Attack defense method, apparatus and electronic device

Abstract

The application discloses an attack defense method and device and electronic equipment. The method comprises the following steps: in response to a UE initiating a request to a server, adding information in the header of the original message corresponding to the request to obtain a new message after the original message is changed; and sending the new message to a defense device, so that the defense device determines whether to forward the request to the server based on the matching result of the new added information in the new message and a legal list comprising information of a legal UE. Through the technical scheme provided by the embodiment of the application, effective defense of the attack is realized, and the legal UE is prevented from being mistakenly blocked. The user experience is improved. At the same time, the resources of the server do not need to be additionally increased, so that the resources and costs are obviously reduced compared with the consumption of the resources and costs of the conventional defense mode.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an attack defense method, device and electronic device. Background Technology

[0002] Challenge Collapsar (CC) attacks are a type of Distributed Denial of Service (DDoS) attack. In a CC attack, attackers use a large number of botnets, proxy servers, and compromised computers (Zombie computers) to forge World Wide Web (WWW) requests, consuming the target server's resources and ultimately paralyzing the system. Implementing effective protective measures against this type of threat is a crucial aspect of ensuring network security.

[0003] Currently, defense methods against CC attacks include load balancing-based defense and defense device-based defense.

[0004] Load balancing-based defenses can reduce the load on a single server by distributing user equipment (UE) requests across multiple servers, thus mitigating the impact of CC attacks. Other methods include increasing server bandwidth and hardware resources to enhance processing power and better withstand CC attack pressure, and traffic limiting. However, these methods require more resources and resources to effectively defend against CC attacks.

[0005] Defense methods based on security devices can prevent CC attacks by limiting Internet Protocol (IP) access frequency or using CAPTCHAs. However, using IP access frequency to defend against CC attacks can easily misclassify legitimate UEs as illegitimate UEs (such as attackers), leading to the wrongful blocking of legitimate UEs. Using CAPTCHAs, on the other hand, can negatively impact user experience.

[0006] Therefore, common defense methods against CC attacks require more resources and costs, and are also prone to misjudgment and affect user experience. Summary of the Invention

[0007] This application provides an attack defense method, device, and electronic device to address the problems that common defense methods against CC attacks consume more resources and are prone to false positives and negatively impact user experience. The specific implementation scheme is as follows:

[0008] Firstly, this application provides an attack defense method applied to a user plane function (UPF), the method comprising:

[0009] In response to a request initiated by the user terminal (UE) to the server, information is added to the header of the original message corresponding to the request to obtain a new message after the original message has been modified.

[0010] The new message is sent to the defense device so that the defense device can determine whether to forward the request to the server based on the matching result of the newly added information in the new message and the legitimate list; the legitimate list includes information of legitimate UEs; the newly added information is information added to the header of the original message.

[0011] Through the above-described embodiments, the UPF adds information to the header of the original message corresponding to the request initiated by the UE to the server, and then sends the modified message to the defense device. This allows the defense device to accurately identify legitimate and illegitimate UEs based on the matching results between the added information in the new message and a legitimate list including information about legitimate UEs. This avoids wrongful blocking of legitimate UEs and helps improve the user experience. Furthermore, by adding information to the header of the original message for defense, no additional server resources are required, significantly reducing resource and cost compared to conventional defense methods.

[0012] In one possible implementation, adding information to the header of the original message corresponding to the request to obtain a new message after modification includes:

[0013] The system receives a list of Uniform Resource Locators (URLs) sent by the defense device; wherein the URL list includes the URLs that have been attacked; and the URL list is determined by the defense device based on statistics of the number of times the URLs are accessed.

[0014] Determine whether the URL corresponding to the request is a URL in the URL list;

[0015] If so, information is added to the header of the original message corresponding to the request to obtain the new message after the original message has been modified.

[0016] Through the above application embodiments, it is determined whether the URL corresponding to the request is the URL in the URL list sent by the defense device. Only when the URL corresponding to the request is the URL of the attack is the information added to the header of the original message corresponding to the request, thereby reducing the detection workload of the subsequent defense device and improving the efficiency of defense.

[0017] In one possible implementation, adding information to the header of the original message corresponding to the request includes:

[0018] In the header of the original message corresponding to the request, add Q types of fields and field values; where Q is a positive integer, and the Q types of fields and field values ​​include the identity information of the UE corresponding to the original message.

[0019] Through the above application embodiments, Q types of fields and field values, including the identity information of the UE, are inserted into the header of the original message corresponding to the request initiated by the UE, resulting in new information. This allows subsequent defense devices to verify whether the UE is a legitimate UE based on the inserted Q types of fields and field values ​​(i.e., the new information), thereby facilitating the defense against attacks.

[0020] In one possible implementation, adding information to the header of the original message corresponding to the request includes:

[0021] Receive change information sent by the defense device;

[0022] Based on the change information, and whether it is a fixed period or a non-fixed period, the added fields and field values ​​are modified in the header of the original message corresponding to the request; or

[0023] Based on the change information, after determining that the number of requests to the server is greater than or equal to the HTTP request per second threshold and lasts for a duration of K, the added fields and field values ​​are changed in the header of the original message until the number of requests is lower than the HTTP request per second threshold; where K is a positive integer.

[0024] Through the above application embodiments, based on a fixed period or a non-fixed period, or the comparison result of the number of requests and the HTTP request per second threshold, the fields and field values ​​added to the header of the original message are changed, making it difficult for attackers to impersonate the header of a legitimate UE in real time, thereby resisting attacks that impersonate legitimate UEs and further enhancing the defense.

[0025] Secondly, this application provides an attack defense method, which is applied to a defense device, and the method includes:

[0026] The system receives a new message sent by the User Plane Function (UPF) and obtains the newly added information in the new message; wherein the newly added information is information added by the UPF to the header of the original message corresponding to the new message; the new message is the message modified from the original message corresponding to the request initiated by the user terminal (UE) to the server.

[0027] Based on the matching result between the newly added information and the legitimate list, it is determined whether to forward the request to the server; wherein, the legitimate list includes information on legitimate UEs.

[0028] Through the above-described embodiments, the defense device matches the newly added information in the new messages sent by the UPF (i.e., the information added by the UPF to the header of the original message corresponding to the request initiated by the UE to the server) with information including legitimate users (i.e., the legitimate list). Based on the matching result, it determines whether to forward the request to the server, thereby accurately identifying legitimate UEs and illegitimate UEs, avoiding false blocking of legitimate UEs, and helping to improve user experience. At the same time, the defense device uses the newly added information in the new messages sent by the UPF for defense, without requiring additional server resources, thus significantly reducing resource and cost compared to conventional defense methods.

[0029] In one possible implementation, before receiving the new message sent by the User Plane Function (UPF), the method further includes:

[0030] In response to an attack, a list of URLs is determined by counting the number of Uniform Resource Locators (URLs) accessed, and the list of URLs is sent to the UPF. The UPF then adds information to the header of the original message when it determines that the URL corresponding to the request is a URL in the list of URLs. The list of URLs includes the URLs that have been attacked.

[0031] Through the above-described embodiments, after an attack occurs, the defense device sends a list of URLs, including the attacked URLs, determined by the statistics of URL access counts, to the UPF. This provides the UPF with a matching list for matching the URLs corresponding to the requests. This allows the UPF to add information to the header of the original message only when the URL corresponding to the request matches the URL list, thereby reducing the number of new messages received by the defense device and further reducing the amount of matching between the added information and the legitimate list, thus improving the efficiency of the defense.

[0032] In one possible implementation, determining the URL list by counting the number of accesses to Uniform Resource Locators (URLs) includes:

[0033] Count the number of visits to all URLs;

[0034] The target URL whose access count meets the preset conditions is determined, and a URL list including the target URL is generated; wherein, the target URL is the URL that is attacked; the preset conditions are that the access count is greater than or equal to the access count threshold, or that the access count is in the top N positions of the access count ranking, where N is a positive integer.

[0035] Through the above application embodiments, based on the comparison between the number of times a URL is accessed and preset conditions, the URL corresponding to the number of accesses is determined to be the URL being attacked only after the number of accesses meets the preset conditions, thereby accurately generating a URL list including the URLs being attacked, which helps to further improve the accuracy of defense.

[0036] In one possible implementation, determining whether to forward the request to the server based on the matching result of the newly added information and the valid list includes:

[0037] Determine whether the newly added information matches the valid list;

[0038] If so, the request is forwarded to the server so that the UE corresponding to the new message can communicate with the server;

[0039] If not, then the UE corresponding to the new message will be refused communication with the server.

[0040] Through the above application embodiments, based on the judgment result of whether the newly added information matches the legitimate list (i.e., the matching result of the newly added information and the legitimate list), it is determined whether the UE corresponding to the new message is a legitimate UE. Therefore, if it is a legitimate UE, the request sent by the UE is forwarded to the server, and if it is not a legitimate UE, the request is refused to be forwarded to the Web server, thereby achieving effective defense against attacks.

[0041] In one possible implementation, after the "if" statement, it further includes:

[0042] Add the Internet Protocol IP address of the UE corresponding to the new message to the whitelist; and

[0043] Following the statement "if not", it also includes:

[0044] Add the IP address of the UE corresponding to the new message to the blacklist.

[0045] Through the above application embodiments, after the newly added information matches the legitimate list, the IP of the UE corresponding to the new message is added to the whitelist. This allows the UE to directly submit a request to the server again, avoiding another detection of the legitimate UE. This speeds up the UE's request rate, further improves the user experience, and also enhances the efficiency of defense.

[0046] In addition, when the newly added information does not match the list of legitimate UEs, the IP address of the UE corresponding to the new message is added to the blacklist. This allows the server to directly reject the request when the UE makes another request, avoiding further detection of illegitimate UEs and further improving the efficiency of defense.

[0047] Thirdly, this application also provides an attack defense device applied to the User Plane Function (UPF), the device comprising:

[0048] The modification module is used to respond to a request initiated by the user terminal UE to the server, add information to the header of the original message corresponding to the request, and obtain a new message after the original message is modified.

[0049] The first processing module is used to send the new message to the defense device, so that the defense device determines whether to forward the request to the server based on the matching result of the newly added information in the new message and the legitimate list; the legitimate list includes information of legitimate UEs; the newly added information is information added to the header of the original message.

[0050] In one possible implementation, the modification module is specifically configured to receive a list of Uniform Resource Locators (URLs) sent by the defense device; wherein, the URL list includes attacked URLs; and the URL list is determined by the defense device based on statistics of URL access counts.

[0051] Determine whether the URL corresponding to the request is a URL in the URL list;

[0052] If so, information is added to the header of the original message corresponding to the request to obtain the new message after the original message has been modified.

[0053] In one possible implementation, the modification module is specifically used to add Q types of fields and field values ​​to the header of the original message corresponding to the request; wherein Q is a positive integer, and the Q types of fields and field values ​​include the identity information of the UE corresponding to the original message.

[0054] In one possible implementation, the modification module is specifically used to receive change information sent by the defense device;

[0055] Based on the change information, and whether it is a fixed period or a non-fixed period, the added fields and field values ​​are modified in the header of the original message corresponding to the request; or

[0056] Based on the change information, after determining that the number of requests to the server is greater than or equal to the HTTP request per second threshold and lasts for a duration of K, the added fields and field values ​​are changed in the header of the original message until the number of requests is lower than the HTTP request per second threshold; where K is a positive integer.

[0057] Fourthly, this application also provides an attack defense device for use in defense equipment, the device comprising:

[0058] The receiving module is used to receive new messages sent by the User Plane Function (UPF) and obtain newly added information in the new messages; wherein, the newly added information is information added by the UPF to the header of the original message corresponding to the new message; the new message is the message corresponding to the modified original message of the request initiated by the user terminal (UE) to the server;

[0059] The second processing module is used to determine whether to forward the request to the server based on the matching result between the newly added information and the legal list; wherein the legal list includes information on legal UEs.

[0060] In one possible implementation, the apparatus further includes a sending module, configured to, in response to an attack, determine a URL list by counting the number of Uniform Resource Locators (URLs) accesses before receiving a new message from the User Plane Function (UPF), and send the URL list to the UPF, so that the UPF, based on the URL list, adds information to the header of the original message when it determines that the URL corresponding to the request is a URL in the URL list; wherein the URL list includes the attacked URLs.

[0061] In one possible implementation, the sending module is specifically used to count the number of visits to all URLs;

[0062] The target URL whose access count meets the preset conditions is determined, and a URL list including the target URL is generated; wherein, the target URL is the URL that is attacked; the preset conditions are that the access count is greater than or equal to the access count threshold, or that the access count is in the top N positions of the access count ranking, where N is a positive integer.

[0063] In one possible implementation, the second processing module is specifically used to determine whether the newly added information matches the valid list;

[0064] If so, the request is forwarded to the server so that the UE corresponding to the new message can communicate with the server;

[0065] If not, then the UE corresponding to the new message will be refused communication with the server.

[0066] In one possible implementation, the second processing module is specifically configured to, after the "yes" condition is met, add the Internet Protocol (IP) of the UE corresponding to the new message to the whitelist; and

[0067] If no, the IP address of the UE corresponding to the new message will be added to the blacklist.

[0068] Fifthly, this application provides an electronic device, comprising:

[0069] Memory, used to store computer programs;

[0070] When the processor executes the computer program stored in the memory, it implements the above-described attack defense method steps.

[0071] Sixthly, this application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the aforementioned attack defense method.

[0072] For the various aspects of the third to sixth aspects mentioned above, and the technical effects that each aspect may achieve, please refer to the above description of the technical effects that can be achieved for the first aspect or the various possible solutions in the first aspect, or the above description of the technical effects that can be achieved for the second aspect or the various possible solutions in the second aspect. They will not be repeated here. Attached Figure Description

[0073] Figure 1 A schematic diagram of a CC attack provided for an embodiment of this application;

[0074] Figure 2 A flowchart illustrating an attack defense method provided in this application embodiment. Figure 1 ;

[0075] Figure 3 A flowchart illustrating an attack defense method provided in this application embodiment. Figure 2 ;

[0076] Figure 4a This is a schematic diagram of a point-to-point linkage method provided in an embodiment of this application;

[0077] Figure 4b This is a schematic diagram of a centralized control linkage method provided in an embodiment of this application;

[0078] Figure 5 A schematic diagram illustrating the processing steps of the attack defense method provided in this application embodiment;

[0079] Figure 6 A schematic diagram of the structure of an attack defense device provided in this application embodiment. Figure 1 ;

[0080] Figure 7 A schematic diagram of the structure of an attack defense device provided in this application embodiment. Figure 2 ;

[0081] Figure 8 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0082] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The specific operational methods in the method embodiments can also be applied to the device embodiments or system embodiments. It should be noted that in the description of this application, "multiple" is understood as "at least two". "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. A connected to B can represent: A and B directly connected, and A and B connected through C. Furthermore, in the description of this application, terms such as "first" and "second" are used only for distinguishing the purpose of description and should not be construed as indicating or implying relative importance or order.

[0083] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0084] Example 1:

[0085] like Figure 1 As shown, a CC attack controls multiple computers or devices to send a large number of forged Hypertext Transfer Protocol (HTTP) requests to a target server (such as a web server). These requests typically require the target server to perform complex and time-consuming calculations or database operations, thereby exhausting the target server's resources and causing the target server to be unable to respond to normal UE requests (such as requests from legitimate UEs), resulting in slow UE access speeds or even inaccessibility.

[0086] CC attacks are mainly divided into botnet CC attacks and free proxy server CC attacks. Botnet CC attacks refer to attackers using many innocent but controlled computers and IoT devices (i.e., botnets) to attack target servers. Free proxy server CC attacks involve attackers using free proxy servers to generate legitimate page requests to the victim host (such as the target server), making it unable to process normal requests.

[0087] Since CC attack requests are simulated as real, valid requests, they cannot be rejected by the target server; and since CC attack data packets are simulated as normal data packets from real UEs, it is difficult to distinguish between legitimate and illegitimate requests. As a result, CC attack defenses are prone to mistakenly blocking legitimate UEs, which can easily affect the user experience.

[0088] Therefore, this application proposes an attack defense method applied to User Plane Function (UPF). When a UE initiates a request to the server, information is added to the header of the original message corresponding to the request, and then the modified message is sent to the defense device. The defense device determines whether to forward the request to the server based on the matching result of the added information in the new message and the legitimate list including information of legitimate UEs, thereby achieving effective defense against attack messages. At the same time, it does not require additional server resources, thus significantly reducing resource and cost consumption compared to conventional defense methods.

[0089] Reference Figure 2 The diagram shown is a flowchart of an attack defense method provided in an embodiment of this application. The method includes:

[0090] S201, in response to the UE's request to the server, adds information to the header of the original message corresponding to the request to obtain a new message after the original message has been modified.

[0091] In this embodiment of the application, the server can be a web server, that is, in response to a request initiated by the UE to the web server.

[0092] S202, a new message is sent to the defense device so that the defense device can determine whether to forward the request to the server based on the matching result of the new information in the new message with the legal list.

[0093] The valid list includes information about valid UEs. New information is added to the header of the original message. This header can be the HTTP header of the original message. The new information can include fields and field values.

[0094] As the user plane function of the 5G core network, the User Plane Function (UPF) carries all UE service traffic. Modifying or enhancing the headers of passing HTTP / HTTPS traffic within the UPF is a mature technology operating in carrier-grade 5G networks.

[0095] Therefore, the UPF can modify the HTTP header information of the message (i.e., the original message) corresponding to a request (such as an HTTP request) initiated by the UE to a server (such as a web server), and add relevant information. It can also customize the inserted fields and field value configurations. Thus, by adding information to the header of the original message through the UPF, a new message containing the added information can be obtained.

[0096] The fields and values ​​in the newly added information are separated by colons (:). The fields and values ​​in this newly added information can be represented as follows:

[0097] GET / HTTP / 1.1

[0098] Cache-Control:max-age=3600

[0099] Connection: Keep-Alive

[0100] Accept: * / *

[0101] If-Modified-Since: Mon, 12Feb 2024 22:07:27GMT

[0102] If-None-Match: "65ca969f-2cd"

[0103] User-Agent:Microsoft-CryptoAPI / 10.0

[0104] Host: x1.c.lencr.org

[0105] For example, Cache-Control is the field name, and max-age=3600 is the field value.

[0106] In this embodiment, the added information (i.e., information added to the header of the original message) can be obtained by adding appropriate fields and field values ​​to the header of the original message based on the terminal information and network information known to the UE in the 5G application scenario. Furthermore, the added fields and their corresponding field value configurations can also be customized to obtain the added information.

[0107] Based on the terminal and network information obtained by the UE in the 5G application scenario, appropriate fields and values ​​are added to the header of the original message to obtain the new information, which can be:

[0108] Obtain the UE information corresponding to the original message. This UE information can be the UE's identity information. This identity information can be the UE's corresponding mobile phone number (Generic Public Subscription Identifier, abbreviated as GPSI), subscription permanent identifier (Subscription Permanent Identifier, abbreviated as SUPI), device identifier (Permanent Equipment Identifier, abbreviated as PEI), identity document (ID), etc., but is not limited to these.

[0109] Then, Q types of fields and their values ​​are added to the header of the original message to obtain the new information. These Q types of fields and their values ​​include the UE's identity information, such as the UE's GPSI. Here, Q is a positive integer.

[0110] The above-mentioned addition of Q fields and field values ​​to the header of the original message can be based on the information received from the defense device. It can insert one of the UE's identity information fields and field values ​​into the header of the original message, such as inserting the UE's GPSI, so that the defense device can verify whether the UE is a legitimate UE based on the inserted fields and field values.

[0111] The above-mentioned addition of Q fields and field values ​​to the header of the original message can also be used to insert at least two fields and field values ​​into the header of the original message based on the current status of 5G scenarios (for example, in addition to inserting the UE's GPSI into the header of the original message, the UE's PEI, SUPI and other information can also be inserted), thereby improving the accuracy of the added information so that subsequent defense equipment can verify whether the UE is a legitimate UE based on the inserted fields and field values.

[0112] However, attackers may obtain the fields and field values ​​of legitimate UEs (such as the GPSI of legitimate UEs) through technical means, and then launch attacks by imitating the field values ​​of legitimate UEs. As a result, the method of adding Q fields and field values ​​including the identity information of the UE to the header of the original message cannot effectively identify attackers and legitimate UEs.

[0113] Therefore, to solve this problem, the fields and values ​​inserted into the header of the original message can be modified by receiving change information sent by the defense device (such as adding custom fields and values ​​to the header of the original message), thereby performing proactive defense and further improving the accuracy of the defense. This process can be implemented through method 1, method 2, or method 3 as shown below.

[0114] Method 1:

[0115] After receiving the change information sent by the defense device, the header of the original message is periodically updated with new information, namely, the fields and values ​​of the new fields, based on the change information and a fixed period.

[0116] The aforementioned change information may include instructions for the UPF to change the fields and field values ​​added to the header of the original message according to a fixed period.

[0117] The aforementioned fixed cycle can be adjusted according to specific application scenarios.

[0118] The fields and values ​​added in the above changes can be modified by customizing the fields and values, or by randomly modifying them. This makes it difficult for attackers to spoof the headers of legitimate UEs in real time, thus resisting attacks that spoof legitimate UEs and further enhancing the defense.

[0119] Method 2:

[0120] After receiving the change information sent by the defense device, the header of the original message is periodically updated with new information, i.e., the fields and values ​​of the new fields are changed and added, based on the change information and the non-fixed period.

[0121] The aforementioned change information may include information instructing the UPF to change the fields and field values ​​added to the header of the original message according to a non-fixed period.

[0122] The aforementioned non-fixed period can be adjusted according to specific application scenarios.

[0123] The fields and values ​​added in the above changes can be modified by customizing the fields and values, or by randomly modifying them. This makes it difficult for attackers to spoof the headers of legitimate UEs in real time, thus resisting attacks that spoof legitimate UEs and further enhancing the defense.

[0124] Method 3:

[0125] After receiving the change information from the defense device, and after determining that the number of requests to the server is greater than or equal to the HTTP requests per second threshold for a duration of K, the system modifies the header of the original message with new information, i.e., changes the added fields and their values, until the number of requests falls below the HTTP requests per second threshold. Here, K is a positive integer.

[0126] The above HTTP requests per second threshold can be adjusted according to specific application scenarios.

[0127] The fields and values ​​added in the above changes can be modified by customizing the fields and values, or by continuously changing random fields and values. This makes it difficult for attackers to spoof the headers of legitimate UEs in real time, thus resisting attacks that spoof legitimate UEs and further enhancing the defense.

[0128] The determination of the number of requests, the HTTP request per second threshold, and the duration of K can be made by the defense device.

[0129] In other words, after receiving the first change information sent by the defense device, the system continuously modifies the header of the original message with new information, that is, changes the added fields and field values, and stops modifying the new information after receiving the second change information sent by the defense device.

[0130] The first change information is sent by the defense device after determining that the number of requests to the server is greater than or equal to the HTTP requests per second threshold, and this continues for a duration of K. This first change information may include instructions for the UPF to continuously update and add new information.

[0131] The second change message is sent by the defense device after it determines that the number of requests to the server is below the HTTP requests per second threshold, or after it determines that the number of requests to the server is below the HTTP requests per second threshold for a duration of L, where L is a positive integer. This second change message may include information instructing the UPF to stop adding new information.

[0132] The determination of the number of requests, the HTTP request per second threshold, and the duration of K can also be made by the UPF. In this case, the aforementioned change information can include information instructing the UPF to modify the header of the original message with new information after determining that the number of requests to the server is greater than or equal to the HTTP request per second threshold and has lasted for K durations, until the number of requests is lower than the HTTP request per second threshold.

[0133] By employing methods 1, 2, and 3 as described above, the accuracy of the defense has been further improved.

[0134] In addition, in this embodiment of the application, in order to reduce the amount of detection work of the subsequent defense device on the newly added information in the new message, before adding information to the header of the original message corresponding to the request to obtain the new message after the original message is changed, the request initiated by the UE can be matched according to the rules first, so that information is added to the header of the original message corresponding to the request only after the request is the URL to be attacked.

[0135] Specifically, first, the system receives a list of Uniform Resource Locators (URLs) sent by the defense device. This list of URLs includes the URLs that have been attacked.

[0136] Then, it is determined whether the URL corresponding to the request initiated by the UE is a URL in the URL list. The URL corresponding to the request initiated by the UE is the URL that the UE wants to access.

[0137] If it is determined that the URL corresponding to the request initiated by the UE is a URL in the URL list, then the URL that the UE is about to access is determined to be the URL under attack. At this point, it is necessary to verify the legitimacy of the UE through the defense device to prevent illegitimate UEs (i.e., attackers) from accessing the URL, thereby achieving effective defense against the attack. Specifically, information is added to the header of the original message corresponding to the request initiated by the UE to obtain a new message after modification. This new message is then sent to the defense device so that the defense device can determine whether to forward the request to the server based on the added information in the new message.

[0138] By using the above methods, the amount of new information that subsequent defense devices need to detect in new messages can be reduced, thereby helping to improve the efficiency of defense.

[0139] Optionally, a list of URLs sent by the defense device is received. This list includes URLs that have been attacked. Then, it is determined whether the URL corresponding to the request initiated by the UE is a URL in the URL list.

[0140] If it is determined that the URL corresponding to the request initiated by the UE is not in the URL list, then it is determined that the URL the UE is about to access is not the attacked URL, and the UE can directly access the URL corresponding to the request normally.

[0141] By using the above methods, the detection of access to normal URLs by subsequent defense devices can be avoided, further improving the efficiency of defense.

[0142] In this embodiment, the method of determining whether to add information to the header of the original message corresponding to the request initiated by the UE by receiving a list of URLs can also be modified to determine whether to add information to the header of the original message corresponding to the request initiated by the UE by receiving a list of IPs. This IP list includes the IPs that have been attacked.

[0143] The specific process of determining whether to add information to the header of the original message corresponding to the request initiated by the UE by receiving the IP list is the same as the specific process of determining whether to add information to the header of the original message corresponding to the request initiated by the UE by receiving the URL list, and will not be repeated here.

[0144] In summary, the attack defense method proposed in this application involves the UPF adding information (i.e., new information) to the header of the original message (such as the HTTP header) after determining that the URL (or IP) corresponding to the request initiated by the UE is the attacked URL (or IP). The new message with the added information is then sent to the defense device. Based on the matching result between the new information in the new message and a legitimate list including information about legitimate UEs, the defense device determines whether to forward the request to the server, thus effectively defending against attacks (such as CC attacks). Defending against attacks by adding information to the header of the new message can resist conventional attacks and effectively distinguish between legitimate and illegitimate UEs in 5G scenarios, thereby preventing requests from illegitimate UEs and avoiding the mistaken blocking of legitimate UEs.

[0145] Furthermore, when defending against attacks by adding information in the header of new messages, the field and field value in the added information are changed by randomly generated custom fields, making it difficult for attackers to spoof the header of legitimate UEs in real time. This can resist attacks that spoof legitimate UEs and further enhance the defense.

[0146] In addition, when customers encounter attacks such as CC attacks, compared with traditional defense methods, the defense method proposed in this application embodiment can more effectively protect against attacks such as CC attacks in 5G scenarios, thereby reducing the impact on legitimate UEs.

[0147] Example 2:

[0148] This application also proposes an attack defense method applied to a defense device. The device receives new messages sent by a UPF (User-Defined Request), and then, based on the matching result of the newly added information in the new message (i.e., information added by the UPF to the header of the original message corresponding to the request initiated by the UE to the server) with a legitimate list including information about legitimate UEs, determines whether to forward the request initiated by the UE to the server. This achieves effective attack defense and avoids rejecting requests from legitimate UEs. Furthermore, it eliminates the need for additional server resources, significantly reducing resource and cost compared to conventional defense methods.

[0149] Reference Figure 3 The diagram shown is a flowchart of an attack defense method provided in an embodiment of this application. The method includes:

[0150] S301 receives new messages sent by UPF and obtains the new information in the new messages.

[0151] The newly added information refers to the information added by the UPF to the header of the original message corresponding to the new message. This new message is the modified message corresponding to the original message of the request initiated by the UE to the server.

[0152] Specifically, before receiving a new message from the UPF, the defense device first sends a list of attacked URLs to the UPF, so that the UPF can determine the information to add to the header of the original message based on the URL list, and then send the new message to the defense device.

[0153] Before sending the URL list to UPF, the URL list needs to be generated first.

[0154] In this embodiment of the application, the specific process of generating the URL list can be as follows:

[0155] In response to an attack, the system identifies the attacked URL by counting the number of URL visits, and generates a list of URLs that include the attacked URL. This attack can be a DDoS attack, but it is not limited to this.

[0156] The above method of identifying the attacked URL by counting the number of URL visits can be determined based on whether the number of visits meets preset conditions.

[0157] Specifically, the number of visits to all accessed URLs is counted. Then, for each URL's number of visits, it is determined whether the number of visits meets preset conditions.

[0158] If the number of accesses is determined to meet the preset conditions, then the URL corresponding to that number of accesses is determined to be the URL that has been attacked.

[0159] If the number of accesses is determined to be inconsistent with the preset conditions, then the URL corresponding to that number of accesses is determined to be not the URL being attacked.

[0160] In this embodiment, the preset condition can be that the number of visits is among the top N in the visit count ranking. Therefore, the URL being attacked can be determined by statistically analyzing the number of URL visits:

[0161] First, count the number of visits to each URL. Then, sort all the visit counts to obtain a ranking. The higher the ranking, the greater the number of visits. That is, the first place in the visit count ranking is the URL with the largest number of visits (i.e., the most visits).

[0162] Then, for each URL's access count, it is determined whether that access count ranks among the top N in the access count ranking. N is a positive integer. Furthermore, in this embodiment, the specific value of N can be adjusted according to the specific application scenario to ensure that all attacked URLs can be identified subsequently.

[0163] If it is determined that the number of visits is among the top N in the visit count ranking (i.e., the number of visits meets the preset conditions), then the URL corresponding to the number of visits is determined to be the URL that has been attacked.

[0164] If it is determined that the number of visits is not among the top N in the visit count ranking (i.e., the number of visits does not meet the preset conditions), then it is determined that the URL corresponding to the number of visits is not the URL being attacked.

[0165] By using the above method, the URLs corresponding to the top N most accessed URLs in the access ranking are identified as the attacked URLs. This accurately identifies the attacked URLs, allowing UPF to enhance only the headers of these URLs (i.e., add information to the headers). Subsequent defense devices then only target requests corresponding to these attacked URLs, significantly improving defense efficiency while maintaining accuracy. Furthermore, configuring the top N access counts is convenient, allowing for faster configuration of preset conditions for these URLs, thus quickly identifying the attacked URLs and further improving defense speed.

[0166] In this embodiment, the aforementioned preset condition can also be that the number of visits is greater than or equal to a threshold number of visits. Therefore, the URL being attacked, determined by counting the number of URL visits, can be:

[0167] First, the number of visits to each URL is counted. Then, for each URL's visit count, it is determined whether the visit count is greater than or equal to a visit count threshold. In this embodiment, the visit count threshold can be adjusted according to the specific application scenario to ensure that all attacked URLs can be identified subsequently.

[0168] If it is determined that the number of visits is greater than or equal to the number of visits threshold (i.e., the number of visits meets the preset conditions), then the URL corresponding to the number of visits is determined to be the URL that has been attacked.

[0169] If it is determined that the number of visits is less than the access threshold (i.e., the number of visits does not meet the preset conditions), then the URL corresponding to the number of visits is determined not to be the URL being attacked.

[0170] By comparing each access count with an access count threshold, URLs with access counts greater than or equal to the threshold are identified as attacked URLs, thus accurately determining the attacked URLs. Furthermore, using access count thresholds to determine attacked URLs compensates for the shortcomings of using access count ranking, further improving the accuracy and authenticity of the identified attacked URLs.

[0171] In addition, in this embodiment of the application, before receiving a new message sent by the UPF, the defense device can also send change information to the UPF, so that the UPF can change the added information (i.e. change the added fields and field values) in the header of the original message corresponding to the request initiated by the UE according to the change information. This makes it difficult for attackers to impersonate the header of the legitimate UE in real time, thereby resisting the attack of impersonating the legitimate UE and further enhancing the defense.

[0172] S302, based on the matching results between the newly added information and the valid list, determines whether to forward the request to the server.

[0173] The legitimate list contains the identity information of legitimate UEs, such as the UE's GPSI, SUPI, PEI, etc.

[0174] The above list of valid entries can be obtained as follows:

[0175] In response to an attack, it receives a list of valid entries imported by the user, thus obtaining the list of valid entries.

[0176] Further, the newly added information obtained in step S301 is matched with the list of valid entries.

[0177] If it is determined that the newly added information matches the valid list, that is, the matching result of the newly added information and the valid list is that the newly added information matches the valid list, then the request sent by the UE corresponding to the new message is forwarded to the server so that the UE can communicate with the server.

[0178] For example, the newly added information includes the UE's GPSI, i.e., the UE's mobile phone number; the valid list includes the GPSI of valid UEs, i.e., the mobile phone numbers of valid UEs. It is determined whether the mobile phone number is in the valid list. If so, it is determined that the newly added information matches the valid list, and the request sent by the UE corresponding to the new message is forwarded to the server to enable communication between the UE and the server.

[0179] If it is determined that the newly added information does not match the valid list, a Reset (RST) message is sent to the UE to disconnect the UE from the server, thereby rejecting communication between the UE and the server.

[0180] The RST message is used to close a TCP connection or to sever illegal data and requests. By sending an RST message, the purpose of disconnecting the connection can be achieved.

[0181] In addition, in this embodiment of the application, after the defense device determines that the newly added information matches the legitimate list, it can add the identity information (such as IP) of the UE corresponding to the new message to the whitelist, so that when the UE makes another request, it can be directly allowed to communicate with the server, thereby further improving the efficiency of the defense while ensuring the accuracy of the defense.

[0182] After determining that the newly added information does not match the legitimate list, the defense device can add the UE's identity information (such as IP) corresponding to the new message to the blacklist. This way, when the UE makes another request, the communication between the UE and the server will be directly rejected, thereby further improving the efficiency of the defense while ensuring its accuracy.

[0183] Furthermore, in this embodiment of the application, after detecting no attack, the defense device can send a URL deletion list or an IP deletion list to the UPF, so that the UPF can delete the list according to the received URL deletion list or IP deletion list.

[0184] In summary, the attack defense method proposed in this application involves the defense device comparing the newly added information (i.e., the information added by the UPF to the header of the original message corresponding to the request initiated by the UE) in the header of a new message sent by the UPF with a legitimate list. The method determines whether the newly added information in the header of the new message matches the legitimate list, which includes the identity information of legitimate UEs. If the newly added information matches the legitimate list, the UE corresponding to the new message is determined to be a legitimate UE, and communication between the UE and the server is allowed. If the newly added information does not match the legitimate list, the UE corresponding to the new message is determined to be an illegitimate UE, and communication between the UE and the server is not allowed. This effectively defends against attacks (such as CC attacks).

[0185] By adding new information to the header of new messages, attacks can be defended against conventional attacks. It can also effectively distinguish between legitimate and illegitimate UEs in 5G scenarios, thereby avoiding requests from illegitimate UEs and preventing the wrongful blocking of legitimate UEs.

[0186] Furthermore, when defending against attacks by adding information in the header of new messages, the field and field value in the added information are changed by randomly generated custom fields, making it difficult for attackers to spoof the header of legitimate UEs in real time. This can resist attacks that spoof legitimate UEs and further enhance the defense.

[0187] In addition, when customers encounter attacks such as CC attacks, compared with traditional defense methods, the defense method proposed in this application embodiment can more effectively protect against attacks such as CC attacks in 5G scenarios, thereby reducing the impact on legitimate UEs.

[0188] Furthermore, the attack defense method proposed in this application can be used by operators to defend against attacks such as CC attacks in 5G scenarios, protecting user web applications deployed in parks and cloud resource pools, avoiding server resource paralysis caused by CC attacks, and thus preventing application denial-of-service. In the embodiments of this application, the defense device (such as a DDoS defense device) achieves effective attack defense by linking with UPF.

[0189] The above-mentioned defense equipment and UPF can be linked in the following ways: Figure 4a The point-to-point linkage method shown; it can also be used for Figure 4b The centralized control linkage method shown is that the defense equipment sends messages through the centralized control equipment to achieve network-wide linkage and improve efficiency.

[0190] The technical solutions of this application (including the technical solutions of Embodiment 1 and Embodiment 2) will be further explained below with reference to specific application processes.

[0191] like Figure 5 The diagram shows the process of the attack defense method. The defense device is a DDoS defense device, and the server is a web server.

[0192] Before the attack, the DDoS defense device receives a list of legitimate 5G mobile phone numbers.

[0193] When an attack occurs, the DDoS defense device activates its defense, determines a list of URLs including the attacked URLs by counting the number of URL accesses, and sends this list of URLs to the UPF.

[0194] After receiving a request from a UE to a web server, UPF matches the URL corresponding to the request with a list of URLs received from the DDoS defense device. Specifically, it determines whether the URL is in the URL list. If so, the URL match is successful. Then, the UPF adds the UE's phone number field to the HTTP header of the original request message, resulting in a new message with HTTP header enhancement (i.e., the modified message). This new message is then sent to the DDoS defense device.

[0195] Upon receiving a new packet from the UPF, the DDoS defense device checks the newly added information in the HTTP header of the new packet (i.e., the phone number field added by the UPF to the original HTTP header). Specifically, it determines whether the phone number carried in the newly added HTTP header belongs to the list of legitimate 5G terminal phone numbers. If yes, the detection passes, the request initiated by the UE corresponding to the new packet is forwarded to the web server (i.e., the UE's request is forwarded), and the UE's IP address is added to the whitelist. If not, the detection fails, the UE's request is blocked, and an RST message is sent to disconnect the TCP connection between the web server and the UE corresponding to the new packet, and the UE's IP address is added to the blacklist.

[0196] After receiving a request from the UE forwarded by the DDoS defense device, the web server sends a reply request to the UPF, which in turn forwards the reply request to the UE, thereby enabling normal communication with the UE.

[0197] By linking the UPF with the DDoS defense device and combining the UPF's HTTP header enhancement technology, information is added to the HTTP header of the original message corresponding to the request initiated by the UE (i.e., special fields and field values ​​are inserted, such as the UE's mobile phone number), and the DDoS defense device identifies and detects it, which can effectively defend against CC attacks in 5G scenarios.

[0198] Example 3:

[0199] Based on the same inventive concept, this application also provides an attack defense device, such as... Figure 6 The diagram shown is a structural schematic of an attack defense device provided in this application. Figure 1 This device is applied to UPF, and this device is similar to the aforementioned Figure 2 This corresponds to one attack defense method. The device includes:

[0200] Modification module 601 is used to respond to a request initiated by the user terminal UE to the server, add information to the header of the original message corresponding to the request, and obtain a new message after the original message is modified.

[0201] The first processing module 602 is used to send the new message to the defense device, so that the defense device determines whether to forward the request to the server based on the matching result of the newly added information in the new message and the legitimate list; the legitimate list includes information of legitimate UEs; the newly added information is information added to the header of the original message.

[0202] In one possible implementation, the modification module 601 is specifically configured to receive a list of Uniform Resource Locators (URLs) sent by the defense device; wherein, the URL list includes the URLs that have been attacked; and the URL list is determined by the defense device based on statistics of the number of URL accesses.

[0203] Determine whether the URL corresponding to the request is a URL in the URL list;

[0204] If so, information is added to the header of the original message corresponding to the request to obtain the new message after the original message has been modified.

[0205] In one possible implementation, the modification module 601 is specifically used to add Q types of fields and field values ​​to the header of the original message corresponding to the request; wherein Q is a positive integer, and the Q types of fields and field values ​​include the identity information of the UE corresponding to the original message.

[0206] In one possible implementation, the modification module 601 is specifically used to receive change information sent by the defense device;

[0207] Based on the change information, and whether it is a fixed period or a non-fixed period, the added fields and field values ​​are modified in the header of the original message corresponding to the request; or

[0208] Based on the change information, after determining that the number of requests to the server is greater than or equal to the HTTP request per second threshold and lasts for a duration of K, the added fields and field values ​​are changed in the header of the original message until the number of requests is lower than the HTTP request per second threshold; where K is a positive integer.

[0209] Example 4:

[0210] Based on the same inventive concept, this application also provides an attack defense device, such as... Figure 7 The diagram shown is a structural schematic of an attack defense device provided in this application. Figure 2 This device is used in defensive equipment, and this device is similar to the aforementioned Figure 3 This corresponds to one attack defense method. The device includes:

[0211] The receiving module 701 is used to receive a new message sent by the User Plane Function (UPF) and obtain newly added information in the new message; wherein, the newly added information is information added by the UPF to the header of the original message corresponding to the new message; the new message is a message modified from the original message corresponding to a request initiated by the user terminal (UE) to the server.

[0212] The second processing module 702 is used to determine whether to forward the request to the server based on the matching result between the newly added information and the legal list; wherein the legal list includes information on legal UEs.

[0213] In one possible implementation, the apparatus further includes a sending module, configured to, in response to an attack, determine a URL list by counting the number of Uniform Resource Locators (URLs) accesses before receiving a new message from the User Plane Function (UPF), and send the URL list to the UPF, so that the UPF, based on the URL list, adds information to the header of the original message when it determines that the URL corresponding to the request is a URL in the URL list; wherein the URL list includes the attacked URLs.

[0214] In one possible implementation, the sending module is specifically used to count the number of visits to all URLs;

[0215] The target URL whose access count meets the preset conditions is determined, and a URL list including the target URL is generated; wherein, the target URL is the URL that is attacked; the preset conditions are that the access count is greater than or equal to the access count threshold, or that the access count is in the top N positions of the access count ranking, where N is a positive integer.

[0216] In one possible implementation, the second processing module 702 is specifically used to determine whether the newly added information matches the valid list;

[0217] If so, the request is forwarded to the server so that the UE corresponding to the new message can communicate with the server;

[0218] If not, then the UE corresponding to the new message will be refused communication with the server.

[0219] In one possible implementation, the second processing module 702 is specifically configured to, after the "yes" condition is met, add the Internet Protocol IP address of the UE corresponding to the new message to the whitelist; and

[0220] If no, the IP address of the UE corresponding to the new message will be added to the blacklist.

[0221] Based on the same inventive concept, this application also provides an electronic device that can realize the function of the aforementioned attack defense device. (Refer to...) Figure 8 The aforementioned electronic devices include:

[0222] At least one processor 801 and a memory 802 connected to at least one processor 801. In this embodiment, the specific connection medium between the processor 801 and the memory 802 is not limited. Figure 8 The example shown is the connection between processor 801 and memory 802 via bus 800. Bus 800 is... Figure 8 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The 800 bus can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 8 The term is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, the processor 801 can also be called a controller; there is no restriction on the name.

[0223] In this embodiment, the memory 802 stores instructions executable by at least one processor 801. By executing the instructions stored in the memory 802, the at least one processor 801 can perform the attack defense method discussed above. The processor 801 can implement... Figure 6-7 The functions of each module in the device shown.

[0224] The processor 801 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 802 and calling data stored in memory 802, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0225] In one possible design, processor 801 may include one or more processing units. Processor 801 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 801. In some embodiments, processor 801 and memory 802 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0226] The processor 801 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the attack defense method disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0227] Memory 802, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 802 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disk, etc. Memory 802 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 802 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0228] By designing and programming the processor 801, the code corresponding to the attack defense methods described in the foregoing embodiments can be embedded into the chip, enabling the chip to execute these methods during operation. Figure 2-3 The steps of the attack defense method in the illustrated embodiment are as follows. How to design and program the processor 801 is a technique well-known to those skilled in the art and will not be described further here.

[0229] Based on the same inventive concept, embodiments of this application also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform the attack and defense methods described above.

[0230] In some possible implementations, various aspects of the attack defense method provided in this application may also be implemented in the form of a program product, which includes program code that, when the program product is run on a device, causes the control device to perform the steps in the attack defense method according to the various exemplary embodiments of this application described above.

[0231] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0232] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0233] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0234] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0235] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. An attack defense method applied to User Plane Function (UPF), characterized in that, include: In response to a request initiated by the user terminal (UE) to the server, before receiving the new message corresponding to the original message modified for the request, the system receives a list of Uniform Resource Locators (URLs) sent by the defense device; wherein, the URL list includes the URLs that have been attacked; the URL list is determined by the defense device based on statistics of the number of URL accesses. Determine whether the URL corresponding to the request is a URL in the URL list; If so, add Q types of fields and field values ​​to the header of the original message to obtain the new message; where Q is a positive integer, and the Q types of fields and field values ​​include the UE's identity information corresponding to the original message; The new message is sent to the defense device so that the defense device can determine whether to forward the request to the server based on the matching result of the newly added information in the new message and the legitimate list; the legitimate list includes information of legitimate UEs; the newly added information is information added to the header of the original message.

2. The method as described in claim 1, characterized in that, The method involves adding Q types of fields and field values ​​to the header of the original message, including: Receive change information sent by the defense device; Based on the change information, and whether it is a fixed period or a non-fixed period, the added fields and field values ​​are modified in the header of the original message corresponding to the request; or Based on the change information, after determining that the number of requests to the server is greater than or equal to the HTTP request per second threshold and lasts for a duration of K, the added fields and field values ​​are changed in the header of the original message until the number of requests is lower than the HTTP request per second threshold; where K is a positive integer.

3. An attack defense method, applied to defense equipment, characterized in that, include: In response to an attack, a URL list is determined by counting the number of Uniform Resource Locators (URLs) accessed, and this URL list is sent to the User Plane Function (UPF). Before receiving a new message (modified from the original message) corresponding to a request initiated by the User Terminal (UE) to the server, the UPF, based on the URL list, adds Q fields and their values ​​to the header of the original message when it determines that the URL corresponding to the request is one of those URLs. The URL list includes the attacked URLs; Q is a positive integer; the Q fields and their values ​​include the UE's identity information corresponding to the original message; and the new message is the modified version of the original message. The system receives the new message sent by the UPF and obtains the newly added information in the new message; wherein the newly added information is the Q fields and field values ​​added by the UPF to the header of the original message. Based on the matching result between the newly added information and the legitimate list, it is determined whether to forward the request to the server; wherein, the legitimate list includes information on legitimate UEs.

4. The method as described in claim 3, characterized in that, The URL list determined by counting the number of accesses through Uniform Resource Locators (URLs) includes: Count the number of visits to all URLs; The target URL whose access count meets the preset conditions is determined, and a URL list including the target URL is generated; wherein, the target URL is the URL that is attacked; the preset conditions are that the access count is greater than or equal to the access count threshold, or that the access count is in the top N positions of the access count ranking, where N is a positive integer.

5. The method as described in claim 3, characterized in that, The step of determining whether to forward the request to the server based on the matching result between the newly added information and the valid list includes: Determine whether the newly added information matches the valid list; If so, the request is forwarded to the server so that the UE corresponding to the new message can communicate with the server; If not, then the UE corresponding to the new message will be refused communication with the server.

6. The method as described in claim 5, characterized in that, Following the statement "if", it also includes: Add the Internet Protocol IP address of the UE corresponding to the new message to the whitelist; and Following the statement "if not", it also includes: Add the IP address of the UE corresponding to the new message to the blacklist.

7. An attack defense device applied to the User Plane Function (UPF), characterized in that, The device includes: The modification module is used to respond to a request initiated by the user terminal (UE) to the server. Before receiving the new message (after modification of the original message corresponding to the request), it receives a list of Uniform Resource Locators (URLs) sent by the defense device. The URL list includes the URLs being attacked. The URL list is determined by the defense device based on statistics of URL access counts. The module determines whether the URL corresponding to the request is a URL in the URL list. If so, it adds Q fields and their values ​​to the header of the original message to obtain the new message. Here, Q is a positive integer, and the Q fields and their values ​​include the identity information of the UE corresponding to the original message. The first processing module is used to send the new message to the defense device, so that the defense device determines whether to forward the request to the server based on the matching result of the newly added information in the new message and the legitimate list; the legitimate list includes information of legitimate UEs; the newly added information is information added to the header of the original message.

8. An attack defense device, applied to defensive equipment, characterized in that, The device includes: The sending module is used to respond to an attack by determining a URL list through statistics of Uniform Resource Locator (URL) access counts, and sending the URL list to the User Plane Function (UPF). Before receiving a new message (modified from the original message) corresponding to a request initiated by the User Terminal (UE) to the server, the UPF, based on the URL list, adds Q fields and their values ​​to the header of the original message when it determines that the URL corresponding to the request is one of the URLs in the URL list. The URL list includes the attacked URLs; Q is a positive integer; the Q fields and their values ​​include the UE's identity information corresponding to the original message; and the new message is the modified version of the original message. The receiving module is used to receive the new message sent by the UPF and obtain the newly added information in the new message; wherein, the newly added information is the Q fields and field values ​​added by the UPF to the header of the original message; The second processing module is used to determine whether to forward the request to the server based on the matching result between the newly added information and the legal list; wherein the legal list includes information on legal UEs.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, when executing a computer program stored in the memory, implements the method steps of any one of claims 1-6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1-6.

Images