Network attack processing method, device, equipment, medium and product

Abstract

The invention discloses a network attack processing method, device and equipment, a medium and a product. The method comprises the steps that when a network attack event sent by the intrusion prevention system equipment is received, a target load balancing source address field is acquired, and the target load balancing source address field is stored in equipment corresponding to the network attack event; determining an initial address set corresponding to the target load balancing source address field; the initial address set is screened based on a target white list to obtain an attack source address, and the target white list comprises an application load device address, a white list stored in the intrusion prevention system device and a white list stored in the security operation device; the white list stored in the intrusion prevention system equipment comprises a translation address, and the white list stored in the security operation equipment comprises an application system address running in the server and the content distribution network address.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer technology, and in particular, to a network attack processing method, device, equipment, medium and product. Background Art

[0002] In the industry data center security solution deployment scenario, the intrusion prevention system equipment detects attacks and traces the source of the attacks and collects evidence to report them to the enterprise management platform so that users can further determine the security risks of the entire network and take necessary measures.

[0003] In the prior art, the strategy for collecting data on network attacks is to generate security events through intrusion prevention system equipment (security events include: source address, destination address, protocol, protocol, port, attack type, attack name, level, URL, domain name and other information), transmit the security events to the management device in a specific format, and the enterprise network security personnel conduct secondary security analysis and take measures, and generate evaluation data.

[0004] However, in complex data center networking, various network devices are often deployed in front of the intrusion prevention system equipment, which may result in the source address not being the real attack source address. If the user blocks the above source address, it will affect normal traffic. Summary of the invention

[0005] The embodiments of the present invention provide a network attack processing method, device, equipment, medium and product, which can more accurately determine the attack source address and ensure that the normal traffic of the existing network is not affected.

[0006] According to one aspect of the present invention, a network attack processing method is provided, which is applied to a target system, wherein the target system includes: a content distribution network, an application load device, an intrusion prevention system device, a server, and a security operation device, wherein the network attack processing method is executed by the security operation device, and the network attack processing method includes:

[0007] When receiving a network attack event sent by the intrusion prevention system device, obtaining a target load balancing source address field, wherein the target load balancing source address field is stored in a device corresponding to the network attack event;

[0008] Determine an initial address set corresponding to the target load balancing source address field;

[0009] The initial address set is screened based on the target whitelist to obtain the attack source address, wherein the target whitelist includes: the application load device address, the whitelist stored in the intrusion prevention system device and the whitelist stored in the security operation device, the whitelist stored in the intrusion prevention system device includes: the translation address, and the whitelist stored in the security operation device includes: the application system address running in the server and the content distribution network address.

[0010] According to another aspect of the present invention, a network attack processing device is provided, which is configured in a security operation device in a target system, wherein the target system includes: a content distribution network, an application load device, an intrusion prevention system device, a server, and a security operation device, and the network attack processing device includes:

[0011] An acquisition module, configured to acquire a target load balancing source address field when receiving a network attack event sent by the intrusion prevention system device, wherein the target load balancing source address field is stored in a device corresponding to the network attack event;

[0012] A determination module, used to determine an initial address set corresponding to the target load balancing source address field;

[0013] A screening module is used to screen the initial address set based on a target whitelist to obtain an attack source address, wherein the target whitelist includes: an application load device address, a whitelist stored in the intrusion prevention system device, and a whitelist stored in the security operation device, the whitelist stored in the intrusion prevention system device includes: a translation address, and the whitelist stored in the security operation device includes: an application system address running in the server and the content distribution network address.

[0014] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network attack processing method described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network attack processing method described in any embodiment of the present invention when executed.

[0019] According to another aspect of the present invention, a computer program product is provided. When the computer program is executed by a processor, the network attack processing method as described in any one of the embodiments of the present invention is implemented.

[0020] When receiving a network attack event sent by the intrusion prevention system device, the embodiment of the present invention obtains the target load balancing source address field and determines the initial address set corresponding to the target load balancing source address field; the initial address set is screened based on the target whitelist to obtain the attack source address. In a complex network environment, the attack source address can be determined more accurately to ensure that the normal traffic of the existing network is not affected.

[0021] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 is a flow chart of a network attack processing method in an embodiment of the present invention;

[0024] Figure 2 is a schematic diagram of a network in an embodiment of the present invention;

[0025] Figure 3 is a schematic diagram of the structure of a network attack processing device in an embodiment of the present invention;

[0026] Figure 4 It is a structural schematic diagram of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0030] Embodiment 1

[0031] In the prior art, the following solutions are generally used to handle network attacks:

[0032] Technical solution 1: directly report the source address of the current traffic and the URL in the attack flow for forensic analysis. The IP to be handled may be the CDN proxy IP. The disadvantages of this technology are: it cannot guarantee that it is the real attack source, it is easy to cause accidental damage, or the CDN IP cannot be banned in the permanent whitelist.

[0033] Technical Solution 2: Directly block the attack source based on the X-Forward-For field (XFF) of the current traffic. The use of X-Forward-For is a de facto standard, widely used in proxy servers or load balancing services. In some scenarios, the necessary information can be extracted through the XFF field in the traffic. The disadvantage of this technology is that in complex scenarios, the authenticity of XFF is difficult to determine. Once an error is reported, the analysis on the platform side is also disturbed, which will cause the IP to be blocked by mistake and affect normal users in handling Internet services.

[0034] In view of the above problems, an embodiment of the present invention provides a method for processing network attacks. Figure 1 Flow chart of a network attack processing method provided by an embodiment of the present invention. This embodiment is applicable to the situation of network attack processing. The method can be executed by a network attack processing device in an embodiment of the present invention. The device can be implemented in software and / or hardware. Figure 1 As shown, the method specifically comprises the following steps:

[0035] S110, when receiving a network attack event sent by the intrusion prevention system device, obtaining a target load balancing source address field.

[0036] In this embodiment, the target load balancing source address field is stored in a device corresponding to the network attack event.

[0037] In this embodiment, the network attack processing method provided by the embodiment of the present invention is applied to a target system, and the target system includes: a content distribution network, an application load device, an intrusion prevention system device, a server, and a security operation device, and the network attack processing method is executed by the security operation device. The content distribution network (Content Delivery Network, CDN) is a layer of intelligent virtual network based on the existing Internet by placing node servers in various places in the network. The CDN can redirect the user's request to a service node closer to the user in real time according to the network traffic and the connection and load status of each node, as well as the distance to the user and the response time and other comprehensive information. The application load device is used to ensure that the network load is balanced through load balancing technology. Load balancing (Load Balance, LB) technology refers to balancing and distributing the load (work task) to multiple operation units for operation, such as Web servers, application servers and other main task servers, so as to collaboratively complete the work task. The intrusion prevention system (Intrusion Prevention System, IPS) can monitor the network data transmission behavior of the network or network equipment, and can immediately interrupt, adjust or isolate some abnormal or harmful network data transmission behaviors. The Security Operation Center (SOC) is used to detect network security incidents in real time and resolve the issues as quickly and effectively as possible.

[0038] In this embodiment, when a network attack event sent by the intrusion prevention system device is received, the method for obtaining the target load balancing source address field may be: when a network attack event sent by the intrusion prevention system device is received, the target load balancing source address field corresponding to the grid attack event is obtained. When a network attack event sent by the intrusion prevention system device is received, the method for obtaining the target load balancing source address field may also be: when a network attack event sent by the intrusion prevention system device is received, the target session corresponding to the grid attack event is obtained; and the target load balancing source address field is determined according to the load balancing source address field stored in the device corresponding to the target session.

[0039] Optionally, get the target load balancing source address field, including:

[0040] Get the target session corresponding to the grid attack event.

[0041] In this embodiment, the target session corresponding to the grid attack event may be obtained by querying the log file according to the identification information carried by the grid attack event to obtain the target session corresponding to the grid attack event.

[0042] The target load balancing source address field is determined according to the load balancing source address field stored in the device corresponding to the target session.

[0043] In this embodiment, according to the load balancing source address field stored in the device corresponding to the target session, the method of determining the target load balancing source address field may be: starting from the last hop of the target session, reading in reverse order until the target load balancing source address field is obtained. According to the load balancing source address field stored in the device corresponding to the target session, the method of determining the target load balancing source address field may also be: obtaining the load balancing source address field stored in the application load device corresponding to the target session.

[0044] It should be noted that a real source IP switch can be added. When the switch is turned on, when the real source IP address (that is, the target load balancing source address field) cannot be extracted from the last hop of the target session, the current session is reused starting from the last hop of the target session and read in reverse order until the real source IP address is obtained; when the switch is turned off, the load balancing source address field stored in the application load device corresponding to the target session is obtained. If there is no real source IP address, the real source IP address is marked as empty. If the real source IP switch is not set, the real source IP switch is closed by default.

[0045] Optionally, determining the target load balancing source address field according to the load balancing source address field stored in the device corresponding to the target session includes:

[0046] Starting from the last hop of the target session, read in reverse direction until the target load balancing source address field is obtained.

[0047] In this embodiment, starting from the last hop of the target session, the target load balancing source address field is read. If the target load balancing source address field read at the last hop is empty, the target load balancing source address field is read in sequence in the reverse direction until the read target load balancing source address field is not empty.

[0048] Optionally, determining the target load balancing source address field according to the load balancing source address field stored in the device corresponding to the target session includes:

[0049] Gets the read variant mode.

[0050] In this embodiment, the read variant mode carries the load balancing source address field identifier. The read variant modes include: X-Forwarded-For Only mode, Cdn-Src-IP Only mode, X-Real-IP Only mode and Tcp-Option Only mode. X-Forwarded-For, Cdn-Src-IP, X-Real-IP and Tcp-Option are all different variants of the load balancing source address field identifier.

[0051] The target load balancing source address field corresponding to the load balancing source address field identifier stored in the device corresponding to the target session is read.

[0052] In this embodiment, read variant modes are added, such as X-Forwarded-For Only mode, Cdn-Src-IP Only mode, X-Real-IP Only mode, and Tcp-Option Only mode. After the read variant mode is selected, the load balancing source address field is only extracted from the specified field, and other fields are no longer concerned, which simplifies the configuration. The read variant mode and the priority logic are in parallel, which is equivalent to 5 mutually exclusive extraction methods. If the read variant mode is not selected, the X-Forwarded-for Only mode is used by default.

[0053] S120: Determine an initial address set corresponding to the target load balancing source address field.

[0054] In this embodiment, the method for determining the initial address set corresponding to the target load balancing source address field can be: obtaining a preset address extraction quantity; extracting the addresses in the target load balancing source address field according to the preset address extraction quantity; generating an initial address set based on the addresses extracted from the preset address extraction quantity.

[0055] It should be noted that the target load balancing source address field can be appended with records, so the function of extracting multiple addresses is added on the basis of extracting the last address and the first address. Users can choose to extract the last N addresses, the first N addresses, or all addresses, where N is a positive integer greater than 1.

[0056] In this embodiment, the method for determining the initial address set corresponding to the target load balancing source address field can also be: obtaining extraction rules, extracting addresses in the target load balancing source address field according to the extraction rules, and generating an initial address set based on the extracted addresses.

[0057] S130, screening the initial address set based on the target whitelist to obtain the attack source address.

[0058] In this embodiment, the target whitelist includes: the application load device address, the whitelist stored in the intrusion prevention system device, and the whitelist stored in the security operation device. The whitelist stored in the intrusion prevention system device includes: the translation address, and the whitelist stored in the security operation device includes: the application system address running in the server and the content distribution network address.

[0059] In this embodiment, the initial address set is screened based on the target whitelist to obtain the attack source address by: first screening the initial address set based on the application load device address and the translation address to obtain the screened initial address set, and then second screening the screened initial address set based on the application system address and the content distribution network address running in the server to obtain the attack source address. Optionally, determining the initial address set corresponding to the target load balancing source address field includes:

[0060] Get the extraction quantity of the preset address;

[0061] Extracting the address in the target load balancing source address field according to the preset address extraction quantity;

[0062] A number of addresses are extracted according to the extracted preset addresses to generate an initial address set.

[0063] In this embodiment, because the target load balancing source address field can be appended with records, the function of extracting multiple addresses is added on the basis of extracting the last address and the first address. The user can choose to extract the last few addresses. For example, the target load balancing source address field can be:

[0064] X-Forwarded-For: 110.100.122.132, 111.111.111.111, 113.113.113.111, 115.115.115.115, 1.1.1.1, 1.1.12.1, 12.12.12.2;

[0065] If the last two are configured to be extracted, 1.1.12.1 and 12.12.12.2 are extracted. It should be noted that extracting from the front and extracting from the back are mutually exclusive, and extracting one and extracting multiple are mutually exclusive. The upper limit of the number of real source IP addresses that can be extracted is temporarily set at 10. If the number of addresses to be extracted is not set, the first address in the source address field of the target load balancing is extracted by default.

[0066] Optionally, the target system further includes: a network security device;

[0067] After the initial address set is screened based on the whitelist to obtain the attack source address, the method further includes:

[0068] The attack source address is sent to the application load device or the network security device, so that the application load device or the network security device blocks the attack source address.

[0069] In this embodiment, the network security device can be a firewall. The main function of the firewall is to promptly discover and deal with security risks, data transmission and other problems that may exist during the operation of the computer network. Its processing measures include isolation and protection. At the same time, it can record and detect various operations in computer network security to ensure the security of computer network operation and protect the integrity of user data and information.

[0070] In this embodiment, the attack source address is sent to the application load device or the network security device so that the application load device or the network security device bans the attack source address. The method can be: sending the attack source address to the application load device so that the application load device bans the attack source address; or sending the attack source address to the network security device so that the network security device bans the attack source address.

[0071] In this embodiment, the deep source tracing and the combination of the whole network resources are used to make a comprehensive evaluation and decision on the acquired address set, so that the real attack source has no chance to launch an attack again, and the clean traffic is no longer affected by the misjudgment, which effectively protects the security of the intranet.

[0072] In a specific example, Figure 2 As shown, Figure 2The network diagram includes: client GET1, client GET2, client GET3, proxy device Proxy1, proxy device Proxy2, IPS and server. Client GET1, client GET2 and client GET3 need to go through at least proxy device Proxy1, proxy device Proxy2 and IPS device to access the server. It should be noted that proxy device Proxy1 and proxy device Proxy2 include an internal distribution network. Each client and the first proxy device Proxy1 need to establish connections 1, 2 and 3 respectively. The process from Proxy1 to the server is the same for each user. If each user creates a session from Proxy1 to Proxy2, from Proxy2 to IPS, and from IPS to the server, it will increase the pressure on the proxy, IPS and server. Therefore, from Proxy1 to Proxy2, from Proxy2 to IPS, and from IPS to the server, only one session 4, 5 and 6 is created. Proxy1 integrates the sessions accessing the same server and reuses one session 4. In the same session, Proxy1 fills the user's source IP into the X-Forwarded-For field. Because the X-Forwarded-for field is appendable, when the request is sent from Proxy2 to IPS for session 5, Proxy2 appends the IP address of Proxy1 after the user's IP address. In extreme cases, each request in the request message received by the IPS device may have a large number of X-forwarded-for fields, or the X-Forwarded-For field has multiple IP addresses, and the last IP address is the IP address of the first proxy Proxy1 in the above networking. Due to the need for tracing the source, the attack source address is reported to the security operation device. When the last IP address is reported, the IP address extracted is actually the IP address of Proxy1. If this IP address is banned, all traffic is blocked. Therefore, under the premise of complex networking, the embodiment of the present invention extracts all addresses as much as possible, for example, it can be to extract all addresses in the X-forwarded-for field. The security operation device has a collection of security events for the entire network, and also has the application load device address, the whitelist stored in the intrusion prevention system device, and the whitelist stored in the security operation device. This part of the addresses can be considered as the possibility of actively launching attacks in the intranet, and is used as the target whitelist. The reported initial address set is compared with the target whitelist. The address not in the target whitelist is determined as the attack source address. The security operation device can choose to send the attack source address to the firewall or application load device for blocking.

[0073] The technical solution of this embodiment, when receiving the network attack event sent by the intrusion prevention system device, obtains the target load balancing source address field, and determines the initial address set corresponding to the target load balancing source address field; the initial address set is filtered based on the target whitelist to obtain the attack source address. The attack source address can be determined more accurately to ensure that the normal traffic of the existing network is not affected.

[0074] Embodiment 2

[0075] Figure 3 This is a schematic diagram of the structure of a network attack processing device provided by an embodiment of the present invention. This embodiment can be applied to network attack processing. The device can be implemented in software and / or hardware. The device can be integrated in any device that provides network attack processing functions, such as Figure 3 As shown, the network attack processing device specifically includes: an acquisition module 310, a determination module 320 and a screening module 330.

[0076] Wherein, the acquisition module is used to acquire the target load balancing source address field when receiving the network attack event sent by the intrusion prevention system device, wherein the target load balancing source address field is stored in the device corresponding to the network attack event;

[0077] A determination module, used to determine an initial address set corresponding to the target load balancing source address field;

[0078] A screening module is used to screen the initial address set based on a target whitelist to obtain an attack source address, wherein the target whitelist includes: an application load device address, a whitelist stored in the intrusion prevention system device, and a whitelist stored in the security operation device, the whitelist stored in the intrusion prevention system device includes: a translation address, and the whitelist stored in the security operation device includes: an application system address running in the server and the content distribution network address.

[0079] The above-mentioned product can execute the method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0080] Embodiment 3

[0081] Figure 4A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0082] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0083] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0084] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a network attack processing method.

[0085] In some embodiments, the network attack processing method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the network attack processing method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the network attack processing method in any other appropriate manner (e.g., by means of firmware).

[0086] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0087] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0088] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0089] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0090] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0091] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0092] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0093] An embodiment of the present invention further provides a computer program product, including a computer program, wherein when the computer program is executed by a processor, the network attack processing method according to any embodiment of the present invention is implemented.

[0094] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0095] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A network attack processing method, characterized in that: Applied to a target system, the target system includes: a content distribution network, an application load device, an intrusion prevention system device, a server, and a security operation device, the network attack processing method is executed by the security operation device, and the network attack processing method includes: When receiving a network attack event sent by the intrusion prevention system device, obtaining a target load balancing source address field, wherein the target load balancing source address field is stored in a device corresponding to the network attack event; Determine an initial address set corresponding to the target load balancing source address field; The initial address set is screened based on the target whitelist to obtain the attack source address, wherein the target whitelist includes: the application load device address, the whitelist stored in the intrusion prevention system device and the whitelist stored in the security operation device, the whitelist stored in the intrusion prevention system device includes: the translation address, and the whitelist stored in the security operation device includes: the application system address running in the server and the content distribution network address.

2. The method according to claim 1, characterized in that The target system also includes: network security equipment; After the initial address set is screened based on the whitelist to obtain the attack source address, the method further includes: The attack source address is sent to the application load device or the network security device, so that the application load device or the network security device blocks the attack source address.

3. The method according to claim 1, characterized in that Get the target load balancing source address field, including: Get the target session corresponding to the grid attack event; The target load balancing source address field is determined according to the load balancing source address field stored in the device corresponding to the target session.

4. The method according to claim 3, characterized in that Determining a target load balancing source address field according to a load balancing source address field stored in a device corresponding to the target session includes: Starting from the last hop of the target session, read in reverse direction until the target load balancing source address field is obtained.

5. The method according to claim 3, characterized in that: Determining a target load balancing source address field according to a load balancing source address field stored in a device corresponding to the target session includes: Obtaining a read variant mode, wherein the read variant mode carries a load balancing source address field identifier; The target load balancing source address field corresponding to the load balancing source address field identifier stored in the device corresponding to the target session is read.

6. The method according to claim 1, characterized in that Determining an initial address set corresponding to the target load balancing source address field includes: Get the extraction quantity of the preset address; Extracting the address in the target load balancing source address field according to the preset address extraction quantity; A number of addresses are extracted according to the extracted preset addresses to generate an initial address set.

7. A network attack processing device, characterized in that: In the security operation equipment configured in the target system, the target system includes: a content distribution network, an application load device, an intrusion prevention system device, a server and a security operation equipment, the network attack processing device includes: An acquisition module, configured to acquire a target load balancing source address field when receiving a network attack event sent by the intrusion prevention system device, wherein the target load balancing source address field is stored in a device corresponding to the network attack event; A determination module, used to determine an initial address set corresponding to the target load balancing source address field; A screening module is used to screen the initial address set based on a target whitelist to obtain an attack source address, wherein the target whitelist includes: an application load device address, a whitelist stored in the intrusion prevention system device, and a whitelist stored in the security operation device, the whitelist stored in the intrusion prevention system device includes: a translation address, and the whitelist stored in the security operation device includes: an application system address running in the server and the content distribution network address.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network attack processing method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network attack processing method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the network attack processing method according to any one of claims 1 to 6 is implemented.

Images