Gateway anti-attack method and device, gateway equipment and storage medium
By receiving messages in the home gateway for connection tracking, and determining the anti -attack package rules according to the preparatory list, the attack packet directly discards the problem of paralysis of the gateway when facing the DOS attack, realizing the rapid identification attack and improving performance performance Effect.
Patent Information
- Application Number
- CN202310929944.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-07-26
- Publication Date
- 2025-01-28
AI Technical Summary
When facing DoS attacks, the existing technology relies on the Linux kernel for anti-attack processing, resulting in the gateway being paralyzed during large traffic attacks and unable to provide normal network services.
Through the connection tracking of the receiving packet, the connection tracking information is obtained, and the connection tracking entry that meets the counting conditions in the anti -attack preparation list determines the anti -attack package rules, directly discard the attack message that meets the rules Essence
A rapid identification attack based on connection tracking is achieved, avoiding the linux kernel resources occupying a large number of gateways, preventing the gateway from paralysis, and ensuring the normal operation and performance improvement of the gateway.
Smart Images
Figure CN119382912A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of home gateway firewalls, and in particular to a gateway anti-attack method, device, gateway equipment and storage medium. Background Art
[0002] The Internet is full of various Denial of Service (DoS) attacks, the most common of which are TCP-SYN Flood, UDP Flood and ICMP Flood.
[0003] A standard Transmission Control Protocol (TCP) connection has a three-way handshake process, while TCP-SYN Flood only has the first two steps in its implementation. In this way, the service provider will wait for a certain period of time to receive the ACK message from the requester. Since the available TCP connections for the home gateway are limited, if the malicious attacker sends such connection requests quickly and continuously, the gateway's available TCP connection queue will soon be blocked, the CPU and available bandwidth will drop sharply, and normal network services cannot be provided, resulting in a denial of service.
[0004] UDP Flood is a traffic-based DoS attack that is becoming increasingly rampant. Since the User Datagram Protocol (UDP) is a connectionless service, attackers can send a large number of small UDP packets with forged source IP addresses. Under normal application conditions, the bidirectional traffic of UDP packets will be basically equal, and the size and content are random and vary greatly. In the case of UDP Flood, a large number of UDP packets targeting the same target IP appear on one side, and the content and size are relatively fixed, causing the gateway's UDP resources to be consumed in large quantities at the same time, or even exhausted, and unable to provide normal network services.
[0005] ICMP Flood sends a large number of ping packets to the destination gateway in a short period of time. The gateway needs to return a large number of ping responses, which consumes a large amount of gateway resources. When the gateway resources are exhausted, it will be paralyzed or unable to provide other services.
[0006] Home gateway products based on the Linux kernel mainly rely on the anti-attack method built into the Linux kernel. This method requires all messages to be transmitted to the Linux kernel for identification and processing. When a large-volume attack occurs, the gateway will be paralyzed. Summary of the invention
[0007] In order to solve the above technical problems or at least partially solve the above technical problems, the present application provides a gateway anti-attack method, apparatus, gateway device and storage medium.
[0008] In a first aspect, the present application provides a gateway attack protection method, which is applied to a gateway device, and the method includes:
[0009] receiving a first message, performing connection tracking on the first message, and obtaining connection tracking information;
[0010] In the case where the connection tracking information meets the anti-attack packet loss rule, the first message is discarded, wherein the anti-attack packet loss rule is determined according to the connection tracking entries that meet the counting condition in the anti-attack preliminary list.
[0011] Optionally, the anti-attack packet loss rule is preset in a hardware driver of the gateway device.
[0012] Optionally, the method further comprises:
[0013] Adding a connection tracking entry containing the connection tracking information to the attack prevention preliminary list;
[0014] Counting a first number of connection tracking entries having the same first target feature within a preset period in the attack prevention preliminary list;
[0015] When the first number is greater than or equal to a first preset threshold, the first target feature is written into the anti-attack packet loss rule.
[0016] Optionally, the method further comprises:
[0017] When the first number is smaller than the first preset threshold, the first target feature is deleted from the anti-attack packet loss rule.
[0018] Optionally, the method further comprises:
[0019] Adding a connection tracking entry containing the connection tracking information to the attack prevention preliminary list;
[0020] Counting a second number of connection tracking entries in the anti-attack preliminary list that have the same second target feature within a preset period, where the second target feature is different from the first target feature;
[0021] When the second number is greater than or equal to a second preset threshold, the second target feature is written into the anti-attack packet loss rule.
[0022] Optionally, the method further comprises:
[0023] When the second number is less than the second preset threshold, the second target feature is deleted from the anti-attack packet loss rule.
[0024] Optionally, the method further comprises:
[0025] In a case where it is determined based on the connection tracking information that the connection tracking state of the first message is the target tracking state, a step of adding a connection tracking entry containing the connection tracking information to the attack prevention preliminary list is performed.
[0026] In a second aspect, the present application provides a gateway anti-attack device, which is applied to a gateway device, and the device includes:
[0027] A receiving module, configured to receive a first message, perform connection tracking on the first message, and obtain connection tracking information;
[0028] A discarding module is used to discard the first message when the connection tracking information meets the anti-attack packet loss rule, wherein the anti-attack packet loss rule is determined based on the connection tracking entries that meet the counting conditions in the anti-attack preliminary list.
[0029] Optionally, the anti-attack packet loss rule is preset in a hardware driver of the gateway device.
[0030] Optionally, the device further comprises:
[0031] A first adding module, configured to add a connection tracking entry containing the connection tracking information to the anti-attack preliminary list;
[0032] A first statistical module, used to count a first number of connection tracking entries having the same first target feature within a preset period in the anti-attack preliminary list;
[0033] The first writing module is used to write the first target feature into the anti-attack packet loss rule when the first number is greater than or equal to a first preset threshold.
[0034] Optionally, the device further comprises:
[0035] A first deleting module is configured to delete the first target feature from the anti-attack packet loss rule when the first number is less than the first preset threshold.
[0036] Optionally, the device further comprises:
[0037] A second adding module, configured to add a connection tracking entry containing the connection tracking information to the anti-attack preliminary list;
[0038] A second statistical module, configured to count a second number of connection tracking entries in the anti-attack preliminary list having the same second target feature within a preset period, where the second target feature is different from the first target feature;
[0039] A second writing module is configured to write the second target feature into the anti-attack packet loss rule when the second number is greater than or equal to a second preset threshold.
[0040] Optionally, the device further comprises:
[0041] A second deleting module is configured to delete the second target feature from the anti-attack packet loss rule when the second number is less than the second preset threshold.
[0042] Optionally, the device further comprises:
[0043] An execution module is used to execute the step of adding a connection tracking entry containing the connection tracking information to the anti-attack preliminary list when it is determined based on the connection tracking information that the connection tracking state of the first message is a target tracking state.
[0044] In a third aspect, the present application provides a gateway device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;
[0045] Memory, used to store computer programs;
[0046] The processor is used to implement any gateway attack protection method described in the first aspect when executing the program stored in the memory.
[0047] In a fourth aspect, the present application provides a computer-readable storage medium, on which a program of a gateway anti-attack method is stored. When the program of the gateway anti-attack method is executed by a processor, the steps of the gateway anti-attack method described in any one of the first aspects are implemented.
[0048] The above technical solution provided by the embodiment of the present application has the following advantages compared with the prior art:
[0049] The method provided in the embodiment of the present application determines an anti-attack packet loss rule according to a connection tracking entry that meets the counting conditions, and then uses the anti-attack packet loss rule to verify the connection tracking information of the first message. When the connection tracking information of the first message meets the anti-attack packet loss rule, the first message is considered to be an attack message, and the first message is directly discarded, thereby realizing rapid identification of attacks based on connection tracking, without the need to forward all messages to the Linux kernel of the gateway for anti-attack processing, avoiding the situation where the attack occupies a large amount of Linux kernel resources of the gateway and causes the gateway to be paralyzed, ensuring the normal operation of the gateway, and improving the performance of the gateway. BRIEF DESCRIPTION OF THE DRAWINGS
[0050] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.
[0051] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.
[0052] Figure 1 A schematic diagram of a networking architecture provided for an embodiment of the present application;
[0053] Figure 2 A flow chart of a gateway attack protection method provided in an embodiment of the present application;
[0054] Figure 3 An internal structure diagram of a gateway device provided in an embodiment of the present application;
[0055] Figure 4 A flowchart of another gateway anti-attack method provided in an embodiment of the present application;
[0056] Figure 5 A structural diagram of a gateway anti-attack device provided in an embodiment of the present application;
[0057] Figure 6 A structural diagram of a gateway device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0058] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.
[0059] The anti-attack function of the home gateway is an important part of the home gateway security. Based on the anti-attack means of the Linux kernel itself, all messages need to be transmitted to the Linux kernel for identification and processing. When there is a large-volume attack, it will occupy a large amount of CPU resources, causing the gateway to be paralyzed and affecting the normal business. To this end, the embodiments of the present application provide a gateway anti-attack method, device, gateway device and storage medium. The embodiments of the present application can help the home gateway resist the attack without affecting the normal business when there is a large-volume DoS attack in the network. The network architecture diagram of the embodiments of the present application is as follows: Figure 1 shown.
[0060] The present application embodiment provides a gateway anti-attack method, which is applied to a gateway device, such as Figure 2 As shown, the method includes:
[0061] Step S101, receiving a first message, performing connection tracking on the first message, and obtaining connection tracking information;
[0062] In an embodiment of the present application, the first message is a message received by a gateway device. The first message may be an attack message or may not be an attack message. Connection tracking (conntrack) is performed on the first message to obtain connection tracking information. The connection tracking information includes: connection tracking status and five-tuple information, etc.
[0063] In actual applications, each connection may contain five connection tracking states: NEW (representing the initial state of a connection), ESTABLISHED (representing that the connection has been established), RELATED (representing an associated connection, a sub-connection of a main connection), and INVALID (representing a special connection that did not behave as expected).
[0064] In order to more accurately and efficiently find messages that may contain attack behaviors, after receiving the first message, it can be determined whether the connection tracking state of the message is the target tracking state. The target tracking state can include: NEW or INVALID, that is, determine whether the connection tracking state of the message is NEW or INVALID.
[0065] When it is determined based on the connection tracking information that the connection tracking state of the first message is the target tracking state, that is, if the connection tracking state of the message is NEW or INVALID, the step of adding the connection tracking entry containing the connection tracking information to the anti-attack preparation list is executed; and it is determined whether the connection tracking information complies with the anti-attack packet loss rules.
[0066] Step S102: when the connection tracking information complies with the anti-attack packet loss rule, discard the first message.
[0067] In the embodiment of the present application, the anti-attack packet loss rule is determined based on the connection tracking entries in the anti-attack preparation list that meet the counting conditions, that is, the connection tracking entries in the anti-attack preparation list that meet the technical conditions can be used as the anti-attack packet loss rule.
[0068] like Figure 3 As shown, the home gateway is composed of a hardware driver and a software system. The message is first received by the hardware driver and then processed by the software system. When a message meets the anti-attack packet loss rule, it will be lost in the anti-attack matching packet loss module. In one embodiment of the present application, the anti-attack packet loss rule is preset in the hardware driver of the gateway device. In another embodiment of the present application, the anti-attack packet loss rule is preset in the software program of the gateway device. Loading it in the hardware driver can greatly reduce the burden of the software CPU.
[0069] In this step, the connection tracking information may be matched with the anti-attack packet loss rule. If the connection tracking information matches any entry in the anti-attack packet loss rule, it indicates that the first message is an attack message and the first message may be discarded.
[0070] The method provided in the embodiment of the present application determines an anti-attack packet loss rule according to a connection tracking entry that meets the counting conditions, and then uses the anti-attack packet loss rule to verify the connection tracking information of the first message. When the connection tracking information of the first message meets the anti-attack packet loss rule, the first message is considered to be an attack message, and the first message is directly discarded, thereby realizing rapid identification of attacks based on connection tracking, without the need to forward all messages to the Linux kernel of the gateway for anti-attack processing, avoiding the situation where the attack occupies a large amount of Linux kernel resources of the gateway and causes the gateway to be paralyzed, ensuring the normal operation of the gateway, and improving the performance of the gateway.
[0071] In another embodiment of the present application, after step S101, the method further includes:
[0072] Step S201, adding the connection tracking entry containing the connection tracking information to the attack prevention preliminary list;
[0073] In this step, after obtaining the connection tracking information of the first message, a connection tracking entry may be generated based on the connection tracking information of the first message, and then the connection tracking entry may be added to the anti-attack preliminary list.
[0074] Step S202, counting a first number of connection tracking entries having the same first target feature within a preset period in the attack prevention preparation list;
[0075] In an embodiment of the present application, the first target feature includes: source IP and protocol. Since the first target feature only uses two elements in the five-tuple, the minimum features can be used to identify attack messages, saving gateway resources. The preset period can be a preset statistical period, such as: 1 second, 2 seconds, etc.
[0076] In this step, the attack prevention preparation list may be traversed, and each time a connection tracking entry containing the first target feature is traversed, a counter is incremented by 1, thereby obtaining the first number.
[0077] Step S203: When the first number is greater than or equal to a first preset threshold, the first target feature is written into the anti-attack packet loss rule.
[0078] When the first number is greater than or equal to the first preset threshold, it indicates that a large number of messages with the first target feature have been received within the preset period, and the messages with the first target feature are most likely attack messages. The first target feature is written into the anti-attack packet loss rule so that the next attack message with the first target feature can be intercepted and discarded.
[0079] Step S204: when the first number is less than the first preset threshold, delete the first target feature in the anti-attack packet loss rule.
[0080] When the first number is less than the first preset threshold, it indicates that a large number of messages with the first target feature have not been received within the preset period, and the messages with the first target feature are most likely not attack messages. Therefore, the first target feature can be deleted in the anti-attack packet loss rule to avoid intercepting and discarding normal messages with the first target feature.
[0081] As an example: Use the hping3 command tool to simulate the attack process, preset the cycle time to 1s, and set the gateway attack defense threshold to 500.
[0082] Use the following attack command to simulate the SYN_FLOOD attack (with fixed source IP)
[0083] Attack command: hping3 -I eth0 -S 10.10.10.10 -p 80 -a 10.10.10.20 -i u333
[0084] For ease of understanding, the following explains the meaning of each part of the attack command:
[0085] -I eth0: The network card eth0 from which the attack source sends packets
[0086] -S10.10.10.10: Send SYN message to 10.10.10.10 (gateway device address)
[0087] -p 80: The destination port is 80
[0088] -a 10.10.10.20: The source IP address is 10.10.10.20
[0089] -i u333: The sending interval is 333us, that is, 3000 messages are sent in 1s
[0090] Implicit: Random source port
[0091] The following is the entire anti-attack process of the home gateway:
[0092] When the first message arrives at the gateway, it passes through the anti-attack packet loss module. Currently, there is no anti-attack packet loss rule.
[0093] The message arrives at the attack prevention identification module. The link tracking information of the message is obtained: state: NEW, protocol: TCP, source IP: 10.10.10.20, source port: random port 1, destination IP: 10.10.10.10, destination port: 80.
[0094] The link tracking information is added to the attack prevention preliminary list, and the number of link tracking with the same first target feature within 1 second before the current time is counted, with source IP 10.10.10.20 + protocol TCP: 1. The threshold is not exceeded.
[0095] Count the number of link tracking with the same second target feature within 1 second before the current time, destination IP 10.10.10.10 + destination port 80 + protocol TCP: 1. Does not exceed the threshold.
[0096] The message is forwarded normally.
[0097] The same process is repeated until the 501th packet reaches the gateway and passes through the anti-attack packet loss module. Currently, there is no anti-attack packet loss rule, so an anti-attack packet loss rule is created.
[0098] The message arrives at the attack prevention identification module. The link tracking of the message is obtained: state: NEW, protocol: TCP, source IP: 10.10.10.20, source port: random port 501, destination IP: 10.10.10.10, destination port: 80.
[0099] Add the link tracking information to the anti-attack preparatory list, count the number of link tracking with the same first target feature within 1 second before the current time, source IP 10.10.10.20 + protocol TCP: 501. Exceed the threshold. Configure the anti-attack packet loss rule "source IP 10.10.10.20 + protocol TCP" to the anti-attack packet loss module, and discard the message.
[0100] When the 502nd message arrives at the gateway, it successfully matches the corresponding anti-attack packet loss rule in the anti-attack packet loss module and directly discards the message.
[0101] In another embodiment of the present application, after step S101, the method further includes:
[0102] Step S301, adding the connection tracking entry containing the connection tracking information to the attack prevention preliminary list;
[0103] In this step, after obtaining the connection tracking information of the first message, a connection tracking entry may be generated based on the connection tracking information of the first message, and then the connection tracking entry may be added to the anti-attack preliminary list.
[0104] Step S302, counting a second number of connection tracking entries having the same second target feature within a preset period in the attack prevention preparation list, where the second target feature is different from the first target feature;
[0105] The second target feature includes: destination IP, destination port and protocol. Since the first target feature only uses three of the five-tuple, the minimum features can be used to identify attack messages, saving gateway resources. The preset period can be a preset statistical period, such as: 1 second, 2 seconds, etc.
[0106] In this step, the attack prevention preparation list may be traversed, and each time a connection tracking entry containing the second target feature is traversed, a counter is incremented by 1, thereby obtaining the second number.
[0107] Step S303: When the second number is greater than or equal to a second preset threshold, the second target feature is written into the anti-attack packet loss rule.
[0108] When the second number is greater than or equal to the second preset threshold, it indicates that a large number of messages with the second target feature have been received within the preset period, and the messages with the second target feature are most likely attack messages. The second target feature is written into the anti-attack packet loss rule so that the next attack message with the second target feature can be intercepted and discarded.
[0109] Step S304: when the second number is less than the second preset threshold, delete the second target feature in the anti-attack packet loss rule.
[0110] When the second number is less than the second preset threshold, it indicates that a large number of messages with the second target feature have not been received within the preset period, and the messages with the second target feature are most likely not attack messages. Therefore, the second target feature can be deleted in the anti-attack packet loss rule to avoid intercepting and discarding normal messages with the second target feature.
[0111] As an example: Use the hping3 command tool to simulate the attack process, preset the cycle time to 1s, and set the gateway attack defense threshold to 500.
[0112] Simulate the following attack command: SYN_FLOOD attack (source IP random)
[0113] Attack command: hping3 -I eth0 -S10.10.10.10 -p 80 --rand-source -i u333
[0114] For ease of understanding, the following explains the meaning of each part of the attack command:
[0115] -I eth0: The network card eth0 from which the attack source sends packets
[0116] -S10.10.10.10: Send SYN message to 10.10.10.10 (gateway device address)
[0117] -p 80: The destination port is 80
[0118] --rand-source: random source IP
[0119] -i u333: The sending interval is 333us, that is, 3000 messages are sent in 1s
[0120] Implicit: Random source port
[0121] The following is the entire anti-attack process of the home gateway:
[0122] When the first message arrives at the gateway, it passes through the anti-attack packet loss module. Currently, there is no anti-attack packet loss rule.
[0123] The message arrives at the attack prevention identification module. The link tracking information of the message is obtained: state: NEW, protocol: TCP, source IP: random IP1, source port: random port 1, destination IP: 10.10.10.10, destination port: 80.
[0124] The link tracking information is added to the attack prevention preliminary list, and the number of link tracking with the same first target feature within 1 second before the current time is counted, with a random source IP1 and a TCP protocol: 1. The threshold is not exceeded.
[0125] Count the number of link tracking with the same second target feature within 1 second before the current time, destination IP 10.10.10.10 + destination port 80 + protocol TCP: 1. Does not exceed the threshold.
[0126] The message is forwarded normally.
[0127] The same process is repeated until the 501th packet reaches the gateway and passes through the anti-attack packet loss module. Currently, there is no anti-attack packet loss rule, so an anti-attack packet loss rule is created.
[0128] The message arrives at the attack prevention identification module. The link tracking of the message is obtained: state: NEW, protocol: TCP, source IP: random IP501, source port: random port 501, destination IP: 10.10.10.10, destination port: 80.
[0129] The link tracking information is added to the attack prevention preliminary list, and the number of link tracking with the same first target feature within 1 second before the current time is counted: source IP random IP1 + protocol TCP: 1, source IP random IP2 + protocol TCP: 1, ..., source IP random IP501 + protocol TCP: 1. The threshold is not exceeded.
[0130] Count the number of link tracking with the same target feature 2 within 1 second before the current time, destination IP 10.10.10.10 + destination port 80 + protocol TCP: 501. Exceed the threshold. Configure the anti-attack packet loss rule "destination IP 10.10.10.10 + destination port 80 + protocol TCP" to the anti-attack packet loss module and discard the message.
[0131] When the 502nd message arrives at the gateway, it successfully matches the corresponding anti-attack packet loss rule in the anti-attack packet loss module and directly discards the message.
[0132] like Figure 4 As shown, in another embodiment of the present application, when it is determined that the first number of connection tracking entries with the same first target feature in the anti-attack preparation list within a preset period is less than the first preset threshold, it can also be determined that the second number of connection tracking entries with the same second target feature in the preset period in the anti-attack preparation list is less than the second preset threshold, and then the corresponding process is executed. By first judging the first target feature and then judging the second feature, the identification of the attack message can be made more accurate, thereby improving the anti-attack performance of the gateway device.
[0133] In another embodiment of the present application, a gateway anti-attack device is also provided, which is applied to a gateway device, such as Figure 5 As shown, the device comprises:
[0134] The receiving module 11 is used to receive a first message, perform connection tracking on the first message, and obtain connection tracking information;
[0135] The discarding module 12 is used to discard the first message when the connection tracking information meets the anti-attack packet loss rule, wherein the anti-attack packet loss rule is determined according to the connection tracking entries that meet the counting conditions in the anti-attack preliminary list.
[0136] Optionally, the anti-attack packet loss rule is preset in a hardware driver of the gateway device.
[0137] Optionally, the device further comprises:
[0138] A first adding module, configured to add a connection tracking entry containing the connection tracking information to the anti-attack preliminary list;
[0139] A first statistical module, used to count a first number of connection tracking entries having the same first target feature within a preset period in the anti-attack preliminary list;
[0140] The first writing module is used to write the first target feature into the anti-attack packet loss rule when the first number is greater than or equal to a first preset threshold.
[0141] Optionally, the device further comprises:
[0142] A first deleting module is configured to delete the first target feature from the anti-attack packet loss rule when the first number is less than the first preset threshold.
[0143] Optionally, the device further comprises:
[0144] A second adding module, configured to add a connection tracking entry containing the connection tracking information to the anti-attack preliminary list;
[0145] A second statistical module, configured to count a second number of connection tracking entries in the anti-attack preliminary list having the same second target feature within a preset period, where the second target feature is different from the first target feature;
[0146] A second writing module is configured to write the second target feature into the anti-attack packet loss rule when the second number is greater than or equal to a second preset threshold.
[0147] Optionally, the device further comprises:
[0148] A second deleting module is configured to delete the second target feature from the anti-attack packet loss rule when the second number is less than the second preset threshold.
[0149] Optionally, the device further comprises:
[0150] An execution module is used to execute the step of adding a connection tracking entry containing the connection tracking information to the anti-attack preliminary list when it is determined based on the connection tracking information that the connection tracking state of the first message is a target tracking state.
[0151] In another embodiment of the present application, a gateway device is further provided, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;
[0152] Memory, used to store computer programs;
[0153] The processor is used to implement the gateway attack protection method described in any of the above method embodiments when executing the program stored in the memory.
[0154] In the gateway device provided by the embodiment of the present invention, the processor implements the determination of the anti-attack packet loss rule according to the connection tracking entries that meet the counting conditions by executing the program stored in the memory, and then verifies the connection tracking information of the first message by using the anti-attack packet loss rule. When the connection tracking information of the first message meets the anti-attack packet loss rule, the first message is considered to be an attack message, and the first message is directly discarded, thereby realizing rapid identification of attacks based on connection tracking, without the need to forward all messages to the Linux kernel of the gateway for anti-attack processing, avoiding the situation where the attack occupies a large amount of Linux kernel resources of the gateway and causes the gateway to be paralyzed, ensuring the normal operation of the gateway, and improving the performance of the gateway.
[0155] The communication bus 1140 mentioned in the above-mentioned gateway device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The communication bus 1140 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.
[0156] The communication interface 1120 is used for communication between the above-mentioned gateway device and other devices.
[0157] The memory 1130 may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.
[0158] The above-mentioned processor 1110 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.
[0159] In another embodiment of the present application, a computer-readable storage medium is further provided, on which a program of the gateway anti-attack method is stored. When the program of the gateway anti-attack method is executed by a processor, the steps of the gateway anti-attack method described in any of the aforementioned method embodiments are implemented.
[0160] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.
[0161] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.
Claims
1. A gateway anti-attack method, characterized in that: Applied to a gateway device, the method includes: receiving a first message, performing connection tracking on the first message, and obtaining connection tracking information; In the case where the connection tracking information meets the anti-attack packet loss rule, the first message is discarded, wherein the anti-attack packet loss rule is determined according to the connection tracking entries that meet the counting condition in the anti-attack preliminary list.
2. The gateway anti-attack method according to claim 1, characterized in that: The anti-attack packet loss rule is preset in the hardware driver of the gateway device.
3. The gateway anti-attack method according to claim 1, characterized in that: The method further comprises: Adding a connection tracking entry containing the connection tracking information to the attack prevention preliminary list; Counting a first number of connection tracking entries having the same first target feature within a preset period in the attack prevention preliminary list; When the first number is greater than or equal to a first preset threshold, the first target feature is written into the anti-attack packet loss rule.
4. The gateway attack protection method according to claim 3, characterized in that: The method further comprises: When the first number is smaller than the first preset threshold, the first target feature is deleted from the anti-attack packet loss rule.
5. The gateway attack protection method according to claim 1, characterized in that: The method further comprises: Adding a connection tracking entry containing the connection tracking information to the attack prevention preliminary list; Counting a second number of connection tracking entries in the anti-attack preliminary list that have the same second target feature within a preset period, where the second target feature is different from the first target feature; When the second number is greater than or equal to a second preset threshold, the second target feature is written into the anti-attack packet loss rule.
6. The gateway attack protection method according to claim 5, characterized in that: The method further comprises: When the second number is less than the second preset threshold, the second target feature is deleted from the anti-attack packet loss rule.
7. The gateway attack protection method according to claim 1, characterized in that: The method further comprises: In a case where it is determined based on the connection tracking information that the connection tracking state of the first message is the target tracking state, a step of adding a connection tracking entry containing the connection tracking information to the attack prevention preliminary list is performed.
8. A gateway anti-attack device, characterized in that: Applied to a gateway device, the device comprises: A receiving module, configured to receive a first message, perform connection tracking on the first message, and obtain connection tracking information; A discarding module is used to discard the first message when the connection tracking information meets the anti-attack packet loss rule, wherein the anti-attack packet loss rule is determined based on the connection tracking entries that meet the counting conditions in the anti-attack preliminary list.
9. A gateway device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; The processor is used to implement the gateway attack protection method described in any one of claims 1 to 7 when executing the program stored in the memory.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program of the gateway anti-attack method, and when the program of the gateway anti-attack method is executed by the processor, the steps of the gateway anti-attack method described in any one of claims 1 to 7 are implemented.