Attack detection method and device and computer equipment

Abstract

The invention relates to an attack detection method and device and computer equipment. Comprising the following steps: in a first time window period, analyzing a received synchronous message and a received confirmation message, generating a plurality of count values of mapping characteristics, realizing rapid coarse-grained matching of communication messages under a large-flow forwarding plane, and preliminarily screening out suspicious abnormal messages. In a second time window period, aiming at the received current synchronization message, querying a count value of a mapping characteristic of the current synchronization message; determining whether the current synchronous message is an abnormal message or not according to the queried count value; if yes, adding one to the abnormal count value stored in the first node; and accurate matching of the synchronous message is realized. If the sum of the abnormal count value and one is greater than a threshold value, detecting that a synchronous packet storm attack occurs at present; and the network attack can be quickly and efficiently detected. Based on a successive mechanism of the first time window period and the second time window period, each node only stores the feature information of the suspicious message, so that the memory occupation is reduced.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an attack detection method, device and computer equipment. Background Art

[0002] With the development of the Internet era, there are more and more services in cyberspace, which bring convenience to people, but also cause many network security problems that cannot be ignored. There are more and more types and means of DDoS (distributed denial of service attack) attacks on services, and such network security incidents occur from time to time. Sync-Flood (synchronous packet storm) attack is one of the most popular types of DDoS attacks. The attack principle is that the attacker sends a large number of TCP Syn (synchronous) request messages to the target host. After receiving the request, the server uses the listening queue to save the connection and returns the Syn+Ack (synchronous + confirmation) message to the client. Because the attacker's IP (Internet Protocol address) is forged or the attacker deliberately does not send an Ack response message, the server's listening queue will be occupied for a long time until the queue is full, resulting in the server being unable to respond to normal connection requests and unable to provide services normally.

[0003] In this situation, traditional detection methods mainly use source authentication methods: after receiving Syn, the server returns Syn_Ack. If the Ack message returned by the client is detected, the client is considered to be legitimate, and the server adds the client IP to the whitelist. However, the attacker will respond to the Ack packet in a targeted manner in the early stage of the attack, thereby tricking the server into adding the attacker IP to the whitelist, and then conduct a Syn-Flood attack, making the detection method ineffective.

[0004] Some companies have network operation and maintenance personnel regularly audit historical logs and count the historical attacker IP addresses and add them to the blacklist. However, this method is time-consuming and labor-intensive. Even if some automated scripts or programs are used to monitor the connection request logs on the server side, the entire statistical process has low real-time performance, low statistical efficiency, and high memory usage. Usually, a Spark Streaming (stream processing framework) computing platform or a Redis server must be built separately, which requires high computing and memory resources.

[0005] There is another method, which is to store the connection request authentication information in the header sequence number field of the Syn request packet. After receiving the request, the server will first verify the authentication information. If the authentication is passed, it will be added to the server's connection cache queue. Although this method solves the problem of cache queue fullness caused by illegal requests, it puts forward higher requirements on the client request format. It cannot guarantee that all clients support this authentication format, and there is a universal problem. Summary of the invention

[0006] Based on this, it is necessary to provide an attack detection method, device and computer equipment to address the above technical problems, which can quickly and efficiently detect Sync-Flood attacks.

[0007] In a first aspect, the present application provides an attack detection method, comprising:

[0008] During the first time window, the received synchronization message and confirmation message are parsed to generate a plurality of count values ​​of mapping features; the count value is used to record the difference between the number of times the mapping feature is mapped by the synchronization message and the number of times the mapping feature is mapped by the confirmation message;

[0009] In the second time window period, for the received current synchronization message, query the count value of the mapping feature of the current synchronization message;

[0010] According to the count value obtained, determine whether the current synchronization message is an abnormal message;

[0011] If the current synchronization message is an abnormal message, the abnormal count value stored in the first node is incremented by one; the characteristic information corresponding to the first node is consistent with the characteristic information corresponding to the current synchronization message;

[0012] If the abnormal count value after the increment processing is greater than the first set threshold, it is detected that a synchronous packet storm attack is currently occurring.

[0013] In one embodiment, the received synchronization message and confirmation message are parsed to generate count values ​​of multiple mapping features, including:

[0014] For each synchronization message received, analyze the characteristic information of the synchronization message;

[0015] Using m predefined hash functions, characteristic information of the synchronization message is calculated respectively to obtain m first mapping characteristics;

[0016] In a Bloom filter, m first elements corresponding to the m first mapping features are determined; the Bloom filter includes a plurality of elements corresponding one-to-one to the mapping features;

[0017] Add one to the count value stored in the m first elements;

[0018] For each confirmation message received, analyze the characteristic information of the confirmation message;

[0019] Using m hash functions, characteristic information of the confirmation message is calculated respectively to obtain m second mapping characteristics;

[0020] In the Bloom filter, determining m second elements corresponding to the m second mapping features;

[0021] Subtract one from the count value stored in the m second elements;

[0022] The count values ​​stored in a plurality of elements in the Bloom filter are determined as the count values ​​of a plurality of mapping features.

[0023] In one of the embodiments, querying a count value of a mapping feature of a received current synchronization message includes:

[0024] Analyze the characteristic information of the received current synchronization message;

[0025] Using m hash functions, characteristic information of the current synchronization message is calculated respectively to obtain m third mapping characteristics;

[0026] In the Bloom filter, determining m third elements corresponding to the m third mapping features;

[0027] The count values ​​stored in the m third elements are determined as the count values ​​of the mapping features of the current synchronization message.

[0028] In one of the embodiments, determining whether the current synchronization message is an abnormal message according to the queried count value includes:

[0029] Determine whether the count values ​​stored in the m third elements are all greater than a second set threshold;

[0030] If the count values ​​stored in the m third elements are all greater than the second set threshold, the current synchronization message is determined to be an abnormal message;

[0031] If the count value stored in any third element is less than or equal to the second set threshold, it is determined that the synchronization message is not an abnormal message.

[0032] In one embodiment, the method further comprises:

[0033] According to the target mapping feature among the m third mapping features, a corresponding hash bucket is determined in a preset hash table; the preset hash table includes multiple hash buckets, each hash bucket is connected to a lock-free circular queue; the target mapping feature is obtained by calculating the feature information of the current synchronization message using a target hash function, and the target hash function is a specified hash function among the m hash functions;

[0034] The lock-free circular queue corresponding to the hash bucket is traversed to determine the first node corresponding to the current synchronization message; the lock-free circular queue includes multiple nodes, and each node includes feature information and an abnormal count value.

[0035] In one embodiment, the method further comprises:

[0036] If the first node corresponding to the current synchronization message is not found in the lock-free circular queue corresponding to the hash bucket, a first node with an abnormal count value of 0 is newly created in the lock-free circular queue corresponding to the hash bucket according to the characteristic information of the current synchronization message.

[0037] In one embodiment, the method further comprises:

[0038] In the second time window period, for the received current confirmation message, query the count value of the mapping feature of the current confirmation message;

[0039] According to the count value obtained, determine whether the current confirmation message is an abnormal message;

[0040] If the current confirmation message is an abnormal message, the abnormal count value stored in the second node is reduced by one; the characteristic information corresponding to the second node is consistent with the characteristic information corresponding to the current confirmation message.

[0041] In one embodiment, after detecting that a synchronous packet storm attack is currently occurring, the method further includes:

[0042] Determine a protection flag value corresponding to the first node;

[0043] If the protection flag value is the first value, it is determined that the preset protection strategy has been executed;

[0044] If the protection flag value is the second value, the preset protection strategy is executed and the protection flag value is modified to the first value.

[0045] In a second aspect, the present application also provides an attack detection device, including:

[0046] A counting module, used to parse the received synchronization message and confirmation message within the first time window period to generate a count value of a plurality of mapping features; the count value is used to record the difference between the number of times the mapping feature is mapped by the synchronization message and the number of times the mapping feature is mapped by the confirmation message;

[0047] A query module, used for querying the count value of the mapping feature of the current synchronization message received within the second time window period;

[0048] A determination module, used to determine whether the current synchronization message is an abnormal message according to the queried count value;

[0049] An attack detection module is used to increase the abnormal count value stored in the first node by one if the current synchronization message is an abnormal message; the characteristic information corresponding to the first node is consistent with the characteristic information corresponding to the current synchronization message; if the abnormal count value after the increase by one is greater than the first set threshold, it is detected that a synchronization packet storm attack is currently occurring.

[0050] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method described in the first aspect above are implemented.

[0051] The above-mentioned attack detection method, device and computer equipment parse the received synchronization message and confirmation message within the first time window period to generate a plurality of count values ​​of mapping features; the count value is used to record the number of times the mapping feature is mapped by the synchronization message and the difference between the number of times the mapping feature is mapped by the confirmation message; within the second time window period, for the received current synchronization message, query the count value of the mapping feature of the current synchronization message; determine whether the current synchronization message is an abnormal message according to the count value queried; if the current synchronization message is an abnormal message, add one to the abnormal count value stored in the first node; the feature information corresponding to the first node is consistent with the feature information corresponding to the current synchronization message; if the abnormal count value after adding one is greater than the first set threshold, it is detected that the current synchronization packet storm attack is occurring. Through the above-mentioned method, within the first time window period, the rapid coarse-grained matching and statistics of TCP Syn messages under the large-flow forwarding plane are realized, and suspicious abnormal messages are preliminarily screened out. Within the second time window period, the accurate matching of TCP Syn packets is realized based on the abnormal count values ​​stored in each node, and the Sync-Flood attack can be detected quickly and efficiently. Based on the sequence mechanism of the first time window period and the second time window period, each node only stores the characteristic information of suspicious Syn messages, thereby reducing memory usage. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0053] FIG1 is a diagram of an application environment of an attack detection method in one embodiment;

[0054] FIG2 is a schematic diagram of a flow chart of an attack detection method in an embodiment;

[0055] FIG3 is a schematic diagram of a processing flow in a first time window period in one embodiment;

[0056] FIG4 is a schematic diagram of a flow chart of an attack detection method in another embodiment;

[0057] FIG5 is a schematic diagram of a processing flow in a second time window period in one embodiment;

[0058] FIG6 is a block diagram of an attack detection device according to an embodiment;

[0059] FIG. 7 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0061] It is understood that the terms "first", "second", etc. used in this application can be used to describe various elements in this article, but these elements are not limited by these terms. These terms are only used to distinguish a first element from another element. For example, without departing from the scope of this application, a first node can be referred to as a second node, and similarly, a second node can be referred to as a first node. Both the first node and the second node are nodes, but they are not the same node.

[0062] The attack detection method provided in the embodiment of the present application can be applied in the application environment shown in FIG. 1. Among them, several clients 102 communicate with the server 106 through the security device 104, and the security device 104 performs attack detection based on the synchronization message and confirmation message sent by each client 102 in the manner of the embodiment of the present application. Among them, the client 102 can run on various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The head-mounted device can be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server 106 can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0063] In an exemplary embodiment, as shown in FIG. 2 , an attack detection method is provided, which is described by taking the method applied to the security device 104 in FIG. 1 as an example, including:

[0064] Step 202, within the first time window, parse the received synchronization message and confirmation message to generate count values ​​of multiple mapping features; the count values ​​are used to record the difference between the number of times the mapping feature is mapped by the synchronization message and the number of times the mapping feature is mapped by the confirmation message.

[0065] The time window period T is set in advance, and the time window period T is divided into a front sub-time window period t1 (i.e., the first time window period) and a rear sub-time window period t2 (i.e., the second time window period). The synchronization message (i.e., Syn message) and confirmation message (i.e., Ack message) received within the t1 time window period are parsed and mapped respectively, and the difference between the number of times each mapping feature is mapped by the synchronization message and the number of times the mapping feature is mapped by the confirmation message is recorded, and the count values ​​of multiple mapping features are generated.

[0066] It can be understood that the mapping feature refers to the feature obtained by mapping the feature information carried by the synchronization message or the confirmation message according to the set mapping strategy, for example, using a hash function for calculation, and other mapping strategies can also be used, which is not limited in this embodiment. The count value of the mapping feature can be stored using a Bloom filter or other data structure, which is not limited in this embodiment.

[0067] In an optional implementation, synchronization messages and confirmation messages are parsed to determine mapping features of messages from the same source, and a count value of the mapping features is determined based on the number of synchronization messages and confirmation messages received from the same source.

[0068] In an optional implementation, a Bloom filter is used, and for each synchronization message received, several hash functions are used to perform calculations to determine multiple hash values, and the value of each hash value corresponding to the position on the Bloom filter is increased by 1; for each confirmation message received, several hash functions are used to perform calculations to determine multiple hash values, and the value of each hash value corresponding to the position on the Bloom filter is decreased by 1.

[0069] Step 204: within the second time window, query the count value of the mapping feature of the received current synchronization message.

[0070] Wherein, for each synchronization message received within the second time window, based on the result of the preliminary screening in the above steps, the count value of the mapping feature of the current synchronization message is queried.

[0071] Step 206: Determine whether the current synchronization message is an abnormal message according to the queried count value.

[0072] Among them, based on the results of the preliminary screening in the above steps, it is determined whether the current synchronization message is an abnormal message. It can be understood that if the difference between the number of times the mapping feature is mapped by the synchronization message and the number of times the mapping feature is mapped by the confirmation message is greater than a certain value, it indicates that the message sender sends a large number of synchronization messages and a small number of confirmation messages. At this time, the current synchronization message is marked as an abnormal message, that is, a suspicious synchronization message.

[0073] Step 208: If the current synchronization message is an abnormal message, the abnormal count value stored in the first node is incremented by one; the characteristic information corresponding to the first node is consistent with the characteristic information corresponding to the current synchronization message.

[0074] Among them, a target data structure is set in advance, and the target data structure includes multiple nodes, each node includes characteristic information and an abnormal count value, and the initial abnormal count value is 0. If the current synchronization message is an abnormal message, a match is performed in the target data structure according to the characteristic information of the current synchronization message, and the first node with consistent characteristic information is determined. The abnormal count value stored in the first node is increased by 1. It can be understood that the abnormal count value stored in each node increases as the number of times the first node is hit by the synchronization message increases. In an optional implementation method, the abnormal count value stored in each node decreases as the number of times the first node is hit by the confirmed message increases.

[0075] Optionally, the target data structure may be a hash table, the hash table includes multiple hash buckets, each hash bucket is connected to a lock-free circular queue, each lock-free circular queue includes at least one node, and each node includes feature information and an abnormality count value.

[0076] In an optional implementation, before step 202, the method further includes: constructing a Bloom filter and a hash table, and setting a time window period T. The Bloom filter is an array, each element of the array includes a space of a preset size (for example, 2 8-bits), as a hit counter, the initial count is 0, and m hash functions (x1, x2, ..., xi, ..., xm) are defined. The hash function of the hash table selects any one of the m hash functions, such as xi. The hash table includes multiple hash buckets, each hash bucket is connected to a lock-free circular queue, and the pointer of the circular queue is initialized. The time window period T is split into a first time window period and a second time window period, and the split ratio is 1:1.

[0077] Step 210: If the abnormal count value after the addition is greater than the first set threshold, it is detected that a synchronous packet storm attack is currently occurring.

[0078] Among them, the first set threshold is an attack judgment threshold set in advance according to actual conditions, and it is judged whether the updated abnormal count value in the first node is greater than the first set threshold. If so, it is detected that a synchronous packet storm attack (Syn-Flood) is currently occurring.

[0079] In an optional implementation, when the second time window period ends, the next time window period is set, and the Bloom filter and the hash table are rebuilt, and the screening and detection operations from step 202 to step 210 are repeated.

[0080] In the above attack detection method, in the first time window period, fast coarse-grained matching and statistics of TCP Sync messages in the large-flow forwarding plane are realized, and suspicious abnormal messages are preliminarily screened out. In the second time window period, accurate matching of TCP Sync packets is realized based on the abnormal count values ​​stored in each node, which can quickly and efficiently detect Sync-Flood attacks. Based on the sequence mechanism of the first time window period and the second time window period, each node only stores the characteristic information of suspicious Sync messages, reducing memory usage.

[0081] In an exemplary embodiment, the received synchronization message and confirmation message are parsed to generate count values ​​of multiple mapping features, including: for each received synchronization message, parsing the feature information of the synchronization message; using pre-defined m hash functions to calculate the feature information of the synchronization message respectively to obtain m first mapping features; in a Bloom filter, determining m first elements corresponding to the m first mapping features; the Bloom filter includes a number of elements corresponding to the mapping features one by one; adding one to the count values ​​stored in the m first elements; for each received confirmation message, parsing the feature information of the confirmation message; using m hash functions to calculate the feature information of the confirmation message respectively to obtain m second mapping features; in the Bloom filter, determining m second elements corresponding to the m second mapping features; subtracting one from the count values ​​stored in the m second elements; and determining the count values ​​stored in a number of elements in the Bloom filter as the count values ​​of multiple mapping features.

[0082] The characteristic information includes source IP, source MAC (Media Access Control Address, Media Access Control Address) address, destination IP, destination MAC address, destination port, message header data (4-bit header length), and other fields can also be set according to specific circumstances, which is not limited in this embodiment. During the first time window period, for the received synchronization message, the characteristic information of the synchronization message is used as input, and m hash values, i.e., m first mapping features, are calculated according to the m hash functions corresponding to the Bloom filter, and the values ​​of the elements of the m first mapping features on the Bloom filter are incremented by one. In an optional implementation method, the counter of the Bloom filter occupies 2 bytes, and the counting range of the count value is 0-65535. If the value of the first element corresponding to a first mapping feature is 65535, the count value is maintained and no longer incremented.

[0083] During the first time window, for the received confirmation message, the characteristic information of the confirmation message is used as input, and m hash values, i.e., m second mapping features, are calculated according to the m hash functions corresponding to the Bloom filter, and the values ​​of the elements of the m second mapping features on the Bloom filter are reduced by 1. It can be understood that if the value of the second element corresponding to a second mapping feature is 0, the count value is maintained and no longer reduced by 1.

[0084] After the first time window period ends, the Bloom filter stops counting, and the count values ​​stored in a number of elements in the Bloom filter are determined as the count values ​​of the plurality of mapping features.

[0085] Since normal client requests will also send out synchronous SYN packets, a mechanism of accumulating SYN packets and decreasing confirmation packets is adopted to exclude normal client requests and improve the accuracy of attack detection. Bloom filters are used to face TCP SYN packets in large-volume forwarding planes, which can achieve fast and coarse-grained screening of suspicious SYN-Flood packets and occupy less memory.

[0086] In an optional implementation, referring to FIG. 3 , the screening operation in the first time window period includes the following steps: 1. Entering the first time window period, the message parsing module performs message parsing. If it is determined to be a TCP Syn message, the characteristic information of the message is parsed, such as source IP, source MAC address, destination IP, destination MAC, destination port, 4-bit header length, etc. These characteristic information are used as input, and m hash values ​​are calculated according to the m hash functions of the Bloom filter, and the values ​​of the hash values ​​corresponding to the positions on the Bloom filter are added by 1. The counting range is 0-65535. If the count value is already 65535, the count value is kept and no longer added by 1.

[0087] 2. The message parsing module filters out the TCP Ack message, parses the characteristic information of the message, takes these values ​​as input, calculates m hash values ​​according to the m hash functions of the Bloom filter, and then subtracts 1 from the value of each hash value corresponding to the position on the Bloom filter. If the count value is already 0, the count value is kept and no longer reduced by 1.

[0088] 3. When the first time window ends, the Bloom filter stops counting.

[0089] It is understandable that, since the Bloom filter can perform efficient query and insertion, the above operation can quickly count suspicious Syn messages with a large number of requests. In addition, each element position of the Bloom filter only occupies 2 bytes, which can save more memory space than other search and insertion algorithms. The accumulation of TCP syn messages and the decrement of TCP Ack messages exclude normal client requests to a certain extent, reducing the false alarm rate. Although the Bloom filter itself has a false positive rate, some normal requests will also hash to the same position as the suspicious Syn message, resulting in a larger counter value. However, according to the false positive rate formula, when the number of known hash functions and the length of the Bloom filter are fixed, the more elements inserted, the higher the false positive rate, and the number of elements is positively correlated with the time window period T. The false positive rate of the Bloom filter can be reduced by adjusting the size of the time window period T and the length of the Bloom filter.

[0090] In an exemplary embodiment, for a received current synchronization message, a count value of a mapping feature of the current synchronization message is queried, including: for the received current synchronization message, parsing feature information of the current synchronization message; using m hash functions to respectively calculate the feature information of the current synchronization message to obtain m third mapping features; in a Bloom filter, determining m third elements corresponding to the m third mapping features; and determining the count values ​​stored in the m third elements as the count values ​​of the mapping features of the current synchronization message.

[0091] Among them, based on the same mapping method, the characteristic information of the current synchronization message is extracted, such as source IP, source MAC address, destination IP, destination MAC, destination port, 4-bit header length, etc., and these characteristic information are used as input, and m hash values ​​are calculated according to the m hash functions of the Bloom filter, that is, m third mapping features, and the values ​​of the elements of the m third mapping features on the Bloom filter are obtained, which is the count value of the mapping features of the current synchronization message.

[0092] In an exemplary embodiment, step 206 includes: determining whether the count values ​​stored in the m third elements are all greater than the second set threshold; if the count values ​​stored in the m third elements are all greater than the second set threshold, determining that the current synchronization message is an abnormal message; if the count value stored in any third element is less than or equal to the second set threshold, determining that the synchronization message is not an abnormal message.

[0093] Among them, the second set threshold is an abnormal judgment threshold set in advance according to the actual situation. If the values ​​of the elements of the m third mapping features on the Bloom filter are all greater than the second set threshold, the current synchronization message is considered to be an abnormal message, that is, a suspicious Syn-Flood message. Because the false positive rate has a false alarm situation, this embodiment is first marked as an abnormal message, and then an accurate match is performed later. If there is a count value stored in any third element that is less than or equal to the second set threshold, the current synchronization message is considered not to be a suspicious Syn-Flood message.

[0094] In an exemplary embodiment, the method also includes: determining a corresponding hash bucket in a preset hash table according to a target mapping feature among m third mapping features; the preset hash table includes multiple hash buckets, each hash bucket is connected to a lock-free circular queue; the target mapping feature is obtained by calculating characteristic information of the current synchronization message using a target hash function, and the target hash function is a specified hash function among the m hash functions; traversing the lock-free circular queue corresponding to the hash bucket to determine the first node corresponding to the current synchronization message; the lock-free circular queue includes multiple nodes, each node includes characteristic information and an abnormal count value.

[0095] Among them, it is assumed that the m hash functions defined in advance are (x1, x2, …, xi, …, xm), and the xi hash function is designated as the target hash function, which is the function corresponding to the preset hash table. Since the previous steps have calculated m third mapping features, and the preset hash table uses one of the hash functions, there is no need to repeat the calculation here. For the current synchronization message, using the target mapping feature, in the lock-free circular queue corresponding to the hash bucket, determine the first node whose feature information is consistent with the feature information of the current synchronization message, and add one to the abnormal count value of the first node.

[0096] In an optional implementation, referring to FIG. 4 , the security device includes: a message parsing module, a Bloom filter, and a lock-free circular queue hash table. The message parsing module is used to parse the received synchronization message and confirmation message. During the first time window, preliminary screening is performed through the Bloom filter. During the second time window, the Bloom filter is queried, and attack detection is performed through the lock-free circular queue hash table. According to the detection result, it is determined whether to intercept, alarm or release the current message.

[0097] It is understandable that memory should be applied for each node of the lock-free ring queue in advance to prevent frequent memory application and release. And because the lock-free ring queue is lock-free, IO-free (input / output), and zero-copy, inserting and deleting data is just the movement of the pointer. The hash table based on the lock-free ring queue can achieve efficient detection of Syn-Flood packets. Based on the first time window period and the second time window period, segmented screening and detection, only a small number of suspicious packets will be stored in the hash table for counting, reducing the memory usage of the entire hash table.

[0098] In an exemplary embodiment, the method further includes: if the first node corresponding to the current synchronization message is not found in the lock-free circular queue corresponding to the hash bucket, then, based on the characteristic information of the current synchronization message, a new first node with an abnormal count value of 0 is created in the lock-free circular queue corresponding to the hash bucket.

[0099] If no node with the same characteristic information as the current synchronization message is found in the lock-free circular queue, a new node is created, the characteristic information of the current synchronization message is saved in it, and then queued in the lock-free circular queue.

[0100] In an exemplary embodiment, the method also includes: within the second time window period, for the current confirmation message received, querying the count value of the mapping feature of the current confirmation message; determining whether the current confirmation message is an abnormal message based on the queried count value; if the current confirmation message is an abnormal message, subtracting one from the abnormal count value stored in the second node; the feature information corresponding to the second node is consistent with the feature information corresponding to the current confirmation message.

[0101] Among them, when the false positive rate is controllable, a small number of normal client Syn packet requests may be misjudged as suspicious. During the second time window, for the current confirmation message received, the count value of its mapping feature is also queried. If the difference between the number of times the mapping feature is mapped by the synchronization message and the number of times the mapping feature is mapped by the confirmation message is greater than a certain value, it indicates that the message sender sends a large number of synchronization messages and a small number of confirmation messages. At this time, the current confirmation message is marked as an abnormal message.

[0102] A target data structure is set in advance, and the target data structure includes multiple nodes, each node includes characteristic information and an abnormal count value, and the initial abnormal count value is 0. If the current confirmation message is an abnormal message, a match is performed in the target data structure according to the characteristic information of the current confirmation message, and a second node with consistent characteristic information is determined. The abnormal count value stored in the second node is reduced by 1. It can be understood that if the abnormal count value stored in the second node is already 0, the original value is maintained; if the second node is not matched, it is directly returned without the need for a reduction process.

[0103] In this way, the influence of the initial screening errors on the attack detection results can be avoided to a certain extent, thereby improving the accuracy of attack detection.

[0104] In an optional implementation, for the received current confirmation message, querying the count value of the mapping feature of the current confirmation message includes: parsing the feature information of the current confirmation message; using m hash functions to calculate the feature information of the current confirmation message respectively to obtain m fourth mapping features; determining m fourth elements corresponding to the m fourth mapping features in the Bloom filter; and determining the count value stored in the m fourth elements as the count value of the mapping feature of the current confirmation message. The specific processing method refers to the aforementioned explanation of the current synchronization message, which will not be repeated here.

[0105] In an optional implementation, the method further includes: determining a corresponding hash bucket in a preset hash table according to a target mapping feature among the m fourth mapping features; traversing a lock-free circular queue corresponding to the hash bucket to determine a second node corresponding to the current confirmation message. The specific processing method refers to the aforementioned explanation of the first node and will not be repeated here.

[0106] In an exemplary embodiment, after step 210, the method further includes: determining a protection flag value corresponding to the first node; if the protection flag value is a first value, determining that a preset protection strategy has been executed; if the protection flag value is a second value, executing the preset protection strategy and modifying the protection flag value to the first value.

[0107] Among them, each node corresponds to a protection flag value (for example, a flag value), and the protection flag value is a status identifier used to indicate whether the protection measures have been implemented, wherein the first value (for example, true) represents that the protection measures have been implemented, and the second value (false) represents that the protection measures have not been implemented. If the protection flag value is the first value, there is no need to execute the preset protection strategy. If the protection flag value is the second value, the preset protection strategy is executed, and the protection flag value is modified to the first value. For subsequent synchronization messages that hit the first node, there is no need to execute the preset protection strategy. The preset protection strategy can be to intercept messages or send alarm information, etc.

[0108] In an optional implementation, referring to FIG5 , the detection operation in the second time window period includes the following steps: 1. The Syn-Flood attack is continuous in the T time window. When entering the second time window period, the message parsing module performs message parsing. If a TCP Syn message is received, the Bloom filter is queried first, and m positions are obtained through hash calculation. If the count value of each of the m positions in the Bloom filter is greater than M (the second set threshold), the TCP Syn message is considered to be a suspicious Syn-Flood message and is marked as an abnormal message; if the count value of one of the m positions is less than or equal to M, it is considered not to be a suspicious Syn-Flood message and is returned directly.

[0109] 2. According to the characteristic information of the suspicious Syn-Flood message, the lock-free circular queue corresponding to the hash bucket in the hash table is calculated according to the hash value. The hash function corresponding to the hash table is one of the m hash functions of the previous Bloom filter. When querying the hash table, the hash value does not need to be calculated repeatedly. Traverse the nodes in the lock-free circular queue. Each node contains characteristic information, count value and protection flag value. If the characteristic information of the suspicious Syn-Flood message is the same as the characteristic information of the node, add 1 to the count value of the node. If no node with the same characteristic information is found, create a new node and save the characteristic information of the suspicious Syn-Flood message into it, and queue it into the lock-free circular queue.

[0110] 3. If the Ack message is parsed, the lock-free circular queue of the hash bucket is searched in the same way. If a node with the same feature information is found, the count value of the node is reduced by 1. If the count value is already 0, the original value is retained. If not found, it is returned directly.

[0111] 4. Define a threshold N (i.e., the first set threshold). For suspicious Syn-Flood messages, if the count value of the node with the same characteristic information is increased by 1 and is greater than N, it is considered that a Syn-Flood attack has been detected. According to the protection flag value of the node, determine whether an alarm has been sent or intercepted. If the protection flag value is true, it means that an alarm or interception has been sent, and the subsequent Syn packets that hit this node will no longer send messages; if it is false, an alarm or interception message is sent, and then the value of the protection flag value is set to True;

[0112] 5. After the second time window period ends, the Bloom filter and hash table are rebuilt, and the next time window period T is entered to continue screening and detection.

[0113] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0114] Based on the same inventive concept, the embodiment of the present application also provides an attack detection device for implementing the above-mentioned attack detection method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in one or more attack detection device embodiments provided below can refer to the limitations of the attack detection method above, and will not be repeated here.

[0115] In an exemplary embodiment, as shown in FIG6 , an attack detection device is provided, including:

[0116] The counting module 602 is used to parse the received synchronization messages and confirmation messages within the first time window to generate count values ​​of multiple mapping features; the count values ​​are used to record the difference between the number of times the mapping feature is mapped by the synchronization message and the number of times the mapping feature is mapped by the confirmation message.

[0117] The query module 604 is used to query the count value of the mapping feature of the current synchronization message received within the second time window.

[0118] A determination module 606, configured to determine whether the current synchronization message is an abnormal message according to the queried count value;

[0119] The attack detection module 608 is used to add one to the abnormal count value stored in the first node if the current synchronization message is an abnormal message; the characteristic information corresponding to the first node is consistent with the characteristic information corresponding to the current synchronization message; if the abnormal count value after the addition is greater than the first set threshold, it is detected that a synchronization packet storm attack is currently occurring.

[0120] In the above attack detection device, within the first time window period, fast coarse-grained matching and statistics of TCP Syn messages in the large-flow forwarding plane are realized, and suspicious abnormal messages are preliminarily screened out. Within the second time window period, accurate matching of TCP Syn packets is realized based on the abnormal count values ​​stored in each node, and Sync-Flood attacks can be detected quickly and efficiently. Based on the sequence mechanism of the first time window period and the second time window period, each node only stores the characteristic information of suspicious Syn messages, reducing memory usage.

[0121] In an exemplary embodiment, for each synchronization message received, the characteristic information of the synchronization message is parsed; the characteristic information of the synchronization message is calculated using m pre-defined hash functions to obtain m first mapping features; in a Bloom filter, m first elements corresponding to the m first mapping features are determined; the Bloom filter includes a number of elements corresponding to the mapping features one by one; the count values ​​stored in the m first elements are incremented by one; for each confirmation message received, the characteristic information of the confirmation message is parsed; the characteristic information of the confirmation message is calculated using m hash functions to obtain m second mapping features; in the Bloom filter, m second elements corresponding to the m second mapping features are determined; the count values ​​stored in the m second elements are decremented by one; the count values ​​stored in a number of elements in the Bloom filter are determined as count values ​​of multiple mapping features.

[0122] In an exemplary embodiment, for a received current synchronization message, characteristic information of the current synchronization message is parsed; m hash functions are used to calculate the characteristic information of the current synchronization message to obtain m third mapping features; in a Bloom filter, m third elements corresponding to the m third mapping features are determined; and the count values ​​stored in the m third elements are determined as the count values ​​of the mapping features of the current synchronization message.

[0123] In an exemplary embodiment, it is determined whether the count values ​​stored in the m third elements are all greater than the second set threshold; if the count values ​​stored in the m third elements are all greater than the second set threshold, it is determined that the current synchronization message is an abnormal message; if the count value stored in any third element is less than or equal to the second set threshold, it is determined that the synchronization message is not an abnormal message.

[0124] In an exemplary embodiment, according to the target mapping feature among the m third mapping features, a corresponding hash bucket is determined in a preset hash table; the preset hash table includes multiple hash buckets, each hash bucket is connected to a lock-free circular queue; the target mapping feature is obtained by calculating the characteristic information of the current synchronization message using the target hash function, and the target hash function is a specified hash function among the m hash functions; the lock-free circular queue corresponding to the hash bucket is traversed to determine the first node corresponding to the current synchronization message; the lock-free circular queue includes multiple nodes, each node includes characteristic information and an abnormal count value.

[0125] In an exemplary embodiment, if the first node corresponding to the current synchronization message is not found in the lock-free circular queue corresponding to the hash bucket, a first node with an abnormal count value of 0 is newly created in the lock-free circular queue corresponding to the hash bucket according to the characteristic information of the current synchronization message.

[0126] In an exemplary embodiment, within the second time window period, for the current confirmation message received, the count value of the mapping feature of the current confirmation message is queried; based on the queried count value, it is determined whether the current confirmation message is an abnormal message; if the current confirmation message is an abnormal message, the abnormal count value stored in the second node is reduced by one; the feature information corresponding to the second node is consistent with the feature information corresponding to the current confirmation message.

[0127] In an exemplary embodiment, a protection flag value corresponding to the first node is determined; if the protection flag value is a first value, it is determined that a preset protection strategy has been executed; if the protection flag value is a second value, the preset protection strategy is executed and the protection flag value is modified to the first value.

[0128] Each module in the above attack detection device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0129] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG7. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, an attack detection method is implemented.

[0130] Those skilled in the art will understand that the structure shown in FIG. 7 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0131] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the following steps when executing the computer program: within a first time window period, the received synchronization message and confirmation message are parsed to generate a plurality of count values ​​of mapping features; the count value is used to record the number of times the mapping feature is mapped by the synchronization message and the difference between the number of times the mapping feature is mapped by the confirmation message; within a second time window period, for the current synchronization message received, the count value of the mapping feature of the current synchronization message is queried; based on the queried count value, it is determined whether the current synchronization message is an abnormal message; if the current synchronization message is an abnormal message, the abnormal count value stored in the first node is incremented by one; the feature information corresponding to the first node is consistent with the feature information corresponding to the current synchronization message; if the abnormal count value after incrementing by one is greater than the first set threshold, it is detected that a synchronization packet storm attack is currently occurring.

[0132] In one embodiment, when the processor executes the computer program, the following steps are also implemented: for each synchronization message received, the characteristic information of the synchronization message is parsed; using pre-defined m hash functions, the characteristic information of the synchronization message is calculated respectively to obtain m first mapping features; in the Bloom filter, m first elements corresponding to the m first mapping features are determined; the Bloom filter includes a number of elements corresponding to the mapping features one by one; the count values ​​stored in the m first elements are incremented by one; for each confirmation message received, the characteristic information of the confirmation message is parsed; using m hash functions, the characteristic information of the confirmation message is calculated respectively to obtain m second mapping features; in the Bloom filter, m second elements corresponding to the m second mapping features are determined; the count values ​​stored in the m second elements are decremented by one; the count values ​​stored in a number of elements in the Bloom filter are determined as the count values ​​of multiple mapping features.

[0133] In one embodiment, when the processor executes the computer program, the following steps are also implemented: for the received current synchronization message, the characteristic information of the current synchronization message is parsed; using m hash functions, the characteristic information of the current synchronization message is calculated respectively to obtain m third mapping features; in the Bloom filter, m third elements corresponding to the m third mapping features are determined; and the count values ​​stored in the m third elements are determined as the count values ​​of the mapping features of the current synchronization message.

[0134] In one embodiment, when the processor executes the computer program, the following steps are also implemented: determining whether the count values ​​stored in the m third elements are all greater than the second set threshold; if the count values ​​stored in the m third elements are all greater than the second set threshold, determining that the current synchronization message is an abnormal message; if the count value stored in any third element is less than or equal to the second set threshold, determining that the synchronization message is not an abnormal message.

[0135] In one embodiment, when the processor executes the computer program, the following steps are also implemented: according to the target mapping feature among the m third mapping features, the corresponding hash bucket is determined in the preset hash table; the preset hash table includes multiple hash buckets, each hash bucket is connected to a lock-free circular queue; the target mapping feature is obtained by calculating the feature information of the current synchronization message using the target hash function, and the target hash function is a specified hash function among the m hash functions; the lock-free circular queue corresponding to the hash bucket is traversed to determine the first node corresponding to the current synchronization message; the lock-free circular queue includes multiple nodes, each node includes feature information and an abnormal count value.

[0136] In one embodiment, the processor further implements the following steps when executing the computer program: if the first node corresponding to the current synchronization message is not found in the lock-free circular queue corresponding to the hash bucket, then based on the characteristic information of the current synchronization message, a first node with an abnormal count value of 0 is newly created in the lock-free circular queue corresponding to the hash bucket.

[0137] In one embodiment, when the processor executes the computer program, the following steps are also implemented: within the second time window period, for the current confirmation message received, the count value of the mapping feature of the current confirmation message is queried; based on the queried count value, it is determined whether the current confirmation message is an abnormal message; if the current confirmation message is an abnormal message, the abnormal count value stored in the second node is reduced by one; the feature information corresponding to the second node is consistent with the feature information corresponding to the current confirmation message.

[0138] In one embodiment, when the processor executes the computer program, the following steps are also implemented: determining the protection flag value corresponding to the first node; if the protection flag value is a first value, determining that a preset protection strategy has been executed; if the protection flag value is a second value, executing the preset protection strategy and modifying the protection flag value to the first value.

[0139] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0140] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0141] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0142] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An attack detection method, characterized in that: The method comprises: During the first time window, the received synchronization message and confirmation message are parsed to generate a plurality of count values ​​of mapping features; the count values ​​are used to record the difference between the number of times the mapping feature is mapped by the synchronization message and the number of times the mapping feature is mapped by the confirmation message; In the second time window period, for the received current synchronization message, query the count value of the mapping feature of the current synchronization message; Determine whether the current synchronization message is an abnormal message according to the queried count value; If the current synchronization message is an abnormal message, the abnormal count value stored in the first node is incremented by one; the characteristic information corresponding to the first node is consistent with the characteristic information corresponding to the current synchronization message; If the abnormal count value after the increment processing is greater than the first set threshold, it is detected that a synchronous packet storm attack is currently occurring.

2. The method according to claim 1, characterized in that The received synchronization message and confirmation message are parsed to generate count values ​​of multiple mapping features, including: For each synchronization message received, analyzing characteristic information of the synchronization message; Using m predefined hash functions, characteristic information of the synchronization message is calculated respectively to obtain m first mapping characteristics; In a Bloom filter, determining m first elements corresponding to the m first mapping features; the Bloom filter includes a plurality of elements corresponding one-to-one to the mapping features; Adding one to the count values ​​stored in the m first elements; For each confirmation message received, analyzing characteristic information of the confirmation message; Using the m hash functions, respectively calculate the characteristic information of the confirmation message to obtain m second mapping characteristics; In the Bloom filter, determining m second elements corresponding to the m second mapping features; Subtract one from the count values ​​stored in the m second elements; The count values ​​stored in a plurality of elements in the Bloom filter are determined as the count values ​​of a plurality of mapping features.

3. The method according to claim 2, characterized in that The querying, for the received current synchronization message, a count value of a mapping feature of the current synchronization message includes: For the received current synchronization message, analyzing the characteristic information of the current synchronization message; Using the m hash functions, respectively calculate the characteristic information of the current synchronization message to obtain m third mapping characteristics; In the Bloom filter, determining m third elements corresponding to the m third mapping features; The count values ​​stored in the m third elements are determined as the count values ​​of the mapping features of the current synchronization message.

4. The method according to claim 3, characterized in that The determining, according to the queried count value, whether the current synchronization message is an abnormal message includes: Determine whether the count values ​​stored in the m third elements are all greater than a second set threshold; If the count values ​​stored in the m third elements are all greater than the second set threshold, determining that the current synchronization message is an abnormal message; If the count value stored in any third element is less than or equal to the second set threshold, it is determined that the synchronization message is not an abnormal message.

5. The method according to claim 3, characterized in that: The method further comprises: According to the target mapping feature among the m third mapping features, a corresponding hash bucket is determined in a preset hash table; the preset hash table includes a plurality of hash buckets, each of which is connected to a lock-free circular queue; the target mapping feature is obtained by calculating the feature information of the current synchronization message using a target hash function, and the target hash function is a specified hash function among the m hash functions; The lock-free circular queue corresponding to the hash bucket is traversed to determine the first node corresponding to the current synchronization message; the lock-free circular queue includes a plurality of nodes, each of which includes feature information and an abnormal count value.

6. The method according to claim 5, characterized in that The method further comprises: If the first node corresponding to the current synchronization message is not found in the lock-free circular queue corresponding to the hash bucket, a first node with an abnormal count value of 0 is newly created in the lock-free circular queue corresponding to the hash bucket according to the characteristic information of the current synchronization message.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: Within the second time window, querying the count value of the mapping feature of the received current confirmation message; Determine whether the current confirmation message is an abnormal message according to the queried count value; If the current confirmation message is an abnormal message, the abnormal count value stored in the second node is reduced by one; the characteristic information corresponding to the second node is consistent with the characteristic information corresponding to the current confirmation message.

8. The method according to any one of claims 1 to 6, characterized in that After detecting that a synchronous packet storm attack is currently occurring, the method further includes: Determine a protection flag value corresponding to the first node; If the protection flag value is the first value, it is determined that the preset protection strategy has been executed; If the protection flag value is the second value, the preset protection strategy is executed and the protection flag value is modified to the first value.

9. An attack detection device, characterized in that: The device comprises: A counting module, used to parse the received synchronization message and confirmation message within the first time window period to generate a plurality of count values ​​of mapping features; the count values ​​are used to record the difference between the number of times the mapping feature is mapped by the synchronization message and the number of times the mapping feature is mapped by the confirmation message; A query module, used for querying the count value of the mapping feature of the current synchronization message received within the second time window period; A determination module, used to determine whether the current synchronization message is an abnormal message according to the queried count value; An attack detection module is used to increase the abnormal count value stored in the first node by one if the current synchronization message is an abnormal message; the characteristic information corresponding to the first node is consistent with the characteristic information corresponding to the current synchronization message; if the abnormal count value after the increase by one is greater than the first set threshold, it is detected that a synchronization packet storm attack is currently occurring.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

Images