framework 110, the data packet sent to the application layer can be sent to the application firewall module 130, and the detection of Web attack classes can be performed. In this way, the detection of the application layer can be achieved through the defense system 100. In addition, by setting the third detection point on the FORWARD chain of the Netfilter framework 110, the data packet detected by the application firewall module 130 can be sent to the packet filtering module 140 and subjected to network layer detection. In this way, the defense system 100 can implement detection of the network layer.

[0240] In this way, under the premise of deploying the same defense system 100, the detection method for defending against network attacks based on the Netfilter framework 110 provided in the embodiment of the present application can be used to implement security detection in three different dimensions: authentication judgment, application layer detection, and network layer detection for a network access, thereby improving the protection level against network attacks, reducing the network delay of traditional multi-faceted detection, and reducing the configuration complexity and workload of implementing multi-faceted security protection.

[0241] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0242] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0243] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0244] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0245] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A detection method for defending against network attacks based on a Netfilter framework, applied to a defense system, characterized in that: The defense system is located between a client and a server to be accessed by the client, and the method includes: Sending the access traffic from the client to the authentication tunnel module through the first detection point and performing authentication judgment, and after the authentication is passed, the defense system starts the process of establishing a secure communication tunnel with the client; The data packets sent to the application layer are sent to the application firewall module through the second detection point, and the Web attack type is detected; wherein the second detection point and the first detection point are respectively set on the PREROUTING chain of the Netfilter framework; The data packet detected by the application firewall module is sent to the packet filtering module through the third detection point, and a network layer detection is performed; wherein the third detection point is set on the FORWARD chain of the Netfilter framework.

2. The method according to claim 1, characterized in that The defense system further includes a log analysis and dynamic strategy generation module connected to the authentication tunnel module, the application firewall module and the packet filtering module respectively, and the method further includes: The dynamic policy module is generated by the log analysis to obtain the attack log from the application firewall module and the packet filtering log from the packet filtering module; Analyze the attack log to generate a defense blocking strategy for the first detection point and the third detection point; The packet filtering log is analyzed to generate a control strategy for the first detection point to block the attack at the very beginning of the kernel protocol stack for processing traffic.

3. The method according to claim 2, characterized in that The analyzing the attack log to generate a defense blocking strategy for the first detection point and the third detection point includes one of the following: Notifying the authentication tunnel module through the first detection point to kick out the access user to the client and disconnect the secure communication tunnel; By generating a packet filtering blocking strategy for the network layer, the IP address of the accessing user is blocked at the third detection point; Attack defense measures are strengthened at both the first detection point and the third detection point.

4. The method according to claim 1 or 2, characterized in that: The step of sending the access traffic from the client to the authentication tunnel module through the first detection point and performing authentication determination includes: After the access traffic from the client hits the first detection point, the access traffic enters the authentication tunnel module; authenticating the identity information of the access user from the client through the authentication tunnel module; If the authentication fails, the login is denied; If the authentication is successful, a virtual IP is assigned to the client, and the virtual IP and the defense system IP are sent to the client, so that a secure communication tunnel is established between the client and the defense system.

5. The method according to claim 1 or 2, characterized in that: The method of sending the data packet detected by the application firewall module to the packet filtering module through the third detection point and performing network layer detection includes: Sending the data packet detected by the application firewall module to the packet filtering module through the third detection point; The packet filtering module is used to detect whether there is a network layer DOS attack, and the five-tuple of the data packet detected by the application firewall module is filtered and controlled.

6. The method according to claim 1 or 2, characterized in that: If the second detection point and the third detection point are both enabled, before the application firewall module performs the detection of the Web attack class, the method further includes: If the server accessed by the client through the defense system is configured with an application firewall protection policy, the access traffic hits the second detection point, and the data packets sent to the application layer are filtered by the application firewall to obtain the filtered data packets; By modifying the kernel code of the hook point of the PREROUTING chain, the packet filtering policy of the third detection point is re-called to filter the filtered data packets, which are then redirected to the local of the defense system so that the application firewall module can perform Web attack detection.

7. A defense system for defending against network attacks based on the Netfilter framework, characterized in that: The defense system is located between the client and the server to be accessed by the client, and the system includes: A first detection point and a second detection point are respectively set on a PREROUTING chain, and a third detection point is set on a FORWARD chain; wherein the PREROUTING chain and the FORWARD chain are located on the Netfilter framework; an authentication tunnel module connected to the Netfilter framework through the first detection point, the authentication tunnel module being configured to receive access traffic from the client through the first detection point and perform authentication determination, and after the authentication is passed, the defense system starts a process of establishing a secure communication tunnel with the client; an application firewall module connected to the Netfilter framework via the second detection point, the application firewall module being configured to receive data packets sent to the application layer via the second detection point and perform Web attack detection; A packet filtering module connected to the Netfilter framework via the third detection point, wherein the packet filtering module is configured to receive data packets detected by the application firewall module via the third detection point and perform network layer detection.

8. A detection device for defending against network attacks based on the Netfilter framework, applied to a defense system, characterized in that: The device comprises: The authentication unit sends the access traffic from the client to the authentication tunnel module through the first detection point, and performs authentication judgment. After the authentication is passed, the defense system starts the process of establishing a secure communication tunnel with the client; The first detection unit sends the data packet sent to the application layer to the application firewall module through the second detection point, and performs Web attack detection; wherein the second detection point and the first detection point are respectively set on the PREROUTING chain of the Netfilter framework; The second detection unit sends the data packet detected by the application firewall module to the packet filtering module through the third detection point, and performs network layer detection; wherein the third detection point is set on the FORWARD chain of the Netfilter framework.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to implement the method steps of any one of claims 1 to 6 when executing the computer program stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 6 are implemented.

Images