Network link state advertisement attack processing method, system, equipment and medium

Abstract

The invention discloses a network link state advertisement attack processing method, system and device and a medium. The method comprises the steps of obtaining target network LSA information corresponding to each target network LSA message by analyzing target network link state advertisement LSA messages received from a sending end; determining whether the target network LSA message is an attack message according to the target network LSA information and pre-recorded comparison information; if it is determined that the target network LSA message is an attack message, the target network LSA message is blocked from being sent to the receiving end; if it is determined that the target network LSA message is a non-attack message, pre-recorded comparison information is updated, and the target network LSA message continues to be sent to the receiving end. According to the method, the target network LSA information and the pre-recorded comparison information are verified, so that the accuracy and timeliness of detecting that the target network LSA message is the attack message of the maximum age are improved, the attack message is blocked in real time, normal operation of the network is effectively kept, and meanwhile, the safety and reliability of the network are ensured.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network link status notification attack processing method, system, equipment and medium. Background Art

[0002] The Open Shortest Path First (OSPF) protocol is a link state routing protocol widely used in network deployment. It publishes link state information in the form of Link State Advertisement (LSA). Routers in the OSPF area synchronize routing information by exchanging LSA messages.

[0003] Each LSA carries an age field, which starts at a value of zero when the LSA is generated and increases over time until it reaches the maximum age of the aged LSA (e.g., 3600 seconds). Attackers take advantage of the aging characteristics of LSAs and send aged Network LSA messages (e.g., Network LSA messages with age=3600) multiple times in a short period of time, causing the router's routing table to be frequently deleted and added, thus causing network oscillation and short-term unavailability.

[0004] The existing Network LSA maximum age attack detection method mainly relies on judging whether the age field of NetworkLSA is equal to the maximum age at the receiving end, and it needs to be triggered a certain number of times before the attack can be detected. The disadvantage of this method is that it may miss some attack messages and cannot effectively defend in real time, thereby reducing the stability and security of OSPF routers. Summary of the invention

[0005] The present invention provides a network link state announcement attack processing method, system, device and medium to solve the problem that the existing maximum age attack detection method cannot accurately and real-time detect and defend against the maximum age attack, resulting in low stability and security of OSPF routers.

[0006] In a first aspect, an embodiment of the present invention provides a method for processing a network link state notification attack, the method comprising:

[0007] Parsing the target network link state advertisement LSA message received from the sending end, and obtaining the target network LSA information corresponding to each target network LSA message, wherein the target network LSA information includes the target network LSA age;

[0008] Determine whether the target network LSA message is an attack message according to the target network LSA information and pre-recorded comparison information, wherein the pre-recorded comparison information includes comparison router LSA information and comparison network LSA information;

[0009] If it is determined that the target network LSA message is an attack message, blocking the target network LSA message from being sent to the receiving end;

[0010] If it is determined that the target network LSA message is not an attack message, the pre-recorded comparison information is updated, and the target network LSA message continues to be sent to the receiving end.

[0011] In a second aspect, an embodiment of the present invention provides a network link state notification attack processing device, the device comprising:

[0012] The target information determination module is used to parse the target network link state advertisement LSA message received from the sending end, and obtain the target network LSA information corresponding to each target network LSA message;

[0013] An attack message identification module, used to determine whether the target network LSA message is an attack message according to the target network LSA information and pre-recorded comparison information;

[0014] An attack message processing module, configured to block the target network LSA message from being sent to a receiving end if the target network LSA message is determined to be an attack message;

[0015] The non-attack message processing module is used to update the pre-recorded comparison information if it is determined that the target network LSA message is a non-attack message, and continue to send the target network LSA message to the receiving end.

[0016] In a third aspect, an embodiment of the present invention provides an electronic device, the electronic device comprising:

[0017] at least one processor;

[0018] and a memory communicatively coupled to the at least one processor;

[0019] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network link state notification attack processing method described in any embodiment of the present invention.

[0020] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network link status notification attack processing method described in any embodiment of the present invention when executed.

[0021] In a fifth aspect, an embodiment of the present invention further provides a computer program product, wherein the computer program product includes a computer program, and when the computer program is executed by a processor, the network link status notification attack processing method described in any embodiment of the present invention is implemented.

[0022] The technical solution of the embodiment of the present invention is to obtain the target network LSA information corresponding to each target network LSA message by parsing the target network link state notification LSA message received from the sending end, wherein the target network LSA information includes the target network LSA age; determine whether the target network LSA message is an attack message according to the target network LSA information and the pre-recorded comparison information, wherein the pre-recorded comparison information includes the comparison router LSA information and the comparison network LSA information; if the target network LSA message is determined to be an attack message, block the target network LSA message from being sent to the receiving end; if the target network LSA message is determined to be a non-attack message, update the pre-recorded comparison information, and continue to send the target network LSA message to the receiving end. The method verifies the target network LSA information with the pre-recorded comparison information to determine whether the target network LSA message is an attack message, thereby improving the accuracy and timeliness of detecting whether the target network LSA message is a maximum age attack message, and effectively blocks the attack message in real time while maintaining the normal operation of the network, ensuring the security, reliability and stability of the network.

[0023] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 A flowchart of a method for processing a network link status notification attack provided by an embodiment of the present invention;

[0026] Figure 2A schematic diagram of the principle of a method for processing a network link state notification attack provided by an embodiment of the present invention;

[0027] Figure 3 A schematic diagram of the structure of a network link status notification attack processing device provided by an embodiment of the present invention;

[0028] Figure 4 A schematic diagram of the structure of an electronic device that can be used to implement an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "target", "original", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] It should be noted that the existing network link state advertisement LSA maximum age attack detection method mainly relies on judging whether the age of the network LSA is equal to the maximum age at the receiving end, and it needs to be triggered a certain number of times before the attack can be detected. The disadvantage of this method is that it may miss some attack packets and cannot effectively defend in real time, thus bringing potential risks to the stability and security of OSPF routers.

[0032] Based on this, an embodiment of the present invention provides a method for processing a network link status notification attack. Figure 1A flowchart of a network link state announcement attack processing method provided in an embodiment of the present invention. The embodiment of the present invention can be applied to the scenario of detecting and defending against network link state announcement maximum age attacks in an OSPF area. The method can be executed by a network link state announcement attack processing device, which can be implemented in the form of software and / or hardware, and optionally, by an electronic device, which is preferably a mobile terminal, a desktop computer, a laptop computer, a server, etc.

[0033] like Figure 1 As shown, the network link state notification attack processing method provided by the embodiment of the present invention may specifically include:

[0034] S101. Parse target network link state advertisement LSA messages received from a sending end to obtain target network LSA information corresponding to each target network LSA message, wherein the target network LSA information includes the target network LSA age.

[0035] In this embodiment, the target network link state advertisement LSA message can be understood as a network LSA message with detection, identification and other processing requirements received from the sender, which can be generated and sent by the sender, or received and forwarded by the sender. The target network LSA information can be understood as part or all of the information contained in the message obtained after parsing the target network LSA message, such as the router neighbor relationship and link state information of the sender. The target network LSA age can be understood as the time used to record the target network LSA since its creation, that is, the survival cycle. It can be understood that the target network LSA age increases with time. During the increasing process, the validity of the target network LSA can be guaranteed by periodic refresh (such as resetting when reaching half of the maximum age). When the target network LSA age increases to the maximum age and is not refreshed, it is considered that the corresponding target network LSA is invalid and will be deleted from the router's database and no longer participate in the routing calculation.

[0036] Specifically, all target network link state advertisement LSA messages sent by a sending end router to a receiving end router in an open shortest path first (OSPF) protocol network are obtained, each received target network LSA message is parsed, and target network LSA information corresponding to each target network LSA message is obtained as needed.

[0037] It can be understood that the process of acquiring the target network LSA message sent by the sender is during the transmission process of the message, that is, the receiver has not yet received the target network LSA message sent by the sender.

[0038] S102: Determine whether the target network LSA message is an attack message according to the target network LSA information and pre-recorded comparison information, wherein the pre-recorded comparison information includes comparison router LSA information and comparison network LSA information.

[0039] In this embodiment, the comparison information can be understood as information reflecting the latest state of the network, such as the latest state of each router and the latest state of each link, which is used to provide reference information for timely discovery of network abnormalities. The comparison information includes comparing router LSA information and comparing network LSA information. The comparing router LSA information and comparing network LSA information can be determined by real-time recording of the latest normal router LSA information and network LSA information, respectively. Router LSA information can be understood as information containing each router's own information and the link state between adjacent routers, which is used to provide other routers with information about their directly connected networks and neighbors, helping to build a complete link state database. The attack message can be understood as a target network LSA message that forges the target network LSA age as the maximum age. The maximum age can be understood as the age at which the link is confirmed to be aged, that is, a router that receives an attack message with the target network LSA age as the maximum age will mistakenly believe that the link corresponding to the message is disconnected through routing calculation.

[0040] In this embodiment, when the target network LSA age in the target network LSA information is the maximum age, it is determined whether the target network LSA message meets the characteristics of the maximum age attack message according to the preset defense condition. If the preset defense condition is met, the pre-recorded corresponding comparison information is searched, and it is determined whether the target network LSA message is a real network LSA message according to the comparison network LSA information; if it is determined to be a real network LSA message, then the consistency verification of the network disconnection state reflected by the target network LSA information is performed by comparing the network state reflected by the router LSA information; if the network state reflected by the comparison router LSA information is that the network is normal, it is determined that the verification result is that the target network LSA message is an attack message; if the network state reflected by the comparison router LSA information is that the network is disconnected, it is determined that the verification result is that the target network LSA message is a non-attack message.

[0041] S103: If it is determined that the target network LSA message is an attack message, block the target network LSA message from being sent to the receiving end.

[0042] In this embodiment, once the target network LSA message is determined to be an attack message, the target network LSA message is blocked from continuing to be sent to the receiving end, so as to ensure that the receiving end router is not attacked by the attack message.

[0043] S104: If it is determined that the target network LSA message is not an attack message, the pre-recorded comparison information is updated, and the target network LSA message continues to be sent to the receiving end.

[0044] In this embodiment, if the target network LSA message is determined to be a non-attack message, the corresponding information in the pre-recorded comparison information can be updated according to the target network LSA message to ensure that the comparison information stores information that can reflect the latest status of the network, and release the target network LSA message, so that the target network LSA message continues to be sent to the receiving router to maintain the dynamic routing and stability of the network.

[0045] An embodiment of the present invention provides a network link state announcement attack processing method, which obtains target network LSA information corresponding to each target network LSA message by parsing the target network link state announcement LSA message received from the sending end, wherein the target network LSA information includes the target network LSA age; determines whether the target network LSA message is an attack message according to the target network LSA information and pre-recorded comparison information, wherein the pre-recorded comparison information includes comparison router LSA information and comparison network LSA information; if it is determined that the target network LSA message is an attack message, the target network LSA message is blocked from being sent to the receiving end; if it is determined that the target network LSA message is not an attack message, the pre-recorded comparison information is updated, and the target network LSA message continues to be sent to the receiving end. The method verifies the target network LSA information with the pre-recorded comparison information to determine whether the target network LSA message is an attack message, thereby improving the accuracy and timeliness of detecting whether the target network LSA message is a maximum-age attack message, and effectively ensures the security, reliability and stability of the network while maintaining the normal operation of the network by blocking the attack message in real time.

[0046] As a first optional embodiment of this embodiment, based on the above embodiment, the step of determining whether the target network LSA message is an attack message based on the target network LSA information and the pre-recorded comparison information may be specifically implemented as the following steps:

[0047] a1) detecting the target network LSA age in the target network LSA information, and if the target network LSA age is a preset maximum age, determining whether the target network LSA information meets a defense condition.

[0048] The maximum age can be understood as the age of the link that is confirmed to be aged, that is, a router that receives an attack message with the target network LSA age as the maximum age will mistakenly believe that the link corresponding to the message is disconnected through routing calculation. The defense condition can be understood as the condition for judging the attack message, that is, only the message that meets the defense condition has the possibility of being an attack message or has the aggressiveness recognized by the router.

[0049] In this embodiment, a maximum age (such as 3600 seconds) is set in advance according to needs or experience. After the target network LSA age in the target network LSA information is obtained, it is determined whether the target network LSA age is the maximum age. If it is the preset maximum age, the next step is performed to determine whether the target network LSA information meets the defense conditions. The defense conditions can be set in advance according to experience and may include a source router, a checksum, an LSA sequence number, etc.

[0050] As one implementation manner, the target network LSA information further includes: a target network LSA sequence number and a target connection router identifier; the comparison network LSA information includes: a comparison network LSA sequence number and a comparison connection router identifier.

[0051] Among them, the network LSA sequence number can be understood as a sequence number that identifies the network LSA version, which is used to determine the newness of the network LSA message, that is, when the router that generates the network LSA updates the network LSA, the network LSA sequence number in the network LSA information contained in the sent network LSA message will increase. It can be understood that the larger the network LSA sequence number, the newer the network LSA message. The connection router identifier can be understood as an identifier that describes each router that is directly connected to a specific multi-access network (such as Ethernet) and has established an adjacency relationship with a designated router.

[0052] It should be noted that the network LSA sequence numbers to be compared are the latest sequence numbers corresponding to the non-attack messages that have been most recently sent by each router at the sending end.

[0053] Accordingly, this optional embodiment can further specify the defense conditions as follows:

[0054] a11) The target network LSA sequence number in the target network LSA information is greater than the comparison network LSA sequence number in the comparison network LSA information.

[0055] In this embodiment, the corresponding comparison network LSA information in the comparison network is determined according to the interface IP address in the target network LSA information, and the target network LSA sequence number in the target network LSA information and the comparison network LSA sequence number in the comparison network LSA information are respectively obtained to determine whether the target network LSA sequence number is greater than the comparison network LSA sequence number. If it is greater, this defense condition is satisfied, that is, the target network LSA information is the latest network LSA information in history and has the conditions for recognition by the receiving end router, which means that there is a possibility of attacking the network and further verification is required. If the target network LSA sequence number is not greater than the comparison network LSA sequence number, it is considered that the target network LSA information is outdated and is not recognized by the receiving end router, and no further verification is required.

[0056] a12) The target connection router identifier is identical to at least one of the comparison connection router identifiers.

[0057] In this embodiment, the target connection router identifier in the target network LSA information is obtained, and it is determined from the comparison network LSA information whether there is a comparison connection router identifier that is the same as the target connection router identifier. If so, it means that the target network LSA information is sent by a real router and can be used to update the routing table, that is, it has the possibility of attacking the network. If not, it is determined that the target network LSA information is forged information and is not recognized by the receiving router, and no further verification is required.

[0058] The above technical solution of this embodiment, by presetting defense conditions, compares the target network LSA information and compares the network LSA sequence number and the connection router identifier in the network LSA information, effectively filters the forged messages that do not cause attack impact, and improves the efficiency and accuracy of attack message identification.

[0059] b1) If the target network LSA information meets the defense condition, link verification is performed on the target network LSA information according to the comparison router LSA information to determine the verification result of the target network LSA message.

[0060] In this embodiment, if the target network LSA information meets the defense condition, at least one comparison router LSA information for comparison and verification is determined based on the information contained in the target network LSA information, and it is determined whether the link state reflected by the corresponding comparison router LSA information is the abnormal operating state reflected by the target network LSA information, thereby determining the verification result of the target network LSA message.

[0061] The above technical scheme of this embodiment, by determining whether the target network LSA information meets the defense conditions after detecting that the target network LSA age is a preset maximum age, achieves effective filtering of non-attack messages or forged messages that do not cause the impact of the maximum age attack, improves recognition efficiency, and saves computing resources; by performing link verification on the target network LSA information according to the comparison of router LSA information to determine the verification result, it reduces false positives and false negatives and improves the security and stability of the network.

[0062] As one implementation method, the comparing router LSA information includes: comparing router link identifiers;

[0063] The comparison router link identifier can be understood as an identifier used to uniquely identify a specific link (ie, interface) on a router, which is usually an IP address.

[0064] This optional embodiment may further implement the following contents: performing link verification on the target network LSA information according to the comparison of the router LSA information to determine the verification result of the target network LSA message:

[0065] b11) determining a comparison router link identifier that is identical to one of the target connection router identifiers from the comparison router LSA information, and determining the comparison router LSA information corresponding to the comparison router link identifier as the verification router LSA information.

[0066] Among them, verifying the router LSA information can be understood as comparing the router LSA information with the same target connection router identifier in the target network LSA information, that is, reflecting the link status of the same link as the target network LSA information, so it can be used to perform link verification on the target network LSA information.

[0067] In this embodiment, a comparison router LSA information is searched from all comparison router LSA information, and its comparison router link identifier is the same as one of the target connection router identifiers in the target network LSA information. After finding the comparison router link identifier that is the same as one of the target connection router identifiers, the comparison router LSA information corresponding to the comparison router link identifier is determined as the verification router LSA information.

[0068] b12) detecting whether there is a transmission network identifier field in the verification router LSA information; if the transmission network identifier field exists, indicating that the link is in a normal operating state, then determining that the verification result is that the target network LSA message is an attack message.

[0069] The transmission network identifier field may be understood as a field describing the network type and regional transmission capability to which the router is connected.

[0070] In this embodiment, it is checked whether there is a transmission network identifier field in the router LSA information. If it exists, it indicates that the link has the traffic transmission capability, that is, the verification result of the abnormal operating link described in the target network LSA information is that the link is operating normally. The link verification results are inconsistent. At this time, it is determined that the verification result is that the target network LSA message is an attack message.

[0071] b13) If the transmission network identifier field does not exist, indicating that the link is in an abnormal operating state, then determining that the verification result is that the target network LSA message is a non-attack message.

[0072] In this embodiment, if the transmission network identifier field does not exist in the router LSA information, it indicates that the link does not have the routing forwarding or traffic transmission capability, that is, the verification result of the abnormal operating link described in the target network LSA information is that the link is operating abnormally, and the link verification results are consistent. At this time, the verification result is determined to be that the target network LSA message is a non-attack message.

[0073] The above technical solution of this embodiment determines and verifies the router LSA information according to the target connection router identifier and the comparison router link identifier, and confirms the abnormal operating link described in the target network LSA information by verifying whether there is a transmission network identifier field in the router LSA information, thereby determining the verification result of the target network LSA message, reducing the possibility of missed reports and false reports, and effectively improving the accuracy, reliability and timeliness of detecting attack messages.

[0074] As one implementation method, this optional embodiment also includes:

[0075] a2) if the target network LSA age is not the preset maximum age, updating the comparison network LSA information according to the target network LSA information.

[0076] In this embodiment, when it is detected that the target network LSA age in the target network LSA information is not the preset maximum age, that is, does not meet the characteristics of an attack message, the corresponding historical latest information recorded in the comparison network LSA information is updated according to the target network LSA information.

[0077] It is understandable that the comparison network LSA information stores all the comparison router LSA information and comparison network LSA information in the OSPF network. Therefore, when updating, it is necessary to first find the historically stored comparison network LSA information corresponding to the target network LSA information and update the corresponding comparison network LSA information.

[0078] b2) If the target network LSA information does not meet the defense condition, the target network LSA information is ignored.

[0079] In this embodiment, if it is determined that the target network LSA information does not meet the defense condition, it means that the receiving end router will not recognize the target network LSA information, and the target network LSA information is directly ignored, that is, no subsequent processing is performed.

[0080] The above technical scheme of this embodiment ensures the accuracy, reliability and effectiveness of the compared network LSA information by updating the compared network LSA information in real time according to the target network LSA information when the target network LSA age is not the preset maximum age, thereby improving the accuracy of detecting attack messages; and improves the efficiency of detecting attack messages by filtering the target network LSA information that does not meet the defense conditions.

[0081] As a second optional embodiment of this embodiment, based on the above embodiment, it also includes:

[0082] a3) Parse the router link state advertisement LSA message received from the sending end to obtain the router LSA information corresponding to each router LSA message.

[0083] Among them, the router LSA message can be understood as a message generated by each OSPF router to describe the link status between itself and the adjacent router. Each router LSA message contains all the interface information of the router, such as interface type, subnet mask, IP address, etc.

[0084] In this embodiment, the router link state advertisement LSA message sent by the sending end router is received and parsed in real time, and the corresponding router LSA information is obtained as needed by parsing each router LSA message.

[0085] b3) updating the pre-recorded comparison information in real time according to the router LSA information.

[0086] In this embodiment, the compared router LSA information in the compared information is updated by recording the latest router LSA information in real time.

[0087] The above technical solution of this embodiment ensures the real-time and accuracy of the comparison router LSA information by dynamically updating the comparison router LSA information in the pre-recorded comparison information in real time according to the router LSA information, provides an effective reference for determining the verification result of the target network LSA message, improves the accuracy and reliability of detecting attack messages, and thus ensures the stable operation of the network.

[0088] In order to better understand a method for processing a network link state advertisement attack provided by an embodiment of the present invention, a specific example is given here.

[0089] Figure 2 The following is a schematic diagram of the principle of a method for processing a network link state notification attack provided by an embodiment of the present invention. Figure 2 As shown, first, the RDR device (i.e., the network link state notification attack processing device) is connected in series in the network to learn the LSA messages of the entire network in real time. Router R4 is selected as the designated router between router R1 and router R4 through an election mechanism, and is used to send the target network LSA message as the sender, that is, to send L3 messages and forward A1 attack messages. When the attacker's personal computer PC does not send an attack message, the sender router R1 sends a router LSA message, i.e., an L1 message, to the receiver router R2, and the sender router R4 sends a router LSA message, i.e., an L2 message, to the receiver router R2. Then, the sender router R4, as the designated router, sends the target network LSA message, i.e., an L3 message, to the receiver router R2.

[0090] In this process, the network link state notification attack processing device (RDR device) obtains L1 messages, L2 messages and L3 messages sent by the sending router in real time, obtains router LSA information corresponding to each router LSA message and target network LSA information corresponding to the target network LSA message by parsing, records the router LSA information to form or update comparison information, and if the target network LSA age in the target network LSA information is not the maximum age, then records the target network LSA information to form or update comparison information.

[0091] When the attacker's personal computer PC sends an A1 attack message to router R4, it attempts to simulate the target network LSA message (L3 message) generated by router R4 and send it to the receiving router R2, so that after receiving the A1 attack message forwarded by router R4, router R2 mistakenly believes through routing calculation that the R1-R4 link is disconnected (in fact, the R1-R4 link is not disconnected); or the target network LSA age in the target network LSA information is the maximum age (such as 3600).

[0092] At this time, when the RDR device receives the target network LSA message (A1 attack message), it parses and obtains the target network LSA information, detects that the target network LSA age is the maximum age of 3600, and then determines whether the target network LSA information meets the defense condition. If it meets the condition, it determines the L3 message, that is, the target network LSA message is a message sent by the real router by finding whether there is a comparison connection router identifier that is the same as the target connection router identifier of the target network LSA message (A1 attack message). Then find at least one comparison router link identifier, which is the same as one of the target connection router identifiers, and determine the verification router LSA information, that is, the comparison router LSA information of router R1 and / or router R4 (that is, the information corresponding to the L1 message and / or the information corresponding to the L2 message). Then, the OSPF protocol Transit link verification is performed on the target network LSA information based on the verification router LSA information. If the verification router LSA information corresponding to R1 (L1) or R4 (L2) indicates that the link of R1-R4 is in normal operation, the verification result is determined to be that the target network LSA message is a network LSA maximum age attack message; and the RDR device will block the target network LSA message (A1 attack message), and router R2 will not receive the attack message, thereby effectively protecting the stable operation of the network in real time.

[0093] Figure 3 The structure diagram of a network link status notification attack processing device provided by an embodiment of the present invention is shown in FIG. Figure 3 As shown, the device includes: a target information determination module 31, an attack message identification module 32, an attack message processing module 33 and a non-attack message processing module 34, wherein:

[0094] The target information determination module 31 is used to parse the target network link state advertisement LSA message received from the sending end, and obtain the target network LSA information corresponding to each target network LSA message, wherein the target network LSA information includes the target network LSA age, the target network LSA sequence number and the target connection router identifier;

[0095] The attack message identification module 32 is used to determine whether the target network LSA message is an attack message according to the target network LSA information and the pre-recorded comparison information, wherein the pre-recorded comparison information includes the comparison router LSA information and the comparison network LSA information; the comparison router LSA information includes: the comparison router link identifier; the comparison network LSA information includes: the comparison network LSA sequence number and the comparison connection router identifier;

[0096] An attack message processing module 33, configured to block the target network LSA message from being sent to a receiving end if it is determined that the target network LSA message is an attack message;

[0097] The non-attack message processing module 34 is used to update the pre-recorded comparison information if it is determined that the target network LSA message is a non-attack message, and continue to send the target network LSA message to the receiving end.

[0098] An embodiment of the present invention provides a network link state announcement attack processing device, which obtains target network LSA information corresponding to each target network LSA message by parsing the target network link state announcement LSA message received from the sending end, wherein the target network LSA information includes the target network LSA age; determines whether the target network LSA message is an attack message according to the target network LSA information and pre-recorded comparison information, wherein the pre-recorded comparison information includes comparison router LSA information and comparison network LSA information; if it is determined that the target network LSA message is an attack message, blocks the target network LSA message from being sent to the receiving end; if it is determined that the target network LSA message is not an attack message, updates the pre-recorded comparison information, and continues to send the target network LSA message to the receiving end. The method verifies the target network LSA information with the pre-recorded comparison information to determine whether the target network LSA message is an attack message, thereby improving the accuracy and timeliness of detecting whether the target network LSA message is a maximum-age attack message, and effectively ensures the security, reliability and stability of the network while maintaining the normal operation of the network by blocking the attack message in real time.

[0099] Furthermore, the attack message identification module 32 may specifically include:

[0100] a condition detection unit, configured to detect the target network LSA age in the target network LSA information, and if the target network LSA age is a preset maximum age, determine whether the target network LSA information satisfies a defense condition; the defense condition includes: the target network LSA sequence number in the target network LSA information is greater than the comparison network LSA sequence number in the comparison network LSA information; the target connection router identifier is the same as at least one of the comparison connection router identifiers;

[0101] The result verification unit is used to perform link verification on the target network LSA information according to the comparison router LSA information if the target network LSA information meets the defense condition, and determine the verification result of the target network LSA message.

[0102] Furthermore, the result verification unit may specifically include:

[0103] Determine a comparison router link identifier that is identical to one of the target connection router identifiers from the comparison router LSA information, and determine the comparison router LSA information corresponding to the comparison router link identifier as the verification router LSA information;

[0104] Detecting whether a transmission network identifier field exists in the verification router LSA information, and if the transmission network identifier field exists, indicating that the link is in a normal operating state, then determining that the verification result is that the target network LSA message is an attack message;

[0105] If the transmission network identifier field does not exist, indicating that the link is in an abnormal operating state, then the verification result is determined to be that the target network LSA message is a non-attack message.

[0106] Furthermore, the attack message identification module 32 also includes an execution unit, which can be specifically used to:

[0107] If the target network LSA age is not the preset maximum age, updating the comparison network LSA information according to the target network LSA information;

[0108] If the target network LSA information does not meet the defense condition, the target network LSA information is ignored.

[0109] Furthermore, the network link status notification attack processing device also includes a record update module, which can be specifically used to:

[0110] Parse the router link state advertisement LSA message received from the sender to obtain the router LSA information corresponding to each router LSA message;

[0111] The pre-recorded comparison information is updated in real time according to the router LSA information.

[0112] The network link status notification attack processing device provided in the embodiment of the present invention can execute the network link status notification attack processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0113] Figure 4A schematic diagram of the structure of an electronic device 40 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0114] like Figure 4 As shown, the electronic device 40 includes at least one processor 41, and a memory connected to the at least one processor 41, such as a read-only memory (ROM) 42, a random access memory (RAM) 43, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 41 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 42 or the computer program loaded from the storage unit 48 to the random access memory (RAM) 43. In the RAM 43, various programs and data required for the operation of the electronic device 40 can also be stored. The processor 41, the ROM 42, and the RAM 43 are connected to each other through a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0115] A number of components in the electronic device 40 are connected to the I / O interface 45, including: an input unit 46, such as a keyboard, a mouse, etc.; an output unit 47, such as various types of displays, speakers, etc.; a storage unit 48, such as a disk, an optical disk, etc.; and a communication unit 49, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 49 allows the electronic device 40 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0116] The processor 41 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 41 executes the various methods and processes described above, such as a network link state notification attack processing method.

[0117] In some embodiments, the network link state announcement attack processing method can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 48. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 40 via the ROM 42 and / or the communication unit 49. When the computer program is loaded into the RAM 43 and executed by the processor 41, one or more steps of the network link state announcement attack processing method described above can be performed. Alternatively, in other embodiments, the processor 41 can be configured to execute the network link state announcement attack processing method in any other appropriate manner (for example, by means of firmware).

[0118] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0119] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0120] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0121] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0122] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0123] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0124] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0125] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for processing a network link state notification attack, characterized in that: include: Parsing the target network link state advertisement LSA message received from the sending end, and obtaining the target network LSA information corresponding to each target network LSA message, wherein the target network LSA information includes the target network LSA age; Determine whether the target network LSA message is an attack message according to the target network LSA information and pre-recorded comparison information, wherein the pre-recorded comparison information includes comparison router LSA information and comparison network LSA information; If it is determined that the target network LSA message is an attack message, blocking the target network LSA message from being sent to the receiving end; If it is determined that the target network LSA message is not an attack message, the pre-recorded comparison information is updated, and the target network LSA message continues to be sent to the receiving end.

2. The method according to claim 1, characterized in that The determining, based on the target network LSA information and pre-recorded comparison information, whether the target network LSA message is an attack message includes: Detecting the target network LSA age in the target network LSA information, and if the target network LSA age is a preset maximum age, determining whether the target network LSA information meets a defense condition; If the target network LSA information meets the defense condition, link verification is performed on the target network LSA information according to the comparison router LSA information to determine a verification result of the target network LSA message.

3. The method according to claim 2, characterized in that The target network LSA information also includes: a target network LSA sequence number and a target connection router identifier; The comparing network LSA information includes: comparing network LSA sequence numbers and comparing connection router identifiers; Accordingly, the defense conditions include: The target network LSA sequence number in the target network LSA information is greater than the comparison network LSA sequence number in the comparison network LSA information; The target connection router identifier is identical to at least one of the comparison connection router identifiers.

4. The method according to claim 2, characterized in that: The comparing router LSA information includes: comparing router link identifiers; The link verification of the target network LSA information is performed according to the comparison of the router LSA information to determine the verification result of the target network LSA message, including: Determine a comparison router link identifier that is identical to one of the target connection router identifiers from the comparison router LSA information, and determine the comparison router LSA information corresponding to the comparison router link identifier as the verification router LSA information; Detecting whether a transmission network identifier field exists in the verification router LSA information, and if the transmission network identifier field exists, indicating that the link is in a normal operating state, then determining that the verification result is that the target network LSA message is an attack message; If the transmission network identifier field does not exist, indicating that the link is in an abnormal operating state, then the verification result is determined to be that the target network LSA message is a non-attack message.

5. The method according to claim 2, characterized in that: Also includes: If the target network LSA age is not the preset maximum age, updating the comparison network LSA information according to the target network LSA information; If the target network LSA information does not meet the defense condition, the target network LSA information is ignored.

6. The method according to claim 1, characterized in that Also includes: Parse the router link state advertisement LSA message received from the sender to obtain the router LSA information corresponding to each router LSA message; The pre-recorded comparison information is updated in real time according to the router LSA information.

7. A network link status notification attack processing device, characterized in that: include: A target information determination module, used for parsing the target network link state advertisement LSA message received from the sending end, and obtaining the target network LSA information corresponding to each target network LSA message, wherein the target network LSA information includes the target network LSA age; An attack message identification module, used to determine whether the target network LSA message is an attack message according to the target network LSA information and pre-recorded comparison information, wherein the pre-recorded comparison information includes comparison router LSA information and comparison network LSA information; An attack message processing module, configured to block the target network LSA message from being sent to a receiving end if the target network LSA message is determined to be an attack message; The non-attack message processing module is used to update the pre-recorded comparison information if it is determined that the target network LSA message is a non-attack message, and continue to send the target network LSA message to the receiving end.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network link state notification attack processing method described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network link status notification attack processing method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the network link state advertisement attack processing method according to any one of claims 1 to 6.

Images