Second dialing attack traffic blocking method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a second dial attack traffic blocking method and device, equipment and a storage medium, and relates to the technical field of network security, and the method comprises the steps: obtaining the mirror image traffic of a to-be-detected data packet, the mirror image traffic being obtained by copying the data traffic; according to a plurality of data packet features set in the first second dial blocking rule, determining a first data packet conforming to the plurality of data packet features in the mirror image traffic as a first second dial data packet; determining a second second dial data packet conforming to a second dial attack from the second data packets through the session information of the second data packets; and generating a second second dialing blocking rule newly added to the second dialing blocking rule set based on the second second dialing data packet, and constructing a blocking message based on the first second dialing data packet and the second second dialing data packet so as to complete second dialing attack traffic blocking. By covering the handshake stage and the data transmission stage in the TCP protocol, the second dial attack traffic is blocked more comprehensively.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, equipment and storage medium for blocking second dial attack traffic. Background Art

[0002] IP address is the most basic identity in the Internet space. Generally speaking, the IP address corresponding to a physical computer is basically fixed and limited. When the network is disconnected and reconnected, a new IP address will be obtained based on the principle of domestic home broadband dial-up Internet access.

[0003] The second dial attack uses this method to continuously change the IP in a short period of time, so as to attack the target IP and obtain the data information of the target IP.

[0004] Usually, when dealing with second dial attacks, firewall blocking is used, but there is a certain limit on the number of blocked IPs. When the number of blocked IPs is too large, the system performance reaches a bottleneck. In addition, the blocking is relatively simple and can only target attack scenarios of a single IP and a single port. Summary of the invention

[0005] The embodiments of the present application provide a method, device, equipment and storage medium for blocking second dial attack traffic, which are used to improve the blocking accuracy and efficiency of second dial attack traffic.

[0006] In a first aspect, an embodiment of the present application provides a method for blocking traffic of a second dial attack, which is applicable to a bypass blocking device, including:

[0007] Acquire mirrored traffic of a data packet to be detected, where the mirrored traffic is obtained by duplicating data traffic;

[0008] According to the multiple data packet features set in the first second dial blocking rule, the first data packet in the mirrored traffic that meets the multiple data packet features is determined as the first second dial data packet; the first second dial blocking rule is any one in the second dial blocking rule set;

[0009] Determine, from each second data packet, a second second data packet that meets the second dial attack requirement through the session information of each second data packet; each second data packet is a data packet in the mirrored traffic except the first data packet;

[0010] A second second dial blocking rule added to the second dial blocking rule set is generated based on the second second dial data packet, and a blocking message is constructed based on the first second dial data packet and the second second dial data packet to complete the second dial attack traffic blocking.

[0011] In the embodiment of the present application, a blocking message is sent by a bypass blocking device to complete the blocking of the second dial attack traffic, thereby improving the blocking efficiency of the second dial attack; by adding a mirror traffic link and separating it from the blocking message link, the sending speed of the blocking message is improved; by comparing the mirror traffic with the set second dial blocking rules, if it does not meet the requirements, the non-compliant mirror traffic is further processed to obtain the final second dial attack traffic, thereby improving the accuracy of determining the second dial attack traffic; the newly added second dial blocking rules and the previous second dial blocking rules are merged to improve the matching rate of the mirror traffic and the second dial blocking rules; by covering the handshake phase and the data transmission phase in the TCP protocol, the coverage of the second dial attack traffic is wider, and the second dial attack traffic is blocked more comprehensively.

[0012] Optionally, the multiple data packet features include: source IP information, destination IP information, source port information, destination port information, transport layer protocol, and a flag bit of the transport layer protocol; the second dial blocking rule also includes a hit return value when multiple data packet features are hit; the hit return value is used to indicate whether the second dial blocking rule is hit; at least one of the source IP information, the destination IP information, the source port information, and the destination port information is a data packet feature with a range attribute.

[0013] In the embodiment of the present application, by using the source IP information, destination IP information, source port information, destination port information, transport layer protocol, and flag bit of the transport layer protocol, these 6 groups of information are used as the basis for determining the second dial blocking rule, the second dial attack traffic can be hit more accurately; and each group of information is determined separately, rather than only the hash value of the 6 groups of information, which further improves the efficiency of determining the second dial attack traffic; and the inclusion range information in the 6 groups of information is used as a matching rule, which reduces the number of rule matches and prevents performance bottlenecks caused by too many rule matches.

[0014] Optionally, for at least one of the source IP information, the destination IP information, the source port information and the destination port information being a data packet feature with a range attribute, storage is performed in the following manner:

[0015] According to at least one packet feature among the source IP information, the destination IP information, the source port information and the destination port information, a range bitmap of each segment information of the packet feature is constructed, wherein each segment information and a table entry locator pointed to by each segment information is stored in the range bitmap;

[0016] Constructing data table entries indicated by each table entry locator; the data table entries use each segment information as row information and the segment position to which each segment information belongs as column information, and the data table entries store the next segment information to be traversed when each segment information corresponds to the segment position; at least one next segment information corresponds to an equally divided interval tree; the equally divided interval tree corresponds to segment information with a range attribute;

[0017] Construct an equally divided interval tree; the root node of the equally divided interval tree is a common prefix of the segment information corresponding to the range attribute, and each leaf path of the equally divided interval tree corresponds to one of the segment information of the range attribute.

[0018] In the embodiment of the present application, the matching rules for the second dial attack traffic are constructed as a range bitmap, a table entry locator and an equally divided interval tree, which can quickly match the mirrored traffic with the second dial blocking rules, thereby improving the speed of determining the second dial attack traffic.

[0019] Optionally, determining a first data packet in the mirrored traffic that meets the multiple data packet characteristics as a first second dialing data packet according to multiple data packet characteristics set in the first second dialing blocking rule includes:

[0020] For the data packet feature with the range attribute in the first second dial blocking rule, obtain each segment information of the data packet corresponding to the data packet feature with the range attribute in any data packet in the mirrored traffic;

[0021] Determine the table entry locator corresponding to the i-th segment information through the range bitmap; the i-th segment information is the segment information corresponding to the i-th segment bit in each segment information of the data packet;

[0022] According to the entry locator corresponding to the i-th segment of information, determine the next segment to be searched from the data entry;

[0023] When the next segment is an equally divided interval tree, determining whether the short information of the next segment of the data packet exists in the equally divided interval tree;

[0024] Optionally, determining a second second dialing data packet that meets the second dialing attack from the second data packets through the session information of the second data packets includes:

[0025] Determine, from each of the second data packets, a third data packet that satisfies the second dial attack through the session information of each of the second data packets;

[0026] The third data packet is verified through the session information of the historical second-dial data packets and the session information of the fourth data packet, and is determined to be the second second-dial data packet after passing the verification; the fourth data packet is the data packet among the second data packets except the third data packet.

[0027] In the embodiment of the present application, the second data packet is a data packet that matches the second dial blocking rule. In order to avoid missing second dial attack traffic in the second data packet, it is further confirmed whether there is a third data packet of second dial attack traffic based on the session information of the second data packet, and then the third data packet is compared with the fourth data packet and the historical second dial data packets, so that the second data packet can be determined more accurately.

[0028] Optionally, determining a third data packet that satisfies a second dial attack from each of the second data packets by using the session information of each of the second data packets includes:

[0029] For any characteristic dimension in the session information of each second data packet, determine the first potential energy of each data packet under the characteristic dimension and determine the average potential energy under the characteristic dimension; the characteristic dimension includes at least: session duration, inbound flow size, outbound flow size, number of inbound flow packets, and number of outbound flow packets; the first potential energy is determined according to the negative exponential power of the Euclidean distance between any two characteristic dimensions; the average potential energy is the average of the difference between any two first potential energies;

[0030] Determine the potential energy distance of each second data packet under each second data packet according to the first potential energy of each second data packet under each characteristic dimension and the average potential energy under each characteristic dimension;

[0031] For any second data packet, the neighborhood of the second data packet under each second data packet is determined according to the potential energy distance of the second data packet under each second data packet; the local anomaly factor of the second data packet is determined according to the neighborhood of the second data packet under each second data packet; when the local anomaly factor exceeds a set threshold, the second data packet is determined to be a third data packet that meets the requirements of a second dial attack.

[0032] In an embodiment of the present application, by calculating the potential energy value of each dimension in the session information of the second data packet and the average potential energy of the dimension, and by determining the potential energy distance, neighborhood and local anomaly factor, the accuracy of determining the third data packet can be improved.

[0033] Optionally, determining the potential energy distance of each second data packet under each second data packet according to the first potential energy of each second data packet under each characteristic dimension and the average potential energy under each characteristic dimension includes:

[0034] The potential energy distance under the second data packet of the grid is determined by the Euclidean distance from the calibrated average potential energy, and the calibrated average potential energy is:

[0035] The calibration average potential energy is determined by calculating the ratio of the difference between the first potential energy and each of the average potential energies to the difference between the maximum first potential energy and the minimum first potential energy.

[0036] In the embodiment of the present application, the third data packet is determined by the first potential energy distance with the historical second dial data packet and the second potential energy distance with the fourth data packet, so that the third data packet can be determined more accurately.

[0037] Optionally, the verifying the third data packet through the session information of the historical second-dial data packet and the session information of each fourth data packet, and determining the third data packet as the second second-dial data packet after the verification, includes:

[0038] Determine a first potential energy distance of the third data packet under the historical second dialing data packet and a second potential energy distance of the third data packet under each fourth data packet;

[0039] If the first potential energy distance is greater than the second potential energy distance, the second data packet is determined to be the third data packet.

[0040] Optionally, obtaining the mirrored traffic of the data packet to be detected includes:

[0041] Obtain mirrored traffic of the data packet to be detected through the aggregation switch; the aggregation switch mirrors the data traffic received by the border core switch;

[0042] The construction of the blocking message to block the second dial attack traffic includes:

[0043] A blocking message is constructed and sent directly to the border core switch, and the second dial attack traffic is blocked through the border core switch.

[0044] Optionally, the transport layer protocol is a short connection mode corresponding to the TCP protocol or a long connection mode corresponding to the TCP protocol;

[0045] The generating a newly added second dial blocking rule based on the second second dial data packet includes:

[0046] If the second second dial data is in short connection mode, constructing a first second dial blocking rule applicable to the data packet in the TCP connection establishment phase based on the second second dial data packet;

[0047] If the second second dial data is in the long connection mode, a second second dial blocking rule applicable to the data packet in the TCP transmission connection phase is constructed based on the second second dial data packet.

[0048] In the embodiment of the present application, different second dial blocking rules are constructed according to different TCP connection modes, so that the second dial attack traffic can be blocked more comprehensively; by blocking the second dial attack traffic in two stages, namely, the TCP connection establishment stage and the data transmission stage, the scope of blocking the second dial attack traffic is further increased.

[0049] Optionally, the constructing, based on the second second dialing data packet, a first second dialing blocking rule applicable to a data packet in a TCP connection establishment phase includes:

[0050] The source IP of the second second dialing data packet is used as the source IP information of the first second dialing blocking rule, and the flag data of TCP SYN is set to a valid value and the corresponding mask as the flag information of the first second dialing blocking rule;

[0051] A second-second dial blocking rule applicable to a data packet in a TCP transmission connection phase is constructed based on the second-second dial data packet, including:

[0052] The source IP of the second second dialing data packet is used as the source IP information of the second second dialing blocking rule, and the flag data of TCP ACK is set to a valid value and the corresponding mask as the flag information of the second second dialing blocking rule.

[0053] In the embodiment of the present application, a first second dial data packet and a second second dial data packet are constructed respectively for the TCP connection establishment phase and the TCP transmission connection phase, so that when the second dial attack traffic is blocked, different data packets are used for blocking, thereby improving the accuracy of blocking the second dial attack traffic.

[0054] In a second aspect, an embodiment of the present application provides a second dial attack traffic blocking device, which is applicable to a bypass blocking device, including:

[0055] An acquisition module, used for acquiring the mirrored traffic of the data packet to be detected, wherein the mirrored traffic is obtained by copying the data traffic;

[0056] A setting module, used to determine the first data packet in the mirrored traffic that meets the multiple data packet characteristics set in the first second dial blocking rule as the first second dial data packet; the first second dial blocking rule is any one in the second dial blocking rule set;

[0057] A determination module, used to determine, from each second data packet, a second second data packet that meets the second dial attack requirement through session information of each second data packet; each second data packet is a data packet in the mirrored traffic except the first data packet;

[0058] A generating module is used to generate a second second dial blocking rule added to the second dial blocking rule set based on the second second dial data packet, and to construct a blocking message based on the first second dial data packet and the second second dial data packet to complete the second dial attack traffic blocking.

[0059] Optionally, the multiple data packet features include: source IP information, destination IP information, source port information, destination port information, transport layer protocol, and a flag bit of the transport layer protocol; the second dial blocking rule also includes a hit return value when multiple data packet features are hit; the hit return value is used to indicate whether the second dial blocking rule is hit; at least one of the source IP information, the destination IP information, the source port information, and the destination port information is a data packet feature with a range attribute.

[0060] Optionally, the setting module is specifically used to:

[0061] For at least one of the source IP information, the destination IP information, the source port information and the destination port information being a data packet feature with a range attribute, storage is performed in the following manner:

[0062] According to at least one packet feature among the source IP information, the destination IP information, the source port information and the destination port information, a range bitmap of each segment information of the packet feature is constructed, wherein each segment information and a table entry locator pointed to by each segment information is stored in the range bitmap;

[0063] Constructing data table entries indicated by each table entry locator; the data table entries use each segment information as row information and the segment position to which each segment information belongs as column information, and the data table entries store the next segment information to be traversed when each segment information corresponds to the segment position; at least one next segment information corresponds to an equally divided interval tree; the equally divided interval tree corresponds to segment information with a range attribute;

[0064] Construct an equally divided interval tree; the root node of the equally divided interval tree is a common prefix of the segment information corresponding to the range attribute, and each leaf path of the equally divided interval tree corresponds to one of the segment information of the range attribute.

[0065] Optionally, the determining module is specifically used to:

[0066] For the data packet feature with the range attribute in the first second dial blocking rule, obtain each segment information of the data packet corresponding to the data packet feature with the range attribute in any data packet in the mirrored traffic;

[0067] Determine the table entry locator corresponding to the i-th segment information through the range bitmap; the i-th segment information is the segment information corresponding to the i-th segment bit in each segment information of the data packet;

[0068] According to the entry locator corresponding to the i-th segment of information, determine the next segment to be searched from the data entry;

[0069] When the next segment is an equally divided interval tree, determining whether the short information of the next segment of the data packet exists in the equally divided interval tree;

[0070] If any segment of information of the data packet does not conform to the range-type bitmap or the equally divided interval tree, the data packet is a data packet that does not conform to the first second dial blocking rule; if each segment of information of the data packet conforms to the range-type bitmap and the equally divided interval tree, the data packet is the first data packet that conforms to the first second dial blocking rule.

[0071] Optionally, the determining module is specifically used to:

[0072] Determine, from each of the second data packets, a third data packet that satisfies the second dial attack through the session information of each of the second data packets;

[0073] The third data packet is verified through the session information of the historical second-dial data packets and the session information of the fourth data packet, and is determined to be the second second-dial data packet after passing the verification; the fourth data packet is the data packet among the second data packets except the third data packet.

[0074] Optionally, the determining module is specifically used to:

[0075] For any characteristic dimension in the session information of each second data packet, determine the first potential energy of each data packet under the characteristic dimension and determine the average potential energy under the characteristic dimension; the characteristic dimension includes at least: session duration, inbound flow size, outbound flow size, number of inbound flow packets, and number of outbound flow packets; the first potential energy is determined according to the negative exponential power of the Euclidean distance between any two characteristic dimensions; the average potential energy is the average of the difference between any two first potential energies;

[0076] Determine the potential energy distance of each second data packet under each second data packet according to the first potential energy of each second data packet under each characteristic dimension and the average potential energy under each characteristic dimension;

[0077] For any second data packet, the neighborhood of the second data packet under each second data packet is determined according to the potential energy distance of the second data packet under each second data packet; the local anomaly factor of the second data packet is determined according to the neighborhood of the second data packet under each second data packet; when the local anomaly factor exceeds a set threshold, the second data packet is determined to be a third data packet that meets the requirements of a second dial attack.

[0078] Optionally, the determining module is specifically used to:

[0079] The potential energy distance under the second data packet of the grid is determined by the Euclidean distance from the calibrated average potential energy, and the calibrated average potential energy is:

[0080] The calibration average potential energy is determined by calculating the ratio of the difference between the first potential energy and each of the average potential energies to the difference between the maximum first potential energy and the minimum first potential energy.

[0081] Optionally, the determining module is specifically used to:

[0082] Determine a first potential energy distance of the third data packet under the historical second dialing data packet and a second potential energy distance of the third data packet under each fourth data packet;

[0083] If the first potential energy distance is greater than the second potential energy distance, the second data packet is determined to be the third data packet.

[0084] Optionally, the acquisition module is specifically used for:

[0085] Obtain mirrored traffic of the data packet to be detected through the aggregation switch; the aggregation switch mirrors the data traffic received by the border core switch;

[0086] The construction of the blocking message to block the second dial attack traffic includes:

[0087] A blocking message is constructed and sent directly to the border core switch, and the second dial attack traffic is blocked through the border core switch.

[0088] Optionally, the generating module is specifically used for:

[0089] If the second second dial data is in short connection mode, the source IP of the second second dial data packet is used as the source IP information of the first second dial blocking rule, and the flag data of TCP SYN is set to a valid value and the corresponding mask is used as the flag information of the first second dial blocking rule;

[0090] If the second second dial data is in the long connection mode, a second second dial blocking rule applicable to the data packet in the TCP transmission connection phase is constructed based on the second second dial data packet.

[0091] Optionally, the generating module is specifically used for:

[0092] The source IP of the second second dialing data packet is used as the source IP information of the second second dialing blocking rule, and the flag data of TCP ACK is set to a valid value and the corresponding mask as the flag information of the second second dialing blocking rule.

[0093] If the second second dial data is in the long connection mode, a second second dial blocking rule applicable to the data packet in the TCP transmission connection phase is constructed based on the second second dial data packet.

[0094] In a third aspect, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any of the above-mentioned methods when executing the program.

[0095] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a computer device, wherein when the program is run on the computer device, the computer device executes the steps of any of the above-described methods.

[0096] In a fifth aspect, the present application provides a computer program product, which, when executed on a computer, enables the computer to execute the methods of the various embodiments of the first aspect described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0097] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0098] Figure 1 A system architecture diagram provided for an embodiment of the present application;

[0099] Figure 2 A flow chart of a method for blocking second dial attack traffic provided in an embodiment of the present application;

[0100] Figure 3 A schematic diagram of a storage structure of a second dial blocking rule provided in an embodiment of the present application;

[0101] Figure 4 A schematic diagram of matching a second dial blocking rule provided in an embodiment of the present application;

[0102] Figure 5 A schematic diagram of a process for determining a data packet that meets the second dial attack requirement provided by an embodiment of the present application;

[0103] Figure 6 A schematic diagram of a flow chart of a second dial blocking rule in different connection modes provided in an embodiment of the present application;

[0104] Figure 7 A schematic diagram of a short connection mode structure provided in an embodiment of the present application;

[0105] Figure 8 A schematic diagram of a long connection mode structure provided in an embodiment of the present application;

[0106] Fig. 9A schematic diagram of the structure of a TCP message provided in an embodiment of the present application;

[0107] Fig.10 A schematic diagram of the structure of a device for blocking second dial attack traffic provided in an embodiment of the present application;

[0108] Fig.11 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0109] In order to make the purpose, technical solution and beneficial effects of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0110] To facilitate understanding of this solution, the application scenario of this solution is introduced below.

[0111] Internet Protocol Address (IP address for short) is the most basic identity identifier in the network interconnection space. Under normal circumstances, the IP address corresponding to a physical computer is basically fixed and limited. Seconds dialing is a way to connect to IP. Its underlying idea is to use the principle of domestic home broadband dial-up Internet access. A new IP will be obtained every time the connection is disconnected and reconnected. The black industry has a large number of broadband line resources, which are packaged into cloud services using virtualization and cloud computing technologies, and ROS (soft router) is used to uniformly allocate and manage virtual hosts and broadband resources. This cloud service is actually delivered to black industry users as a cloud host (commonly known as a "seconds dialing machine"). Black industry users can install Windows or Linux systems, connect through RDP, VNC or SSH, and deploy automatic disconnection and reconnection IP switching and attack tools before launching attacks. At present, the second-dial IP technology can automatically switch IPs when the target IP cannot be accessed to counter automatic blocking strategies, automatically switch IPs after completing an HTTP session to counter threshold security strategies, automatically switch IPs after generating a certain amount of TCP sessions to counter threshold security strategies, switch IPs in custom time periods to counter protection that reaches the threshold of security strategies, and use different IP proxy pools and switching strategies according to different target IPs / domain names / URLs to counter centralized control security protection strategies in a refined manner.

[0112] Whether it is WAF or firewall, there is a certain limit on the number of banned IPs, because the more banned IPs, the greater the performance pressure on the device. In this protection case, if the attacker uses the second dial technology to attack, each attack changes an IP, and the interception device keeps banning IPs, it will soon reach the performance bottleneck and lose its protection ability.

[0113] In the process of matching the second dial traffic, the following methods can be used to deal with it: 1) The five-tuple hash value is used as the traffic feature, and the string comparison is performed by calculating the five-tuple hash value in the second dial traffic. 2) By establishing an active window, the total number of attacking IP addresses of the asset in the current window and the average number of attacks for each attacking IP address are counted to determine the second dial traffic. 3) The business traffic with specified routing information is mirrored to the protection blocking device for blocking rule matching. However, the above method still has the following problems: 1) The hash value has a weak ability to describe traffic characteristics and cannot cope with the characteristics of frequent changes in IP and port of second dial traffic, and the string matching speed is slow, and it cannot cope with the matching of large-volume second dial traffic. 2) This method has less feature extraction, weak second dial traffic judgment ability, and requires asset access data and security alarm data to be provided by other network security devices. The generation and circulation of data takes time, and real-time second dial traffic identification cannot be achieved. 3) This solution cannot directly mirror the full amount of business traffic to the protection blocking device for analysis, which will cause the second dial traffic to bypass the blocking system. At the same time, after the protection device generates a blocking packet, the sending link is long and needs to pass through the blocking switch and core router to reach the user and the service to complete the blocking. There is a risk of blocking failure due to the long time it takes for the blocking packet to reach the user and the service. The specific implementation steps of the embodiment of this application are introduced below:

[0114] The system architecture diagram of this application is as follows Figure 1 As shown, it includes: a core switch 101 in the border area, an aggregation switch 102, a bypass blocking device 103, a terminal 104, and a server 105. The traffic of users accessing the server is forwarded through the core switch 101 in the border area. Generally, there are more than one core switch 101 in the border area. In order to save the network port resources of the bypass blocking device 103, the traffic of all the core switches 101 in the border area is aggregated through the aggregation switch 102 and connected to the bypass blocking device 103, so as to complete the traffic bypass access in the border area.

[0115] The border zone core switch 101 is a network device for forwarding electrical signals, which can provide an exclusive electrical signal path for any two nodes of the access switch. The border zone refers specifically to the area connecting external users and internal services. The border zone core switch refers to a network device for forwarding external user and internal service traffic.

[0116] Aggregation switch 102: has multiple ports and can connect multiple computers or other network devices. The border area core switch 101 and the aggregation switch 102 are connected through optical fiber, and the traffic between the user and the service end 105 is copied to the aggregation switch 102. The aggregation switch 102 and the bypass blocking system 103 are also connected through optical fiber. The aggregation switch 102 copies and aggregates the traffic of the border area core switch 101 and forwards it to the bypass blocking device.

[0117] The bypass blocking device 103 can be implemented as a server, and is deployed with a bypass blocking system for performing second-dial identification on the received mirrored traffic and generating a corresponding blocking packet to block the second-dial traffic.

[0118] Terminal 104: used to implement blocking management of the second dial traffic identification of the protection blocking device based on user operations.

[0119] Block traffic: A blocking packet constructed based on the determination of second-dial traffic, used to block second-dial traffic.

[0120] Mirror traffic: Copies the specified traffic to the specified location by splitting the light.

[0121] The specific implementation steps of the bypass blocking device are as follows:

[0122] Step 1: Receive mirrored traffic. Receive traffic from all core switches in the border area through the aggregation switch;

[0123] Step 2: Create a data packet queue, a session data queue, and a second dial data packet queue. Divide the time period into time periods according to the time interval T, and create a data packet set D in the tth time period. t , session data set S t , the second dial data packet set R t , store all the data packets received in the tth time period into the data packet set D t , and the set D t Store in packet queue;

[0124] Step 3: The data packet matches the second dial blocking rule. Get the i-th data packet set D in the data packet queue i , i is a positive integer and its initial value is 1, check the packet queue D i Whether it matches the second dial blocking rule, if it matches, put the matching data packet into the second dial data packet set R i , and R i Add to the second dial data packet queue;

[0125] Step 4: Collect traffic characteristics. i Delete the set of second dial packets R that have matched the second dial blocking rule i , get the data packet set DS that does not match the second dial blocking rule i , Statistics DS i The duration of the TCP session, the size of the incoming traffic, the size of the outgoing traffic, the number of incoming traffic packets, and the number of outgoing traffic packets are taken as the data samples to be detected and put into the session data set S i In the example, the session data set S istoring in the session data queue;

[0126] Step 5: Detect anomalies in session data. Use the LOF algorithm with potential energy distance to detect anomalies in the i-th session data set S i Perform anomaly detection to obtain the abnormal session data set RS i , and the normal data set NS i If there is no abnormal session data, go to step 12;

[0127] Step 6: Second dial sample verification. Introduce the known second dial attack session sample set and the session data set NS that was not judged as abnormal in step 5. i RS i Perform positive and negative cross validation, and automatically perform positive and negative validation on the sample points through the potential energy distance judgment criteria. If abnormal, go to step 7, if normal, go to step 8;

[0128] Step 7: Generate a second-dial blocking rule. i Extract RS i The corresponding data packet is obtained, and a set of abnormal data packets is obtained. A second dial blocking rule is generated according to the set of abnormal data packets, and the set of abnormal data packets is updated to R i middle;

[0129] Step 8: Construct the TCP header of the blocking message. i The sequence number seq and the confirmation number ack are used to construct the TCP header of the blocking message;

[0130] Step 9: Construct the blocking message IP header. Based on the source IP address and destination IP address of the session message, construct the blocking message IP header;

[0131] Step 10: Construct the blocking message data link layer. Use the physical address MAC of the core switch as the destination MAC of the Ethernet header of the blocking message, and use the source MAC of the bypass blocking system as the source MAC of the Ethernet header of the blocking message;

[0132] Step 11: Send a bidirectional blocking message;

[0133] Step 12: determine whether the i-th session data set is the last session data set in the session data queue. If so, the detection ends. If not, i=i+1, and go to step 3.

[0134] like Figure 2 As shown, a method for blocking second dial attack traffic provided by an embodiment of the present application is applicable to a bypass blocking device, and includes the following steps:

[0135] Step 201: Acquire mirrored traffic of a data packet to be detected, where the mirrored traffic is obtained by duplicating data traffic.

[0136] Specifically, in the tth time period, the bypass blocking device stores the mirrored traffic of all the packets to be detected received in the tth time period into the session data set S t , get S t ={p t1 , p t2 ,…,p tm}, p tm Indicates that the mth session information in time period t is p tm ={x 1 , x 2 , ..., x i}, x i Represents the value of the i-th dimension feature.

[0137] The bypass blocking device stores the session data set of each time period into the session data queue, and obtains the session data queue {S 1 , S 2 , ..., S t , ..., S E}, E represents the current time period, S E It is a collection of session data in the current time period.

[0138] In some embodiments, obtaining mirrored traffic of a data packet to be detected includes:

[0139] The mirrored traffic of the data packet to be detected is obtained through the aggregation switch; the aggregation switch mirrors the data traffic received by the border core switch.

[0140] In some embodiments, constructing a blocking message to block the second dial attack traffic includes:

[0141] Construct a blocking message and send it directly to the border core switch to block the second dial attack traffic through the border core switch.

[0142] Specifically, the mirrored traffic is obtained by copying the data traffic to the specified location, and the mirrored traffic and the blocking message are not on the same link. When the bypass blocking device receives the mirrored traffic and sends the blocking message, it is on two links.

[0143] Step 202: determine the first data packet in the mirrored traffic that meets the multiple data packet characteristics as the first second dialing data packet according to the multiple data packet characteristics set in the first second dialing blocking rule; the first second dialing blocking rule is any one in the second dialing blocking rule set.

[0144] Specifically, the second dial blocking rule set includes multiple second dial blocking rules, which are used to determine whether a data packet is a second dial data packet. Multiple data packet features are set in the second dial blocking rule. If the data packet features in the mirrored traffic meet the data packet features set in the second dial blocking rule, the data packet is taken as the first data packet. The first second dial blocking rule is a second dial blocking rule generated according to a known second dial data packet.

[0145] In some embodiments, multiple data packet features include: source IP information, destination IP information, source port information, destination port information, transport layer protocol, and flag bit of the transport layer protocol; the second dial blocking rule also includes a hit return value when multiple data packet features are hit; the hit return value is used to indicate whether the second dial blocking rule is hit; at least one of the source IP information, destination IP information, source port information, and destination port information is a data packet feature with a range attribute.

[0146] Specifically, the data packet features include the following six: source IP information, destination IP information, source port information, destination port information, transport layer protocol, and flag bit of the transport layer protocol. At the same time, the second dial blocking rule also includes a hit return value, which is used to indicate whether it is a hit. Among these six data packet features, there are data packet features with range attributes and data packet features without range attributes. The data packet feature with a range attribute is that the data packet feature not only indicates a specific value or character, but indicates that the data packet feature is expressed as a range, such as the source IP information, destination IP information, source port information, and destination port information are all data packet features with range attributes.

[0147] For example, a second dial blocking rule is as follows: 192.168.36.5 / 30 224.1.1.10:80 0:8880x06 0x20000 / 0x3f0000 1000

[0148] Including:

[0149] (a) 192.168.36.5 / 30 indicates the source IP information in the form of an IP mask.

[0150] (b) 224.1.1.1 indicates the destination IP information.

[0151] (c) 0:80 indicates the source port information.

[0152] (d) 0:888 indicates the destination port information.

[0153] (e) 0x06 indicates the transport layer protocol, which is TCP protocol.

[0154] (f) 0x20000 / 0x3f0000 indicates the flag of the transport layer protocol, that is, the flag value of the TCP protocol is 0x20000, and 0x3f0000 indicates that the TCP protocol is in mask form.

[0155] (g) 1000 indicates the value returned after the data packet matches the second dial blocking rule.

[0156] In some embodiments, for at least one of the source IP information, the destination IP information, the source port information, and the destination port information as a data packet feature having a range attribute, the data packet is stored as follows:

[0157] According to at least one data packet feature among source IP information, destination IP information, source port information and destination port information, a range bitmap of each segment information of the data packet feature is constructed, wherein each segment information and a table entry locator pointed to by each segment information are stored in the range bitmap;

[0158] Constructing data table entries indicated by each table entry locator; the data table entry uses each segment information as row information and the segment position to which each segment information belongs as column information, and the data table entry stores the next segment information to be traversed when each segment information corresponds to the segment position; at least one next segment information corresponds to an equally divided interval tree; the equally divided interval tree corresponds to segment information with range attributes;

[0159] Construct an equally partitioned interval tree; the root node of the equally partitioned interval tree is the common prefix of the segment information corresponding to the range attribute, and each leaf path of the equally partitioned interval tree corresponds to one of the segment information of the range attribute.

[0160] Specifically, Figure 3 This is the storage structure for the second dial blocking rules.

[0161] The following uses 192.168.36.5 / 30 as an example to explain the storage process of the second dial blocking rule:

[0162] The IP addresses in 192.168.36.5 / 30 are: 192.168.36.4, 192.168.36.5, 192.168.36.6, 192.168.36.7. The IP addresses are converted to hexadecimal and divided into 4 segments. The first segment L1 is 0xc0, the second segment L2 is 0xa8, the third segment L3 is 0x24, and the fourth segment L4 is a range [0x04, 0x07]. Since the maximum range that each segment of IP can represent is [0x00ˉ0xff], that is, 1 byte, the rule storage and rule matching are based on 1 byte step. In order to compress data table items and avoid range data occupying too much space in data table items or being repeatedly expressed in data table items, this paper uses a range bitmap to find the table item locator. The range bitmap provides a table item locator search within 1 byte, that is, the range [0x00, 0xff]. According to the range bitmap and IP segment, a data table entry is generated, and the value in the data table entry indicates the location of the next hop. The range data is represented by equally divided interval trees to store the range intervals, providing fast search and matching. The following are the detailed steps:

[0163] 1. Generate a range bitmap: L1: 0xc0 corresponds to the entry locator 0xc0 in the range bitmap. Because L1 is not a range, no additional conversion steps are required. L4: [0x04, 0x07] represents a range. The entry locator is represented by 2 bytes to distinguish it from the non-range entry locator. The low-order bytes are incremented in sequence according to the data of the range entry locator.

[0164] 2. Generate data table entries: Take all table entry locators in the range bitmap and determine the next hop position of the IP segment in turn. IP192.168.36.5 / 30, L1 is 0xc0, which can be represented by the position of point (0xc0, L1) in the data table entry. L1 indicates that the L2 position that needs to continue to generate IP has been completed, so the next hop of point (0xc0, L1) is L2; ​​IP192.168.36.5 / 30, L2 is 0xa8, which can be represented by the position of point (0xa8, L2) in the data table entry. L2 indicates that the L3 position that needs to continue to generate IP has been completed, so the next hop of point (0xa8, L2) is L3; IP192.168.36.5 / 30, L3 is 0x24, which can be represented by the position of point (0x24, L3) in the data table entry. L3 indicates that the L4 position that needs to continue to generate IP has been completed, so the next hop of point (0x24, L3) is L4. 0 in the data table entry indicates a blank position.

[0165] 3. Generate an equally divided interval tree: Divide 4 bits into equal parts, and then use 00*, 01*, 10*, 11* as prefixes for the equally divided intervals. * is a wildcard, representing 0 or 1. The prefix does not require additional computational overhead and can be directly indexed. The * part establishes an equally divided interval tree. The equally divided intervals and the tree as a whole constitute an equally divided interval tree.

[0166] In some embodiments, by using multiple packet features set in the first second dial blocking rule, determining the first packet in the mirrored traffic that meets the multiple packet features as the first second dial packet includes:

[0167] For the data packet feature with the range attribute in the first second dial blocking rule, obtain each segment information of the data packet corresponding to the data packet feature with the range attribute in any data packet in the mirrored traffic;

[0168] The table entry locator corresponding to the i-th segment information is determined by a range bitmap; the i-th segment information is the segment information corresponding to the i-th segment bit in each segment information of the data packet;

[0169] According to the table entry locator corresponding to the i-th segment information, determine the next segment to be searched from the data table entry;

[0170] When the next segment is an equally divided interval tree, determining whether the short information of the next segment of the data packet exists in the equally divided interval tree;

[0171] If any segment of information in the data packet does not conform to the range bitmap or the equally divided interval tree, the data packet is a data packet that does not conform to the first second dial blocking rule; if each segment of information in the data packet conforms to the range bitmap and the equally divided interval tree, the data packet is the first data packet that conforms to the first second dial blocking rule.

[0172] Specifically, Figure 4 As shown below, take 192.168.36.6 as an example to explain the rule matching process:

[0173] 1. Get the entry locator: Get L1:0xc0 of IP:192.168.36.6, get the entry locator as 0xc0 in the range bitmap, and get the point (0xc0,L1);

[0174] 2. Check the data table entry: Get the value of point (0xc0, L1) in the data table entry as L2, indicating that the next hop checks the value of IP L2; get IP: 192.168.36.6's L2: 0xa8, get the table locator as 0xa8 in the range bitmap, get the point (0xa8, L2), get the value of point (0xa8, L2) in the data table entry as L3, indicating that the next hop checks the value of IP L3; get IP: 192.168.36.6's L3: 0x24, get the table locator as 0x24 in the range bitmap, get the point (0x24, L3), get the value of point (0x24, L3) in the data table entry as L4, indicating that the next hop checks the value of IP L4;

[0175] 3. Equally divided interval tree matching: Take L4:0x06 of IP: 192.168.36.6, obtain the table item locator 0xff01 in the range bitmap, and get the point (0xff01, L4). The prefix 0xff shows that the second dial blocking rule here represents a range. The equally divided interval tree of point (0xff01, L4) can be obtained in the data table item. The binary representation of L4:0x06 is: 0110. Since the equally divided interval tree is equally divided, the first 2 bits of 0110 are 01, which can be directly indexed to 01 in the equally divided interval tree. Then traverse the equally divided interval tree with 01 as the root node. If the bit is 0, go left, and if the bit is 1, go right. The traversal process is as follows: Figure 3 The dotted path in the figure can get the ID, indicating a successful match.

[0176] In the embodiment of the present application, the second dial blocking rule of the source IP information is used as an example for explanation, and the destination IP information, source port information, destination port information, transport layer protocol and the flag bit of the transport layer protocol are also stored according to the second dial blocking rule of the source IP. If there is no range information in the above information, it does not need to be stored. When the second dial blocking rule is matched, only text matching is required. The embodiments of the present application will not be repeated one by one.

[0177] The following uses 192.168.36.5 / 29 as an example to explain the process of merging the second dial blocking rules:

[0178] The existing IP segment 192.168.36.5 / 29 needs to be added to Figure 4The existing rules shown. The IP segment includes: 192.168.36.1, 192.168.36.2, 192.168.36.3, 192.168.36.4, 192.168.36.5, 192.168.36.6, 192.168.36.7. The L1, L2, and L3 of the IP segment are consistent with the existing second dial blocking rules and do not need to be processed. The range of L4 is [0x01, 0x07] , where the L4 range of the existing second dial blocking rule is [0x04, 0x07], [0x01, 0x07] is divided into two parts: [0x01, 0x03] and [0x04, 0x07]. In the original range bitmap, [0x04, 0x07] already has an entry locator, but the entry locators corresponding to 0x01, 0x02, and 0x03 are 0x01, 0x02, and 0x03 respectively. The range-type bitmap of the dial blocking rule represents the non-range table item locator, so 0x01, 0x02, and 0x03 need to be merged in the range-type bitmap of the existing second dial blocking rule. According to the storage process of the second dial blocking rule, the range-type table item locator is represented by 2 bytes, and the prefix is ​​0xff. According to the data of the range-type table item locator, it is incremented in sequence. The range-type table item locator in the existing second dial blocking rule is 0xff01, so after merging 0x01, 0x02, and 0x03, the table item locator corresponding to [0x01, 0x03] is 0xff02. 0x01, 0x02, and 0x03 are converted to binary as follows: 0001, 0010, and 0011 respectively. The original equal-division interval tree of the second dial blocking rule does not store the equal-division interval tree with the prefix 00*, so a new equal-division interval tree storing 0001, 0010, and 0011 is added, such as Figure 4 As shown in the dotted part of the equally divided interval tree, the jump table corresponding to the point (0xff02, L4) can point to the equally divided interval tree.

[0179] Step 203: Determine, from each second data packet, a second second data packet that meets the second dial attack requirement through the session information of each second data packet; each second data packet is a data packet in the mirrored traffic except the first data packet.

[0180] Specifically, if the characteristics of the data packet in the mirrored traffic do not meet the characteristics of the data packet set in the second dial blocking rule, the data packet is used as the second data packet. The second second dial data packet is determined according to the session information of the second data packet. The first data packet and the second data packet together constitute the data packet of the mirrored traffic.

[0181] Step 204: Generate a second second dial blocking rule added to the second dial blocking rule set based on the second second dial data packet, and construct a blocking message based on the first second dial data packet and the second second dial data packet to complete the second dial attack traffic blocking.

[0182] Specifically, the second second dial blocking rule is a second dial blocking rule generated according to the second second dial data packet. Therefore, the second dial blocking rule set includes the first second dial blocking rule and the second second dial blocking rule. According to the first second dial data packet and the second second dial data packet, a blocking message is constructed, and the second dial attack traffic is blocked by sending the blocking message.

[0183] In some embodiments, determining a second second dialing data packet that meets the second dialing attack from each second data packet through session information of each second data packet includes:

[0184] Determine, from each second data packet, a third data packet that satisfies the second dial attack through the session information of each second data packet;

[0185] The third data packet is verified through the session information of the historical second-dial data packet and the session information of the fourth data packet, and is determined to be the second second-dial data packet after passing the verification; the fourth data packet is the data packet in each second data packet except the third data packet.

[0186] Specifically, session information is used to characterize traffic data. In the embodiment of the present application, session information includes at least the following five items: duration of the TCP session, size of incoming traffic, size of outgoing traffic, number of incoming traffic packets, and number of outgoing traffic packets, but is not limited to these five items of session information.

[0187] In some embodiments, the session information of each second data packet is used to determine a third data packet that meets the second dial attack requirement from each second data packet, such as Figure 5 As shown, the following steps are included:

[0188] Step 501: for any characteristic dimension in the session information of each second data packet, determine the first potential energy of each data packet under the characteristic dimension and determine the average potential energy under the characteristic dimension; the characteristic dimension includes at least: session duration, incoming traffic size, outgoing traffic size, number of incoming traffic messages, number of outgoing traffic messages; the first potential energy is determined based on the negative exponential power of the Euclidean distance between any two characteristic dimensions; the average potential energy is the average of the difference between any two first potential energies.

[0189] Specifically, take each session information set p in the second data packet m The feature values ​​of the i-th feature dimension constitute the i-th dimension of the session information data plane set D 3 ={p 1 (i), p 2 (i), ..., p m (i)}, p m (i) indicates S t The ith dimension feature value of the mth session set in .

[0190] Calculate the potential energy value of each dimension of data in that dimension, and take Di Any point p in j (i), 0≤j≤m, then point p j (i) The potential energy value E(p j (i)) is as shown in formula (1):

[0191]

[0192] Among them, ||p j (i)-p n (i)|| 2 For point p j (i) and point p n The Euclidean distance of (i) is For point p n (i) Radiate to point p j (i) Energy.

[0193] Calculate S t The average potential energy value of the i-th dimension data in the data plane is the average value of the potential energy difference between any two data in the data plane. Take the session information data plane set D i Any two data p in n (i) and p m (i) The potential energy value E(p n (i)) and E(p m (i)), then p n (i) and p m The potential energy difference of (i) is E(p n (i))-E(p m (i)), as shown in formula (2), to calculate the average potential energy:

[0194]

[0195] Among them, N is the number of data in the i-th dimension, E(p n (i))-E(p m (i)) is p n (i) and p m (i) The potential energy difference.

[0196] Step 502: Determine the potential energy distance of each second data packet under each second data packet according to the first potential energy of each second data packet under each feature dimension and the average potential energy under each feature dimension.

[0197] In some embodiments, the potential energy distance of each second data packet under each second data packet is determined according to the first potential energy of each second data packet under each characteristic dimension and the average potential energy under each characteristic dimension, including: determining the potential energy distance under the second data packet by the Euclidean distance between the second data packet and the calibrated average potential energy, and the calibrated average potential energy is: determining the calibrated average potential energy by calculating the ratio of the difference between the first potential energy and each average potential energy to the difference between the maximum first potential energy and the minimum first potential energy.

[0198] Specifically, the potential energy distance of all conversation data in the conversation data set is calculated, then point p n The potential energy distance is f(p n ) is shown in formula (3):

[0199]

[0200] Among them, p n ′ indicates p n Data calibrated by average potential energy value. n ′ is shown in formula (4):

[0201]

[0202] Among them, E(pma x (i)) is the maximum potential energy value, E(pmi n (i) is the minimum potential energy value.

[0203] Step 503: for any second data packet, determine the neighborhood of the second data packet under each second data packet according to the potential energy distance of the second data packet under each second data packet; determine the local anomaly factor of the second data packet according to the neighborhood of the second data packet under each second data packet; when the local anomaly factor exceeds a set threshold, determine that the second data packet is a third data packet that meets the requirements of a second dial attack.

[0204] Specifically, get p n The k-neighborhood value of point p n Centered by, the statistics are less than k neighboring distances f k (p n ) is p n The k-neighborhood value, potential energy distance f k (p n ) is the k-distance neighborhood, N k (p n ) is the set of all points in the neighborhood, that is, N k (p n )={f(p n , p m )≤f k (p n )}.

[0205] Calculate point p n The kth reachable distance reach_distance k (p n , o). The reachable distance is shown in formula (5):

[0206] reach_distance k (p n , o)=max{f k (p n ), f k (p n ,o)},o∈N k (p n )……

[0207] Formula (5)

[0208] Calculate point p n The local reachable density LRD k (p n ).

[0209]

[0210] Calculate point p n Local anomaly factor:

[0211]

[0212] Set a threshold β, and determine whether the local abnormal factor of the session data in the session data set is greater than the set threshold β. If so, the session data is abnormal session data; otherwise, the session data is normal session data, and continue to determine the next session data until the session data set S is completed. i All session data in the packet. All abnormal sessions are taken as the third packet.

[0213] In some embodiments, the third data packet is verified by using the session information of the historical second-dial data packet and the session information of each fourth data packet, and the third data packet is determined to be the second second-dial data packet after passing the verification, including:

[0214] Determine a first potential energy distance of the third data packet under the historical second-dial data packet and a second potential energy distance of the third data packet under each fourth data packet; if the first potential energy distance is greater than the second potential energy distance, determine that the second data packet is the third data packet.

[0215] Specifically, after obtaining the third data packet, in order to reduce the misjudgment rate and reduce the blocking behavior caused by misjudgment, the third data packet is verified by introducing the historical second-dial data packet and the fourth data packet. The fourth data packet is the data packet in the second data packet except the third data packet.

[0216] The potential energy distances between the third data packet and the historical second-dial data packet and the fourth data packet are respectively determined by formula (8):

[0217]

[0218] Among them, f a (RS i (j)) is the potential energy distance between the third data packet and the historical second-dial data packet, f b (RS i (j)) is the potential energy distance between the third data packet and the fourth data packet. It can be seen from formula (8) that if the potential energy distance between the third data packet and the historical second-dial data packet is greater than the potential energy distance between the third data packet and the fourth data packet, it means that the third data packet deviates from the historical second-dial data packet; if the potential energy distance between the third data packet and the historical second-dial data packet is less than or equal to the potential energy distance of the fourth data packet, it means that the third data packet is close to the fourth data packet, that is, close to the normal data packet.

[0219] In some embodiments, the transport layer protocol is a short connection mode corresponding to the TCP protocol or a long connection mode corresponding to the TCP protocol; a newly added second dial blocking rule is generated based on the second second dial data packet, such as Figure 6 As shown, the following steps are included:

[0220] Step 601: If the second second dial data packet is in the short connection mode, a second second dial blocking rule applicable to data packets in the TCP connection establishment phase is constructed based on the second second dial data packet.

[0221] Step 602: If the second second dial data packet is in the long connection mode, a second second dial blocking rule applicable to data packets in the TCP transmission connection phase is constructed based on the second second dial data packet.

[0222] Specifically, different blocking rules for second dialing are generated according to different scenarios of TCP data transmission. TCP transmission is divided into TCP long connection mode and TCP short connection mode. Figure 7 and Figure 8 As shown, Figure 7 For short connection mode, Figure 8 This is the long connection mode.

[0223] like Figure 7 As shown in the figure, the TCP short connection mode closes the connection immediately after the data transmission is completed. Before the subsequent data transmission, a TCP three-way handshake is required to establish a connection. In order to effectively block TCP short connections, the data packets of TCP during the connection establishment phase can be detected. Figure 8As shown, in a TCP long connection, since the TCP connection is not disconnected after data transmission, there is no need to establish a connection through the TCP three-way handshake before subsequent data transmission, and the TCP connection establishment process cannot be detected. In order to effectively block the TCP long connection, the data packets of TCP in the data transmission stage can be detected.

[0224] The TCP message structure is as follows Fig. 9 As shown, TCP flags: a set of six fields, each one bit long, TCP flags are used to indicate specific states during a TCP session, which can be used for troubleshooting or controlling how a specific connection is handled. The functions of each flag are as follows:

[0225] (1) URG (Urgent): When this bit is set, the data takes precedence over other data. This means that the data carried by the data packet should be processed immediately by the TCP stack. This means that the sender is sending data to the other end in an urgent manner and that the packet contains data that needs to be processed urgently.

[0226] (2) ACK (Acknowledgment): This bit field is used during connection establishment (three-way handshake) and data transmission. It is used to confirm that the data packet has been received, and is also used to confirm the initiation request and the removal request. TCP stipulates that this bit must be set to 1 except for the SYN packet when the connection is initially established.

[0227] (3) PSH (Push): This bit field tells the application to send data immediately. It indicates that the incoming data should be passed directly to the application instead of being cached. If PSH is 0, it means that in normal circumstances, it does not need to be transmitted immediately, but cached first.

[0228] (4) RST (Reset): This bit field is set to reset the TCP connection. It indicates that the connection is closed or the service may not accept the request. It indicates that an abnormality has occurred in the TCP connection and the connection must be forcibly disconnected. The RST flag is used to terminate the connection and is often used to solve network connection problems.

[0229] (5) SYN (Synchronization): This bit flag is used to initiate a connection, establish a connection and set the initial sequence number.

[0230] (6) FIN (Finish): This bit field indicates the end of a TCP connection, indicating that the connection is being disconnected or closed. Both the sender and the receiver send a FIN packet to terminate the connection. This indicates that the sender has completed the task and will not send any data in the future and wishes to disconnect. When the communication is over and the connection is disconnected, the hosts on both sides of the communication can exchange TCP segments with the FIN bit set to 1. The FIN flag is used to terminate a TCP connection.

[0231] In some embodiments, a second dial blocking rule applicable to a data packet in the TCP connection establishment phase is constructed based on the second second dial data packet, including: using the source IP of the second second dial data packet as the source IP information of the first second dial blocking rule, and setting TCP's SYN to a valid value flag data and the corresponding mask as the flag information of the first second dial blocking rule.

[0232] A second second dial blocking rule applicable to a data packet in a TCP transmission connection phase is constructed based on the second second dial data packet, including: using the source IP of the second second dial data packet as the source IP information of the second second dial blocking rule, and setting the TCP ACK as a valid value flag data and a corresponding mask as the flag information of the second second dial blocking rule.

[0233] Specifically, the rule generation process is as follows: Fig. 9 The format is shown in the figure. Fig. 9 Source IP information in the data packet: 192.168.32.155, destination IP information: 224.1.1.1, source port information: 34, destination port information: 443, transport layer protocol: 0x6, SYN is 1, and the custom return value increases according to the rule data, and increases in sequence. Fig. 9 The rules in.

[0234] In the TCP three-way handshake, the TCP of the first packet must set SYN to 1. To block TCP short connections, you can check the data packets with the SYN flag set in the TCP flag. For example, if the source IP of one of the abnormal data packets is 10.123.0.31, the generated second dial-up blocking rule is:

[0235] 10.123.0.31 / 32 0.0.0.0 / 0 0:65535 0:65535 0x06 0x20000 / 0x3f0000 The 1-second dial blocking rule includes: source IP information, destination IP information, source port information, destination port information, transport layer protocol, flag of the transport layer protocol, and the custom return value after hitting the rule. The above rule will hit the request data packet from the source port 0 to 65535 of 10.123.0.31 to any port of any target IP with the TCP flag position set to SYN. ​​After hitting, the data 1 will be returned; the TCP flag in the rule is in the form of value and mask. In the above rule, the TCP flag value is 0x20000, and the TCP flag mask is 0x3f0000. By performing an AND operation on the 32-bit data containing TCP flags and the TCP flags mask, if the value is 0x20000, it means that the data packet has the SYN flag set.

[0236] Because TCP stipulates that after the connection is established, all transmitted segments must set ACK to 1. To block TCP long connections, you can check the data packets with the ACK flag set in the TCP flag. The long connection second dial blocking rules for the above abnormal data packets are:

[0237] 10.123.0.31 / 32 0.0.0.0 / 0 0:65535 0:65535 0x06 0x100000 / 0x3f0000 2

[0238] The above rule will hit the request data packet from the source port 0 to 65535 of 10.123.0.31 to any port of any target IP with the ACK flag in the TCP flag position, and will return data 2 after hitting. The inspection method of TCP flag: 0x100000 / 0x3f0000 in the rule is similar to the explanation of TCP short connection.

[0239] In some embodiments, constructing a blocking message based on the first second dialing data packet and the second second dialing data packet includes the following steps:

[0240] Step 701: for any one of the first second dial-up data packet and the second second dial-up data packet, construct a first blocking message sent to the source IP according to the source IP in the data packet, and construct a second blocking message sent to the destination IP according to the destination IP in the data packet;

[0241] Step 702: Construct a TCP header of the first blocking message and a TCP header of the second blocking message respectively according to the sequence number seq and the acknowledgment number ack in the data packet.

[0242] Specifically, after TCP establishes a connection, the client and the server can perform data transmission. TCP stipulates that after the connection is established, all transmitted segments must set ACK to 1. The data transmission process is as follows:

[0243] First handshake: The client sends the first handshake message to the server and waits for the server to confirm. The first handshake message is a SYN (Synchronize Sequence Numbers) packet, which includes a synchronization flag SYN=1, a sequence number seq=0, and an acknowledgment number ack=0. The synchronization flag SYN=1 indicates a request to establish a connection.

[0244] Second handshake: The server receives the first handshake message sent by the client, confirms the first handshake message and then sends the second handshake message to the client. The second handshake message is a SYN+ACK (Acknowledgement) packet, which includes a synchronization flag SYN=1, an acknowledgement flag ACK=1, a sequence number seq=0, and an acknowledgement number ack=1. The synchronization flag SYN=1 and the acknowledgement ACK=1 indicate that the server confirms that the sequence number seq in the first handshake message of the client is valid, that it can normally receive the data sent by the client, and agrees to create a new connection; the acknowledgement number ack indicates that the server receives the sequence number seq=0 of the client, and adds 1 to its value as the value of its own acknowledgement number ack.

[0245] The third handshake: The client receives the second handshake message sent by the server, determines that the data transmission from the client to the server is normal, and sends the third handshake message to the server. After the client and server receive the third handshake message, the TCP connection is established, and data transmission can be performed at this time. Among them, the third handshake message is an ACK packet, which includes the confirmation flag ACK=1, the sequence number seq=1, and the confirmation number ack=1. Among them, the confirmation flag ACK=1 indicates that the client has received the signal that the server agrees to connect; the sequence number seq indicates that the client has received the confirmation number ack=1 sent by the server, and uses its value as its own sequence number; the confirmation number ack indicates that the client has received the sequence number seq=0 sent by the server, and adds 1 to its value as the value of its own confirmation number ack.

[0246]

[0247]

[0248] Table 1

[0249] As shown in Table 1, sequence number 4 means that after the connection is established, the client and the server can perform data transmission. This time, the client sends 725 bytes of data to the server, with the confirmation flag ACK=1, the sequence number seq=1, and the confirmation number ack=1.

[0250] Sequence number 5 is a data packet sent by the server to the client with the flag bit ACK=1, sequence number seq=1, and confirmation number ack=726, where the sequence number seq indicates that the server receives the confirmation number ack=1 sent by the client and uses its value as its own sequence number; the confirmation number ack indicates that the server receives the sequence number seq=1 sent by the client and adds its value to the received data length 725 as the value of its own confirmation number ack.

[0251] The process for numbers 6, 7, and 8 in the table is similar.

[0252] R k is the set of second dial packets R i The kth data packet, R k The sequence number seq is x, and the confirmation number ack is y. According to the relationship between seq and ack in the TCP connection establishment phase and data transmission phase in Figure 1, it can be seen that the sequence number seq and the confirmation number ack in the blocking message sent to the source and destination have the same relationship as shown in Table 2.

[0253]

[0254] Table 2

[0255] Step 703: construct the first blocking message and the second blocking message, both of which have a source MAC that is the MAC of the bypass blocking device, and a destination MAC that is the MAC of the border core switch.

[0256] Specifically, after the first blocking message and the second blocking message are constructed, the first blocking message and the second blocking message of the bypass blocking device can be sent to the border core switch by matching the MAC of the bypass blocking device with the MAC of the border core switch. Through the border core switch, the first blocking message and the second blocking message are sent to the user and the server for bidirectional blocking, thereby completing the blocking of the second dial attack traffic.

[0257] When sending the first blocking message and the second blocking message, the bypass blocking device reverses the source IP and the destination IP, that is, the source IP of the first blocking message becomes the destination IP, and the destination IP in the second blocking message becomes the source IP.

[0258] In the embodiment of the present application, a blocking message is sent by a bypass blocking device to complete the blocking of the second dial attack traffic, thereby improving the blocking efficiency of the second dial attack; by adding a mirror traffic link and separating it from the blocking message link, the sending speed of the blocking message is improved; by comparing the mirror traffic with the set second dial blocking rules, if it does not meet the requirements, the non-compliant mirror traffic is further processed to obtain the final second dial attack traffic, thereby improving the accuracy of determining the second dial attack traffic; the newly added second dial blocking rules and the previous second dial blocking rules are merged to improve the matching rate of the mirror traffic and the second dial blocking rules; by covering the handshake phase and the data transmission phase in the TCP protocol, the coverage of the second dial attack traffic is wider, and the second dial attack traffic is blocked more comprehensively.

[0259] Based on the same technical concept, the embodiment of the present application provides a device for blocking traffic of a second dial attack, such as Fig.10 As shown, the device 1000 includes:

[0260] An acquisition module 1001 is used to acquire the mirrored traffic of the data packet to be detected, where the mirrored traffic is obtained by copying the data traffic;

[0261] The setting module 1002 is used to determine the first data packet in the mirrored traffic that meets the multiple data packet characteristics as the first second dialing data packet according to the multiple data packet characteristics set in the second dialing blocking rule;

[0262] The determination module 1003 is used to determine the second second-dial data packets that meet the second-dial attack from the second data packets through the session information of the second data packets; each second data packet is a data packet in the mirrored traffic except the first data packet;

[0263] The generating module 1004 is used to generate a newly added second dial blocking rule based on the second second dial data packet, and construct a blocking message based on the first second dial data packet and the second second dial data packet to complete the second dial attack traffic blocking.

[0264] Optionally, the multiple data packet features include: source IP information, destination IP information, source port information, destination port information, transport layer protocol, and flag bit of the transport layer protocol; the second dial blocking rule also includes a hit return value when multiple data packet features are hit; the hit return value is used to characterize the hit second dial blocking rule.

[0265] Optionally, data packet features with range attributes are stored as follows:

[0266] Constructing a range bitmap of each segment of information corresponding to the characteristics of the data packet, wherein the range bitmap stores each segment of information and a table entry locator pointed to by each segment of information;

[0267] Constructing data table entries indicated by each table entry locator; the data table entry stores the next segment of information to be traversed for each segment of information; the next segment of information includes an equally divided interval tree;

[0268] Construct an equally divided interval tree; any node of the equally divided interval tree is the common prefix of the corresponding segment information.

[0269] Optionally, the determining module 1003 is specifically configured to:

[0270] Determine, from each second data packet, a third data packet that satisfies the second dial attack through the session information of each second data packet;

[0271] The third data packet is verified through the session information of the historical second-dial data packet and the session information of the fourth data packet, and is determined to be the second second-dial data packet after passing the verification; the fourth data packet is the data packet in each second data packet except the third data packet.

[0272] Optionally, the determining module 1003 is specifically configured to:

[0273] For any dimension feature in the session information of each second data packet, determine a first potential energy of each data packet in the feature dimension and determine an average potential energy in the feature dimension;

[0274] Determine the potential energy distance of each second data packet under each second data packet according to the first potential energy of each second data packet under each characteristic dimension and the average potential energy under each characteristic dimension;

[0275] For any second data packet, the neighborhood of the second data packet under each second data packet is determined according to the potential energy distance of the second data packet under each second data packet; the local anomaly factor of the second data packet is determined according to the neighborhood of the second data packet under each second data packet; when the local anomaly factor exceeds a set threshold, the second data packet is determined to be a third data packet that meets the requirements of a second dial attack.

[0276] Optionally, the determining module 1003 is specifically configured to:

[0277] Determine a first potential energy distance of the third data packet under the historical second-dial data packet and a second potential energy distance of the third data packet under each fourth data packet;

[0278] If the first potential energy distance is greater than the second potential energy distance, the third data packet is determined to be the third data packet.

[0279] Optionally, the acquisition module 1001 is specifically used for:

[0280] The mirrored traffic of the data packet to be detected is obtained through the aggregation switch; the aggregation switch mirrors the data traffic received by the border core switch;

[0281] Construct a blocking message to block the second dial attack traffic, including:

[0282] Construct a blocking message and send it directly to the border core switch to block the second dial attack traffic through the border core switch.

[0283] Optionally, the generating module 1004 is specifically used for:

[0284] If the second-second dial data is in short connection mode, a first-second dial blocking rule applicable to the data packet in the TCP connection establishment phase is constructed based on the second-second dial data packet;

[0285] If the second-second dial data is in the long connection mode, a second-second dial blocking rule applicable to the data packet in the TCP transmission connection phase is constructed based on the second-second dial data packet.

[0286] Optionally, the generating module 1004 is specifically used for:

[0287] The source IP of the second second dial data packet is used as the source IP information of the first second dial blocking rule, and the flag data of TCP SYN is set to a valid value and the corresponding mask is used as the flag information of the first second dial blocking rule;

[0288] The source IP of the second second dial data packet is used as the source IP information of the second second dial blocking rule, and the flag data of TCP ACK is set to a valid value and the corresponding mask as the flag information of the second second dial blocking rule.

[0289] Optionally, the generating module 1004 is specifically used for:

[0290] For any data packet in the first second dial-up data packet and the second second dial-up data packet, construct a first blocking message sent to the source IP according to the source IP in the data packet, and construct a blocking message sent to the destination IP according to the destination IP in the data packet;

[0291] According to the sequence number seq and the confirmation number ack in the data packet, a TCP header of the first blocking message and a TCP header of the second blocking message are constructed respectively;

[0292] The source MACs for constructing the first blocking message and the second blocking message are both the MACs of the bypass blocking device, and the destination MACs are both the MACs of the border core switch.

[0293] Based on the same technical concept, the embodiment of the present application provides a computer device, which may be a terminal or a server, such as Fig.11 As shown, it includes at least one processor 1101 and a memory 1102 connected to the at least one processor. The specific connection medium between the processor 1101 and the memory 1102 is not limited in the embodiment of the present application. Fig.11 For example, the processor 1101 and the memory 1102 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, and the like.

[0294] In the embodiment of the present application, the memory 1102 stores instructions that can be executed by at least one processor 1101. The at least one processor 1101 can execute the steps included in the above-mentioned second dial attack traffic blocking method by executing the instructions stored in the memory 1102.

[0295] Among them, the processor 1101 is the control center of the computer device, and can use various interfaces and lines to connect various parts of the computer device, by running or executing instructions stored in the memory 1102 and calling data stored in the memory 1102. Optionally, the processor 1101 may include one or more processing units, and the processor 1101 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 1101. In some embodiments, the processor 1101 and the memory 1102 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

[0296] Processor 1101 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.

[0297] Memory 1102, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs and modules. Memory 1102 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), programmable read-only memory (Programmable Read Only Memory, PROM), read-only memory (Read Only Memory, ROM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), magnetic memory, disk, optical disk, etc. Memory 1102 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 1102 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0298] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program executable by a computer device. When the program runs on the computer device, the computer device executes the steps of the above-mentioned second dial attack traffic blocking method.

[0299] Based on the same inventive concept, an embodiment of the present application provides a computer program product, characterized in that the computer program product includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer device, the computer device executes the steps of the above-mentioned second dial attack traffic blocking method.

[0300] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0301] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0302] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0303] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0304] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for blocking second dial attack traffic, characterized in that: Applicable to a bypass blocking device, the method comprises: Acquire mirrored traffic of a data packet to be detected, where the mirrored traffic is obtained by duplicating data traffic; According to the multiple data packet features set in the first second dial blocking rule, the first data packet in the mirrored traffic that meets the multiple data packet features is determined as the first second dial data packet; the first second dial blocking rule is any one in the second dial blocking rule set; Determine, from each second data packet, a second second data packet that meets the second dial attack requirement through the session information of each second data packet; each second data packet is a data packet in the mirrored traffic except the first data packet; A second second dial blocking rule added to the second dial blocking rule set is generated based on the second second dial data packet, and a blocking message is constructed based on the first second dial data packet and the second second dial data packet to complete the second dial attack traffic blocking.

2. The method according to claim 1, characterized in that The multiple data packet characteristics include: Source IP information, destination IP information, source port information, destination port information, transport layer protocol, and flag bit of the transport layer protocol; at least one of the source IP information, the destination IP information, the source port information, and the destination port information is a data packet feature having a range attribute; The second dial blocking rule also includes a hit return value when multiple data packet features are hit; the hit return value is used to indicate whether the second dial blocking rule is hit.

3. The method according to claim 2, characterized in that For at least one of the source IP information, the destination IP information, the source port information and the destination port information being a data packet feature with a range attribute, storage is performed in the following manner: According to at least one packet feature among the source IP information, the destination IP information, the source port information and the destination port information, a range bitmap of each segment information of the packet feature is constructed, wherein each segment information and a table entry locator pointed to by each segment information is stored in the range bitmap; Constructing data table entries indicated by each table entry locator; the data table entries use each piece of information as row information and the segment to which each piece of information belongs as column information, and the data table entries store the next piece of information to be traversed when each piece of information corresponds to the segment; At least one next segment of information corresponds to an equally divided interval tree; The equally divided interval tree corresponds to the segment information with range attributes; Construct an equally divided interval tree; the root node of the equally divided interval tree is a common prefix of the segment information corresponding to the range attribute, and each leaf path of the equally divided interval tree corresponds to one of the segment information of the range attribute.

4. The method according to claim 3, characterized in that Determining a first data packet in the mirrored traffic that meets the multiple data packet characteristics as a first second dialing data packet according to the multiple data packet characteristics set in the first second dialing blocking rule includes: For the data packet feature with the range attribute in the first second dial blocking rule, obtain each segment information of the data packet corresponding to the data packet feature with the range attribute in any data packet in the mirrored traffic; Determine the table entry locator corresponding to the i-th segment information through the range bitmap; the i-th segment information is the segment information corresponding to the i-th segment bit in each segment information of the data packet; According to the entry locator corresponding to the i-th segment of information, determine the next segment to be searched from the data entry; When the next segment is an equally divided interval tree, determining whether the segment information of the next segment of the data packet exists in the equally divided interval tree; If any segment of information of the data packet does not conform to the range-type bitmap or the equally divided interval tree, the data packet is a data packet that does not conform to the first second dial blocking rule; if each segment of information of the data packet conforms to the range-type bitmap and the equally divided interval tree, the data packet is the first data packet that conforms to the first second dial blocking rule.

5. The method according to claim 1, characterized in that Determining a second second dialing data packet that meets the second dialing attack requirement from the second data packets by using the session information of the second data packets includes: Determine, from each of the second data packets, a third data packet that satisfies the second dial attack through the session information of each of the second data packets; The third data packet is verified through the session information of the historical second-dial data packets and the session information of the fourth data packet, and is determined to be the second second-dial data packet after passing the verification; the fourth data packet is the data packet among the second data packets except the third data packet.

6. The method according to claim 5, characterized in that The step of determining a third data packet that satisfies the second dial attack from each of the second data packets by using the session information of each of the second data packets includes: For any characteristic dimension in the session information of each second data packet, determine the first potential energy of each data packet under the characteristic dimension and determine the average potential energy under the characteristic dimension; the characteristic dimension includes at least: session duration, inbound flow size, outbound flow size, number of inbound flow packets, and number of outbound flow packets; the first potential energy is determined according to the negative exponential power of the Euclidean distance between any two characteristic dimensions; the average potential energy is the average of the difference between any two first potential energies; Determine the potential energy distance of each second data packet under each second data packet according to the first potential energy of each second data packet under each characteristic dimension and the average potential energy under each characteristic dimension; For any second data packet, the neighborhood of the second data packet under each second data packet is determined according to the potential energy distance of the second data packet under each second data packet; the local anomaly factor of the second data packet is determined according to the neighborhood of the second data packet under each second data packet; when the local anomaly factor exceeds a set threshold, the second data packet is determined to be a third data packet that meets the requirements of a second dial attack.

7. The method according to claim 6, characterized in that Determining the potential energy distance of each second data packet under each second data packet according to the first potential energy of each second data packet under each characteristic dimension and the average potential energy under each characteristic dimension includes: The potential energy distance under the second data packet is determined by the Euclidean distance from the calibration average potential energy, and the calibration average potential energy is: The calibration average potential energy is determined by calculating the ratio of the difference between the first potential energy and each of the average potential energies to the difference between the maximum first potential energy and the minimum first potential energy.

8. The method according to claim 5, characterized in that The verifying the third data packet through the session information of the historical second dial data packet and the session information of each fourth data packet, and determining the third data packet as the second second dial data packet after the verification, comprises: Determine a first potential energy distance of the third data packet under the historical second dialing data packet and a second potential energy distance of the third data packet under each fourth data packet; If the first potential energy distance is greater than the second potential energy distance, the second data packet is determined to be the third data packet.

9. The method according to any one of claims 1 to 8, characterized in that: The obtaining of the mirrored traffic of the data packet to be detected includes: Obtain mirrored traffic of the data packet to be detected through the aggregation switch; the aggregation switch mirrors the data traffic received by the border core switch; The construction of the blocking message to block the second dial attack traffic includes: A blocking message is constructed and sent directly to the border core switch, and the second dial attack traffic is blocked through the border core switch.

10. The method according to any one of claims 1 to 8, characterized in that: The transport layer protocol is a short connection mode corresponding to the TCP protocol or a long connection mode corresponding to the TCP protocol; The generating, based on the second second dial data packet, a second second dial blocking rule added to the second second dial blocking rule set comprises: If the second second dial data packet is in short connection mode, the source IP of the second second dial data packet is used as the source IP information of the second second dial blocking rule, and the flag data of TCP SYN is set to a valid value and the corresponding mask is used as the flag information of the second second dial blocking rule; If the second second dial data packet is in long connection mode, the source IP of the second second dial data packet is used as the source IP information of the second second dial blocking rule, and the TCP ACK is set to the flag data of the valid value and the corresponding mask as the flag information of the second second dial blocking rule.

11. A device for blocking second dial attack traffic, characterized in that: Suitable for bypass blocking devices including: An acquisition module, used for acquiring the mirrored traffic of the data packet to be detected, wherein the mirrored traffic is obtained by copying the data traffic; A setting module, used to determine the first data packet in the mirrored traffic that meets the multiple data packet characteristics set in the first second dial blocking rule as the first second dial data packet; the first second dial blocking rule is any one in the second dial blocking rule set; A determination module, used to determine, from each second data packet, a second second data packet that meets the second dial attack requirement through session information of each second data packet; each second data packet is a data packet in the mirrored traffic except the first data packet; A generating module is used to generate a second second dial blocking rule added to the second dial blocking rule set based on the second second dial data packet, and to construct a blocking message based on the first second dial data packet and the second second dial data packet to complete the second dial attack traffic blocking.

12. A computer device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the steps of the method according to any one of claims 1 to 10 are implemented when the processor executes the program.

13. A computer-readable storage medium, characterized in that: It stores a computer program executable by a computer device, and when the program is run on the computer device, the computer device executes the steps of any method described in claims 1 to 10.

Images