Message processing method and device, electronic equipment and storage medium
By implementing packet address translation and attack feature judgment methods in network security detection and defense equipment, the problem of normal service requests being accidentally intercepted is solved, ensuring the stability and reliability of service access.
Patent Information
- Application Number
- CN202411781118.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-05
- Publication Date
- 2025-03-25
AI Technical Summary
Existing network security detection and defense devices cannot avoid the problem of accidentally intercepting normal business requests when intercepting network attacks.
By obtaining the target message, obtaining the IP address based on the translation address database for address conversion, and determining whether the message has attack behavior based on the attack feature information. If there is an attack, remove the target address and re-acquire it until the packet does not have an attack behavior.
It effectively avoids the situation where normal service packets are accidentally intercepted due to address translation triggering attack behavior, and ensures the stability and reliability of service access.
Smart Images
Figure CN119697152A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of message processing, and in particular, to a message processing method, device, electronic device and storage medium. Background Art
[0002] Faced with increasingly complex network threats, most companies often deploy network security detection and defense security devices in front of business servers in order to resolve various types of network attacks and ensure the normal operation of internal servers and the stable, reliable and continuous operation of business systems. When network security detection and defense security devices detect network attacks and intercept them based on attack characteristics, they cannot meet the situation where normal business requests are forwarded to network security detection and defense products after source address conversion by data communication products and are mistakenly intercepted. Therefore, it is particularly important to ensure that normal business access is not mistakenly intercepted as much as possible. Summary of the invention
[0003] The purpose of the embodiments of the present application is to provide a message processing method, device, electronic device and storage medium, which are used to perform address conversion on messages and forward the address converted messages. At the same time, it is used to prevent normal business messages from being mistakenly intercepted after address conversion.
[0004] In a first aspect, the present invention provides a message processing method, the method comprising:
[0005] Get the target message;
[0006] Acquire an IP address based on the conversion address library and use it as the target address, and perform address conversion on the target message based on the target address;
[0007] Determine whether the target message has an attack behavior based on the attack feature information, and if the determination result indicates that the target message has the attack behavior, remove the target address from the conversion address library, and reacquire an IP address from the conversion address library as the target address, until the target address makes the target message free of the attack behavior;
[0008] Forward the target message.
[0009] In the first aspect of the present application, a target message is obtained, and then an IP address is obtained based on a conversion address library and used as the target address, and the target message is converted based on the target address, and then it is determined whether the target message has an attack behavior based on attack feature information. If the judgment result indicates that the target message has the attack behavior, the target address is removed from the conversion address library, and an IP address is re-obtained from the conversion address library as the target address, until the target address makes the target message free of the attack behavior, and the target message is forwarded, thereby avoiding the normal business message being mistakenly intercepted due to the conversion address triggering the attack behavior.
[0010] In an optional embodiment, the method further comprises:
[0011] Attack interception information is acquired in real time, and the attack feature information is determined based on the attack interception information.
[0012] This optional implementation can obtain the attack interception information in real time, and determine the attack feature information based on the attack interception information.
[0013] In an optional implementation manner, the attack feature information includes an attack source address, and judging whether the target message includes an attack behavior based on the attack feature information includes:
[0014] It is determined whether the target message hits the attack source address. If the target message hits the attack source address, it is determined that the target message has the attack behavior.
[0015] This optional implementation manner determines whether the target message hits the attack source address, and then can determine that the target message has the attack behavior when the target message hits the attack source address.
[0016] In an optional implementation manner, the attack feature information further includes attack quadruple information, wherein the step of judging whether the target message includes attack behavior based on the attack feature information further includes:
[0017] When the target message does not hit the attack source address, it is determined whether the target message hits the attack four-tuple information; if the target message hits the attack four-tuple information, it is determined that the target message has the attack behavior.
[0018] This optional implementation manner can determine whether the target message hits the attack four-tuple information when the target message does not hit the attack source address. If the target message hits the attack four-tuple information, it is determined that the target message has the attack behavior.
[0019] In an optional implementation manner, the attack feature information further includes attack triplet information, wherein the step of judging whether the target message includes attack behavior based on the attack feature information further includes:
[0020] When the target message does not hit the attack four-tuple information, it is determined whether the target message hits the triple information. If the target message hits the triple information, it is determined that the target message has the attack behavior.
[0021] This optional implementation manner can determine whether the target message hits the triplet information when the target message does not hit the attack quadruple information. If the target message hits the triplet information, it is determined that the target message contains the attack behavior.
[0022] In an optional implementation manner, after performing address conversion on the target message based on the target address and before determining whether the target message contains attack behavior based on the attack feature information, the method further includes:
[0023] It is determined whether the attack feature information exists in the cache information, and if the attack feature information exists in the cache information, the step of determining whether the target message has an attack behavior based on the attack feature information is performed.
[0024] This optional implementation manner determines whether the attack feature information exists in the cache information, and then if the attack feature information exists in the cache information, the determination of whether the target message has an attack behavior based on the attack feature information is performed.
[0025] In an optional implementation manner, after acquiring the target message and before acquiring an IP address based on the conversion address library and using it as the target address, the method further includes:
[0026] Determine whether the target message hits the application load policy. If the target message hits the application load policy, execute the step of obtaining an IP address based on the conversion address library and use it as the target address.
[0027] This optional implementation method determines whether the target message hits the application load policy, and then when the target message hits the application load policy, it can execute the acquisition of an IP address based on the conversion address library and use it as the target address.
[0028] In a second aspect, the present invention provides a message processing device, the method comprising:
[0029] An acquisition module, used to acquire a target message;
[0030] An address conversion module, used for acquiring an IP address based on a conversion address library and using it as a target address, and performing address conversion on the target message based on the target address;
[0031] A judgment module, used for judging whether the target message has an attack behavior based on the attack feature information, and if the judgment result indicates that the target message has the attack behavior, removing the target address from the conversion address library, and reacquiring an IP address from the conversion address library as the target address, until the target address makes the target message free of the attack behavior;
[0032] A forwarding module is used to forward the target message.
[0033] The device of the second aspect of the present application can obtain the target message by executing the message processing method, and then can obtain an IP address based on the conversion address library and use it as the target address, and perform address conversion on the target message based on the target address, and then can judge whether the target message has an attack behavior based on the attack feature information. If the judgment result indicates that the target message has the attack behavior, the target address is removed from the conversion address library, and an IP address is re-obtained from the conversion address library as the target address, until the target address makes the target message free of the attack behavior, and forwards the target message, thereby avoiding the normal business message being mistakenly intercepted due to the conversion address triggering the attack behavior.
[0034] In a third aspect, the present invention provides an electronic device, the device comprising:
[0035] Processor; and
[0036] A memory configured to store machine-readable instructions, which, when executed by the processor, execute the method described in any one of the aforementioned embodiments.
[0037] The electronic device of the third aspect of the present application can obtain a target message by executing a message processing method, and then can obtain an IP address based on a conversion address library as a target address, and perform address conversion on the target message based on the target address, and then can judge whether the target message has an attack behavior based on attack feature information. If the judgment result indicates that the target message has the attack behavior, the target address is removed from the conversion address library, and an IP address is re-obtained from the conversion address library as the target address, until the target address makes the target message free of the attack behavior, and forwards the target message, thereby avoiding the normal business message being mistakenly intercepted due to the conversion address triggering the attack behavior.
[0038] In a fourth aspect, the present invention provides a storage medium storing a computer program, wherein the computer program is executed by a processor as described in any one of the aforementioned embodiments.
[0039] The storage medium of the fourth aspect of the present application can obtain the target message by executing the message processing method, and then can obtain an IP address based on the conversion address library and use it as the target address, and perform address conversion on the target message based on the target address, and then can judge whether the target message has an attack behavior based on the attack feature information. If the judgment result indicates that the target message has the attack behavior, the target address is removed from the conversion address library, and an IP address is re-obtained from the conversion address library as the target address, until the target address makes the target message free of the attack behavior, and forwards the target message, thereby avoiding the normal business message being mistakenly intercepted due to the conversion address triggering the attack behavior.
[0040] In a fifth aspect, the present invention provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the method described in any one of the claims in the aforementioned implementation methods.
[0041] The computer program product of the fifth aspect of the present application can obtain a target message by executing a message processing method, and then can obtain an IP address based on a conversion address library and use it as a target address, and perform address conversion on the target message based on the target address, and then can judge whether the target message has an attack behavior based on attack feature information. If the judgment result indicates that the target message has the attack behavior, the target address is removed from the conversion address library, and an IP address is re-obtained from the conversion address library as the target address, until the target address makes the target message free of the attack behavior, and forwards the target message, thereby avoiding the normal business message being mistakenly intercepted due to the conversion address triggering the attack behavior. BRIEF DESCRIPTION OF THE DRAWINGS
[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.
[0043] Figure 1 It is a flowchart of a message processing method disclosed in an embodiment of the present application;
[0044] Figure 2It is a structural schematic diagram of a message processing device disclosed in an embodiment of the present application;
[0045] Figure 3 It is a structural schematic diagram of an electronic device disclosed in an embodiment of the present application. DETAILED DESCRIPTION
[0046] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.
[0047] Embodiment 1
[0048] See also Figure 1 , Figure 1 is a flow chart of a message processing method disclosed in an embodiment of the present application, such as Figure 1 As shown, the method of the embodiment of the present application includes the following steps:
[0049] 101. Obtain the target message;
[0050] 102. Obtain an IP address based on the conversion address library and use it as the target address, and perform address conversion on the target message based on the target address;
[0051] 103. Determine whether the target message contains attack behavior based on the attack feature information. If the determination result indicates that the target message contains attack behavior, remove the target address from the conversion address library, and reacquire an IP address from the conversion address library as the target address until the target address makes the target message contain no attack behavior.
[0052] 104. Forward the target message.
[0053] The embodiment of the present application obtains the target message, and then can obtain an IP address based on the conversion address library as the target address, and perform address conversion on the target message based on the target address, and then can judge whether the target message has attack behavior based on the attack feature information. If the judgment result indicates that the target message has attack behavior, the target address is removed from the conversion address library, and a new IP address is obtained from the conversion address library as the target address, until the target address makes the target message free of attack behavior, and forwards the target message, thereby avoiding the normal business message being mistakenly intercepted due to the conversion address triggering the attack behavior.
[0054] In the embodiment of the present application, by removing the target address that causes the target message to be erroneously intercepted from the conversion address library, it is possible to avoid selecting the target address that causes the target message to be erroneously intercepted when reselecting an IP address from the conversion address library.
[0055] With respect to step 101, the target message may be a target message sent by the client in order to access the server, and the target message is a normal service message.
[0056] In an embodiment of the present application, for step 102, the conversion address library includes multiple IP addresses, wherein each IP address corresponds to a server, and multiple servers constitute a server cluster to provide services to the client together. The services provided by each server may be the same, and multiple servers provide services to the client based on a preset load balancing strategy.
[0057] In the embodiment of the present application, for step 102, an IP address matching strategy can be preset, and the matching strategy can select an IP address from the conversion address library and use the IP address as the target address. It should be noted that the IP address in the conversion address library can be associated with a port number, and accordingly, when performing address conversion, the port number is used as an associated object and replaced synchronously, thereby adapting the association between the converted address and the port number.
[0058] In the embodiment of the present application, for step 102, the attack feature information refers to the network parameters that characterize the attack, and the network parameters include data such as source address, source port, destination address, destination port, etc. Further, according to the type of attack, the network parameters can be organized into an IP address attack library, a triple attack library, and a quadruple attack library.
[0059] In an embodiment of the present application, with respect to step 102, the target address may be used to replace the destination in the target message, wherein the target address is a real IP address of a server.
[0060] In the embodiment of the present application, with respect to step 103, if the IP address, or triplet or quadruple of the target message appears in the attack feature information, it can be determined that the target message contains attack behavior.
[0061] In the embodiment of the present application, with respect to step 104, forwarding the target message means forwarding the target message to the server providing services to the client after the address of the target message is converted and the converted target message will not be intercepted by mistake.
[0062] In the embodiment of the present application, as an optional implementation, the method of the embodiment of the present application further includes the following steps:
[0063] Acquire attack interception information in real time, and determine attack feature information based on the attack interception information.
[0064] This optional implementation can obtain attack interception information in real time and determine attack feature information based on the attack interception information.
[0065] For this optional implementation, the attack interception information can be obtained in real time from the network defense device, wherein the network defense device can provide an API, and then the attack interception information generated by the network defense device can be monitored in real time through the API. Accordingly, the acquired attack interception information can be temporarily stored in the cache space.
[0066] In the embodiment of the present application, as an optional implementation mode, the attack feature information includes the attack source address, and the step of determining whether the target message has an attack behavior based on the attack feature information includes the following sub-steps:
[0067] Determine whether the target message hits the attack source address. If the target message hits the attack source address, it is determined that the target message has an attack behavior.
[0068] This optional implementation method determines whether the target message hits the attack source address, and then can determine that the target message has an attack behavior when the target message hits the attack source address.
[0069] In the embodiment of the present application, as an optional implementation manner, the attack feature information further includes attack quadruple information, wherein judging whether the target message has an attack behavior based on the attack feature information further includes the following steps:
[0070] When the target message does not hit the attack source address, it is determined whether the target message hits the attack four-tuple information. If the target message hits the attack four-tuple information, it is determined that the target message has an attack behavior.
[0071] This optional implementation method can determine whether the target message hits the attack four-tuple information when the target message does not hit the attack source address. If the target message hits the attack four-tuple information, it is determined that the target message has an attack behavior.
[0072] In the embodiment of the present application, as an optional implementation, the attack feature information further includes attack triplet information, wherein judging whether the target message has an attack behavior based on the attack feature information further includes the following steps:
[0073] When the target message does not hit the attack four-tuple information, it is determined whether the target message hits the three-tuple information. If the target message hits the three-tuple information, it is determined that the target message has an attack behavior.
[0074] This optional implementation method can determine whether the target message hits the triplet information when the target message does not hit the attack quadruple information. If the target message hits the triplet information, it is determined that the target message has an attack behavior.
[0075] In the embodiment of the present application, as an optional implementation, after performing address conversion on the target message based on the target address and before determining whether the target message contains attack behavior based on the attack feature information, the method of the embodiment of the present application further includes the following steps:
[0076] It is determined whether there is attack feature information in the cache information. If there is attack feature information in the cache information, it is determined whether there is attack behavior in the target message based on the attack feature information.
[0077] This optional implementation method determines whether there is attack feature information in the cache information, and then determines whether there is attack behavior in the target message based on the attack feature information.
[0078] For this optional implementation, the cache information records the data storage status of the cache space, which can be used to determine whether there is attack feature information.
[0079] In the embodiment of the present application, as an optional implementation, after the step of obtaining the target message and before the step of obtaining an IP address based on the conversion address library and using it as the target address, the method of the embodiment of the present application further includes the following steps:
[0080] It is determined whether the target message hits the application load policy. If the target message hits the application load policy, an IP address is obtained based on the translation address library and used as the target address.
[0081] This optional implementation method determines whether the target message hits the application load policy, and then can obtain an IP address based on the conversion address library and use it as the target address when the target message hits the application load policy.
[0082] For an optional implementation method, the application load policy may be to perform load balancing on IP addresses within a certain range. If the IP address of the target message is not within this range, the IP address of the target message may not be converted.
[0083] In the embodiments of the present application, as an example, the embodiments of the present application can be applied to products that support source address translation and bidirectional address translation. On the basis of the original address translation function, the attack interception perception technology is used to match and optimize the attack feature information pushed by the detection and defense security equipment to the API interface to convert the source address or port, thereby reducing and avoiding the situation where normal business access is mistakenly intercepted.
[0084] Furthermore, for a business network, a load balancing device that supports application load function is deployed in front of the WAF device in the business area. The load balancing device enables the API service and configures the server load policy of source address translation and source port change type. The WAF device identifies and filters malicious network attacks to ensure the normal operation of the business.
[0085] Furthermore, based on the above business networking, the load balancing device determines whether the application load strategy is hit after receiving the request message. If not, it enters other modules for processing. If it is hit, it selects the server node according to the algorithm to convert the destination address and then converts the source address and source port according to the source address pool.
[0086] Furthermore, after the address conversion is completed, check whether there is an attack feature cache. If not, check the routing forwarding request message. If so, determine whether it matches the attack source address information pushed by the WAF device. If the match is successful, the source address that matches the attack feature is temporarily removed from the source address pool and no longer participates in the source address conversion (restored after the timer is reset). Use the source address in the changed source address pool to perform source address conversion again. When there is no available address, clear all attack feature caches to maintain the default source address and source port conversion logic.
[0087] Furthermore, after the attack source address pushed by the WAF device fails to match, it continues to match the four-tuple attack feature information. There are two situations:
[0088] If the four-tuple attack feature matches successfully, all source ports matching the four-tuple are retrieved according to the triple information of the matching attack feature, and the triple attack feature matching judgment is performed after changing the source port different from the search result.
[0089] If the four-tuple attack feature matching fails, the three-tuple attack feature matching judgment is directly performed.
[0090] Furthermore, if the message entering the triple attack feature matching is matched successfully, all quadruple attack feature caches are retrieved, and the route forwarding is checked after the source address is changed according to the search result. If the match fails, the route forwarding message can be directly checked.
[0091] Embodiment 2
[0092] See also Figure 2 , Figure 2 is a structural diagram of a message processing device disclosed in an embodiment of the present application, such as Figure 2 As shown, the device of the embodiment of the present application includes the following functional modules:
[0093] An acquisition module 201 is used to acquire a target message;
[0094] The address conversion module 202 is used to obtain an IP address based on the conversion address library and use it as the target address, and perform address conversion on the target message based on the target address;
[0095] The judgment module 203 is used to judge whether the target message has an attack behavior based on the attack feature information. If the judgment result indicates that the target message has an attack behavior, the target address is removed from the conversion address library, and an IP address is re-obtained from the conversion address library as the target address, until the target address makes the target message have no attack behavior;
[0096] The forwarding module 204 is used to forward the target message.
[0097] The device of the embodiment of the present application can obtain the target message by executing the message processing method, and then can obtain an IP address based on the conversion address library and use it as the target address, and perform address conversion on the target message based on the target address, and then can judge whether the target message has attack behavior based on the attack feature information. If the judgment result indicates that the target message has attack behavior, the target address is removed from the conversion address library, and an IP address is re-obtained from the conversion address library as the target address, until the target address makes the target message free of attack behavior, and forwards the target message, thereby avoiding the normal business message being mistakenly intercepted due to the conversion address triggering the attack behavior.
[0098] It should be noted that for other detailed descriptions of the device in the embodiment of the present application, please refer to the relevant description of the embodiment of the present application, and the embodiment of the present application will not go into details.
[0099] Embodiment 3
[0100] See also Figure 3 , Figure 3 is a schematic diagram of the structure of an electronic device disclosed in an embodiment of the present application, such as Figure 3 As shown, the electronic device of the embodiment of the present application includes:
[0101] Processor 301; and
[0102] The memory 302 is configured to store machine-readable instructions, and when the instructions are executed by the processor 301, the method of any one of the aforementioned embodiments is executed.
[0103] The electronic device of the embodiment of the present application can obtain the target message by executing the message processing method, and then can obtain an IP address based on the conversion address library as the target address, and perform address conversion on the target message based on the target address, and then can judge whether the target message has attack behavior based on the attack feature information. If the judgment result indicates that the target message has attack behavior, the target address is removed from the conversion address library, and an IP address is re-obtained from the conversion address library as the target address, until the target address makes the target message free of attack behavior, and forwards the target message, thereby avoiding the normal business message being mistakenly intercepted due to the conversion address triggering the attack behavior.
[0104] Embodiment 4
[0105] An embodiment of the present application provides a storage medium, wherein the storage medium stores a computer program, and the computer program is executed by a processor as in any of the methods described in the foregoing implementations.
[0106] The storage medium of the embodiment of the present application can obtain the target message by executing the message processing method, and then can obtain an IP address based on the conversion address library and use it as the target address, and perform address conversion on the target message based on the target address, and then can judge whether the target message has attack behavior based on the attack feature information. If the judgment result indicates that the target message has attack behavior, the target address is removed from the conversion address library, and an IP address is re-obtained from the conversion address library as the target address, until the target address makes the target message free of attack behavior, and forwards the target message, thereby avoiding the normal business message being mistakenly intercepted due to the conversion address triggering the attack behavior.
[0107] Embodiment 5
[0108] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, any method claimed in any of the above-mentioned embodiments is implemented.
[0109] The computer program product of the embodiment of the present application can obtain the target message by executing the message processing method, and then can obtain an IP address based on the conversion address library and use it as the target address, and perform address conversion on the target message based on the target address, and then can judge whether the target message has attack behavior based on the attack feature information. If the judgment result indicates that the target message has attack behavior, the target address is removed from the conversion address library, and an IP address is re-obtained from the conversion address library as the target address, until the target address makes the target message free of attack behavior, and forwards the target message, thereby avoiding the normal business message being mistakenly intercepted due to the conversion address triggering the attack behavior.
[0110] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.
[0111] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0112] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.
[0113] It should be noted that if the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk.
[0114] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.
[0115] The above are only embodiments of the present application and are not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.
Claims
1. A message processing method, characterized in that: The method comprises: Get the target message; Acquire an IP address as a target address based on the conversion address library, and perform address conversion on the target message based on the target address; Determine whether the target message has an attack behavior based on the attack feature information, and if the determination result indicates that the target message has the attack behavior, remove the target address from the conversion address library, and reacquire an IP address from the conversion address library as the target address, until the target address makes the target message free of the attack behavior; Forward the target message.
2. The method according to claim 1, characterized in that The method further comprises: Attack interception information is acquired in real time, and the attack feature information is determined based on the attack interception information.
3. The method according to claim 1, characterized in that The attack feature information includes an attack source address, and judging whether the target message has an attack behavior based on the attack feature information includes: It is determined whether the target message hits the attack source address. If the target message hits the attack source address, it is determined that the target message has the attack behavior.
4. The method according to claim 3, characterized in that The attack feature information also includes attack quadruple information, wherein judging whether the target message contains attack behavior based on the attack feature information further includes: When the target message does not hit the attack source address, it is determined whether the target message hits the attack four-tuple information; if the target message hits the attack four-tuple information, it is determined that the target message has the attack behavior.
5. The method according to claim 4, characterized in that The attack feature information also includes attack triplet information, wherein the step of judging whether the target message contains attack behavior based on the attack feature information further includes: When the target message does not hit the attack four-tuple information, it is determined whether the target message hits the triple information. If the target message hits the triple information, it is determined that the target message has the attack behavior.
6. The method according to claim 1, characterized in that After performing address conversion on the target message based on the target address and before determining whether the target message contains attack behavior based on the attack feature information, the method further includes: It is determined whether the attack feature information exists in the cache information, and if the attack feature information exists in the cache information, the step of determining whether the target message has an attack behavior based on the attack feature information is performed.
7. The method according to claim 1, characterized in that After obtaining the target message and before obtaining an IP address based on the conversion address library and using it as the target address, the method further includes: Determine whether the target message hits the application load policy. If the target message hits the application load policy, execute the step of obtaining an IP address based on the conversion address library and use it as the target address.
8. An electronic device, characterized in that: include: processor; as well as A memory configured to store machine-readable instructions, wherein when the instructions are executed by the processor, the method according to any one of claims 1 to 7 is performed.
9. A storage medium, characterized in that: The storage medium stores a computer program, and the computer program is executed by a processor to perform the method according to any one of claims 1 to 7.
10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.