Abnormal connection blocking method, device and equipment

Abstract

The embodiment of the invention provides an abnormal connection blocking method, device and equipment. The method comprises the following steps: extracting a first source IP address and a first flow fingerprint from a received encrypted data packet to be defended; then, comparing the first traffic fingerprint with a traffic fingerprint in a preset self-learning fingerprint database to obtain a first comparison result; wherein the preset self-learning fingerprint database comprises the traffic fingerprint with the threat. Then, if the first comparison result is that the first flow fingerprint exists in a preset self-learning fingerprint database, comparing the first source IP address with an IP address in a full-amount information database to obtain a second comparison result; wherein the full-amount information library comprises abnormal and suspected abnormal IP addresses. And if the second comparison result is that the first source IP address exists in the full-amount information library, determining that the first source IP address is the first abnormal IP address. And furthermore, blocking processing is performed on the connection request initiated by the first abnormal IP address. The method is used for achieving the effect of accurately blocking the abnormal connection for sending the encrypted data packet.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device and equipment for blocking abnormal connections. Background Art

[0002] As network attack technology continues to upgrade, abnormal connections need to be blocked.

[0003] In the prior art, abnormal connections can be blocked by extracting the source IP address, destination IP address, attack payload, etc. in the data packet.

[0004] However, since the encrypted attack payload cannot be extracted from the encrypted data packet, it is impossible to accurately block the abnormal connection that sends the encrypted data packet. Summary of the invention

[0005] The embodiments of the present application provide a method, device and equipment for blocking abnormal connections, so as to achieve the effect of accurately blocking abnormal connections that send encrypted data packets.

[0006] In a first aspect, an embodiment of the present application provides a method for blocking an abnormal connection, comprising:

[0007] Extracting the source IP address and traffic fingerprint of the received encrypted data packet to be defended, and obtaining a first source IP address and a first traffic fingerprint; wherein the encrypted data packet to be defended includes information sent by the sender of the received first source IP address based on network communication; the first traffic fingerprint is used to identify the sender device that sends the encrypted data packet to be defended;

[0008] Comparing the first traffic fingerprint with the traffic fingerprint in a preset self-learning fingerprint library to obtain a first comparison result; wherein the preset self-learning fingerprint library includes threatening traffic fingerprints;

[0009] If the first comparison result indicates that the first traffic fingerprint exists in the preset self-learning fingerprint library, a full intelligence library is obtained, and the first source IP address is compared with the IP address in the full intelligence library to obtain a second comparison result; wherein the full intelligence library includes abnormal IP addresses and suspected abnormal IP addresses;

[0010] If the second comparison result indicates that the first source IP address exists in the full intelligence library, it is determined that the first source IP address represents a first abnormal IP address; and based on the encrypted data packet to be defended, the connection request initiated by the first abnormal IP address is blocked.

[0011] In a possible implementation, the method further includes:

[0012] Extracting the source IP address of the received encrypted data packet to be learned to obtain a second source IP address; wherein the encrypted data packet to be learned includes information sent by the sender of the received second source IP address based on network communication; obtaining a precise intelligence library, and comparing the second source IP address with the IP address in the precise intelligence library to obtain a third comparison result; wherein the precise intelligence library includes the abnormal IP address in the full intelligence library;

[0013] If the third comparison result indicates that the second source IP address exists in the precise intelligence library, an initial self-learning fingerprint library is obtained, and the initial self-learning fingerprint library is updated according to the encrypted data packet to be learned to obtain the preset self-learning fingerprint library.

[0014] In a possible implementation, the initial self-learning fingerprint library is updated according to the encrypted data packet to be learned to obtain the preset self-learning fingerprint library, including:

[0015] Extracting a traffic fingerprint of the encrypted data packet to be learned to obtain a second traffic fingerprint; wherein the second traffic fingerprint is used to identify a sending device that sends the encrypted data packet to be learned;

[0016] If the second traffic fingerprint does not exist in the initial self-learning fingerprint library, the second traffic fingerprint is stored in the initial self-learning fingerprint library to obtain the preset self-learning fingerprint library.

[0017] In a possible implementation, the method further includes:

[0018] If the third comparison result indicates that the second source IP address does not exist in the precise intelligence database, obtaining a full intelligence database, and comparing the second source IP address with the IP addresses in the full intelligence database to obtain a fourth comparison result;

[0019] If the fourth comparison result indicates that the second source IP address exists in the full intelligence library, it is determined that the second source IP address represents a second abnormal IP address; and based on the encrypted data packet to be learned, the connection initiated by the second abnormal IP address is blocked.

[0020] In a possible implementation, blocking the connection initiated by the second abnormal IP address according to the encrypted data packet to be learned includes:

[0021] Generate a third close data packet and a fourth close data packet according to the encrypted data packet to be learned; wherein the third close data packet is used to notify the sender of the second abnormal IP address to stop sending connection requests; and the fourth close data packet is used to notify to stop receiving connection requests sent by the sender of the second abnormal IP address;

[0022] Sending the third close data packet to the sender of the second abnormal IP address, and stopping sending the connection request sent by the sender of the second abnormal IP address;

[0023] The fourth close data packet sent by the sender of the second abnormal IP address is simulated to be received, and the connection request sent by the sender of the second abnormal IP address is stopped.

[0024] In a possible implementation manner, it is characterized in that, according to the encrypted data packet to be defended, blocking the connection request initiated by the first abnormal IP address includes:

[0025] Generate a first close data packet and a second close data packet according to the encrypted data packet to be defended; wherein the first close data packet is used to notify the sender of the first abnormal IP address to stop sending connection requests; and the second close data packet is used to notify to stop receiving connection requests sent by the sender of the first abnormal IP address;

[0026] Sending the first close data packet to the sender of the first abnormal IP address, and stopping sending the connection request sent by the sender of the first abnormal IP address;

[0027] The receiving of the second close data packet sent by the sender of the first abnormal IP address is simulated, and the receiving of the connection request sent by the sender of the first abnormal IP address is stopped.

[0028] In a second aspect, an embodiment of the present application provides a device for blocking abnormal connection, including:

[0029] An extraction module is used to extract the source IP address and traffic fingerprint of the received encrypted data packet to be defended, and obtain a first source IP address and a first traffic fingerprint; wherein the encrypted data packet to be defended includes information sent by the sender of the received first source IP address based on network communication; the first traffic fingerprint is used to identify the sender device that sends the encrypted data packet to be defended;

[0030] A first comparison module, used to compare the first traffic fingerprint with a traffic fingerprint in a preset self-learning fingerprint library to obtain a first comparison result; wherein the preset self-learning fingerprint library includes threatening traffic fingerprints;

[0031] A second comparison module is used for obtaining a full intelligence library if the first comparison result indicates that the first traffic fingerprint exists in the preset self-learning fingerprint library, and comparing the first source IP address with the IP address in the full intelligence library to obtain a second comparison result; wherein the full intelligence library includes abnormal IP addresses and suspected abnormal IP addresses;

[0032] a determination module, configured to determine that the first source IP address represents a first abnormal IP address if the second comparison result represents that the first source IP address exists in the full intelligence database;

[0033] The blocking module is used to block the connection request initiated by the first abnormal IP address according to the encrypted data packet to be defended.

[0034] In a possible implementation manner, the device is further used for:

[0035] Extracting the source IP address of the received encrypted data packet to be learned to obtain a second source IP address; wherein the encrypted data packet to be learned includes information sent by the sender of the received second source IP address based on network communication; obtaining a precise intelligence library, and comparing the second source IP address with the IP address in the precise intelligence library to obtain a third comparison result; wherein the precise intelligence library includes the abnormal IP address in the full intelligence library;

[0036] If the third comparison result indicates that the second source IP address exists in the precise intelligence library, an initial self-learning fingerprint library is obtained, and the initial self-learning fingerprint library is updated according to the encrypted data packet to be learned to obtain the preset self-learning fingerprint library.

[0037] In a possible implementation manner, the “updating the initial self-learning fingerprint library according to the encrypted data packet to be learned to obtain the preset self-learning fingerprint library” in the device is specifically used for:

[0038] Extracting a traffic fingerprint of the encrypted data packet to be learned to obtain a second traffic fingerprint; wherein the second traffic fingerprint is used to identify a sending device that sends the encrypted data packet to be learned;

[0039] If the second traffic fingerprint does not exist in the initial self-learning fingerprint library, the second traffic fingerprint is stored in the initial self-learning fingerprint library to obtain the preset self-learning fingerprint library.

[0040] In a possible implementation manner, the device is further used for:

[0041] If the third comparison result indicates that the second source IP address does not exist in the precise intelligence database, obtaining a full intelligence database, and comparing the second source IP address with the IP addresses in the full intelligence database to obtain a fourth comparison result;

[0042] If the fourth comparison result indicates that the second source IP address exists in the full intelligence library, it is determined that the second source IP address represents a second abnormal IP address; and based on the encrypted data packet to be learned, the connection initiated by the second abnormal IP address is blocked.

[0043] In a possible implementation manner, the “blocking the connection initiated by the second abnormal IP address according to the encrypted data packet to be learned” in the device is specifically used to:

[0044] Generate a third close data packet and a fourth close data packet according to the encrypted data packet to be learned; wherein the third close data packet is used to notify the sender of the second abnormal IP address to stop sending connection requests; and the fourth close data packet is used to notify to stop receiving connection requests sent by the sender of the second abnormal IP address;

[0045] Sending the third close data packet to the sender of the second abnormal IP address, and stopping sending the connection request sent by the sender of the second abnormal IP address;

[0046] The fourth close data packet sent by the sender of the second abnormal IP address is simulated to be received, and the connection request sent by the sender of the second abnormal IP address is stopped.

[0047] In a possible implementation manner, the blocking module is specifically used to:

[0048] Generate a first close data packet and a second close data packet according to the encrypted data packet to be defended; wherein the first close data packet is used to notify the sender of the first abnormal IP address to stop sending connection requests; and the second close data packet is used to notify to stop receiving connection requests sent by the sender of the first abnormal IP address;

[0049] Sending the first close data packet to the sender of the first abnormal IP address, and stopping sending the connection request sent by the sender of the first abnormal IP address;

[0050] The receiving of the second close data packet sent by the sender of the first abnormal IP address is simulated, and the receiving of the connection request sent by the sender of the first abnormal IP address is stopped.

[0051] In a third aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor;

[0052] The memory stores computer-executable instructions;

[0053] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0054] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0055] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0056] The method, device and equipment for blocking abnormal connections provided by the embodiment of the present application extract the first source IP address and the first traffic fingerprint from the received encrypted data packet to be defended, wherein the encrypted data packet to be defended includes information sent by the sender of the received first source IP address based on network communication; the first traffic fingerprint is used to identify the sender device that sends the encrypted data packet to be defended. Then, the first traffic fingerprint is compared with the traffic fingerprint in the preset self-learning fingerprint library to obtain a first comparison result; wherein the preset self-learning fingerprint library includes threatening traffic fingerprints. Then, if the first comparison result indicates that the first traffic fingerprint exists in the preset self-learning fingerprint library, the full intelligence library is obtained, and the first source IP address is compared with the IP address in the full intelligence library to obtain a second comparison result; wherein the full intelligence library includes abnormal IP addresses and suspected abnormal IP addresses. If the second comparison result indicates that the first source IP address exists in the full intelligence library, it is determined that the first source IP address represents the first abnormal IP address. Then, according to the encrypted data packet to be defended, the connection request initiated by the first abnormal IP address is blocked.

[0057] Since the preset self-learning fingerprint library includes threatening traffic fingerprints and the full intelligence library includes abnormal IP addresses and suspected abnormal IP addresses, when the first traffic fingerprint extracted from the encrypted data packet to be defended is in the preset self-learning fingerprint library and the first source IP address extracted from the encrypted data packet to be defended is in the full intelligence library, the connection initiated by the sender of the first source IP address is blocked, so that the abnormal connection that sends the encrypted data packet to be defended can be blocked more accurately. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0059] Figure 1 A schematic diagram of a flow chart of a method for blocking abnormal connections provided by the present application;

[0060] Figure 2 A flowchart of another abnormal connection blocking method provided by the present application;

[0061] Figure 3 A schematic diagram of the structure of the abnormal connection blocking device provided in this application;

[0062] Figure 4 A schematic diagram of the structure of the electronic device provided in this application.

[0063] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0064] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0065] In recent years, many complex network attack methods have emerged (such as HTTPS second dial attack, etc.). Therefore, it is necessary to block abnormal connections to ensure security.

[0066] In one example, abnormal connections can be blocked by identifying the source IP address, destination IP address, and attack payload in the data packet.

[0067] However, in the above method, since the attack payload in the encrypted data packet is encrypted, the attack payload cannot be identified from the encrypted data packet, and further, the abnormal connection of the encrypted data packet cannot be accurately blocked.

[0068] The present application provides a method, device and equipment for blocking abnormal connection to solve the above technical problems.

[0069] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0070] Figure 1 A flowchart of a method for blocking abnormal connections provided in this application is shown in FIG. Figure 1 As shown, the method includes:

[0071] S101. Extract the source IP address and traffic fingerprint of the received encrypted data packet to be defended to obtain a first source IP address and a first traffic fingerprint; wherein the encrypted data packet to be defended includes information sent by the sender of the received first source IP address based on network communication; the first traffic fingerprint is used to identify the sender device that sends the encrypted data packet to be defended.

[0072] Exemplarily, the execution subject of this embodiment can be a server, a distributed system, a terminal device, other electronic devices / computer devices, or any other device or equipment that can implement the solution of this application, without limitation. Among them, the server can be an independent server, or a server cluster, such as but not limited to any form including a cloud server, a distributed server, a blockchain server, etc.

[0073] This embodiment is introduced with the execution subject being a server.

[0074] Exemplarily, the encrypted data packet to be defended can be understood as an encrypted data packet sent by a client or other sender and received by the server, and the encrypted data packet may be abnormal or legal. The encrypted data packet to be defended may be one or more. The sender of the encrypted data packet to be defended and the number of the encrypted data packets to be defended are not limited in this embodiment. If several encrypted data packets to be defended are received, then based on the order in which they are received, the encrypted data packets to be defended can be implemented one by one according to steps S101 to S105.

[0075] In the encrypted data packet to be defended, although the data actually to be transmitted (such as file content, message content, etc.) is encrypted, the header information (such as source IP address, etc.) is unencrypted. Then, the server can extract the first source IP address from the received encrypted data packet to be defended, wherein the first source IP address can be understood as the IP address of the sender of the encrypted data packet to be defended.

[0076] The server can also extract the first traffic fingerprint by analyzing the size, sending frequency, protocol type, port number and other features of the encrypted data packet to be defended. The first traffic fingerprint can uniquely identify the device of the sender of the encrypted data packet to be defended, and the first traffic fingerprint will not change even if the IP address of the sender's device changes.

[0077] S102: Compare the first traffic fingerprint with the traffic fingerprint in a preset self-learning fingerprint library to obtain a first comparison result; wherein the preset self-learning fingerprint library includes threatening traffic fingerprints.

[0078] Exemplarily, the preset self-learning fingerprint library can be understood as a database that can continuously collect threatening traffic fingerprints through continuous learning, wherein the threatening traffic fingerprint can be understood as a connection request from the sender with the traffic fingerprint to send the encrypted data packet to be defended, which may be an abnormal connection request.

[0079] The first comparison result may be, for example, that the first traffic fingerprint exists in the preset self-learning fingerprint library, or that the first traffic fingerprint does not exist in the preset self-learning fingerprint library.

[0080] S103. If the first comparison result indicates that the first traffic fingerprint exists in the preset self-learning fingerprint library, the full intelligence library is obtained, and the first source IP address is compared with the IP address in the full intelligence library to obtain a second comparison result; wherein the full intelligence library includes abnormal IP addresses and suspected abnormal IP addresses.

[0081] Exemplarily, the full intelligence library can download abnormal IP addresses and suspected abnormal IP addresses from a public threat intelligence platform, or identify abnormal activities by analyzing network logs, security logs, etc., and extract abnormal IP addresses and suspected abnormal IP addresses, wherein abnormal IP addresses have high credibility, and connection requests initiated by abnormal IP addresses are likely to be abnormal connections; suspected abnormal IP addresses have lower credibility, and connection requests initiated by suspected abnormal IP addresses may be abnormal connections or legitimate connections.

[0082] If the first comparison result is that the first traffic fingerprint exists in the preset self-learning fingerprint library, it means that the sender with the first traffic fingerprint sends a connection request for the encrypted data packet to be defended, which may be an abnormal connection request. However, in order to avoid misjudgment, the server can also compare the first source IP address with the IP address in the acquired full intelligence library to obtain a second comparison result. The second comparison result can be, for example, that the first source IP address exists in the full intelligence library, or that the first source IP address does not exist in the full intelligence library.

[0083] If the first comparison result is that the first traffic fingerprint does not exist in the preset self-learning fingerprint library, it means that the connection request for the encrypted data packet to be defended by the sender with the first traffic fingerprint is legal and can be released.

[0084] S104. If the second comparison result indicates that the first source IP address exists in the full intelligence database, it is determined that the first source IP address indicates the first abnormal IP address.

[0085] Exemplarily, if the first comparison result is that the first traffic fingerprint exists in the preset self-learning fingerprint library, and the second comparison result is that the first source IP address exists in the full intelligence library, then it means that the first traffic fingerprint of the sender of the encrypted data packet to be defended is threatening, and the first source IP address of the sender of the encrypted data packet to be defended is also an abnormal or suspected abnormal IP address. At this time, the first source IP address is determined as the first abnormal IP address, where the first abnormal IP address can be understood as an IP address that sends an abnormal connection to the server.

[0086] If the second comparison result is that the first source IP address does not exist in the full intelligence database, it means that although the first traffic fingerprint of the sender of the encrypted data packet to be defended is threatening, the first source IP address of the sender of the encrypted data packet to be defended is legal, which means that the connection request of the sender of the first source IP address to send the encrypted data packet to be defended is legal and can be released.

[0087] S105: According to the encrypted data packet to be defended, the connection request initiated by the first abnormal IP address is blocked.

[0088] Exemplarily, after determining that the first source IP address represents the first abnormal IP address, the connection request initiated by the first abnormal IP address can be blocked through an intrusion prevention system (IPS) based on the encrypted data packet to be defended.

[0089] The method for blocking abnormal connections provided in the embodiment of the present application is to extract the first source IP address and the first traffic fingerprint from the received encrypted data packet to be defended, wherein the encrypted data packet to be defended includes information sent by the sender of the received first source IP address based on network communication; the first traffic fingerprint is used to identify the sender device that sends the encrypted data packet to be defended. Then, the first traffic fingerprint is compared with the traffic fingerprint in the preset self-learning fingerprint library to obtain a first comparison result; wherein the preset self-learning fingerprint library includes threatening traffic fingerprints. Then, if the first comparison result indicates that the first traffic fingerprint exists in the preset self-learning fingerprint library, the full intelligence library is obtained, and the first source IP address is compared with the IP address in the full intelligence library to obtain a second comparison result; wherein the full intelligence library includes abnormal IP addresses and suspected abnormal IP addresses. If the second comparison result indicates that the first source IP address exists in the full intelligence library, it is determined that the first source IP address represents the first abnormal IP address. Then, according to the encrypted data packet to be defended, the connection request initiated by the first abnormal IP address is blocked.

[0090] Since the preset self-learning fingerprint library includes threatening traffic fingerprints and the full intelligence library includes abnormal IP addresses and suspected abnormal IP addresses, when the first traffic fingerprint extracted from the encrypted data packet to be defended is in the preset self-learning fingerprint library and the first source IP address extracted from the encrypted data packet to be defended is in the full intelligence library, the connection initiated by the sender of the first source IP address is blocked, so that the abnormal connection that sends the encrypted data packet to be defended can be blocked more accurately.

[0091] Figure 2 A flowchart of another abnormal connection blocking method provided by the present application is shown in FIG. Figure 2 As shown, in this embodiment Figure 1 Based on the embodiment, a method for blocking abnormal connections is described in detail, and the method includes:

[0092] S201. Extract the source IP address of the received encrypted data packet to be learned to obtain a second source IP address; wherein the encrypted data packet to be learned includes information sent by the sender of the received second source IP address based on network communication.

[0093] Exemplarily, the execution subject of this embodiment can be a server, a distributed system, a terminal device, other electronic devices / computer devices, or any other device or equipment that can implement the solution of this application, without limitation. Among them, the server can be an independent server, or a server cluster, such as but not limited to any form including a cloud server, a distributed server, a blockchain server, etc.

[0094] This embodiment is introduced with the execution subject being a server.

[0095] Exemplarily, this embodiment is divided into a learning phase and a defense phase, wherein steps S201 to 206 are the learning phase, which is used to update the threatening traffic fingerprint in the initial self-learning fingerprint library according to the encrypted data packet to be learned, obtain the preset self-learning fingerprint library, and block the connection request initiated by the source IP address of the sender of the encrypted data packet to be learned that is not in the precise intelligence library but in the full intelligence library. Steps S207 to S211 are the defense phase, which are used to block the connection request initiated by the source IP address of the sender of the encrypted data packet to be defended whose traffic fingerprint is in the preset self-learning fingerprint library and whose source IP address is in the full intelligence library.

[0096] The server can first execute the learning phase, and then start the defense phase after the preset self-learning fingerprint library meets the preset conditions. After that, the learning phase and the defense phase can be carried out in parallel, thereby continuously updating the threatening traffic fingerprints in the preset self-learning fingerprint library, and using it in the defense phase to more accurately block abnormal connections initiated by abnormal IP addresses.

[0097] The preset condition may be, for example, that a preset first number of traffic fingerprints is reached in the preset self-learning fingerprint library; or, it may be that within a preset time period, the number of traffic fingerprints in the preset self-learning fingerprint library changes less than a preset second number, etc. The preset condition is set here to obtain a preset self-learning fingerprint library for the defense stage. This embodiment does not limit the preset condition and can be determined according to actual needs. As long as the preset self-learning fingerprint library can be obtained, it can be used to block abnormal connections in the prevention stage.

[0098] In step S201, the encrypted data packet to be learned is similar to the encrypted data packet to be defended in step S101. For detailed introduction, please refer to the description of the encrypted data packet to be defended in step S101. The difference is that the encrypted data packet to be learned is used in the learning stage, and the encrypted data packet to be defended is used in the defense stage.

[0099] The number of encrypted data packets to be learned may be one or more. The sender of the encrypted data packets to be learned and the number of encrypted data packets to be learned are not limited in this embodiment. If several encrypted data packets to be learned are received, the encrypted data packets to be learned are implemented one by one according to steps S201 to S206 based on the order in which they are received.

[0100] The encrypted data packet to be learned and the encrypted data packet to be defended may be the same or different, or may be partially the same and partially different, and this embodiment does not impose any limitation on this.

[0101] Similar to the encrypted data packet to be defended introduced in step S101, the server can extract the second source IP address from the received encrypted data packet to be learned, wherein the second source IP address can be understood as the IP address of the sender of the encrypted data packet to be learned.

[0102] S202. Obtain an accurate intelligence database, and compare the second source IP address with the IP address in the accurate intelligence database to obtain a third comparison result; wherein the accurate intelligence database includes abnormal IP addresses in the full intelligence database.

[0103] Exemplarily, after obtaining the second source IP address, the server may obtain a precise intelligence database, and compare the second source IP address with the IP address in the precise intelligence database to obtain a third comparison result. The precise intelligence database may be, for example, an abnormal IP address obtained from the full intelligence database. The third comparison result may be, for example, that the second source IP address exists in the precise intelligence database, or that the second source IP address does not exist in the precise intelligence database.

[0104] S203. If the third comparison result indicates that the second source IP address exists in the precise intelligence database, an initial self-learning fingerprint database is obtained, and the initial self-learning fingerprint database is updated according to the encrypted data packet to be learned to obtain a preset self-learning fingerprint database.

[0105] In one example, the step S203 of “updating the initial self-learning fingerprint library according to the encrypted data packet to be learned to obtain a preset self-learning fingerprint library” includes the following process:

[0106] Extracting a traffic fingerprint of the encrypted data packet to be learned to obtain a second traffic fingerprint; wherein the second traffic fingerprint is used to identify a sender device that sends the encrypted data packet to be learned;

[0107] If the second traffic fingerprint does not exist in the initial self-learning fingerprint library, the second traffic fingerprint is stored in the initial self-learning fingerprint library to obtain a preset self-learning fingerprint library.

[0108] Exemplarily, when the server receives the first encrypted data packet to be learned and executes to step S203, the initial self-learning fingerprint library may be empty, or may be a pre-stored threatening traffic fingerprint obtained by other means, and this embodiment does not impose any restrictions on this; when the server receives the second and subsequent encrypted data packets to be learned and executes to step S203, the initial self-learning fingerprint library may be understood as the latest preset self-learning fingerprint library to date.

[0109] In an example, if the third comparison result is that the second source IP address exists in the precise intelligence library, it means that the second source IP address sending the encrypted data packet to be learned is an abnormal IP address. It can also be understood that the traffic fingerprint of the sender of the encrypted data packet to be learned is a threatening traffic fingerprint, and the traffic fingerprint needs to be added to the initial self-learning fingerprint library.

[0110] Specifically, the server can obtain the initial self-learning fingerprint library, extract the second traffic fingerprint from the encrypted data packet to be learned, and then determine whether the second traffic fingerprint exists in the initial self-learning fingerprint library. If not, the second traffic fingerprint is stored in the initial self-learning fingerprint library to obtain a preset self-learning fingerprint library; if it exists, it means that the second traffic fingerprint is already in the initial self-learning fingerprint library and does not need to be added.

[0111] The server can continuously update the initial self-learning fingerprint library by performing step S203 learning on the received encrypted data packet to be learned, and obtain a preset self-learning fingerprint library.

[0112] S204. If the third comparison result indicates that the second source IP address does not exist in the precise intelligence database, the full intelligence database is obtained, and the second source IP address is compared with the IP address in the full intelligence database to obtain a fourth comparison result.

[0113] Exemplarily, if the third comparison result is that the second source IP address does not exist in the precise intelligence library, it means that the second source IP address that sends the encrypted data packet to be learned is not an abnormal IP address, but it does not mean that the second source IP address is necessarily a legal IP address. The server can also obtain the full intelligence library and compare the second source IP address with the IP address in the full intelligence library to obtain a fourth comparison result. Among them, the method for obtaining the full intelligence library can refer to the introduction in step S103, which will not be repeated here. The fourth comparison result, for example, can be that the second source IP address exists in the full intelligence library, or that the second source IP address does not exist in the full intelligence library.

[0114] S205. If the fourth comparison result indicates that the second source IP address exists in the full intelligence database, it is determined that the second source IP address indicates the second abnormal IP address.

[0115] Exemplarily, if the third comparison result is that the second source IP address does not exist in the precise intelligence library, and the fourth comparison result is that the second source IP address exists in the full intelligence library, then it means that the second source IP address is a suspected abnormal IP address. At this time, the second source IP address is determined to be the second abnormal IP address, where the second abnormal IP address can be understood as an IP address suspected of sending an abnormal connection to the server.

[0116] If the third comparison result is that the second source IP address does not exist in the precise intelligence database, and the fourth comparison result is that the second source IP address does not exist in the full intelligence database, then it means that the second source IP address is a legal IP address and can be released.

[0117] S206: According to the encrypted data packet to be learned, the connection initiated by the second abnormal IP address is blocked.

[0118] In one example, step S206 includes the following process:

[0119] Generate a third close data packet and a fourth close data packet according to the encrypted data packet to be learned; wherein the third close data packet is used to notify the sender of the second abnormal IP address to stop sending connection requests; the fourth close data packet is used to notify to stop receiving connection requests sent by the sender of the second abnormal IP address;

[0120] Sending a third closing data packet to the sender of the second abnormal IP address, and stopping sending the connection request sent by the sender of the second abnormal IP address;

[0121] The fourth closing data packet sent by the sender of the second abnormal IP address is simulated to be received, and the connection request sent by the sender of the second abnormal IP address is stopped.

[0122] Exemplarily, after determining that the second source IP address represents the second abnormal IP address, the server may block the abnormal connection initiated by the second source IP address.

[0123] For example, the server can extract the destination IP address, that is, the IP address of the server, from the encrypted data packet to be learned. Assume that the IP address of the server in the encrypted data packet to be learned is F; the second source IP address is K, and the server generates a third close data packet and a fourth close data packet based on the IP address F of the server and the second source IP address K; wherein the source IP address in the third close data packet is the IP address F of the server, and the destination IP address is the second source IP address K, and the third close data packet can be used to notify the sender of the second source IP address K to stop sending connection requests to the server. The third close data packet can be, for example, a reset data packet (Reset packet, referred to as RST packet) or a finish data packet (Finish packet, referred to as FIN packet).

[0124] The source IP address in the fourth close data packet is the second source IP address K, and the destination IP address is the IP address F of the server. The fourth close data packet can be used to notify the server to stop receiving connection requests sent by the sender of the second source IP address K. The fourth close data packet can be, for example, a reset data packet (Reset packet, referred to as RST packet) or a finish data packet (Finish packet, referred to as FIN packet).

[0125] Next, the server sends a third close data packet to the sender of the second source IP address K. After receiving the third close data packet, the sender of the second source IP address K stops sending connection requests to the server.

[0126] The server simulates the sender of the second source IP address K and sends a fourth close data packet to the server. After receiving the simulated fourth close data packet, the server stops receiving connection requests sent by the sender of the second source IP address K.

[0127] S207. Extract the source IP address and traffic fingerprint of the received encrypted data packet to be defended to obtain a first source IP address and a first traffic fingerprint; wherein the encrypted data packet to be defended includes information sent by the sender of the received first source IP address based on network communication; the first traffic fingerprint is used to identify the sender device that sends the encrypted data packet to be defended.

[0128] Exemplarily, the implementation of step S207 is the same as that of step S101 , and a detailed description may be referred to step S101 , which will not be repeated here.

[0129] S208. Compare the first traffic fingerprint with the traffic fingerprint in a preset self-learning fingerprint library to obtain a first comparison result; wherein the preset self-learning fingerprint library includes threatening traffic fingerprints.

[0130] Exemplarily, the implementation of step S208 is the same as that of step S102. For a detailed description, please refer to step S102, which will not be repeated here.

[0131] S209. If the first comparison result indicates that the first traffic fingerprint exists in the preset self-learning fingerprint library, the full intelligence library is obtained, and the first source IP address is compared with the IP address in the full intelligence library to obtain a second comparison result; wherein the full intelligence library includes abnormal IP addresses and suspected abnormal IP addresses.

[0132] Exemplarily, the implementation of step S209 is the same as that of step S103 , and a detailed description may be referred to step S103 , which will not be repeated here.

[0133] S210. If the second comparison result indicates that the first source IP address exists in the full intelligence database, it is determined that the first source IP address indicates the first abnormal IP address.

[0134] Exemplarily, the implementation of step S210 is the same as that of step S104. For a detailed description, please refer to step S104, which will not be repeated here.

[0135] S211. According to the encrypted data packet to be defended, a connection request initiated by the first abnormal IP address is blocked.

[0136] In one example, step S211 includes the following process:

[0137] Generate a first closing data packet and a second closing data packet according to the encrypted data packet to be defended; wherein the first closing data packet is used to notify the sender of the first abnormal IP address to stop sending connection requests; the second closing data packet is used to notify to stop receiving connection requests sent by the sender of the first abnormal IP address;

[0138] Sending a first closing data packet to a sender of the first abnormal IP address, and stopping sending the connection request sent by the sender of the first abnormal IP address;

[0139] The receiving of a second closing data packet sent by the sender of the first abnormal IP address is simulated, and the receiving of the connection request sent by the sender of the first abnormal IP address is stopped.

[0140] Exemplarily, after determining that the first source IP address represents the first abnormal IP address, the server may block the abnormal connection initiated by the first source IP address.

[0141] For example, the server can extract the destination IP address, that is, the IP address of the server, from the encrypted data packet to be defended. Assume that the IP address of the server in the encrypted data packet to be defended is W; the first source IP address is H, and the server generates a first close data packet and a second close data packet based on the IP address W of the server and the first source IP address H; wherein the source IP address in the first close data packet is the IP address W of the server, and the destination IP address is the first source IP address H, and the first close data packet can be used to notify the sender of the first source IP address H to stop sending connection requests to the server. The first close data packet can be, for example, a reset data packet (Reset packet, referred to as RST packet) or a finish data packet (Finish packet, referred to as FIN packet).

[0142] The source IP address in the second close data packet is the first source IP address H, and the destination IP address is the IP address W of the server. The second close data packet can be used to notify the server to stop receiving connection requests sent by the sender of the first source IP address H. The second close data packet can be, for example, a reset data packet (Reset packet, referred to as RST packet) or a finish data packet (Finish packet, referred to as FIN packet).

[0143] Next, the server sends the first close data packet to the sender of the first source IP address H. After receiving the first close data packet, the sender of the first source IP address H stops sending connection requests to the server.

[0144] The server simulates the sender of the first source IP address H and sends a second close data packet to the server. After receiving the simulated second close data packet, the server stops receiving the connection request sent by the sender of the first source IP address H.

[0145] The method for blocking abnormal connections provided in the embodiment of the present application extracts a second source IP address from the encrypted data packet to be learned. If the second source IP address exists in the precise intelligence library, a second traffic fingerprint is extracted from the encrypted data packet to be learned, and the second traffic fingerprint is updated to the initial self-learning fingerprint library to obtain a preset self-learning fingerprint library.

[0146] This processing can achieve continuous learning of threatening traffic fingerprints from the encrypted data packets to be learned, so as to update the initial self-learning fingerprint library and obtain a preset self-learning fingerprint library containing more threatening traffic fingerprints. Furthermore, in the subsequent defense stage, abnormal connections can be blocked more accurately based on the preset self-learning fingerprint library containing more threatening traffic fingerprints.

[0147] During the learning phase, when the second source IP address does not exist in the precise intelligence database and exists in the full intelligence database, the connection request sent by the sender of the second source IP address is blocked, so that abnormal connections of suspected abnormal IP addresses can be blocked.

[0148] During the learning phase, by generating a third close data packet and a fourth close data packet and sending them to the network, the server and the sender can simulate sending notifications to each other to stop the connection, thereby accurately blocking abnormal connections initiated by the sender of the second source IP address.

[0149] In the defense phase, by generating a first close data packet and a second close data packet and sending them to the network, the server and the sender can simulate sending notifications to each other to stop the connection, thereby accurately blocking the abnormal connection initiated by the sender of the first source IP address.

[0150] Figure 3 A schematic diagram of the structure of the abnormal connection blocking device provided in this application, such as Figure 3 As shown, the abnormal connection blocking device 30 provided in this embodiment includes:

[0151] The extraction module 301 is used to extract the source IP address and traffic fingerprint of the received encrypted data packet to be defended, and obtain a first source IP address and a first traffic fingerprint; wherein the encrypted data packet to be defended includes information sent by the sender of the received first source IP address based on network communication; the first traffic fingerprint is used to identify the sender device that sends the encrypted data packet to be defended;

[0152] A first comparison module 302 is used to compare the first traffic fingerprint with the traffic fingerprint in a preset self-learning fingerprint library to obtain a first comparison result; wherein the preset self-learning fingerprint library includes threatening traffic fingerprints;

[0153] The second comparison module 303 is used to obtain a full intelligence library if the first comparison result indicates that the first traffic fingerprint exists in a preset self-learning fingerprint library, and compare the first source IP address with the IP address in the full intelligence library to obtain a second comparison result; wherein the full intelligence library includes abnormal IP addresses and suspected abnormal IP addresses;

[0154] A determination module 304 is configured to determine that the first source IP address represents a first abnormal IP address if the second comparison result indicates that the first source IP address exists in the full intelligence database;

[0155] The blocking module 305 is used to block the connection request initiated by the first abnormal IP address according to the encrypted data packet to be defended.

[0156] In a possible implementation manner, the device 30 is further used for:

[0157] Extracting the source IP address of the received encrypted data packet to be learned to obtain a second source IP address; wherein the encrypted data packet to be learned includes information sent by the sender of the received second source IP address based on network communication; obtaining a precise intelligence database, and comparing the second source IP address with the IP address in the precise intelligence database to obtain a third comparison result; wherein the precise intelligence database includes the abnormal IP address in the full intelligence database;

[0158] If the third comparison result indicates that the second source IP address exists in the precise intelligence library, the initial self-learning fingerprint library is obtained, and the initial self-learning fingerprint library is updated according to the encrypted data packet to be learned to obtain a preset self-learning fingerprint library.

[0159] In a possible implementation manner, the “updating the initial self-learning fingerprint library according to the encrypted data packet to be learned to obtain a preset self-learning fingerprint library” in the device 30 is specifically used to:

[0160] Extracting a traffic fingerprint of the encrypted data packet to be learned to obtain a second traffic fingerprint; wherein the second traffic fingerprint is used to identify a sender device that sends the encrypted data packet to be learned;

[0161] If the second traffic fingerprint does not exist in the initial self-learning fingerprint library, the second traffic fingerprint is stored in the initial self-learning fingerprint library to obtain a preset self-learning fingerprint library.

[0162] In a possible implementation manner, the device 30 is further used for:

[0163] If the third comparison result indicates that the second source IP address does not exist in the precise intelligence database, the full intelligence database is obtained, and the second source IP address is compared with the IP address in the full intelligence database to obtain a fourth comparison result;

[0164] If the fourth comparison result indicates that the second source IP address exists in the full intelligence database, it is determined that the second source IP address represents the second abnormal IP address; and based on the encrypted data packet to be learned, the connection initiated by the second abnormal IP address is blocked.

[0165] In a possible implementation manner, the “blocking the connection initiated by the second abnormal IP address according to the encrypted data packet to be learned” in the device 30 is specifically used to:

[0166] Generate a third close data packet and a fourth close data packet according to the encrypted data packet to be learned; wherein the third close data packet is used to notify the sender of the second abnormal IP address to stop sending connection requests; the fourth close data packet is used to notify to stop receiving connection requests sent by the sender of the second abnormal IP address;

[0167] Sending a third closing data packet to the sender of the second abnormal IP address, and stopping sending the connection request sent by the sender of the second abnormal IP address;

[0168] The fourth closing data packet sent by the sender of the second abnormal IP address is simulated to be received, and the connection request sent by the sender of the second abnormal IP address is stopped.

[0169] In a possible implementation manner, the blocking module 305 is specifically configured to:

[0170] Generate a first closing data packet and a second closing data packet according to the encrypted data packet to be defended; wherein the first closing data packet is used to notify the sender of the first abnormal IP address to stop sending connection requests; the second closing data packet is used to notify to stop receiving connection requests sent by the sender of the first abnormal IP address;

[0171] Sending a first closing data packet to a sender of the first abnormal IP address, and stopping sending a connection request sent by the sender of the first abnormal IP address;

[0172] The receiving of a second closing data packet sent by the sender of the first abnormal IP address is simulated, and the receiving of the connection request sent by the sender of the first abnormal IP address is stopped.

[0173] The abnormal connection blocking device provided in this embodiment can execute the method provided in the above method embodiment, and its implementation principle and technical effect are similar, which will not be described in detail in this embodiment.

[0174] Figure 4 This is a schematic diagram of the structure of the electronic device provided in this application. Figure 4 As shown, the electronic device 40 provided in this embodiment includes: at least one processor 401 and a memory 402. Optionally, the device 40 also includes a communication component 403. The processor 401, the memory 402 and the communication component 403 are connected via a bus 404.

[0175] In a specific implementation process, at least one processor 401 executes the computer-executable instructions stored in the memory 402, so that at least one processor 401 executes the above method.

[0176] The specific implementation process of the processor 401 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0177] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0178] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk storage.

[0179] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0180] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0181] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0182] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0183] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0184] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0185] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0186] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0187] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0188] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes.

[0189] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A method for blocking abnormal connection, characterized in that: The method comprises: Extracting the source IP address and traffic fingerprint of the received encrypted data packet to be defended, and obtaining a first source IP address and a first traffic fingerprint; wherein the encrypted data packet to be defended includes information sent by the sender of the received first source IP address based on network communication; the first traffic fingerprint is used to identify the sender device that sends the encrypted data packet to be defended; Comparing the first traffic fingerprint with the traffic fingerprint in a preset self-learning fingerprint library to obtain a first comparison result; wherein the preset self-learning fingerprint library includes threatening traffic fingerprints; If the first comparison result indicates that the first traffic fingerprint exists in the preset self-learning fingerprint library, a full intelligence library is obtained, and the first source IP address is compared with the IP address in the full intelligence library to obtain a second comparison result; wherein the full intelligence library includes abnormal IP addresses and suspected abnormal IP addresses; If the second comparison result indicates that the first source IP address exists in the full intelligence library, it is determined that the first source IP address represents a first abnormal IP address; and based on the encrypted data packet to be defended, the connection request initiated by the first abnormal IP address is blocked.

2. The method according to claim 1, characterized in that: The method further comprises: Extracting the source IP address of the received encrypted data packet to be learned to obtain a second source IP address; wherein the encrypted data packet to be learned includes information sent by the sender of the received second source IP address based on network communication; obtaining a precise intelligence library, and comparing the second source IP address with the IP address in the precise intelligence library to obtain a third comparison result; wherein the precise intelligence library includes the abnormal IP address in the full intelligence library; If the third comparison result indicates that the second source IP address exists in the precise intelligence library, an initial self-learning fingerprint library is obtained, and the initial self-learning fingerprint library is updated according to the encrypted data packet to be learned to obtain the preset self-learning fingerprint library.

3. The method according to claim 2, characterized in that According to the encrypted data packet to be learned, the initial self-learning fingerprint library is updated to obtain the preset self-learning fingerprint library, including: Extracting a traffic fingerprint of the encrypted data packet to be learned to obtain a second traffic fingerprint; wherein the second traffic fingerprint is used to identify a sending device that sends the encrypted data packet to be learned; If the second traffic fingerprint does not exist in the initial self-learning fingerprint library, the second traffic fingerprint is stored in the initial self-learning fingerprint library to obtain the preset self-learning fingerprint library.

4. The method according to claim 2, characterized in that: The method further comprises: If the third comparison result indicates that the second source IP address does not exist in the precise intelligence database, obtaining a full intelligence database, and comparing the second source IP address with the IP addresses in the full intelligence database to obtain a fourth comparison result; If the fourth comparison result indicates that the second source IP address exists in the full intelligence library, it is determined that the second source IP address represents a second abnormal IP address; and based on the encrypted data packet to be learned, the connection initiated by the second abnormal IP address is blocked.

5. The method according to claim 4, characterized in that Blocking the connection initiated by the second abnormal IP address according to the encrypted data packet to be learned, including: Generate a third close data packet and a fourth close data packet according to the encrypted data packet to be learned; wherein the third close data packet is used to notify the sender of the second abnormal IP address to stop sending connection requests; and the fourth close data packet is used to notify to stop receiving connection requests sent by the sender of the second abnormal IP address; Sending the third close data packet to the sender of the second abnormal IP address, and stopping sending the connection request sent by the sender of the second abnormal IP address; The fourth close data packet sent by the sender of the second abnormal IP address is simulated to be received, and the connection request sent by the sender of the second abnormal IP address is stopped.

6. The method according to any one of claims 1 to 5, characterized in that According to the encrypted data packet to be defended, blocking the connection request initiated by the first abnormal IP address includes: Generate a first close data packet and a second close data packet according to the encrypted data packet to be defended; wherein the first close data packet is used to notify the sender of the first abnormal IP address to stop sending connection requests; and the second close data packet is used to notify to stop receiving connection requests sent by the sender of the first abnormal IP address; Sending the first close data packet to the sender of the first abnormal IP address, and stopping sending the connection request sent by the sender of the first abnormal IP address; The receiving of the second close data packet sent by the sender of the first abnormal IP address is simulated, and the receiving of the connection request sent by the sender of the first abnormal IP address is stopped.

7. A device for blocking abnormal connection, characterized in that: include: An extraction module is used to extract the source IP address and traffic fingerprint of the received encrypted data packet to be defended, and obtain a first source IP address and a first traffic fingerprint; wherein the encrypted data packet to be defended includes information sent by the sender of the received first source IP address based on network communication; the first traffic fingerprint is used to identify the sender device that sends the encrypted data packet to be defended; A first comparison module, used to compare the first traffic fingerprint with a traffic fingerprint in a preset self-learning fingerprint library to obtain a first comparison result; wherein the preset self-learning fingerprint library includes threatening traffic fingerprints; A second comparison module is used for obtaining a full intelligence library if the first comparison result indicates that the first traffic fingerprint exists in the preset self-learning fingerprint library, and comparing the first source IP address with the IP address in the full intelligence library to obtain a second comparison result; wherein the full intelligence library includes abnormal IP addresses and suspected abnormal IP addresses; a determination module, configured to determine that the first source IP address represents a first abnormal IP address if the second comparison result represents that the first source IP address exists in the full intelligence database; The blocking module is used to block the connection request initiated by the first abnormal IP address according to the encrypted data packet to be defended.

8. An electronic device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images