Attack defense method and device and electronic equipment

Abstract

The invention discloses an attack defense method and device and electronic equipment, and the method comprises the steps: responding to a request sent by UE to a server, adding information at the head of an original message corresponding to the request, and obtaining a new message after the original message is changed; and sending the new message to the defense equipment, so that the defense equipment determines whether to forward the request to the server based on a matching result of the newly added information in the new message and a legal list comprising the information of the legal UE. Through the technical scheme provided by the embodiment of the invention, effective defense of attacks is realized, and mistaken sealing of legal UE is avoided; the user experience can be improved; and meanwhile, resources and the like of the server do not need to be additionally increased, so that compared with consumption of resources and expenditure in a conventional defense mode, the resources and the expenditure are obviously reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an attack defense method, device and electronic device. Background Art

[0002] Challenge Collapsar (CC) attack is a type of distributed denial of service (DDoS) attack. In CC attack, the attacker uses a large number of zombies, botnets and proxy servers to consume the resources of the target server by forging World Wide Web (Web) requests, thereby paralyzing the system. Taking effective protective measures against this type of threat is an important part of ensuring network security.

[0003] Currently, the defense methods against CC attacks include load balancing-based defense methods and defense device-based defense methods.

[0004] Among them, the defense method based on load balancing can reduce the load pressure of a single server by distributing the requests of user terminals (English: User Equipment, abbreviated as UE) to multiple servers, thereby realizing the defense against CC attacks; it can also improve the processing capacity of the server by increasing the bandwidth and hardware resources of the server so that it can better withstand the pressure of CC attacks, thereby realizing the defense against CC attacks; it can also realize the defense against CC attacks by limiting the flow of traffic. However, this type of defense method needs to consume more resources and costs to realize the defense against CC attacks.

[0005] Defense methods based on defense devices can achieve defense against CC attacks by limiting the Internet Protocol (IP) access frequency, graphic verification codes, etc. However, when using IP access frequency to achieve defense against CC attacks, it is easy to misjudge a legitimate UE as an illegal UE (such as an attacker), thereby mistakenly blocking a legitimate UE; and when using graphic verification codes to achieve defense against CC attacks, it is easy to affect user experience.

[0006] Therefore, common defense methods against CC attacks consume more resources and costs, and are prone to misjudgment and affect user experience. Summary of the invention

[0007] This application provides an attack defense method, device and electronic device to solve the problem that common defense methods against CC attacks consume more resources and costs, are prone to misjudgment and affect user experience. The specific implementation scheme is as follows:

[0008] In a first aspect, the present application provides an attack defense method, which is applied to a user plane function UPF, and the method includes:

[0009] In response to a request initiated by a user terminal UE to a server, information is added to a header of an original message corresponding to the request to obtain a new message after the original message is changed;

[0010] The new message is sent to the defense device so that the defense device determines whether to forward the request to the server based on the matching result of the newly added information in the new message and the legal list; the legal list includes information of legal UEs; the newly added information is the information added to the header of the original message.

[0011] Through the above application embodiment, UPF adds information to the header of the original message corresponding to the request initiated by the UE to the server, and then sends the new message after the original message is changed to the defense device, so that the defense device can accurately identify the legal UE and the illegal UE based on the matching result of the newly added information of the new message and the legal list including the information of the legal UE, thereby avoiding the wrong blocking of the legal UE and helping to improve the user experience. At the same time, by adding information to the header of the original message for defense, there is no need to increase the resources of the server, etc., so compared with the consumption of resources and costs by conventional defense methods, the resources and costs can be significantly reduced.

[0012] In a possible implementation manner, adding information to a header of an original message corresponding to the request to obtain a new message after the original message is changed includes:

[0013] Receiving a uniform resource locator URL list sent by the defense device; wherein the URL list includes the attacked URLs; the URL list is determined by the defense device based on statistics of the number of URL visits;

[0014] Determine whether the URL corresponding to the request is a URL in the URL list;

[0015] If so, information is added to the header of the original message corresponding to the request to obtain the new message after the original message is changed.

[0016] Through the above-mentioned application embodiment, it is determined whether the URL corresponding to the request is an attacked URL based on whether the URL corresponding to the request is a URL in the URL list sent by the defense device. Then, when the URL corresponding to the request is an attacked URL, information is added to the header of the original message corresponding to the request, thereby reducing the amount of detection of subsequent defense devices and improving the efficiency of defense.

[0017] In a possible implementation manner, adding information to the header of the original message corresponding to the request includes:

[0018] In the header of the original message corresponding to the request, Q fields and field values ​​are added; wherein Q is a positive integer, and the Q fields and field values ​​include the identity information of the UE corresponding to the original message.

[0019] Through the above-mentioned application embodiment, Q types of fields and field values ​​including the identity information of the UE are inserted into the header of the original message corresponding to the request initiated by the UE, and the newly added information is obtained, so that the subsequent defense device can verify whether the UE is a legitimate UE based on the inserted Q types of fields and field values ​​(i.e., the newly added information), so as to facilitate the defense against the attack.

[0020] In a possible implementation manner, adding information to the header of the original message corresponding to the request includes:

[0021] receiving change information sent by the defense device;

[0022] According to the change information and a fixed period or a non-fixed period, in the header of the original message corresponding to the request, change the added field and the field value; or

[0023] According to the change information, after determining that the number of requests to the server is greater than or equal to the Hypertext Transfer Protocol HTTP request per second threshold and lasts for K time, the added fields and field values ​​are changed in the header of the original message until the number of requests is lower than the HTTP request per second threshold; wherein K is a positive integer.

[0024] Through the above-mentioned application embodiments, the fields and field values ​​added in the header of the original message are changed according to a fixed period or a non-fixed period, or a comparison result of the number of requests with the HTTP request per second threshold, making it difficult for an attacker to counterfeit the header of a legitimate UE in real time, thereby resisting attacks that counterfeit legitimate UEs and further enhancing defense.

[0025] In a second aspect, the present application provides an attack defense method, which is applied to a defense device, and the method includes:

[0026] Receive a new message sent by a user plane function UPF, and obtain new information in the new message; wherein the new information is information added by the UPF in the header of the original message corresponding to the new message; the new message is a message after the original message is changed corresponding to the request initiated by the user terminal UE to the server;

[0027] Based on the matching result between the newly added information and the legal list, determine whether to forward the request to the server; wherein the legal list includes information of legal UEs.

[0028] Through the above application embodiment, the defense device matches the newly added information in the new message sent by the UPF (i.e., the information added by the UPF in the header of the original message corresponding to the request initiated by the UE to the server) with the information including the legal user (i.e., the legal list), and then determines whether to forward the request to the server based on the matching result, so as to accurately identify the legal UE and the illegal UE, avoid the mistaken blocking of the legal UE, and help improve the user experience. At the same time, the defense device defends by means of the newly added information of the new message sent by the UPF, without adding additional server resources, etc., thereby significantly reducing the consumption of resources and costs compared to conventional defense methods.

[0029] In a possible implementation manner, before the receiving a new message sent by a user plane function UPF, the method further includes:

[0030] In response to an attack, a URL list is determined by counting the number of times a uniform resource locator URL is accessed, and the URL list is sent to the UPF, so that the UPF adds information to the header of the original message based on the URL list when it is determined that the URL corresponding to the request is a URL in the URL list; wherein the URL list includes the attacked URL.

[0031] Through the above-mentioned application embodiment, after an attack occurs, the defense device will send a URL list including the attacked URL determined by counting the number of URL accesses to the UPF, providing a matching list for the UPF to match the URL corresponding to the request, so that the UPF will add information to the header of the original message only when the URL corresponding to the request matches the URL list, thereby reducing the number of new messages received by the defense device, further reducing the amount of matches between the new information and the legitimate list, and improving the efficiency of the defense.

[0032] In a possible implementation manner, determining the URL list by counting the number of visits to the uniform resource locator URL includes:

[0033] Count the number of visits to all URLs;

[0034] Determine the target URL whose access times meet the preset conditions, and generate the URL list including the target URL; wherein the target URL is the attacked URL; the preset conditions are that the access times are greater than or equal to the access times threshold, or that the access times are in the top N positions in the access times ranking, where N is a positive integer.

[0035] Through the above-mentioned application embodiment, based on the comparison of the number of URL accesses with the preset conditions, the URL corresponding to the number of accesses is determined to be the attacked URL only after the number of accesses meets the preset conditions, thereby accurately generating a URL list including the attacked URLs, which helps to further improve the accuracy of defense.

[0036] In a possible implementation manner, determining whether to forward the request to the server based on a matching result between the newly added information and the legal list includes:

[0037] Determining whether the newly added information is consistent with the legal list;

[0038] If yes, forwarding the request to the server so that the UE corresponding to the new message communicates with the server;

[0039] If not, the UE corresponding to the new message is denied from communicating with the server.

[0040] Through the above-mentioned application embodiment, based on the judgment result of whether the newly added information is consistent with the legal list (that is, the matching result of the newly added information and the legal list), it is determined whether the UE corresponding to the new message is a legal UE. Therefore, if it is a legal UE, the request sent by the UE is forwarded to the server, and if it is not a legal UE, the request is refused to be forwarded to the Web server, thereby achieving effective defense against attacks.

[0041] In a possible implementation manner, after the if, the method further includes:

[0042] Adding the Internet Protocol IP of the UE corresponding to the new message to the whitelist; and

[0043] After the above if or not, it also includes:

[0044] The IP address of the UE corresponding to the new message is added to the blacklist.

[0045] Through the above-mentioned application embodiment, after the newly added information matches the legal list, the IP of the UE corresponding to the new message is added to the whitelist, so that when the UE initiates a request to the server again, the request can be directly passed, avoiding re-detection of the legal UE, thereby speeding up the request rate of the UE, further improving the user experience, and at the same time improving the efficiency of defense.

[0046] In addition, when the newly added information does not match the legal list, the IP of the UE corresponding to the new message is added to the blacklist, so that when the UE makes a request to the server again, the request can be directly rejected, avoiding the re-detection of illegal UEs and further improving the defense efficiency.

[0047] In a third aspect, the present application also provides an attack defense device, which is applied to a user plane function UPF, and the device includes:

[0048] A modification module, configured to, in response to a request initiated by a user terminal UE to a server, add information to a header of an original message corresponding to the request to obtain a new message after the original message is modified;

[0049] The first processing module is used to send the new message to the defense device so that the defense device determines whether to forward the request to the server based on the matching result of the newly added information in the new message and the legal list; the legal list includes the information of the legal UE; the newly added information is the information added to the header of the original message.

[0050] In a possible implementation, the modification module is specifically used to receive a uniform resource locator URL list sent by the defense device; wherein the URL list includes attacked URLs; the URL list is determined by the defense device based on statistics of URL access times;

[0051] Determine whether the URL corresponding to the request is a URL in the URL list;

[0052] If so, information is added to the header of the original message corresponding to the request to obtain the new message after the original message is changed.

[0053] In a possible implementation, the modification module is specifically used to add Q fields and field values ​​to the header of the original message corresponding to the request; wherein Q is a positive integer, and the Q fields and field values ​​include the identity information of the UE corresponding to the original message.

[0054] In a possible implementation manner, the modification module is specifically configured to receive change information sent by the defense device;

[0055] According to the change information and a fixed period or a non-fixed period, in the header of the original message corresponding to the request, change the added field and the field value; or

[0056] According to the change information, after determining that the number of requests to the server is greater than or equal to the Hypertext Transfer Protocol HTTP request per second threshold and lasts for K time, the added fields and field values ​​are changed in the header of the original message until the number of requests is lower than the HTTP request per second threshold; wherein K is a positive integer.

[0057] In a fourth aspect, the present application further provides an attack defense device, which is applied to a defense device, and the device includes:

[0058] A receiving module, configured to receive a new message sent by a user plane function UPF, and obtain newly added information in the new message; wherein the newly added information is information added by the UPF in the header of the original message corresponding to the new message; the new message is a message after the original message is changed corresponding to the request initiated by the user terminal UE to the server;

[0059] The second processing module is used to determine whether to forward the request to the server based on the matching result between the newly added information and the legal list; wherein the legal list includes information of legal UEs.

[0060] In a possible implementation, the device also includes a sending module, which is used to determine a URL list by counting the number of visits to a uniform resource locator URL in response to an attack before receiving a new message sent by the user plane function UPF, and send the URL list to the UPF, so that the UPF adds information to the header of the original message based on the URL list when it determines that the URL corresponding to the request is a URL in the URL list; wherein the URL list includes the attacked URL.

[0061] In a possible implementation, the sending module is specifically used to count the number of visits to all URLs;

[0062] Determine the target URL whose access times meet the preset conditions, and generate the URL list including the target URL; wherein the target URL is the attacked URL; the preset conditions are that the access times are greater than or equal to the access times threshold, or that the access times are in the top N positions in the access times ranking, where N is a positive integer.

[0063] In a possible implementation manner, the second processing module is specifically configured to determine whether the newly added information is consistent with the legal list;

[0064] If yes, forwarding the request to the server so that the UE corresponding to the new message communicates with the server;

[0065] If not, the UE corresponding to the new message is denied from communicating with the server.

[0066] In a possible implementation manner, the second processing module is specifically configured to, after the if, add the Internet Protocol IP of the UE corresponding to the new message to a whitelist; and

[0067] After the "if no", the IP address of the UE corresponding to the new message is added to the blacklist.

[0068] In a fifth aspect, the present application provides an electronic device, including:

[0069] Memory, used to store computer programs;

[0070] The processor is used to implement the above-mentioned attack defense method steps when executing the computer program stored in the memory.

[0071] In a sixth aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the above-mentioned attack defense method steps are implemented.

[0072] For each of the above-mentioned aspects from the third to the sixth aspects and the technical effects that may be achieved by each of the aspects, please refer to the above-mentioned description of the technical effects that can be achieved by the first aspect or the various possible schemes in the first aspect, or the above-mentioned description of the technical effects that can be achieved by the various possible schemes in the second aspect, and no repetition will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 A CC attack schematic diagram provided in an embodiment of the present application;

[0074] Figure 2 A schematic diagram of an attack defense method provided in an embodiment of the present application Figure 1 ;

[0075] Figure 3 A schematic diagram of an attack defense method provided in an embodiment of the present application Figure 2 ;

[0076] Figure 4a A schematic diagram of a point-to-point linkage method provided in an embodiment of the present application;

[0077] Figure 4b A schematic diagram of the linkage mode of centralized control provided in an embodiment of the present application;

[0078] Figure 5 A schematic diagram of the processing process of the attack defense method provided in the embodiment of the present application;

[0079] Figure 6 A schematic diagram of the structure of an attack defense device provided in an embodiment of the present application Figure 1 ;

[0080] Figure 7 A schematic diagram of the structure of an attack defense device provided in an embodiment of the present application Figure 2 ;

[0081] Figure 8 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0082] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The specific operating methods in the method embodiments can also be applied to device embodiments or system embodiments. It should be noted that in the description of the present application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A is connected to B, which can represent: A is directly connected to B and A is connected to B through C. In addition, in the description of the present application, words such as "first" and "second" are only used to distinguish the purpose of description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0083] The embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0084] Embodiment 1:

[0085] like Figure 1 As shown in FIG, CC attacks control multiple computers or devices to send a large number of forged Hypertext Transfer Protocol (HTTP) requests to a target server (such as a Web server). These requests usually require the target server to perform complex and time-consuming calculations or database operations, thereby exhausting the resources of the target server, causing the target server to be unable to respond to normal UE requests (such as legitimate UE requests), resulting in slow UE access or even inaccessibility.

[0086] CC attacks are mainly divided into botnet CC attacks and free proxy server CC attacks. Botnet CC attacks refer to attackers using many innocent but controlled computers and IoT devices (i.e. botnets) to attack target servers. Free proxy server CC attacks refer to attackers using free proxy servers to generate legitimate page requests to the victim host (such as the target server), making it unable to process normal requests.

[0087] Since the requests of CC attacks are all simulated real valid requests, they cannot be rejected by the target server; and the data packets of CC attacks are all simulated normal data packets of real UE, so it is difficult to distinguish between legitimate and illegal requests, which makes it easy for CC attack defense to mistakenly block legitimate UEs, which can easily affect user experience.

[0088] Therefore, the present application proposes an attack defense method, which is applied to the user plane function (English: User Plane Function, abbreviated as UPF). When the UE initiates a request to the server, information is added to the header of the original message corresponding to the request, and then the new message after the original message is changed is sent to the defense device, so that the defense device determines whether to forward the request to the server based on the matching result of the newly added information in the new message and the legal list including the information of the legal UE, thereby achieving effective defense against the attack message; at the same time, there is no need to increase the resources of the server, thereby significantly reducing the resources and costs compared to the consumption of resources and costs by conventional defense methods.

[0089] Reference Figure 2 The figure is a flow chart of an attack defense method provided by an embodiment of the present application, the method comprising:

[0090] S201, in response to the UE initiating a request to the server, adding information to the header of the original message corresponding to the request to obtain a new message after the original message is changed.

[0091] In the embodiment of the present application, the server may be a Web server, that is, the server initiates a request to the Web server in response to the UE.

[0092] S202: Send the new message to the defense device, so that the defense device determines whether to forward the request to the server based on the matching result between the newly added information in the new message and the legal list.

[0093] The legal list includes information of legal UEs. The newly added information is information added to the header of the original message. The header may be the HTTP header of the original message. The newly added information may include fields and field values.

[0094] As the user plane function of the core network of the fifth generation mobile communication technology (English: 5th Generation Mobile Communication Technology, abbreviated as 5G), UPF carries the UE service traffic of all UEs. In the UPF, modifying or enhancing the data message header of the HTTP / HTTPS traffic passing through is a mature technology in the 5G network of operators.

[0095] Therefore, UPF can modify the HTTP header information of the message (i.e., the original message) corresponding to the request (such as HTTP request) initiated by the UE to the server (such as a Web server), add relevant information, and can also customize the insertion field and field value configuration. Therefore, by adding information to the header of the original message through UPF, a new message containing the newly added information can be obtained.

[0096] The fields and field values ​​in the above added information are separated by colons (ie:). The fields and field values ​​in the added information can be as follows:

[0097] GET / HTTP / 1.1

[0098] Cache-Control:max-age=3600

[0099] Connection: Keep-Alive

[0100] Accept: * / *

[0101] If-Modified-Since: Mon, 12Feb 2024 22:07:27GMT

[0102] If-None-Match: "65ca969f-2cd"

[0103] User-Agent:Microsoft-CryptoAPI / 10.0

[0104] Host: x1.c.lencr.org

[0105] For example, the Cache-Control mentioned above is the field name, and max-age=3600 is the field value.

[0106] In the embodiment of the present application, the newly added information (i.e., the information added to the header of the original message) can be added to the header of the original message according to the terminal information and network information mastered by the UE in the 5G application scenario, thereby obtaining the newly added information. In addition, the added fields and their corresponding field value configurations can also be customized to obtain the newly added information.

[0107] According to the terminal information and network information mastered by the UE in the 5G application scenario, appropriate fields and field values ​​are added to the header of the original message to obtain the newly added information, which can be:

[0108] The UE information corresponding to the original message is obtained, and the UE information may be the identity information of the UE. The identity information may be the mobile phone number (English: Generic Public Subscription Identifier, abbreviated as GPSI) corresponding to the UE, the subscription permanent identifier (English: Subscription Permanent Identifier, abbreviated as SUPI), the equipment identifier (English: Permanent Equipment Identifier, abbreviated as PEI), the identity code (English: Identity document, abbreviated as ID), etc., but is not limited thereto.

[0109] Then, Q fields and field values ​​are added to the header of the original message to obtain the newly added information. The Q fields and field values ​​include the identity information of the UE, such as the GPSI of the UE. Wherein, Q is a positive integer.

[0110] The above-mentioned addition of Q fields and field values ​​in the header of the original message can be to insert a field and field value in the UE's identity information into the header of the original message according to the information sent by the received defense device, such as inserting the UE's GPSI, so that the subsequent defense device can verify whether the UE is a legitimate UE based on the inserted field and field value.

[0111] The above-mentioned Q fields and field values ​​are added to the header of the original message. According to the current situation of the 5G scenario, at least two fields and field values ​​can be inserted into the header of the original message (for example, in addition to inserting the UE's GPSI into the header of the original message, the UE's PEI, SUPI and other information can also be inserted), thereby improving the accuracy of the newly added information, so that the subsequent defense device can verify whether the UE is a legitimate UE based on the inserted fields and field values.

[0112] However, an attacker may obtain the fields and field values ​​of a legitimate UE (such as the GPSI of a legitimate UE) through technical means, and then launch an attack by counterfeiting the field values ​​of the legitimate UE, resulting in the inability to effectively identify the attacker and the legitimate UE by adding Q fields and field values ​​including the UE's identity information to the header of the original message.

[0113] Therefore, in order to solve this problem, the fields and field values ​​inserted in the header of the original message can be changed by receiving the change information sent by the defense device (such as adding a custom field and field value to the header of the original message), so as to perform active defense and further improve the accuracy of defense. This process can be implemented by the following method 1, method 2, or method 3.

[0114] Method 1:

[0115] After receiving the change information sent by the defense device, the newly added information is periodically changed in the header of the original message according to the change information and a fixed period, that is, the added fields and field values ​​are changed.

[0116] The above-mentioned change information may include information instructing the UPF to change the fields and field values ​​added in the header of the original message according to a fixed period.

[0117] The above fixed period can be adjusted according to specific application scenarios.

[0118] The fields and field values ​​added by the above changes can be changed by customizing the fields and field values, or randomly changed by customizing the fields and field values, making it difficult for attackers to counterfeit the header of a legitimate UE in real time, thereby resisting attacks by counterfeiting legitimate UEs and further enhancing defense.

[0119] Method 2:

[0120] After receiving the change information sent by the defense device, the newly added information is periodically changed in the header of the original message according to the change information and the non-fixed period, that is, the added fields and field values ​​are changed.

[0121] The above-mentioned change information may include information instructing the UPF to change the fields and field values ​​added in the header of the original message according to a non-fixed period.

[0122] The above non-fixed period can be adjusted according to specific application scenarios.

[0123] The fields and field values ​​added by the above changes can be changed by customizing the fields and field values, or randomly changed by customizing the fields and field values, making it difficult for attackers to counterfeit the header of a legitimate UE in real time, thereby resisting attacks by counterfeiting legitimate UEs and further enhancing defense.

[0124] Method 3:

[0125] After receiving the change information sent by the defense device, and after determining that the number of requests to the server is greater than or equal to the HTTP request per second threshold and lasts for K time, the header of the original message is changed to add new information, that is, to change the added fields and field values, until the number of requests is lower than the HTTP request per second threshold. K is a positive integer.

[0126] The above HTTP request per second threshold can be adjusted according to specific application scenarios.

[0127] The fields and field values ​​added by the above changes can be changed by customizing the fields and field values, or by continuously changing the random fields and field values ​​by customizing the fields and field values, so that it is difficult for attackers to counterfeit the header of the legitimate UE in real time, thereby resisting attacks that counterfeit the legitimate UE and further enhancing the defense.

[0128] The above number of requests, HTTP request threshold per second, and duration K can be determined by the defense device.

[0129] That is, after receiving the first change information sent by the defense device, the header of the original message continues to change the newly added information, that is, the added fields and field values ​​are changed, and after receiving the second change information sent by the defense device, the newly added information is stopped from being changed.

[0130] The first change information is sent by the defense device after determining that the number of requests to the server is greater than or equal to the HTTP request per second threshold and lasts for a period of K. The first change information may include information indicating that the UPF continuously changes the newly added information.

[0131] The second change information is sent by the defense device after determining that the number of server requests is lower than the HTTP request per second threshold, or after determining that the number of server requests is lower than the HTTP request per second threshold and continues for a period of L. L is a positive integer. The second change information may include information instructing the UPF to stop changing the newly added information.

[0132] The judgment of the number of requests, the HTTP request per second threshold, and the duration of K can also be determined by the UPF. At this time, the change information can include information instructing the UPF to change the new information in the header of the original message after determining that the number of requests to the server is greater than or equal to the HTTP request per second threshold and lasts for K time, until the number of requests is lower than the HTTP request per second threshold.

[0133] Through the above-mentioned methods 1, 2 and 3, the accuracy of defense is further improved.

[0134] In addition, in an embodiment of the present application, in order to reduce the amount of detection of new information in new messages by subsequent defense devices, before adding information to the header of the original message corresponding to the request and obtaining a new message after the original message is changed, the request initiated by the UE can be matched according to the rules, so that information is added to the header of the original message corresponding to the request only after the request is the attacked URL.

[0135] Specifically, first, a Uniform Resource Locator (URL) list sent by a defense device is received, and the URL list includes the attacked URLs.

[0136] Then, it is determined whether the URL corresponding to the request initiated by the UE is a URL in the URL list. The URL corresponding to the request initiated by the UE is the URL to be accessed by the UE.

[0137] If it is determined that the URL corresponding to the request initiated by the UE is a URL in the URL list, then it is determined that the URL that the UE is about to access is the attacked URL. At this time, the legality of the UE needs to be verified by the defense device to prevent illegal UEs (i.e. attackers) from accessing the URL, thereby achieving effective defense against the attack. Specifically, information is added to the header of the original message corresponding to the request initiated by the UE to obtain a new message after the original message is changed, and then the new message is sent to the defense device, so that the defense device determines whether to forward the request to the server based on the newly added information in the new message.

[0138] Through the above method, the amount of detection of new information in new messages by subsequent defense devices can be reduced, thereby helping to improve the efficiency of defense.

[0139] Optionally, a URL list sent by a defense device is received. The URL list includes the attacked URLs. Then, it is determined whether the URL corresponding to the request initiated by the UE is a URL in the URL list.

[0140] If it is determined that the URL corresponding to the request initiated by the UE is not in the URL list, it is determined that the URL to be accessed by the UE is not the attacked URL, and the URL corresponding to the request can be directly accessed normally.

[0141] Through the above method, the subsequent defense device can avoid detecting the access to the normal URL, further improving the efficiency of the defense.

[0142] In the embodiment of the present application, the above-mentioned determination of whether to add information to the header of the original message corresponding to the request initiated by the UE by the received URL list can also be determined by the received IP list. The IP list includes the attacked IP.

[0143] The specific process of determining whether to add information to the header of the original message corresponding to the request initiated by the UE through the received IP list is consistent with the specific process of determining whether to add information to the header of the original message corresponding to the request initiated by the UE through the received URL list mentioned above, and will not be repeated here.

[0144] In summary, the attack defense method proposed in this application, after the UPF determines that the URL (or IP) corresponding to the request initiated by the UE is the attacked URL (or IP), it adds information (i.e., new information) to the header (such as HTTP header) of the original message corresponding to the request, and then sends the new message with the added information to the defense device, so that the defense device determines whether to forward the request to the server based on the matching result of the new information in the new message and the legal list including the information of the legal UE, thereby achieving effective defense against attacks (such as CC attacks). Defending against attacks through the new information in the header information of the new message can resist conventional attacks, and can also effectively distinguish between legal UEs and illegal UEs in 5G scenarios, thereby avoiding requests from illegal UEs and avoiding mistaken blocking of legal UEs.

[0145] Furthermore, when defending against attacks through the newly added information in the header information of the new message, the fields and field values ​​in the newly added information are transformed through randomly generated custom fields, making it difficult for attackers to counterfeit the header of a legitimate UE in real time, thereby resisting attacks that counterfeit legitimate UEs and further enhancing defense.

[0146] In addition, when a customer encounters an attack such as a CC attack, compared with traditional defense methods, the defense method proposed in the embodiment of the present application can more effectively protect against attacks such as CC attacks in 5G scenarios, thereby reducing the impact on legitimate UEs.

[0147] Embodiment 2:

[0148] The present application also proposes an attack defense method, which is applied to a defense device, receives a new message sent by the UPF, and then determines whether to forward the request initiated by the UE to the server to the server based on the matching result of the newly added information in the new message (i.e., the information added by the UPF to the header of the original message corresponding to the request initiated by the UE to the server) and the legal list including the information of the legal UE, thereby achieving effective defense against attacks and avoiding the rejection of requests from legal UEs; at the same time, there is no need to increase the resources of the server, thereby significantly reducing the consumption of resources and costs compared to conventional defense methods.

[0149] Reference Figure 3 The figure is a flow chart of an attack defense method provided by an embodiment of the present application, the method comprising:

[0150] S301, receive a new message sent by UPF, and obtain the new information in the new message.

[0151] The newly added information is the information added by the UPF in the header of the original message corresponding to the new message. The new message is a message after the original message corresponding to the request initiated by the UE to the server is changed.

[0152] Specifically, before receiving a new message sent by UPF, the defense device first sends a list of attacked URLs to UPF, so that UPF determines to add information to the header of the original message based on the URL list, and then sends the obtained new message to the defense device.

[0153] Before sending the URL list to UPF, the URL list needs to be generated first.

[0154] In the embodiment of the present application, the specific process of generating the URL list can be as follows:

[0155] In response to an attack, the attacked URL is determined by counting the number of URL accesses, thereby generating a URL list including the attacked URL. The attack may be a CC attack, but is not limited thereto.

[0156] The above-mentioned determination of the attacked URL through the statistics of the number of URL accesses can be determined based on whether the number of accesses meets a preset condition.

[0157] Specifically, the number of visits to all visited URLs is counted. Then, for the number of visits to each URL, it is determined whether the number of visits meets a preset condition.

[0158] If it is determined that the number of accesses meets the preset condition, then the URL corresponding to the number of accesses is determined to be the attacked URL.

[0159] If it is determined that the number of accesses does not meet the preset condition, it is determined that the URL corresponding to the number of accesses is not the attacked URL.

[0160] In the embodiment of the present application, the preset condition may be that the number of visits is in the top N in the number of visits ranking. Then, through the statistics of the number of URL visits, the URL to be attacked may be:

[0161] First, count the number of visits to each URL. Then sort all the visit times to get the visit number ranking. The higher the ranking, the greater the number of visits. That is, the first in the visit number ranking is the visit number with the largest number among all the visit times (i.e., the most visits).

[0162] Then, for each URL's access count, determine whether the access count is in the top N of the access count ranking. N is a positive integer. In addition, in the embodiment of the present application, the specific value of N can be adjusted according to the specific application scenario to ensure that all attacked URLs can be determined later.

[0163] If it is determined that the number of visits is in the top N positions in the ranking of the number of visits (ie, the number of visits meets the preset conditions), then it is determined that the URL corresponding to the number of visits is the attacked URL.

[0164] If it is determined that the number of visits is not in the top N positions in the ranking of the number of visits (ie, the number of visits does not meet the preset conditions), it is determined that the URL corresponding to the number of visits is not the attacked URL.

[0165] Through the above method, the URL corresponding to the top N access counts in the access count ranking is used as the attacked URL, thereby accurately identifying the attacked URL, so that the UPF only enhances the header of the attacked URL (i.e., adds information to the header), so that the subsequent defense device only identifies the request corresponding to the attacked URL, which significantly improves the defense efficiency while ensuring the accuracy of the defense. In addition, the configuration of the access count being in the top N positions in the access count ranking is convenient, and the preset condition of the access count being in the top N positions in the access count ranking can be configured more quickly, so that the attacked URL can be quickly determined, thereby further improving the defense rate.

[0166] In the embodiment of the present application, the above preset condition may also be that the number of accesses is greater than or equal to the number of accesses threshold. Then, the above statistics of the number of URL accesses may be used to determine the attacked URL:

[0167] First, the number of visits to each URL is counted. Then, for each URL, it is determined whether the number of visits is greater than or equal to the number of visits threshold. In the embodiment of the present application, the number of visits threshold can be adjusted according to the specific application scenario to ensure that all attacked URLs can be determined later.

[0168] If it is determined that the number of accesses is greater than or equal to the access number threshold (ie, it is determined that the number of accesses meets the preset condition), then the URL corresponding to the number of accesses is determined to be the attacked URL.

[0169] If it is determined that the number of accesses is less than the access number threshold (ie, it is determined that the number of accesses does not meet the preset condition), it is determined that the URL corresponding to the number of accesses is not the attacked URL.

[0170] By comparing each of the above access times with the access times threshold, the URLs with access times greater than or equal to the access times threshold are taken as the attacked URLs, thereby accurately determining the attacked URLs. In addition, determining the attacked URLs by the access times threshold method also makes up for the deficiency of determining the attacked URLs by the access times ranking method, further improving the accuracy and authenticity of the determined attacked URLs.

[0171] In addition, in an embodiment of the present application, before receiving a new message sent by the UPF, the defense device may also send change information to the UPF, so that the UPF changes the newly added information (i.e., changes the added fields and field values) in the header of the original message corresponding to the request initiated by the UE according to the change information, thereby making it difficult for an attacker to forge the header of a legitimate UE in real time, thereby being able to resist attacks that impersonate legitimate UEs and further enhancing defense.

[0172] S302: Determine whether to forward the request to the server based on the matching result between the newly added information and the legal list.

[0173] The legal list includes the identity information of legal UEs, such as GPSI, SUPI, PEI and other information of the UEs.

[0174] The above legal list can be obtained as follows:

[0175] In response to an attack occurring, a legitimate list imported by a user is received, thereby obtaining a legitimate list.

[0176] Furthermore, the newly added information obtained in step S301 is matched with the legal list.

[0177] If it is determined that the newly added information is consistent with the legal list, that is, the matching result of the newly added information and the legal list is that the newly added information is consistent with the legal list, the request sent by the UE corresponding to the new message is forwarded to the server, so that the UE communicates with the server.

[0178] Exemplarily, the newly added information includes the GPSI of the UE, that is, the mobile phone number of the UE; the legal list includes the GPSI of the legal UE, that is, the mobile phone number of the legal UE. It is determined whether the mobile phone number is a mobile phone number in the legal list. If so, it is determined that the newly added information is consistent with the legal list, so that the request sent by the UE corresponding to the new message is forwarded to the server, so that the UE communicates with the server.

[0179] If it is determined that the newly added information does not match the legal list, a reset (English: Reset, abbreviated as RST) message is sent to the UE to disconnect the UE from the server, thereby realizing the rejection of communication between the UE and the server.

[0180] Among them, the RST message is a message used to close a TCP connection or to terminate illegal data and requests, so that the purpose of disconnection can be achieved by sending the RST message.

[0181] In addition, in an embodiment of the present application, after determining that the newly added information is consistent with the legal list, the defense device can add the identity information (such as IP) of the UE corresponding to the new message to the whitelist, so that when the UE initiates a request again, the UE can be directly allowed to communicate with the server, thereby further improving the efficiency of the defense while ensuring the accuracy of the defense.

[0182] After determining that the newly added information does not match the legal list, the defense device can add the identity information (such as IP) of the UE corresponding to the new message to the blacklist, so that when the UE initiates a request again, the communication between the UE and the server is directly rejected, thereby further improving the efficiency of the defense while ensuring the accuracy of the defense.

[0183] In addition, in an embodiment of the present application, after detecting that there is no attack, the defense device can send a URL deletion list or an IP deletion list to the UPF, so that the UPF deletes the list according to the received URL deletion list or IP deletion list.

[0184] In summary, the attack defense method proposed in the present application is that the defense device compares the newly added information in the header (such as HTTP header) of the new message sent by UPF (that is, the information added by UPF in the header of the original message corresponding to the request initiated by UE) with the legal list to determine whether the newly added information in the header of the new message is consistent with the legal list including the identity information of the legal UE. When it is determined that the newly added information is consistent with the legal list, the UE corresponding to the new message is determined to be a legal UE, and the UE is allowed to communicate with the server. When it is determined that the newly added information is inconsistent with the legal list, the UE corresponding to the new message is determined to be an illegal UE, and the UE is not allowed to communicate with the server, thereby achieving effective defense against attacks (such as CC attacks).

[0185] By using the newly added information in the header of the new message to defend against attacks, conventional attacks can be resisted, and legal UEs and illegal UEs in 5G scenarios can be effectively distinguished, thereby avoiding requests from illegal UEs and avoiding mistakenly blocking legal UEs.

[0186] Furthermore, when defending against attacks through the newly added information in the header information of the new message, the fields and field values ​​in the newly added information are transformed through randomly generated custom fields, making it difficult for attackers to counterfeit the header of a legitimate UE in real time, thereby resisting attacks that counterfeit legitimate UEs and further enhancing defense.

[0187] In addition, when a customer encounters an attack such as a CC attack, compared with traditional defense methods, the defense method proposed in the embodiment of the present application can more effectively protect against attacks such as CC attacks in 5G scenarios, thereby reducing the impact on legitimate UEs.

[0188] In addition, the attack defense method proposed in this application can be used by operators to defend against attacks such as CC attacks in 5G scenarios, and to protect user Web applications deployed in campuses and cloud resource pools, etc., to avoid paralysis of server resources caused by attacks such as CC attacks, thereby avoiding application denial of service. In an embodiment of this application, a defense device (such as a DDoS defense device) is linked with a UPF to achieve effective defense against attacks.

[0189] The linkage between the above defense equipment and UPF can be Figure 4a The point-to-point linkage method shown in Figure 4b The centralized control linkage mode shown is that the defense device sends messages through the centralized control device to achieve full network linkage and improve efficiency.

[0190] The technical solution of the present application (including the technical solutions of Embodiment 1 and Embodiment 2) is further explained below in conjunction with a specific application process.

[0191] like Figure 5 The figure shows a processing diagram of the attack defense method, where the defense device is a DDoS defense device and the server is a Web server.

[0192] Before the attack, the DDoS defense device receives a list of legitimate 5G terminal mobile phone numbers.

[0193] When an attack occurs, the DDoS defense device starts defense, determines a URL list including the attacked URL by counting the number of URL accesses, and sends the URL list to the UPF.

[0194] After receiving the request initiated by the UE to the Web server, the UPF matches the URL corresponding to the request with the URL list received from the DDoS defense device, that is, determines whether the URL corresponding to the request is a URL in the URL list. If so, it determines that the URL match is successful, and then adds the UE's mobile phone number field corresponding to the request to the HTTP header of the original message corresponding to the request to obtain a new message enhanced by the HTTP header (that is, the message after the original message is changed). And send the new message to the DDoS defense device.

[0195] After receiving the new message sent by UPF, the DDoS defense device detects the newly added information in the HTTP header of the new message (that is, the mobile phone number field added by UPF in the HTTP header of the original message), that is, determines whether the mobile phone number carried by the newly added information in the HTTP header belongs to the mobile phone number in the legal 5G terminal mobile phone number list. If so, it is determined that the detection is passed, and the request initiated by the UE corresponding to the new message is forwarded to the Web server (that is, the UE's request is forwarded), and the UE's IP is added to the whitelist. If not, it is determined that the detection fails, the UE's request is blocked, and an RST message is sent to disconnect the TCP connection between the Web server and the UE corresponding to the new message, and the UE's IP corresponding to the new message is added to the blacklist.

[0196] After receiving the request from the UE forwarded by the DDoS defense device, the web server sends a reply request to the UPF so that the UPF forwards the reply request to the UE, thereby achieving normal communication with the UE.

[0197] Through the linkage between the above-mentioned UPF and DDoS defense equipment, combined with the HTTP header enhancement technology of UPF, information is added to the HTTP header of the original message corresponding to the request initiated by the UE (that is, special fields and field values ​​are inserted, such as the UE's mobile phone number), and identified and detected by the DDoS defense equipment, which can effectively defend against CC attacks in 5G scenarios.

[0198] Embodiment three:

[0199] Based on the same inventive concept, an attack defense device is also provided in the embodiment of the present application, such as Figure 6 The figure shows a schematic diagram of the structure of an attack defense device provided by the present application. Figure 1 , the device is applied to UPF, and the device is the same as the aforementioned Figure 2 The device corresponds to an attack defense method shown. The device includes:

[0200] The modification module 601 is used to respond to the user terminal UE initiating a request to the server, add information to the header of the original message corresponding to the request, and obtain a new message after the original message is changed;

[0201] The first processing module 602 is used to send the new message to the defense device so that the defense device determines whether to forward the request to the server based on the matching result of the newly added information in the new message and the legal list; the legal list includes the information of the legal UE; the newly added information is the information added to the header of the original message.

[0202] In a possible implementation, the modification module 601 is specifically configured to receive a uniform resource locator URL list sent by the defense device; wherein the URL list includes attacked URLs; and the URL list is determined by the defense device based on statistics of URL access times;

[0203] Determine whether the URL corresponding to the request is a URL in the URL list;

[0204] If so, information is added to the header of the original message corresponding to the request to obtain the new message after the original message is changed.

[0205] In a possible implementation, the modification module 601 is specifically used to add Q fields and field values ​​to the header of the original message corresponding to the request; wherein Q is a positive integer, and the Q fields and field values ​​include the identity information of the UE corresponding to the original message.

[0206] In a possible implementation, the modification module 601 is specifically configured to receive the change information sent by the defense device;

[0207] According to the change information and a fixed period or a non-fixed period, in the header of the original message corresponding to the request, change the added field and the field value; or

[0208] According to the change information, after determining that the number of requests to the server is greater than or equal to the Hypertext Transfer Protocol HTTP request per second threshold and lasts for K time, the added fields and field values ​​are changed in the header of the original message until the number of requests is lower than the HTTP request per second threshold; wherein K is a positive integer.

[0209] Embodiment 4:

[0210] Based on the same inventive concept, an attack defense device is also provided in the embodiment of the present application, such as Figure 7 The figure shows a schematic diagram of the structure of an attack defense device provided by the present application. Figure 2 , the device is applied to defense equipment, and the device is the same as the aforementioned Figure 3 The device corresponds to an attack defense method shown. The device includes:

[0211] The receiving module 701 is used to receive a new message sent by a user plane function UPF, and obtain the newly added information in the new message; wherein the newly added information is the information added by the UPF in the header of the original message corresponding to the new message; the new message is the message after the original message is changed corresponding to the request initiated by the user terminal UE to the server;

[0212] The second processing module 702 is used to determine whether to forward the request to the server based on the matching result between the newly added information and the legal list; wherein the legal list includes information of legal UEs.

[0213] In a possible implementation, the device also includes a sending module, which is used to determine a URL list by counting the number of visits to a uniform resource locator URL in response to an attack before receiving a new message sent by the user plane function UPF, and send the URL list to the UPF, so that the UPF adds information to the header of the original message based on the URL list when it determines that the URL corresponding to the request is a URL in the URL list; wherein the URL list includes the attacked URL.

[0214] In a possible implementation, the sending module is specifically used to count the number of visits to all URLs;

[0215] Determine the target URL whose access times meet the preset conditions, and generate the URL list including the target URL; wherein the target URL is the attacked URL; the preset conditions are that the access times are greater than or equal to the access times threshold, or that the access times are in the top N positions in the access times ranking, where N is a positive integer.

[0216] In a possible implementation, the second processing module 702 is specifically configured to determine whether the newly added information is consistent with the legal list;

[0217] If yes, forwarding the request to the server so that the UE corresponding to the new message communicates with the server;

[0218] If not, the UE corresponding to the new message is denied from communicating with the server.

[0219] In a possible implementation manner, the second processing module 702 is specifically configured to, after the if, add the Internet Protocol IP of the UE corresponding to the new message to a whitelist; and

[0220] After the "if no", the IP address of the UE corresponding to the new message is added to the blacklist.

[0221] Based on the same inventive concept, an electronic device is also provided in the embodiment of the present application. The electronic device can realize the functions of the aforementioned attack defense device. Figure 8 , the electronic equipment includes:

[0222] At least one processor 801, and a memory 802 connected to the at least one processor 801. The specific connection medium between the processor 801 and the memory 802 is not limited in the embodiment of the present application. Figure 8 In the example, the processor 801 and the memory 802 are connected via a bus 800. Figure 8 The connection between other components is shown by bold lines, and is not intended to be limiting. The bus 800 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 801 can also be called a controller, and there is no limitation on the name.

[0223] In the embodiment of the present application, the memory 802 stores instructions that can be executed by at least one processor 801. The at least one processor 801 can execute the attack defense method discussed above by executing the instructions stored in the memory 802. The processor 801 can implement Figure 6-7 The functions of each module in the device shown.

[0224] Among them, the processor 801 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 802 and calling the data stored in the memory 802, the various functions of the device and processing data, the device can be monitored as a whole.

[0225] In one possible design, the processor 801 may include one or more processing units, and the processor 801 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 801. In some embodiments, the processor 801 and the memory 802 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0226] Processor 801 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the attack defense method disclosed in the embodiments of the present application can be directly embodied as a hardware processor execution, or a combination of hardware and software modules in the processor.

[0227] The memory 802 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 802 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (English: Random Access Memory, abbreviated as RAM), a static random access memory (English: Static Random Access Memory, abbreviated as SRAM), a programmable read-only memory (English: Programmable Read Only Memory, abbreviated as PROM), a read-only memory (English: Read Only Memory, abbreviated as ROM), an electrically erasable programmable read-only memory (English: Electrically Erasable Programmable Read-Only Memory, abbreviated as EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 802 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 802 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0228] By programming the processor 801, the code corresponding to the attack defense method described in the above embodiment can be fixed into the chip, so that the chip can execute the attack defense method when it is running. Figure 2-3 The steps of the attack defense method of the embodiment shown are as follows: How to design and program the processor 801 is a technique known to those skilled in the art and will not be described in detail here.

[0229] Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the attack defense method discussed above.

[0230] In some possible implementations, various aspects of the attack defense method provided by the present application can also be implemented in the form of a program product, which includes program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of the attack defense method according to various exemplary embodiments of the present application described above in this specification.

[0231] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0232] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0233] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0234] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0235] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An attack defense method, applied to a user plane function UPF, characterized in that: include: In response to a request initiated by a user terminal UE to a server, information is added to a header of an original message corresponding to the request to obtain a new message after the original message is changed; Sending the new message to the defense device, so that the defense device determines whether to forward the request to the server based on the matching result of the newly added information in the new message and the legal list; the legal list includes information of legal UEs; The newly added information is the information added to the header of the original message.

2. The method according to claim 1, characterized in that The adding information to the header of the original message corresponding to the request to obtain a new message after the original message is changed includes: Receiving a uniform resource locator URL list sent by the defense device; wherein the URL list includes the attacked URLs; the URL list is determined by the defense device based on statistics of the number of URL visits; Determine whether the URL corresponding to the request is a URL in the URL list; If so, information is added to the header of the original message corresponding to the request to obtain the new message after the original message is changed.

3. The method according to claim 1, characterized in that The adding information to the header of the original message corresponding to the request includes: In the header of the original message corresponding to the request, Q fields and field values ​​are added; wherein Q is a positive integer, and the Q fields and field values ​​include the identity information of the UE corresponding to the original message.

4. The method according to claim 1, characterized in that The adding information to the header of the original message corresponding to the request includes: receiving change information sent by the defense device; According to the change information and a fixed period or a non-fixed period, in the header of the original message corresponding to the request, change the added field and the field value; or According to the change information, after determining that the number of requests to the server is greater than or equal to the Hypertext Transfer Protocol HTTP request per second threshold and lasts for K time, the added fields and field values ​​are changed in the header of the original message until the number of requests is lower than the HTTP request per second threshold; wherein K is a positive integer.

5. An attack defense method, applied to a defense device, characterized in that: include: Receive a new message sent by a user plane function UPF, and obtain new information in the new message; wherein the new information is information added by the UPF in the header of the original message corresponding to the new message; the new message is a message after the original message is changed corresponding to the request initiated by the user terminal UE to the server; Based on the matching result between the newly added information and the legal list, determine whether to forward the request to the server; wherein the legal list includes information of legal UEs.

6. The method according to claim 5, characterized in that Before the receiving of the new message sent by the user plane function UPF, the method further includes: In response to an attack, a URL list is determined by counting the number of times a uniform resource locator URL is accessed, and the URL list is sent to the UPF, so that the UPF adds information to the header of the original message based on the URL list when it is determined that the URL corresponding to the request is a URL in the URL list; wherein the URL list includes the attacked URL.

7. The method according to claim 6, characterized in that The method of determining the URL list by counting the number of visits to the uniform resource locator URL includes: Count the number of visits to all URLs; Determine the target URL whose access times meet the preset conditions, and generate the URL list including the target URL; wherein the target URL is the attacked URL; the preset conditions are that the access times are greater than or equal to the access times threshold, or that the access times are in the top N positions in the access times ranking, where N is a positive integer.

8. The method according to claim 5, characterized in that The determining whether to forward the request to the server based on the matching result between the newly added information and the legal list includes: Determining whether the newly added information is consistent with the legal list; If yes, forwarding the request to the server so that the UE corresponding to the new message communicates with the server; If not, the UE corresponding to the new message is denied from communicating with the server.

9. The method according to claim 8, characterized in that After the above, it also includes: Adding the Internet Protocol IP of the UE corresponding to the new message to the whitelist; and After the above if or not, it also includes: The IP address of the UE corresponding to the new message is added to the blacklist.

10. An attack defense device, applied to a user plane function UPF, characterized in that: The device comprises: A modification module, configured to, in response to a request initiated by a user terminal UE to a server, add information to a header of an original message corresponding to the request to obtain a new message after the original message is modified; The first processing module is used to send the new message to the defense device so that the defense device determines whether to forward the request to the server based on the matching result of the newly added information in the new message and the legal list; the legal list includes the information of the legal UE; the newly added information is the information added to the header of the original message.

11. An attack defense device, applied to a defense device, characterized in that: The device comprises: A receiving module, configured to receive a new message sent by a user plane function UPF, and obtain newly added information in the new message; wherein the newly added information is information added by the UPF in the header of the original message corresponding to the new message; the new message is a message after the original message is changed corresponding to the request initiated by the user terminal UE to the server; The second processing module is used to determine whether to forward the request to the server based on the matching result between the newly added information and the legal list; wherein the legal list includes information of legal UEs.

12. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to implement the method steps of any one of claims 1 to 9 when executing a computer program stored in the memory.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 9 are implemented.

Images