Method, device and system for defending ICMP attack

Abstract

The invention discloses a method, device and system for defending ICMP attacks, and the method executed by a message sender comprises the steps: judging whether a target IP address is located in a white list, and the target IP address is the IP address of a message receiver; under the condition that the target IP address is located in the white list, determining a dynamic confusion rule corresponding to the current time, and modifying at least one target field value in a header of a generated standard Internet Control Message Protocol (ICMP) message based on the dynamic confusion rule corresponding to the current time, the current time is added to the data part of the standard ICMP message, the modified ICMP message is sent to the message receiver, and the dynamic confusion rule is a confusion rule dynamically updated according to the time.

Description

Technical Field

[0001] The present application relates to the field of computer communications, and in particular to a method, device and system for defending against ICMP attacks. Background Art

[0002] ICMP (Internet Control Message Protocol) is a connectionless protocol used to transmit error reporting control information. ICMP protocol belongs to the network layer protocol, which is mainly used to transmit control information between hosts and routers, including reporting errors, exchanging restricted control and status information, etc. When IP (Internet Protocol) data cannot access the target, IP routers cannot forward data packets at the current transmission rate, etc., ICMP messages will be sent automatically.

[0003] However, precisely because the ICMP protocol itself is designed for network diagnosis and error reporting, and it does not require a connection to be established, attackers can easily forge or send a large number of malicious messages (especially ICMP messages of the Echo Request type), thereby exhausting the target device's bandwidth, computing resources, or triggering error responses, causing service paralysis.

[0004] At present, the main means of defending against ICMP attacks is to limit the number or frequency of ICMP messages, such as limiting the speed of ICMP traffic through firewall rules or traffic control policies. However, this coarse-grained restriction method has significant problems: on the one hand, legitimate ICMP requests (such as those found by frequent Ping tests or path MTU (Maximum Transmission Unit) by operation and maintenance personnel) may be misjudged as attack traffic because they exceed the threshold, causing critical data to be erroneously discarded, affecting the normal function of the network; on the other hand, attackers may bypass the speed limit policy by forging source IP or distributed attacks, but the defense mechanism cannot accurately identify the attack source due to the "one-size-fits-all" flow limiting rules, which increases the risk of misblocking. Therefore, it is difficult to balance security and availability by simply relying on message quantity restrictions. Summary of the invention

[0005] The present application provides a method, device and system for defending against ICMP attacks, which can change from static defense to active defense, thereby improving the reliability of defending against ICMP attacks.

[0006] The specific technical solutions are as follows:

[0007] In a first aspect, an embodiment of the present application provides a method for defending against ICMP attacks, the method being applied to a message sender, the method comprising:

[0008] Determine whether the target IP address is in the whitelist, wherein the target IP address is the IP address of the message receiver;

[0009] In the case where the target IP address is in the whitelist, a dynamic obfuscation rule corresponding to the current time is determined, and based on the dynamic obfuscation rule corresponding to the current time, at least one target field value in the header of the generated standard Internet Control Message Protocol ICMP message is modified, and the current time is added to the data part of the standard ICMP message, and the modified ICMP message is sent to the message receiver, wherein the dynamic obfuscation rule is an obfuscation rule that is dynamically updated according to time.

[0010] In a possible implementation, determining the dynamic obfuscation rule corresponding to the current time includes:

[0011] Acquire the latest synchronized dynamic obfuscation strategy between the message sender and the message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number of each time window, and a key seed;

[0012] Determine the target time window to which the current time belongs, and the number of the target time window;

[0013] Generate a dynamic obfuscation rule corresponding to the current time according to the key seed and the number of the target time window.

[0014] In a possible implementation manner, the dynamic obfuscation rule corresponding to the current time includes:

[0015] Concatenate the key seed and the number of the target time window, and perform hash calculation on the concatenation result to obtain a target hash value;

[0016] Obtain at least one byte corresponding to each of the target fields from the target hash value;

[0017] In the case where the target field includes a type field, performing an XOR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the XOR operation result as the type field value of the ICMP message to be sent;

[0018] In the case that the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields is determined as the field value of the other fields.

[0019] In a second aspect, an embodiment of the present application provides a method for defending against ICMP attacks, the method being applied to a message receiver, the method comprising:

[0020] Receive Internet Control Message Protocol ICMP messages sent by message senders;

[0021] If the source IP address in the ICMP message is in the blacklist, discard the ICMP message;

[0022] In the case where the source IP address in the ICMP message is not in the blacklist, a dynamic obfuscation rule corresponding to a target time is obtained, and based on a dynamic verification rule determined by the dynamic obfuscation rule corresponding to the target time, whether a field value of at least one target field in a header of the ICMP message is a field value specified by the dynamic obfuscation rule is verified; in the case where it is verified that a field value of at least one target field is not a field value specified by the dynamic obfuscation rule, the ICMP message is discarded, wherein the target time is a timestamp contained in a data portion of the ICMP message, which indicates the time when the message sender encapsulates the ICMP message, and the dynamic obfuscation rule is an obfuscation rule dynamically updated according to time.

[0023] In a possible implementation, obtaining a dynamic obfuscation rule corresponding to a target time includes:

[0024] Acquire the latest synchronized dynamic obfuscation strategy between the message sender and the message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number of each time window, and a key seed;

[0025] Determine the target time window to which the target time belongs, and the number of the target time window;

[0026] Generate a dynamic obfuscation rule corresponding to the target time according to the key seed and the number of the target time window.

[0027] In a possible implementation manner, the dynamic obfuscation rule corresponding to the target time includes:

[0028] Concatenate the key seed and the number of the target time window, and perform hash calculation on the concatenation result to obtain a target hash value;

[0029] Obtain at least one byte corresponding to each of the target fields from the target hash value;

[0030] In the case where the target field includes a type field, performing an XOR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the XOR operation result as the type field value of the ICMP message to be sent;

[0031] In the case that the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields is determined as the field value of the other fields.

[0032] In a possible implementation manner, after successfully parsing the ICMP message, the method further includes:

[0033] Using the ICMP message to update current message characteristic information, wherein the current message characteristic information includes message characteristic information of ICMP messages received in a recent time period;

[0034] Based on a pre-trained message attack detection model, attack behavior detection is performed on the updated current message feature information, wherein the message attack detection model is obtained by using a machine learning model to perform context analysis training on normal traffic and attack traffic of ICMP messages;

[0035] When it is determined that the message sender has ICMP message attack behavior, the ICMP message is discarded.

[0036] In a third aspect, an embodiment of the present application provides a device for defending against ICMP attacks, characterized in that the device is applied to a message sender, and the device includes:

[0037] A determination unit, used to determine whether a target IP address is in a whitelist, wherein the target IP address is an IP address of a message receiver;

[0038] a determination unit, configured to determine a dynamic obfuscation rule corresponding to a current time when the target IP address is in the whitelist, wherein the dynamic obfuscation rule is an obfuscation rule dynamically updated according to time;

[0039] A modification unit, configured to modify at least one target field value in a header of a generated standard Internet Control Message Protocol (ICMP) message based on a dynamic obfuscation rule corresponding to the current time, and to add the current time to a data portion of the standard ICMP message;

[0040] The sending unit is used to send the modified ICMP message to the message receiver.

[0041] In a possible implementation, the determining unit includes:

[0042] An acquisition module, used to acquire the latest synchronized dynamic obfuscation strategy between the message sender and the message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number of each time window, and a key seed;

[0043] A determination module, used to determine the target time window to which the current time belongs, and the number of the target time window;

[0044] A generation module is used to generate a dynamic obfuscation rule corresponding to the current time according to the key seed and the number of the target time window.

[0045] In a possible implementation manner, the dynamic obfuscation rule corresponding to the current time includes:

[0046] Concatenate the key seed and the number of the target time window, and perform hash calculation on the concatenation result to obtain a target hash value;

[0047] Obtain at least one byte corresponding to each of the target fields from the target hash value;

[0048] In the case where the target field includes a type field, performing an XOR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the XOR operation result as the type field value of the ICMP message to be sent;

[0049] In the case that the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields is determined as the field value of the other fields.

[0050] In a fourth aspect, an embodiment of the present application provides a device for defending against ICMP attacks, the device being applied to a message receiver, the device comprising:

[0051] A receiving unit, used for receiving an Internet Control Message Protocol ICMP message sent by a message sender;

[0052] A discarding unit, configured to discard the ICMP message if the source IP address in the ICMP message is in a blacklist;

[0053] an acquiring unit, configured to acquire a dynamic obfuscation rule corresponding to a target time when the source IP address in the ICMP message is not in the blacklist, wherein the target time is a timestamp contained in the data part of the ICMP message, which is used to indicate the time when the message sender encapsulates the ICMP message, and the dynamic obfuscation rule is an obfuscation rule dynamically updated according to the time;

[0054] a verification unit, configured to verify, based on a dynamic verification rule determined by the dynamic obfuscation rule corresponding to the target time, whether a field value of at least one target field in the header of the ICMP message is a field value specified by the dynamic obfuscation rule;

[0055] The discarding unit is further used to discard the ICMP message when verifying that a field value of the at least one target field contains a field value that is not specified by the dynamic obfuscation rule.

[0056] In a possible implementation, the acquisition unit includes:

[0057] An acquisition module, used to acquire the latest synchronized dynamic obfuscation strategy between the message sender and the message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number of each time window, and a key seed;

[0058] A determination module, used to determine the target time window to which the target time belongs, and the number of the target time window;

[0059] A generation module is used to generate a dynamic obfuscation rule corresponding to the target time according to the key seed and the number of the target time window.

[0060] In a possible implementation manner, the dynamic obfuscation rule corresponding to the target time includes:

[0061] Concatenate the key seed and the number of the target time window, and perform hash calculation on the concatenation result to obtain a target hash value;

[0062] Obtain at least one byte corresponding to each of the target fields from the target hash value;

[0063] In the case where the target field includes a type field, performing an XOR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the XOR operation result as the type field value of the ICMP message to be sent;

[0064] In the case that the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields is determined as the field value of the other fields.

[0065] In a possible implementation, the device further includes:

[0066] An updating unit, configured to update current message feature information using the ICMP message after successfully parsing the ICMP message, wherein the current message feature information includes message feature information of ICMP messages received in a recent time period;

[0067] A detection unit, configured to perform attack behavior detection on the updated current message feature information based on a pre-trained message attack detection model, wherein the message attack detection model is obtained by training the normal flow and attack flow of ICMP messages using a machine learning model through context analysis;

[0068] The discarding unit is used to discard the ICMP message when it is determined that the sender of the message has an ICMP message attack behavior.

[0069] In a fifth aspect, an embodiment of the present application provides a system for defending against ICMP attacks, the system comprising a message sender and a message receiver, the message sender comprising:

[0070] one or more first processors;

[0071] The first processor is coupled to a first memory, the first memory being used to store one or more programs;

[0072] When the one or more programs stored in the first memory are executed by the one or more first processors, the message sender implements the method as described in any possible implementation manner of the first aspect;

[0073] The message receiver includes:

[0074] one or more second processors;

[0075] The second processor is coupled to a second memory, and the second memory is used to store one or more programs;

[0076] When one or more programs stored in the second memory are executed by the one or more second processors, the message receiver implements the method described in any possible implementation manner of the second aspect.

[0077] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any possible implementation manner of the first aspect, or implements the method described in any possible implementation manner of the second aspect.

[0078] In the seventh aspect, an embodiment of the present application provides a computer program product, which includes instructions. When the instructions are executed on a computer or a processor, the computer or the processor executes the method described in any possible implementation of the first aspect, or executes the method described in any possible implementation of the second aspect.

[0079] It can be seen from the above scheme that compared with the related technology of defending against ICMP attacks by only limiting the number or frequency of ICMP messages, the method, device and system for defending against ICMP attacks provided by the embodiment of the present application are no longer passive static defense, but dynamic active defense. It can not only modify the field value of at least one target field in the ICMP message by the obfuscation rules dynamically updated according to time, which can prevent attackers from identifying and forging legitimate traffic, but also stipulate that the message sender only sends ICMP messages to the IP addresses in the white list, and the message receiver directly discards the ICMP messages sent by the IP addresses in the black list. This method can effectively prevent the message from being sent to unknown or malicious targets, while ensuring that the receiver can verify the legitimacy of the message. It can be seen that the embodiment of the present application can build a more flexible and intelligent ICMP defense system by combining dynamic obfuscation rules with black and white lists. This combination can not only increase the attack cost of attackers through dynamic obfuscation rules, but also quickly block known malicious traffic through the black and white list mechanism, thereby achieving a multi-level and three-dimensional defense effect.

[0080] In addition, by dividing a valid time period into multiple time windows and dynamically adjusting the dynamic obfuscation rules according to the time window number, the dynamic obfuscation rules used for the messages sent in different time windows are different, which not only reduces the frequency of synchronizing the dynamic obfuscation rules between the two parties, but also, for example, in a longer period of time, it is only necessary to synchronize the seed and algorithm at the initial moment, and the dynamic obfuscation rules in this time period can be automatically generated, and the dynamic obfuscation rules are fixed in each time window (such as 10 minutes), reducing the real-time synchronization requirements, and the mapping rules for each time window are unique, attackers cannot reuse old messages, and based on the irreversibility of the hash algorithm, attackers are prevented from cracking the dynamic obfuscation rules.

[0081] After the message receiver successfully parses the ICMP message, attack detection is performed by combining the pre-trained message attack detection model with the context of the message, which can further improve the reliability of ICMP message defense. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the prior art description are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings without creative work.

[0083] Figure 1 A flowchart of a method for defending against ICMP attacks provided in an embodiment of the present application;

[0084] Figure 2A flowchart of another method for defending against ICMP attacks provided in an embodiment of the present application;

[0085] Figure 3 A block diagram of a device for defending against ICMP attacks provided in an embodiment of the present application;

[0086] Figure 4 A block diagram of another ICMP attack defense device provided in an embodiment of the present application;

[0087] Figure 5 A schematic diagram of the interaction flow of a system for defending against ICMP attacks provided in an embodiment of the present application. DETAILED DESCRIPTION

[0088] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0089] It should be noted that, in the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The terms "including" and "having" in the embodiments of the present application and the accompanying drawings and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices.

[0090] Figure 1 A flowchart of a method for defending against ICMP attacks provided in an embodiment of the present application is provided. The method can be applied to a message sender. The method can include the following steps:

[0091] S110: Determine whether the target IP address is in the whitelist.

[0092] The target IP address is the IP address of the message receiver. The whitelist includes the IP address list of the message receivers trusted by the message sender. The message receivers trusted by the message sender include the message receivers in the same LAN as the message sender, the message receivers in other LANs that have established a trust relationship with the message sender, and the message receivers that the data security center detects have no historical attack behavior, etc.

[0093] In actual applications, the whitelist can be updated dynamically, including removing IP addresses with attack behaviors from the whitelist and adding other IP addresses with no historical attack behaviors to the whitelist.

[0094] S120: When the target IP address is in the whitelist, determine the dynamic obfuscation rule corresponding to the current time, and based on the dynamic obfuscation rule corresponding to the current time, modify at least one target field value in the header of the generated standard Internet Control Message Protocol ICMP message, add the current time to the data part of the standard ICMP message, and send the modified ICMP message to the message recipient.

[0095] If the target IP address is in the whitelist, it means that the message receiver is a trustworthy party. In this way, the ICMP message that needs to be sent can prevent attacks from the other party. If the target IP address is not in the whitelist, ICMP messages will not be sent to it to prevent subsequent attacks from the other party. However, in order to prevent attackers from disguising themselves as either the message sender or the message receiver to attack the other party, ICMP messages can be transmitted through dynamic obfuscation rules agreed upon by both parties. Among them, dynamic obfuscation rules are obfuscation rules that are dynamically updated according to time.

[0096] The method for determining the dynamic obfuscation rules corresponding to the current time includes: obtaining the latest synchronized dynamic obfuscation strategy between a message sender and a message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number of each time window, and a key seed; determining the target time window to which the current time belongs, and the number of the target time window; and generating the dynamic obfuscation rules corresponding to the current time according to the key seed and the number of the target time window.

[0097] The dynamic obfuscation strategy can be generated by the central control center and updated regularly. The central control center can send the latest dynamic obfuscation strategy to all computer devices under its centralized management through a secure channel, so that when these computer devices communicate, they can use the dynamic obfuscation strategy to generate ICMP messages to prevent attackers. The dynamic obfuscation strategy can also be directly generated by the message sender and the message receiver through a negotiation protocol (such as Diffie-Hellman) before communication.

[0098] The effective time period is a future time period agreed upon by both parties. Both parties can agree to divide the effective time period into N time windows evenly or unevenly. For example, the effective time period is from 1:00 on January 1, 2025 to 2:00 on January 1, 2025. The 60-minute time period is divided into 6 time windows, namely [1:00, 1:10], (1:10, 1:20], (1:20, 1:30], (1:30, 1:40], (1:40, 1:50], (1:50, 2:00], numbered 1, 2, 3, 4, 5, 6 respectively. If the current time is 1:25 on January 1, 2025, the target time window corresponding to the current time is (1:20, 1:30], and the number of the target time window is 3. Therefore, the dynamic obfuscation rule corresponding to the current time can be generated according to the key seed and the number 3 of the target time window.

[0099] The dynamic obfuscation rules corresponding to the current time include: concatenating the key seed and the target time window number, and performing hash calculation on the concatenation result to obtain a target hash value; obtaining at least one byte corresponding to each target field from the target hash value; when the target field includes a type field, performing an XOR operation on the type field value of the ICMP message type to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the XOR operation result as the type field value of the ICMP message to be sent; when the target field includes other fields except the type field, determining the value of at least one byte corresponding to the other fields as the field value of the other fields.

[0100] The structure of a standard ICMP message includes: a header and a data part, the header includes Type, Code and Identifier, and the data part includes Data. The number of bytes occupied by each field in the header of the ICMP message generated using dynamic obfuscation rules can be the same as the number of bytes occupied by the corresponding field in the standard ICMP protocol.

[0101] Exemplarily, if the target field includes Type, Code, and Identifier, and the message type of the ICMP message to be sent has a type field value of 8 under the standard ICMP protocol, then when the ICMP message to be sent is encapsulated using the dynamic obfuscation rule, the first byte of the target hash value is XORed with 8, and the XOR result is used as the field value of the Type field, the second byte of the target hash value is used as the field value of the Code field, and the third byte of the target hash value is used as the field value of the Identifier field.

[0102] There are many common types of ICMP messages, but not every type of ICMP message will generate traffic attacks. Therefore, in order to improve communication efficiency, dynamic obfuscation rules can be used to encapsulate only the types that are prone to traffic attacks, while the standard ICMP protocol can be used to encapsulate the types that are not prone to traffic attacks. Other methods can be used to defend against attacks, such as AI-based detection, setting limits on the number of ICMP packets flowing in, etc.

[0103] The types that are prone to traffic attacks are defined as preset types, including types with field values ​​of 0, 8, etc., where when the field value is 0, the corresponding type name is Echo Reply, indicating a response to Echo Request (Ping reply), which is used for Ping testing to troubleshoot network connectivity problems; when the field value is 8, the corresponding type name is Echo Request, indicating a Ping request. The message sender of the embodiment of the present application may be the party sending the request or the party sending the response.

[0104] In addition, in order to allow the message receiver to determine which dynamic obfuscation rule is used to parse the message, the message sender can also add the current time to the data part of the standard ICMP message. For example, it can be added to the beginning of the data part, that is, the data part includes the current time + data content; it can also be added to the end of the data part, that is, the data includes data content + current time; in order to further defend against attacks, the current time can also be added to a specified position in the data content, and the current time can be inserted into the i-th byte and the i+1-th byte of the data content, so that the current time is the i+1-th byte.

[0105] Compared with the related technologies that defend against ICMP attacks only by limiting the number or frequency of ICMP messages, the method for defending against ICMP attacks provided by the embodiments of the present application is no longer a passive static defense, but a dynamic active defense. It can not only modify the field value of at least one target field in the ICMP message by dynamically updating the obfuscation rules according to time, which can prevent attackers from identifying and forging legitimate traffic, but also stipulate that the message sender only sends ICMP messages to the IP addresses in the whitelist. This method can effectively prevent the message from being sent to unknown or malicious targets and avoid the other party from attacking itself in reverse. It can be seen that the embodiments of the present application can build a more flexible and intelligent ICMP defense system by combining dynamic obfuscation rules with whitelists. This combination can not only increase the attack cost of attackers through dynamic obfuscation rules, but also quickly block known malicious traffic through the whitelist mechanism, thereby achieving a multi-level and three-dimensional defense effect.

[0106] In addition, by dividing a valid time period into multiple time windows and dynamically adjusting the dynamic obfuscation rules according to the time window number, the dynamic obfuscation rules used for the messages sent in different time windows are different, which not only reduces the frequency of synchronizing the dynamic obfuscation rules between the two parties, but also, for example, in a longer period of time, it is only necessary to synchronize the seed and algorithm at the initial moment, and the dynamic obfuscation rules in this time period can be automatically generated, and the dynamic obfuscation rules are fixed in each time window (such as 10 minutes), reducing the real-time synchronization requirements, and the mapping rules for each time window are unique, attackers cannot reuse old messages, and based on the irreversibility of the hash algorithm, attackers are prevented from cracking the dynamic obfuscation rules.

[0107] Figure 2 A flowchart of another method for defending against ICMP attacks provided in an embodiment of the present application, which method can be applied to a message receiver, may include the following steps:

[0108] S210: Receive the ICMP message sent by the message sender.

[0109] S220: When the source IP address in the ICMP message is in the blacklist, the ICMP message is discarded.

[0110] Among them, the blacklist includes a list of IP addresses of message senders that are not trusted by the message receiver. For example, it may include IP addresses detected by the data security center to have historical attack behaviors, etc. In actual applications, the data security center can dynamically update the blacklist and send the updated blacklist to the devices managed by the server.

[0111] After the message receiver receives the ICMP message sent by the message sender, it can obtain the source IP address from it and determine whether the source IP address is in the blacklist. If the source IP address is in the blacklist, it means that the message sender has a history of attack behavior and is a dangerous device. To avoid being attacked, the ICMP message can be discarded directly.

[0112] S230: When the source IP address in the ICMP message is not on the blacklist, obtain the dynamic obfuscation rule corresponding to the target time, and based on the dynamic verification rule determined by the dynamic obfuscation rule corresponding to the target time, verify whether the field value of at least one target field in the header of the ICMP message is the field value specified by the dynamic obfuscation rule. When it is verified that there is a field value that is not specified by the dynamic obfuscation rule in the field value of at least one target field, discard the ICMP message.

[0113] The target time is a timestamp contained in the data part of the ICMP message, which is used to indicate the time when the message sender encapsulates the ICMP message. The message receiver can obtain the target time from the specified position of the data part of the ICMP message. The dynamic obfuscation rule is an obfuscation rule that is dynamically updated according to time.

[0114] The method for determining the dynamic obfuscation rules corresponding to the current time includes: obtaining the latest synchronized dynamic obfuscation strategy between a message sender and a message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into multiple time windows, a number of each time window, and a key seed; determining a target time window to which a target time belongs, and the number of the target time window; and generating the dynamic obfuscation rules corresponding to the target time according to the key seed and the number of the target time window.

[0115] The dynamic obfuscation strategy can be generated by the central control center and updated regularly. The central control center can send the latest dynamic obfuscation strategy to all computer devices under its centralized management through a secure channel, so that when these computer devices communicate, they can use the dynamic obfuscation strategy to generate ICMP messages to prevent attackers. The dynamic obfuscation strategy can also be directly generated by the message sender and the message receiver through a negotiation protocol (such as Diffie-Hellman) before communication.

[0116] The effective time period is a future time period agreed upon by both parties. Both parties can agree to divide the effective time period into N time windows evenly or unevenly.

[0117] Among them, the dynamic obfuscation rules corresponding to the target time include: concatenating the key seed and the target time window number, and performing hash calculation on the concatenation result to obtain the target hash value; obtaining at least one byte corresponding to each target field from the target hash value; when the target field includes a type field, performing an XOR operation on the type field value of the ICMP message type to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the XOR operation result as the type field value of the ICMP message to be sent; when the target field includes other fields except the type field, determining the value of at least one byte corresponding to the other fields as the field value of the other fields.

[0118] Correspondingly, the dynamic verification rule determined by the dynamic obfuscation rule corresponding to the current time includes: concatenating the key seed and the number of the target time window, and performing hash calculation on the concatenation result to obtain the target hash value; obtaining at least one byte corresponding to each target field from the target hash value; in the case where the target field includes a type field, performing an XOR operation on the type field value of the received ICMP message and the value of at least one byte corresponding to the type field obtained from the target hash value; if the XOR operation result is not within the value range of the type field value under the standard ICMP protocol, determining that the type field value in the received ICMP message is not the field value specified by the dynamic obfuscation rule; if the XOR operation result is within the standard I If the value of the type field under the CMP protocol is within the value range, the XOR operation result is used as the type field value of the received ICMP message under the standard ICMP protocol, and other fields are verified: when the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields obtained from the target hash value is compared with the value of the corresponding field in the received ICMP message. If they are all the same, the ICMP message is parsed successfully. If there are different field values, it is determined that there is a field value in the field value of at least one target field that is not specified by the dynamic obfuscation rule, the ICMP message parsing fails, the message sender is a suspected attacker, and the ICMP message can be discarded.

[0119] Exemplarily, if the target field includes Type, Code, and Identifier, the message receiver can first obtain the first byte from the calculated target hash value, and perform an XOR operation on the first byte and the field value of the Type field of the received ICMP message. If the XOR operation result is any type field value specified in the standard ICMP protocol, then the ICMP message will continue to be verified. If the XOR operation result is not any type field value specified in the standard ICMP protocol, the ICMP message will be directly discarded. The process of continuing to verify the ICMP message includes: the message receiver continues to obtain the second byte in the target hash value, and determines whether the value of the second byte is the same as the field value of the Code field in the received ICMP message, and obtains the third and fourth bytes in the target hash value, and determines whether the value of the third and fourth bytes is the same as the field value of the Identifier field in the received ICMP message. If any field value is different, the ICMP message is discarded. If they are the same, it is determined that the ICMP message is safe and the data content can be read for processing or response.

[0120] Compared with the related technologies that defend against ICMP attacks by only limiting the number or frequency of ICMP messages, the method for defending against ICMP attacks provided by the embodiments of the present application is no longer a passive static defense, but a dynamic active defense. It can not only modify the field value of at least one target field in the ICMP message by dynamically updating the obfuscation rules according to time, which can prevent attackers from identifying and forging legitimate traffic, but also stipulate that the message receiver directly discards the ICMP message sent by the IP address in the blacklist. This method can ensure that the receiver can verify the legitimacy of the message. It can be seen that the embodiments of the present application can build a more flexible and intelligent ICMP defense system by combining dynamic obfuscation rules with blacklists. This combination can not only increase the attack cost of attackers through dynamic obfuscation rules, but also quickly block known malicious traffic through the blacklist mechanism, thereby achieving a multi-level and three-dimensional defense effect.

[0121] In addition, by dividing a valid time period into multiple time windows and dynamically adjusting the dynamic obfuscation rules according to the time window number, the dynamic obfuscation rules used for the messages sent in different time windows are different, which not only reduces the frequency of synchronizing the dynamic obfuscation rules between the two parties, but also, for example, in a longer period of time, it is only necessary to synchronize the seed and algorithm at the initial moment, and the dynamic obfuscation rules in this time period can be automatically generated, and the dynamic obfuscation rules are fixed in each time window (such as 10 minutes), reducing the real-time synchronization requirements, and the mapping rules for each time window are unique, attackers cannot reuse old messages, and based on the irreversibility of the hash algorithm, attackers are prevented from cracking the dynamic obfuscation rules.

[0122] In one possible implementation, in order to further defend against ICMP message attacks, after successfully parsing the ICMP message, the data content in the ICMP message is not processed immediately, nor is the message sender responded to immediately. Instead, the AI ​​model is used for further attack detection. After it is determined that there is no danger, the data content in the ICMP message is processed or responded to.

[0123] The method for performing attack detection on ICMP messages based on an AI model includes: using ICMP messages to update current message feature information, wherein the current message feature information includes message feature information of ICMP messages received in a recent time period; based on a pre-trained message attack detection model, performing attack behavior detection on the updated current message feature information, wherein the message attack detection model is obtained by using a machine learning model to perform context analysis training on normal traffic and attack traffic of ICMP messages; and discarding the ICMP message when it is determined that the message sender has ICMP message attack behavior.

[0124] Among them, the ICMP messages used in training the message attack detection model are all messages that comply with the standard ICMP protocol.

[0125] The current message feature information includes the source IP address, target IP address, message length, payload content, message interval, message rate, historical behavior of the source IP address (whether there is attack behavior and the number of attack behaviors), geographic location of the source IP address, service type of the target IP address, etc.

[0126] The message length is used to analyze the size distribution of the message and identify abnormal payloads. The payload content is used to analyze the entropy value and fixed pattern of the payload and identify covert channels or abnormal data. The recording method can be: recording the first N bytes of the payload (such as the first 32 bytes) or calculating the entropy value of the payload.

[0127] The message interval is used to analyze the message sending frequency and identify high-frequency attacks (such as ICMP Flood). The recording method is to calculate the time difference between the current message and the previous message (such as 0.1 second).

[0128] The packet rate is used to analyze the number of packets per unit time and identify burst traffic.

[0129] The geographic location of the source IP address is used to analyze the geographic distribution of source IP addresses and identify abnormal areas (such as traffic from high-risk countries).

[0130] The service type of the target IP is used to analyze the service type of the target IP (such as Web server, database server) and identify the attack risk of key assets. The recording method can be: recording the service port of the target IP (such as 80 / TCP).

[0131] In addition, the message attack detection model can be a neural network model such as Random Forest, SVM (Support Vector Machine), Long-Short Term Memory (LSTM), CNN (Convolutional Neural Networks), etc.

[0132] Based on the above method embodiment, another embodiment of the present application provides a device for defending against ICMP attacks, the device being applied to a message sender, such as Figure 3 As shown, the device comprises:

[0133] A determination unit 310 is used to determine whether a target IP address is in a whitelist, wherein the target IP address is an IP address of a message receiver;

[0134] A determination unit 320, configured to determine a dynamic obfuscation rule corresponding to a current time when the target IP address is in the whitelist, wherein the dynamic obfuscation rule is an obfuscation rule dynamically updated according to time;

[0135] A modification unit 330 is used to modify at least one target field value in the header of the generated standard Internet Control Message Protocol ICMP message based on the dynamic obfuscation rule corresponding to the current time, and add the current time to the data part of the standard ICMP message;

[0136] The sending unit 340 is used to send the modified ICMP message to the message receiver.

[0137] In a possible implementation manner, the determining unit 320 includes:

[0138] An acquisition module, used to acquire the latest synchronized dynamic obfuscation strategy between the message sender and the message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number of each time window, and a key seed;

[0139] A determination module, used to determine the target time window to which the current time belongs, and the number of the target time window;

[0140] A generation module is used to generate a dynamic obfuscation rule corresponding to the current time according to the key seed and the number of the target time window.

[0141] In a possible implementation manner, the dynamic obfuscation rule corresponding to the current time includes:

[0142] Concatenate the key seed and the number of the target time window, and perform hash calculation on the concatenation result to obtain a target hash value;

[0143] Obtain at least one byte corresponding to each of the target fields from the target hash value;

[0144] In the case where the target field includes a type field, performing an XOR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the XOR operation result as the type field value of the ICMP message to be sent;

[0145] In the case that the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields is determined as the field value of the other fields.

[0146] Compared with the related technologies that defend against ICMP attacks by only limiting the number or frequency of ICMP messages, the ICMP attack defense device provided by the embodiment of the present application is no longer a passive static defense, but a dynamic active defense. It can not only modify the field value of at least one target field in the ICMP message by dynamically updating the obfuscation rules according to time, which can prevent attackers from identifying and forging legitimate traffic, but also stipulate that the message sender only sends ICMP messages to the IP addresses in the whitelist. This method can effectively prevent the message from being sent to unknown or malicious targets and avoid the other party from attacking itself in reverse. It can be seen that the embodiment of the present application can build a more flexible and intelligent ICMP defense system by combining dynamic obfuscation rules with whitelists. This combination can not only increase the attack cost of attackers through dynamic obfuscation rules, but also quickly block known malicious traffic through the whitelist mechanism, thereby achieving a multi-level and three-dimensional defense effect.

[0147] In addition, by dividing a valid time period into multiple time windows and dynamically adjusting the dynamic obfuscation rules according to the time window number, the dynamic obfuscation rules used for the messages sent in different time windows are different, which not only reduces the frequency of synchronizing the dynamic obfuscation rules between the two parties, but also, for example, in a longer period of time, it is only necessary to synchronize the seed and algorithm at the initial moment, and the dynamic obfuscation rules in this time period can be automatically generated, and the dynamic obfuscation rules are fixed in each time window (such as 10 minutes), reducing the real-time synchronization requirements, and the mapping rules for each time window are unique, attackers cannot reuse old messages, and based on the irreversibility of the hash algorithm, attackers are prevented from cracking the dynamic obfuscation rules.

[0148] Based on the above method embodiment, another embodiment of the present application provides a device for defending against ICMP attacks, the device being applied to a message receiver, such as Figure 4 As shown, the device comprises:

[0149] The receiving unit 410 is used to receive an Internet Control Message Protocol ICMP message sent by a message sender;

[0150] A discarding unit 420, configured to discard the ICMP message if the source IP address in the ICMP message is in a blacklist;

[0151] The acquisition unit 430 is used to acquire a dynamic obfuscation rule corresponding to a target time when the source IP address in the ICMP message is not in the blacklist, wherein the target time is a timestamp contained in the data part of the ICMP message, which is used to indicate the time when the message sender encapsulates the ICMP message, and the dynamic obfuscation rule is an obfuscation rule dynamically updated according to the time;

[0152] A verification unit 440, configured to verify, based on a dynamic verification rule determined by the dynamic obfuscation rule corresponding to the target time, whether a field value of at least one target field in the header of the ICMP message is a field value specified by the dynamic obfuscation rule;

[0153] The discarding unit 420 is further configured to discard the ICMP message when verifying that a field value of the at least one target field does not contain a field value specified by the dynamic obfuscation rule.

[0154] In a possible implementation, the acquisition unit 430 includes:

[0155] An acquisition module, used to acquire the latest synchronized dynamic obfuscation strategy between the message sender and the message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number of each time window, and a key seed;

[0156] A determination module, used to determine the target time window to which the target time belongs, and the number of the target time window;

[0157] A generation module is used to generate a dynamic obfuscation rule corresponding to the target time according to the key seed and the number of the target time window.

[0158] In a possible implementation manner, the dynamic obfuscation rule corresponding to the target time includes:

[0159] Concatenate the key seed and the number of the target time window, and perform hash calculation on the concatenation result to obtain a target hash value;

[0160] Obtain at least one byte corresponding to each of the target fields from the target hash value;

[0161] In the case where the target field includes a type field, performing an XOR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the XOR operation result as the type field value of the ICMP message to be sent;

[0162] In the case that the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields is determined as the field value of the other fields.

[0163] In a possible implementation, the device further includes:

[0164] An updating unit, configured to update current message feature information using the ICMP message after successfully parsing the ICMP message, wherein the current message feature information includes message feature information of ICMP messages received in a recent time period;

[0165] A detection unit, configured to perform attack behavior detection on the updated current message feature information based on a pre-trained message attack detection model, wherein the message attack detection model is obtained by training the normal flow and attack flow of ICMP messages using a machine learning model through context analysis;

[0166] The discarding unit 420 is further configured to discard the ICMP message when it is determined that the message sender has an ICMP message attack behavior.

[0167] Compared with the related technologies that defend against ICMP attacks by only limiting the number or frequency of ICMP messages, the ICMP attack defense device provided by the embodiment of the present application is no longer a passive static defense, but a dynamic active defense. It can not only modify the field value of at least one target field in the ICMP message by dynamically updating the obfuscation rules according to time, which can prevent attackers from identifying and forging legitimate traffic, but also stipulate that the message receiver directly discards the ICMP message sent by the IP address in the blacklist. This method can ensure that the receiver can verify the legitimacy of the message. It can be seen that the embodiment of the present application can build a more flexible and intelligent ICMP defense system by combining dynamic obfuscation rules with blacklists. This combination can not only increase the attack cost of attackers through dynamic obfuscation rules, but also quickly block known malicious traffic through the blacklist mechanism, thereby achieving a multi-level and three-dimensional defense effect.

[0168] In addition, by dividing a valid time period into multiple time windows and dynamically adjusting the dynamic obfuscation rules according to the time window number, the dynamic obfuscation rules used for the messages sent in different time windows are different, which not only reduces the frequency of synchronizing the dynamic obfuscation rules between the two parties, but also, for example, in a longer period of time, it is only necessary to synchronize the seed and algorithm at the initial moment, and the dynamic obfuscation rules in this time period can be automatically generated, and the dynamic obfuscation rules are fixed in each time window (such as 10 minutes), reducing the real-time synchronization requirements, and the mapping rules for each time window are unique, attackers cannot reuse old messages, and based on the irreversibility of the hash algorithm, attackers are prevented from cracking the dynamic obfuscation rules.

[0169] After the message receiver successfully parses the ICMP message, attack detection is performed by combining the pre-trained message attack detection model with the context of the message, which can further improve the reliability of ICMP message defense.

[0170] Based on the above method embodiment, another embodiment of the present application provides a system for defending against ICMP attacks, the system comprising a message sender and a message receiver, the message sender comprising:

[0171] one or more first processors;

[0172] The first processor is coupled to a first memory, the first memory being used to store one or more programs;

[0173] When one or more programs stored in the first memory are executed by the one or more first processors, the message sender implements the method described in any embodiment of the ICMP attack defense method in which the message sender is the execution subject;

[0174] The message receiver includes:

[0175] one or more second processors;

[0176] The second processor is coupled to a second memory, and the second memory is used to store one or more programs;

[0177] When one or more programs stored in the second memory are executed by the one or more second processors, the message receiver implements the method described in any embodiment of the method for defending against ICMP attacks with the message receiver as the execution subject.

[0178] like Figure 5 As shown in the figure, the interaction process between the two parties includes:

[0179] On the message sender:

[0180] S510: Obtain the target IP address.

[0181] S520: Determine whether the target IP address is in the whitelist; if the determination result is yes, execute step S530; if the determination result is no, execute step S540.

[0182] S530: Determine the dynamic obfuscation rule corresponding to the current time, and use the dynamic obfuscation rule to encapsulate the ICMP message to be sent, and then execute step S550.

[0183] S540: Do not send an ICMP message to the target IP address.

[0184] S550: Send an ICMP message to the target IP address.

[0185] On the message receiver:

[0186] S560: Receive the ICMP message sent by the message sender.

[0187] S570: Determine whether the source IP address in the ICMP message is in the blacklist; if so, execute step S5120; if not, execute step S580.

[0188] S580: Obtain dynamic obfuscation rules corresponding to the target time.

[0189] S590: Verify the ICMP message based on the dynamic verification rule determined by the dynamic obfuscation rule corresponding to the target time; if the verification passes, execute step S5110; if the verification fails, execute step S5120.

[0190] S5110: Obtain the data content of the message and perform subsequent processing.

[0191] S5120: discard the ICMP message.

[0192] In order to further defend against ICMP message attacks, after successfully parsing the ICMP message, the message receiver may not immediately process the data content in the ICMP message, nor immediately respond to the message sender, but first use the AI ​​model to perform further attack detection, and then process or respond to the data content in the ICMP message after determining that there is no danger. For specific implementation methods, please refer to the method embodiment executed by the message receiver.

[0193] The ICMP attack defense system provided by the embodiment of the present application can not only modify the field value of at least one target field in the ICMP message by dynamically updating the obfuscation rules according to time, which can prevent attackers from identifying and forging legitimate traffic, but also stipulate that the message sender only sends ICMP messages to the IP addresses in the white list, and the message receiver directly discards the ICMP messages sent by the IP addresses in the black list. This method can effectively prevent the message from being sent to unknown or malicious targets, while ensuring that the receiver can verify the legitimacy of the message. It can be seen that the embodiment of the present application can build a more flexible and intelligent ICMP defense system by combining dynamic obfuscation rules with black and white lists. This combination can not only increase the attack cost of attackers through dynamic obfuscation rules, but also quickly block known malicious traffic through the black and white list mechanism, thereby achieving a multi-level and three-dimensional defense effect.

[0194] In addition, by dividing a valid time period into multiple time windows and dynamically adjusting the dynamic obfuscation rules according to the time window number, the dynamic obfuscation rules used for the messages sent in different time windows are different, which not only reduces the frequency of synchronizing the dynamic obfuscation rules between the two parties, but also, for example, in a longer period of time, it is only necessary to synchronize the seed and algorithm at the initial moment, and the dynamic obfuscation rules in this time period can be automatically generated, and the dynamic obfuscation rules are fixed in each time window (such as 10 minutes), reducing the real-time synchronization requirements, and the mapping rules for each time window are unique, attackers cannot reuse old messages, and based on the irreversibility of the hash algorithm, attackers are prevented from cracking the dynamic obfuscation rules.

[0195] After the message receiver successfully parses the ICMP message, attack detection is performed by combining the pre-trained message attack detection model with the context of the message, which can further improve the reliability of ICMP message defense.

[0196] Based on the above method embodiments, another embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described in any of the above embodiments is implemented.

[0197] Based on the above embodiments, another embodiment of the present application provides a computer program product, which includes instructions. When the instructions are executed on a computer or a processor, the computer or the processor executes the method described in any of the above embodiments.

[0198] The above-mentioned device embodiments and system embodiments correspond to the method embodiments and have the same technical effects as the method embodiments. For specific descriptions, please refer to the method embodiments. The device embodiments and system embodiments are obtained based on the method embodiments. For specific descriptions, please refer to the method embodiment section, which will not be repeated here. A person of ordinary skill in the art can understand that the accompanying drawings are only schematic diagrams of one embodiment, and the modules or processes in the accompanying drawings are not necessarily required to implement the present application.

[0199] Those skilled in the art can understand that the modules in the device in the embodiment can be distributed in the device in the embodiment according to the description of the embodiment, or can be changed accordingly and located in one or more devices different from the embodiment. The modules in the above embodiment can be combined into one module, or can be further divided into multiple sub-modules.

[0200] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for defending against ICMP attacks, characterized in that: The method is applied to a message sender, and the method comprises: Determine whether the target IP address is in the whitelist, wherein the target IP address is the IP address of the message receiver; When the target IP address is in the whitelist, the dynamic obfuscation rule corresponding to the current time is determined, and based on the dynamic obfuscation rule corresponding to the current time, at least one target field value in the header of the generated standard Internet Control Message Protocol ICMP message is modified, and the current time is added to the data part of the standard ICMP message, and the modified ICMP message is sent to the message receiver, wherein the dynamic obfuscation rule is an obfuscation rule that is dynamically updated according to time.

2. The method according to claim 1, characterized in that Determine the dynamic obfuscation rules corresponding to the current time, including: Acquire the latest synchronized dynamic obfuscation strategy between the message sender and the message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number of each time window, and a key seed; Determine the target time window to which the current time belongs, and the number of the target time window; Generate a dynamic obfuscation rule corresponding to the current time according to the key seed and the number of the target time window.

3. The method according to claim 2, characterized in that The dynamic obfuscation rules corresponding to the current time include: Concatenate the key seed and the number of the target time window, and perform hash calculation on the concatenation result to obtain a target hash value; Obtain at least one byte corresponding to each of the target fields from the target hash value; In the case where the target field includes a type field, performing an XOR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the XOR operation result as the type field value of the ICMP message to be sent; In the case that the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields is determined as the field value of the other fields.

4. A method for defending against ICMP attacks, characterized in that: The method is applied to a message receiver, and the method comprises: Receive Internet Control Message Protocol ICMP messages sent by message senders; If the source IP address in the ICMP message is in the blacklist, discard the ICMP message; In the case where the source IP address in the ICMP message is not in the blacklist, a dynamic obfuscation rule corresponding to a target time is obtained, and based on a dynamic verification rule determined by the dynamic obfuscation rule corresponding to the target time, whether a field value of at least one target field in a header of the ICMP message is a field value specified by the dynamic obfuscation rule is verified; in the case where it is verified that a field value of at least one target field is not a field value specified by the dynamic obfuscation rule, the ICMP message is discarded, wherein the target time is a timestamp contained in a data portion of the ICMP message, which indicates the time when the message sender encapsulates the ICMP message, and the dynamic obfuscation rule is an obfuscation rule dynamically updated according to time.

5. The method according to claim 4, characterized in that Get the dynamic obfuscation rules corresponding to the target time, including: Acquire the latest synchronized dynamic obfuscation strategy between the message sender and the message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number of each time window, and a key seed; Determine the target time window to which the target time belongs, and the number of the target time window; Generate a dynamic obfuscation rule corresponding to the target time according to the key seed and the number of the target time window.

6. The method according to claim 5, characterized in that The dynamic obfuscation rules corresponding to the target time include: Concatenate the key seed and the number of the target time window, and perform hash calculation on the concatenation result to obtain a target hash value; Obtain at least one byte corresponding to each of the target fields from the target hash value; In the case where the target field includes a type field, performing an XOR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the XOR operation result as the type field value of the ICMP message to be sent; In the case that the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields is determined as the field value of the other fields.

7. The method according to any one of claims 4 to 6, characterized in that: After successfully parsing the ICMP message, the method further includes: Using the ICMP message to update current message characteristic information, wherein the current message characteristic information includes message characteristic information of ICMP messages received in a recent time period; Based on a pre-trained message attack detection model, attack behavior detection is performed on the updated current message feature information, wherein the message attack detection model is obtained by using a machine learning model to perform context analysis training on normal traffic and attack traffic of ICMP messages; When it is determined that the message sender has ICMP message attack behavior, the ICMP message is discarded.

8. A device for defending against ICMP attacks, characterized in that: The device is applied to a message sender, and the device includes: A determination unit, used to determine whether a target IP address is in a whitelist, wherein the target IP address is an IP address of a message receiver; a determination unit, configured to determine a dynamic obfuscation rule corresponding to a current time when the target IP address is in the whitelist, wherein the dynamic obfuscation rule is an obfuscation rule dynamically updated according to time; A modification unit is used to modify at least one target field value in the header of the generated standard Internet Control Message Protocol ICMP message based on the dynamic obfuscation rule corresponding to the current time, and to add the current time to the data part of the standard ICMP message. The sending unit is used to send the modified ICMP message to the message receiver.

9. A device for defending against ICMP attacks, characterized in that: The device is applied to a message receiver, and comprises: A receiving unit, used for receiving an Internet Control Message Protocol ICMP message sent by a message sender; A discarding unit, configured to discard the ICMP message if the source IP address in the ICMP message is in a blacklist; an acquiring unit, configured to acquire a dynamic obfuscation rule corresponding to a target time when the source IP address in the ICMP message is not in the blacklist, wherein the target time is a timestamp contained in the data part of the ICMP message, which is used to indicate the time when the message sender encapsulates the ICMP message, and the dynamic obfuscation rule is an obfuscation rule dynamically updated according to the time; a verification unit, configured to verify, based on a dynamic verification rule determined by the dynamic obfuscation rule corresponding to the target time, whether a field value of at least one target field in the header of the ICMP message is a field value specified by the dynamic obfuscation rule; The discarding unit is further used to discard the ICMP message when verifying that a field value of the at least one target field contains a field value that is not specified by the dynamic obfuscation rule.

10. A system for defending against ICMP attacks, the system comprising a message sender and a message receiver, characterized in that: The message sender includes: one or more first processors; The first processor is coupled to a first memory, the first memory being used to store one or more programs; When one or more programs stored in the first memory are executed by the one or more first processors, the message sender implements the method according to any one of claims 1 to 3; The message receiver includes: one or more second processors; The second processor is coupled to a second memory, and the second memory is used to store one or more programs; When one or more programs stored in the second memory are executed by the one or more second processors, the message receiver implements the method as described in any one of claims 4 to 7.

Images