ICMP attack defense method, device and system

Abstract

The present application discloses a method, device and system for defending against ICMP attacks, wherein the method executed by the message sender includes: determining whether the target IP address is in a whitelist, wherein the target IP address is the IP address of the message receiver; if the target IP address is in the whitelist, determining the dynamic obfuscation rule corresponding to the current time, and based on the dynamic obfuscation rule corresponding to the current time, modifying at least one target field value in the header of a generated standard Internet Control Message Protocol (ICMP) message, adding the current time to the data part of the standard ICMP message, and sending the modified ICMP message to the message receiver, wherein the dynamic obfuscation rule is an obfuscation rule that is dynamically updated according to time.

Description

Technical Field

[0001] The present application relates to the field of computer communications, and more specifically, to a method, device, and system for defending against ICMP attacks. Background Art

[0002] The Internet Control Message Protocol (ICMP) is a connectionless protocol used to transmit error reporting control messages. ICMP is a network layer protocol primarily used to transmit control information between hosts and routers, including error reporting and the exchange of restricted control and status information. ICMP messages are automatically sent when IP (Internet Protocol) data cannot reach its destination or when an IP router is unable to forward packets at its current rate.

[0003] However, precisely because the ICMP protocol itself is designed for network diagnosis and error reporting, and does not require a connection to be established, attackers can easily forge or send a large number of malicious messages (especially ICMP messages of the Echo Request type), thereby exhausting the target device's bandwidth and computing resources or triggering error responses, causing service paralysis.

[0004] Currently, the primary means of defending against ICMP attacks is to limit the number or frequency of ICMP messages, such as by limiting the rate of ICMP traffic through firewall rules or traffic control policies. However, this coarse-grained restriction method presents significant problems: on the one hand, legitimate ICMP requests (such as those discovered through frequent Ping tests or path MTU (Maximum Transmission Unit) by operations and maintenance personnel) may be mistakenly identified as attack traffic because they exceed the threshold, resulting in critical data being erroneously discarded, affecting the normal functioning of the network; on the other hand, attackers may bypass rate limiting policies by forging source IP addresses or launching distributed attacks, while defense mechanisms cannot accurately identify the source of attacks due to the "one-size-fits-all" flow control rules, which in turn increases the risk of false blocking. Therefore, relying solely on message quantity restrictions makes it difficult to balance security and availability. Summary of the Invention

[0005] The present application provides a method, device and system for defending against ICMP attacks, which can transform static defense into active defense and improve the reliability of defending against ICMP attacks.

[0006] The specific technical solutions are as follows:

[0007] In a first aspect, an embodiment of the present application provides a method for defending against ICMP attacks, the method being applied to a message sender, the method comprising:

[0008] Determine whether the target IP address is in the whitelist, wherein the target IP address is the IP address of the message recipient;

[0009] When the target IP address is in the whitelist, a dynamic obfuscation rule corresponding to the current time is determined, and based on the dynamic obfuscation rule corresponding to the current time, at least one target field value in the header of the generated standard Internet Control Message Protocol (ICMP) message is modified, and the current time is added to the data part of the standard ICMP message, and the modified ICMP message is sent to the message recipient, wherein the dynamic obfuscation rule is an obfuscation rule that is dynamically updated according to time.

[0010] In one possible implementation, determining the dynamic obfuscation rule corresponding to the current time includes:

[0011] Obtaining a dynamic obfuscation strategy that is most recently synchronized between the message sender and the message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number for each time window, and a key seed;

[0012] Determine the target time window to which the current time belongs, and the number of the target time window;

[0013] Generate a dynamic obfuscation rule corresponding to the current time according to the key seed and the number of the target time window.

[0014] In a possible implementation, the dynamic obfuscation rules corresponding to the current time include:

[0015] Concatenate the key seed and the number of the target time window, and perform hash calculation on the concatenation result to obtain a target hash value;

[0016] Obtain at least one byte corresponding to each of the target fields from the target hash value;

[0017] In a case where the target field includes a type field, performing an exclusive OR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the exclusive OR operation result as the type field value of the ICMP message to be sent;

[0018] In the case that the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields is determined as the field value of the other fields.

[0019] In a second aspect, an embodiment of the present application provides a method for defending against ICMP attacks, the method being applied to a message receiver, the method comprising:

[0020] Receive Internet Control Message Protocol (ICMP) messages from the message sender;

[0021] If the source IP address in the ICMP message is in the blacklist, discard the ICMP message;

[0022] When the source IP address in the ICMP message is not in the blacklist, a dynamic obfuscation rule corresponding to the target time is obtained, and based on the dynamic verification rule determined by the dynamic obfuscation rule corresponding to the target time, whether the field value of at least one target field in the header of the ICMP message is the field value specified by the dynamic obfuscation rule is verified; when it is verified that there is a field value that is not specified by the dynamic obfuscation rule in the field value of the at least one target field, the ICMP message is discarded, wherein the target time is a timestamp contained in the data part of the ICMP message, which is used to indicate the time when the message sender encapsulates the ICMP message, and the dynamic obfuscation rule is an obfuscation rule that is dynamically updated according to time.

[0023] In one possible implementation, obtaining a dynamic obfuscation rule corresponding to a target time includes:

[0024] Obtaining a dynamic obfuscation strategy that is most recently synchronized between the message sender and the message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number for each time window, and a key seed;

[0025] Determine the target time window to which the target time belongs and the number of the target time window;

[0026] Generate a dynamic obfuscation rule corresponding to the target time according to the key seed and the number of the target time window.

[0027] In a possible implementation, the dynamic obfuscation rules corresponding to the target time include:

[0028] Concatenate the key seed and the target time window number, and perform hash calculation on the concatenation result to obtain a target hash value;

[0029] Obtain at least one byte corresponding to each of the target fields from the target hash value;

[0030] In a case where the target field includes a type field, performing an exclusive OR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the exclusive OR operation result as the type field value of the ICMP message to be sent;

[0031] In the case that the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields is determined as the field value of the other fields.

[0032] In a possible implementation, after successfully parsing the ICMP message, the method further includes:

[0033] Updating current message feature information using the ICMP message, wherein the current message feature information includes message feature information of ICMP messages received in a recent time period;

[0034] Performing attack behavior detection on the updated current message feature information based on a pre-trained message attack detection model, wherein the message attack detection model is trained by contextual analysis of normal traffic and attack traffic of ICMP messages using a machine learning model;

[0035] If it is determined that the message sender has an ICMP message attack behavior, the ICMP message is discarded.

[0036] In a third aspect, an embodiment of the present application provides a device for defending against ICMP attacks, characterized in that the device is applied to a message sender, and the device includes:

[0037] a determination unit, configured to determine whether a target IP address is in a whitelist, wherein the target IP address is an IP address of a message receiver;

[0038] a determining unit, configured to determine a dynamic obfuscation rule corresponding to a current time when the target IP address is in the whitelist, wherein the dynamic obfuscation rule is an obfuscation rule dynamically updated according to time;

[0039] a modification unit, configured to modify at least one target field value in a header of a generated standard Internet Control Message Protocol (ICMP) message based on a dynamic obfuscation rule corresponding to the current time, and to add the current time to a data portion of the standard ICMP message;

[0040] The sending unit is used to send the modified ICMP message to the message receiver.

[0041] In a possible implementation, the determining unit includes:

[0042] an acquisition module, configured to acquire a dynamic obfuscation strategy most recently synchronized between the message sender and the message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number for each time window, and a key seed;

[0043] a determination module, configured to determine the target time window to which the current time belongs and the number of the target time window;

[0044] A generation module is used to generate a dynamic obfuscation rule corresponding to the current time according to the key seed and the number of the target time window.

[0045] In a possible implementation, the dynamic obfuscation rules corresponding to the current time include:

[0046] Concatenate the key seed and the number of the target time window, and perform hash calculation on the concatenation result to obtain a target hash value;

[0047] Obtain at least one byte corresponding to each of the target fields from the target hash value;

[0048] In a case where the target field includes a type field, performing an exclusive OR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the exclusive OR operation result as the type field value of the ICMP message to be sent;

[0049] In the case that the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields is determined as the field value of the other fields.

[0050] In a fourth aspect, an embodiment of the present application provides a device for defending against ICMP attacks, the device being applied to a message receiver, the device comprising:

[0051] A receiving unit, configured to receive an Internet Control Message Protocol (ICMP) message sent by a message sender;

[0052] a discarding unit, configured to discard the ICMP message if the source IP address in the ICMP message is in a blacklist;

[0053] an acquiring unit, configured to acquire, when the source IP address in the ICMP message is not in the blacklist, a dynamic obfuscation rule corresponding to a target time, wherein the target time is a timestamp contained in a data portion of the ICMP message, indicating a time when the message sender encapsulated the ICMP message, and the dynamic obfuscation rule is an obfuscation rule dynamically updated according to the time;

[0054] a verification unit, configured to verify, based on a dynamic verification rule determined by the dynamic obfuscation rule corresponding to the target time, whether a field value of at least one target field in the header of the ICMP message is a field value specified by the dynamic obfuscation rule;

[0055] The discarding unit is further configured to discard the ICMP message when verifying that a field value of the at least one target field contains a field value that is not specified by the dynamic obfuscation rule.

[0056] In a possible implementation, the acquiring unit includes:

[0057] an acquisition module, configured to acquire a dynamic obfuscation strategy most recently synchronized between the message sender and the message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number for each time window, and a key seed;

[0058] a determination module, configured to determine the target time window to which the target time belongs and the number of the target time window;

[0059] A generation module is used to generate a dynamic obfuscation rule corresponding to the target time according to the key seed and the number of the target time window.

[0060] In a possible implementation, the dynamic obfuscation rules corresponding to the target time include:

[0061] Concatenate the key seed and the target time window number, and perform hash calculation on the concatenation result to obtain a target hash value;

[0062] Obtain at least one byte corresponding to each of the target fields from the target hash value;

[0063] In a case where the target field includes a type field, performing an exclusive OR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the exclusive OR operation result as the type field value of the ICMP message to be sent;

[0064] In the case that the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields is determined as the field value of the other fields.

[0065] In a possible implementation, the device further includes:

[0066] an updating unit, configured to update current message feature information using the ICMP message after successfully parsing the ICMP message, wherein the current message feature information includes message feature information of ICMP messages received in a recent time period;

[0067] a detection unit, configured to perform attack behavior detection on the updated current message feature information based on a pre-trained message attack detection model, wherein the message attack detection model is trained by performing contextual analysis on normal traffic and attack traffic of ICMP messages using a machine learning model;

[0068] The discarding unit is used to discard the ICMP message when it is determined that the sender of the message has an ICMP message attack behavior.

[0069] In a fifth aspect, an embodiment of the present application provides a system for defending against ICMP attacks, the system including a message sender and a message receiver, the message sender including:

[0070] one or more first processors;

[0071] The first processor is coupled to a first memory, and the first memory is used to store one or more programs;

[0072] When the one or more programs stored in the first memory are executed by the one or more first processors, the message sender implements the method as described in any possible implementation manner of the first aspect;

[0073] The message receiver includes:

[0074] one or more second processors;

[0075] The second processor is coupled to a second memory, and the second memory is used to store one or more programs;

[0076] When one or more programs stored in the second memory are executed by the one or more second processors, the message receiver implements the method described in any possible implementation manner of the second aspect.

[0077] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any possible implementation of the first aspect, or implements the method described in any possible implementation of the second aspect.

[0078] In the seventh aspect, an embodiment of the present application provides a computer program product, which contains instructions. When the instructions are run on a computer or a processor, the computer or the processor executes the method described in any possible implementation of the first aspect, or executes the method described in any possible implementation of the second aspect.

[0079] It can be seen from the above scheme that compared with the related technologies that only defend against ICMP attacks by limiting the number or frequency of ICMP messages, the ICMP attack defense method, device and system provided by the embodiment of the present application is no longer a passive static defense, but a dynamic active defense. It can not only modify the field value of at least one target field in the ICMP message by dynamically updating the obfuscation rules according to time, thereby preventing attackers from identifying and forging legitimate traffic, but also stipulate that the message sender only sends ICMP messages to the IP addresses in the whitelist, and the message receiver directly discards the ICMP messages sent by the IP addresses in the blacklist. This method can effectively prevent the message from being sent to unknown or malicious targets, while ensuring that the receiver can verify the legitimacy of the message. It can be seen that the embodiment of the present application can build a more flexible and intelligent ICMP defense system by combining dynamic obfuscation rules with black and white lists. This combination can not only increase the attack cost of the attacker through dynamic obfuscation rules, but also quickly block known malicious traffic through the black and white list mechanism, thereby achieving a multi-level and three-dimensional defense effect.

[0080] In addition, by dividing a valid time period into multiple time windows and dynamically adjusting the dynamic obfuscation rules according to the time window number, the dynamic obfuscation rules used for messages sent in different time windows are different, which not only reduces the frequency of synchronizing the dynamic obfuscation rules between the two parties, but also, for example, in a longer period of time, it is only necessary to synchronize the seed and algorithm at the initial moment. The dynamic obfuscation rules for this time period can be automatically generated, and the dynamic obfuscation rules are fixed in each time window (such as 10 minutes), reducing the need for real-time synchronization. Moreover, the mapping rules for each time window are unique, and attackers cannot reuse old messages. Based on the irreversibility of the hash algorithm, attackers are prevented from cracking the dynamic obfuscation rules.

[0081] After the message receiver successfully parses the ICMP message, attack detection can be performed using a pre-trained message attack detection model combined with the message context, which can further improve the reliability of ICMP message defense. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] To more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are merely some embodiments of the present application. Those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0083] Figure 1 A flowchart of a method for defending against ICMP attacks provided in an embodiment of the present application;

[0084] Figure 2A flowchart of another method for defending against ICMP attacks provided in an embodiment of the present application;

[0085] Figure 3 A block diagram of a device for defending against ICMP attacks provided in an embodiment of the present application;

[0086] Figure 4 A block diagram of another ICMP attack defense device provided in an embodiment of the present application;

[0087] Figure 5 A schematic diagram of the interaction flow of a system for defending against ICMP attacks provided in an embodiment of the present application. DETAILED DESCRIPTION

[0088] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0089] It should be noted that, in the absence of conflict, the embodiments in this application and the features in the embodiments can be combined with each other. The terms "including" and "having" in the embodiments of this application and the accompanying drawings, as well as any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices.

[0090] Figure 1 A flowchart of a method for defending against ICMP attacks provided in an embodiment of the present application is provided. The method can be applied to a message sender and may include the following steps:

[0091] S110: Determine whether the target IP address is in the whitelist.

[0092] The target IP address is the IP address of the message recipient. The whitelist includes the IP addresses of message recipients trusted by the message sender. Trusted message recipients include those on the same local area network (LAN), those on other LANs with which the message sender has established a trust relationship, and those for whom the data security center has detected no history of attack activity.

[0093] In actual applications, the whitelist can be updated dynamically, including removing IP addresses with attack behaviors from the whitelist and adding other IP addresses with no historical attack behaviors to the whitelist.

[0094] S120: When the target IP address is in the whitelist, determine the dynamic obfuscation rule corresponding to the current time, and based on the dynamic obfuscation rule corresponding to the current time, modify at least one target field value in the header of the generated standard Internet Control Message Protocol ICMP message, add the current time to the data part of the standard ICMP message, and send the modified ICMP message to the message recipient.

[0095] If the target IP address is on the whitelist, the recipient is trustworthy, preventing attacks from the recipient after sending the ICMP message. If the target IP address is not on the whitelist, ICMP messages are not sent to it, preventing subsequent attacks from the recipient. However, to prevent attackers from impersonating either the sender or the recipient to attack the other, ICMP messages can be transmitted using mutually agreed-upon dynamic obfuscation rules. Dynamic obfuscation rules are obfuscation rules that are updated dynamically over time.

[0096] The method for determining the dynamic obfuscation rule corresponding to the current time includes: obtaining the latest synchronized dynamic obfuscation strategy between a message sender and a message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into multiple time windows, a number for each time window, and a key seed; determining the target time window to which the current time belongs, and the number of the target time window; and generating the dynamic obfuscation rule corresponding to the current time based on the key seed and the number of the target time window.

[0097] The dynamic obfuscation policy can be generated by a central control center and updated regularly. The central control center can distribute the latest dynamic obfuscation policy to all computer devices under its centralized management via a secure channel, so that when these computer devices communicate, they can use the dynamic obfuscation policy to generate ICMP messages to protect against attackers. The dynamic obfuscation policy can also be generated directly by the message sender and message receiver through a negotiation protocol (such as Diffie-Hellman) before communication.

[0098] The valid time period is a future time period agreed upon by both parties. The two parties can agree to divide the valid time period into N time windows evenly or unevenly. For example, the valid time period is from 1:00 on January 1, 2025 to 2:00 on January 1, 2025. This 60-minute time period is divided into 6 time windows, namely [1:00, 1:10], (1:10, 1:20], (1:20, 1:30], (1:30, 1:40], (1:40, 1:50], (1:50, 2:00], and numbered 1, 2, 3, 4, 5, and 6 respectively. If the current time is 1:25 on January 1, 2025, the target time window corresponding to the current time is (1:20, 1:30], and the target time window is numbered 3. Therefore, the dynamic obfuscation rule corresponding to the current time can be generated based on the key seed and the target time window number 3.

[0099] The dynamic obfuscation rules corresponding to the current time include: concatenating the key seed and the target time window number, and performing hash calculation on the concatenation result to obtain a target hash value; obtaining at least one byte corresponding to each target field from the target hash value; when the target field includes a type field, performing an XOR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the XOR operation result as the type field value of the ICMP message to be sent; when the target field includes other fields except the type field, determining the value of at least one byte corresponding to the other fields as the field value of the other fields.

[0100] The structure of a standard ICMP message consists of a header and a data portion. The header includes the Type, Code, and Identifier (checksum), while the data portion includes the Data. The number of bytes occupied by each field in the header of an ICMP message generated using dynamic obfuscation rules can be the same as the number of bytes occupied by the corresponding field in the standard ICMP protocol.

[0101] For example, if the target field includes Type, Code, and Identifier, and the message type of the ICMP message to be sent has a type field value of 8 under the standard ICMP protocol, then when the ICMP message to be sent is encapsulated using the dynamic obfuscation rule, the first byte of the target hash value is XORed with 8, and the XOR result is used as the field value of the Type field, the second byte of the target hash value is used as the field value of the Code field, and the third byte of the target hash value is used as the field value of the Identifier field.

[0102] There are many common types of ICMP messages, but not every type of ICMP message will generate a traffic attack. Therefore, to improve communication efficiency, dynamic obfuscation rules can be used to encapsulate only those types that are prone to traffic attacks. For those types that are less likely to generate traffic attacks, standard ICMP protocols can be used for encapsulation. Other methods can be used to defend against attacks, such as AI-based detection and setting limits on the number of incoming ICMP packets.

[0103] Types prone to traffic attacks are defined as preset types, including types with field values ​​of 0, 8, etc. When the field value is 0, the corresponding type name is Echo Reply, indicating a response to an Echo Request (Ping reply), used for Ping testing to troubleshoot network connectivity issues; when the field value is 8, the corresponding type name is Echo Request, indicating a Ping request. In the embodiments of the present application, the sender of the message may be the party sending the request or the party sending the response.

[0104] In addition, in order to allow the message receiver to determine which dynamic obfuscation rule is used to parse the message, the message sender can also add the current time to the data part of the standard ICMP message. For example, it can be added to the beginning of the data part, that is, the data part includes the current time + data content; it can also be added to the end of the data part, that is, the data includes the data content + current time; in order to further defend against attacks, the current time can also be added to a specified position in the data content, and the current time can be inserted in the i-th byte and the i+1-th byte of the data content, so that the current time is the i+1-th byte.

[0105] Compared with the related technologies that only defend against ICMP attacks by limiting the number or frequency of ICMP messages, the method for defending against ICMP attacks provided by the embodiment of the present application is no longer a passive static defense, but a dynamic active defense. It can not only modify the field value of at least one target field in the ICMP message by dynamically updating the obfuscation rules according to time, thereby preventing attackers from identifying and forging legitimate traffic, but also stipulate that the message sender only sends ICMP messages to the IP addresses in the whitelist. This method can effectively prevent the message from being sent to unknown or malicious targets, and avoid the other party from attacking itself in reverse. It can be seen that the embodiment of the present application can build a more flexible and intelligent ICMP defense system by combining dynamic obfuscation rules with whitelists. This combination can not only increase the attacker's attack cost through dynamic obfuscation rules, but also quickly block known malicious traffic through the whitelist mechanism, thereby achieving a multi-level and three-dimensional defense effect.

[0106] In addition, by dividing a valid time period into multiple time windows and dynamically adjusting the dynamic obfuscation rules according to the time window number, the dynamic obfuscation rules used for messages sent in different time windows are different, which not only reduces the frequency of synchronizing the dynamic obfuscation rules between the two parties, but also, for example, in a longer period of time, it is only necessary to synchronize the seed and algorithm at the initial moment. The dynamic obfuscation rules for this time period can be automatically generated, and the dynamic obfuscation rules are fixed in each time window (such as 10 minutes), reducing the need for real-time synchronization. Moreover, the mapping rules for each time window are unique, and attackers cannot reuse old messages. Based on the irreversibility of the hash algorithm, attackers are prevented from cracking the dynamic obfuscation rules.

[0107] Figure 2 A flowchart of another method for defending against ICMP attacks provided in an embodiment of the present application is provided. The method can be applied to a message receiver and may include the following steps:

[0108] S210: Receive the ICMP message sent by the message sender.

[0109] S220: If the source IP address in the ICMP message is in the blacklist, the ICMP message is discarded.

[0110] Among them, the blacklist includes a list of IP addresses of message senders that the message receiver does not trust. For example, it may include IP addresses that the data security center has detected to have historical attack behaviors. In actual applications, the data security center can dynamically update the blacklist and send the updated blacklist to the devices managed by the server.

[0111] After receiving the ICMP message from the message sender, the message receiver can obtain the source IP address from it and determine whether the source IP address is on the blacklist. If the source IP address is on the blacklist, it means that the message sender has a history of attack behavior and is a dangerous device. To avoid being attacked, the ICMP message can be directly discarded.

[0112] S230: When the source IP address in the ICMP message is not in the blacklist, obtain the dynamic obfuscation rule corresponding to the target time, and based on the dynamic verification rule determined by the dynamic obfuscation rule corresponding to the target time, verify whether the field value of at least one target field in the header of the ICMP message is the field value specified by the dynamic obfuscation rule. When it is verified that there is a field value in the field value of at least one target field that is not specified by the dynamic obfuscation rule, discard the ICMP message.

[0113] The target time is the timestamp contained in the data portion of the ICMP message, indicating the time when the sender encapsulated the ICMP message. The receiver can obtain the target time from a specified location in the data portion of the ICMP message. Dynamic obfuscation rules are updated dynamically based on time.

[0114] The method for determining the dynamic obfuscation rule corresponding to the current time includes: obtaining the latest synchronized dynamic obfuscation strategy between a message sender and a message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into multiple time windows, a number of each time window, and a key seed; determining a target time window to which a target time belongs, and the number of the target time window; and generating the dynamic obfuscation rule corresponding to the target time based on the key seed and the number of the target time window.

[0115] The dynamic obfuscation policy can be generated by a central control center and updated regularly. The central control center can distribute the latest dynamic obfuscation policy to all computer devices under its centralized management via a secure channel, so that when these computer devices communicate, they can use the dynamic obfuscation policy to generate ICMP messages to protect against attackers. The dynamic obfuscation policy can also be generated directly by the message sender and message receiver through a negotiation protocol (such as Diffie-Hellman) before communication.

[0116] The effective time period is a future time period agreed upon by both parties. The parties can agree to divide the effective time period into N time windows evenly or unevenly.

[0117] Among them, the dynamic obfuscation rules corresponding to the target time include: splicing the key seed and the target time window number, and performing hash calculation on the splicing result to obtain the target hash value; obtaining at least one byte corresponding to each target field from the target hash value; when the target field includes a type field, performing an XOR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the XOR operation result as the type field value of the ICMP message to be sent; when the target field includes other fields except the type field, determining the value of at least one byte corresponding to the other fields as the field value of the other fields.

[0118] Correspondingly, the dynamic verification rule determined by the dynamic obfuscation rule corresponding to the current time includes: concatenating the key seed and the number of the target time window, and performing hash calculation on the concatenation result to obtain a target hash value; obtaining at least one byte corresponding to each target field from the target hash value; in the case where the target field includes a type field, performing an XOR operation on the type field value of the received ICMP message and the value of at least one byte corresponding to the type field obtained from the target hash value; if the XOR operation result is not within the value range of the type field value under the standard ICMP protocol, then determining that the type field value in the received ICMP message is not the field value specified by the dynamic obfuscation rule; if the XOR operation result is within the standard ICMP protocol, then determining that the type field value in the received ICMP message is not the field value specified by the dynamic obfuscation rule; if the XOR operation result is within the standard ICMP protocol, then determining that the type field value in the received ICMP message is not the field value specified by the dynamic obfuscation rule If the value of the type field under the CMP protocol is within the value range, the XOR operation result is used as the type field value of the received ICMP message under the standard ICMP protocol, and other fields are verified: when the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields obtained from the target hash value is compared with the value of the corresponding field in the received ICMP message. If they are all the same, the ICMP message is parsed successfully. If there are different field values, it is determined that there is a field value in the field value of at least one target field that is not specified by the dynamic obfuscation rule, the ICMP message parsing fails, the message sender is a suspected attacker, and the ICMP message can be discarded.

[0119] For example, if the target fields include Type, Code, and Identifier, the message receiver can first obtain the first byte from the calculated target hash value and perform an XOR operation on the first byte with the field value of the Type field of the received ICMP message. If the XOR operation result is any type field value specified in the standard ICMP protocol, the ICMP message is further verified. If the XOR operation result is not any type field value specified in the standard ICMP protocol, the ICMP message is directly discarded. The process of continuing to verify the ICMP message includes: the message receiver continues to obtain the second byte from the target hash value and determines whether the value of the second byte is the same as the field value of the Code field in the received ICMP message, and obtains the third and fourth bytes from the target hash value and determines whether the values ​​of the third and fourth bytes are the same as the field value of the Identifier field in the received ICMP message. If any of the field values ​​are different, the ICMP message is discarded. If they are all the same, the ICMP message is determined to be safe and the data content can be read for processing or response.

[0120] Compared with related technologies that defend against ICMP attacks by only limiting the number or frequency of ICMP messages, the method for defending against ICMP attacks provided by the embodiment of the present application is no longer a passive static defense, but a dynamic active defense. It can not only modify the field value of at least one target field in the ICMP message by dynamically updating the obfuscation rules according to time, thereby preventing attackers from identifying and forging legitimate traffic, but also stipulate that the message recipient directly discards the ICMP message sent by the IP address in the blacklist. This method can ensure that the recipient can verify the legitimacy of the message. It can be seen that the embodiment of the present application can build a more flexible and intelligent ICMP defense system by combining dynamic obfuscation rules with blacklists. This combination can not only increase the attacker's attack cost through dynamic obfuscation rules, but also quickly block known malicious traffic through the blacklist mechanism, thereby achieving a multi-level and three-dimensional defense effect.

[0121] In addition, by dividing a valid time period into multiple time windows and dynamically adjusting the dynamic obfuscation rules according to the time window number, the dynamic obfuscation rules used for messages sent in different time windows are different, which not only reduces the frequency of synchronizing the dynamic obfuscation rules between the two parties, but also, for example, in a longer period of time, it is only necessary to synchronize the seed and algorithm at the initial moment. The dynamic obfuscation rules for this time period can be automatically generated, and the dynamic obfuscation rules are fixed in each time window (such as 10 minutes), reducing the need for real-time synchronization. Moreover, the mapping rules for each time window are unique, and attackers cannot reuse old messages. Based on the irreversibility of the hash algorithm, attackers are prevented from cracking the dynamic obfuscation rules.

[0122] In one possible implementation, in order to further defend against ICMP message attacks, after successfully parsing the ICMP message, the data content in the ICMP message is not immediately processed, nor is the message sender immediately responded to. Instead, the AI ​​model is first used for further attack detection. After determining that there is no danger, the data content in the ICMP message is processed or responded to.

[0123] The method for attack detection on ICMP messages based on an AI model includes: using ICMP messages to update current message feature information, wherein the current message feature information includes message feature information of ICMP messages received in a recent time period; based on a pre-trained message attack detection model, attack behavior detection is performed on the updated current message feature information, wherein the message attack detection model is obtained by using a machine learning model to perform context analysis and training on normal traffic and attack traffic of ICMP messages; if it is determined that the message sender has ICMP message attack behavior, the ICMP message is discarded.

[0124] Among them, the ICMP messages used in training the message attack detection model are all messages that comply with the standard ICMP protocol.

[0125] The current message feature information includes the source IP address, target IP address, message length, payload content, message interval, message rate, historical behavior of the source IP address (whether there is attack behavior and the number of attacks), geographic location of the source IP address, service type of the target IP address, etc.

[0126] The message length is used to analyze message size distribution and identify abnormal payloads. The payload content is used to analyze the payload entropy and fixed patterns to identify covert channels or abnormal data. This can be recorded by recording the first N bytes of the payload (e.g., the first 32 bytes) or calculating the payload entropy.

[0127] The message interval is used to analyze the frequency of message transmission and identify high-frequency attacks (such as ICMP Flood). It is recorded by calculating the time difference between the current message and the previous message (such as 0.1 seconds).

[0128] The packet rate is used to analyze the number of packets per unit time and identify burst traffic.

[0129] The geographic location of the source IP address is used to analyze the geographic distribution of source IP addresses and identify abnormal areas (such as traffic from high-risk countries).

[0130] The target IP service type is used to analyze the target IP service type (such as web server, database server) and identify the attack risk of key assets. The recording method can be: recording the target IP service port (such as 80 / TCP).

[0131] In addition, the message attack detection model can be a neural network model such as Random Forest, SVM (Support Vector Machine), Long-Short Term Memory (LSTM), CNN (Convolutional Neural Networks), etc.

[0132] Based on the above method embodiment, another embodiment of the present application provides a device for defending against ICMP attacks, which is applied to a message sender, such as Figure 3 As shown, the device includes:

[0133] A determination unit 310 is configured to determine whether a target IP address is in a whitelist, wherein the target IP address is an IP address of a message receiver;

[0134] a determining unit 320 configured to determine a dynamic obfuscation rule corresponding to a current time when the target IP address is in the whitelist, wherein the dynamic obfuscation rule is an obfuscation rule dynamically updated according to time;

[0135] a modifying unit 330 configured to modify at least one target field value in a header of a generated standard Internet Control Message Protocol (ICMP) message based on a dynamic obfuscation rule corresponding to the current time, and to add the current time to a data portion of the standard ICMP message;

[0136] The sending unit 340 is configured to send the modified ICMP message to the message receiver.

[0137] In a possible implementation, the determining unit 320 includes:

[0138] an acquisition module, configured to acquire a dynamic obfuscation strategy most recently synchronized between the message sender and the message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number for each time window, and a key seed;

[0139] a determination module, configured to determine the target time window to which the current time belongs and the number of the target time window;

[0140] A generation module is used to generate a dynamic obfuscation rule corresponding to the current time according to the key seed and the number of the target time window.

[0141] In a possible implementation, the dynamic obfuscation rules corresponding to the current time include:

[0142] Concatenate the key seed and the number of the target time window, and perform hash calculation on the concatenation result to obtain a target hash value;

[0143] Obtain at least one byte corresponding to each of the target fields from the target hash value;

[0144] In a case where the target field includes a type field, performing an exclusive OR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the exclusive OR operation result as the type field value of the ICMP message to be sent;

[0145] In the case that the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields is determined as the field value of the other fields.

[0146] Compared with related technologies that defend against ICMP attacks by only limiting the number or frequency of ICMP messages, the ICMP attack defense device provided by the embodiment of the present application is no longer a passive static defense, but a dynamic active defense. It can not only modify the field value of at least one target field in the ICMP message by dynamically updating the obfuscation rules according to time, thereby preventing attackers from identifying and forging legitimate traffic, but also stipulate that the message sender only sends ICMP messages to the IP addresses in the whitelist. This method can effectively prevent the message from being sent to unknown or malicious targets, and avoid the other party from attacking itself in reverse. It can be seen that the embodiment of the present application can build a more flexible and intelligent ICMP defense system by combining dynamic obfuscation rules with whitelists. This combination can not only increase the attacker's attack cost through dynamic obfuscation rules, but also quickly block known malicious traffic through the whitelist mechanism, thereby achieving a multi-level and three-dimensional defense effect.

[0147] In addition, by dividing a valid time period into multiple time windows and dynamically adjusting the dynamic obfuscation rules according to the time window number, the dynamic obfuscation rules used for messages sent in different time windows are different, which not only reduces the frequency of synchronizing the dynamic obfuscation rules between the two parties, but also, for example, in a longer period of time, it is only necessary to synchronize the seed and algorithm at the initial moment. The dynamic obfuscation rules for this time period can be automatically generated, and the dynamic obfuscation rules are fixed in each time window (such as 10 minutes), reducing the need for real-time synchronization. Moreover, the mapping rules for each time window are unique, and attackers cannot reuse old messages. Based on the irreversibility of the hash algorithm, attackers are prevented from cracking the dynamic obfuscation rules.

[0148] Based on the above method embodiment, another embodiment of the present application provides a device for defending against ICMP attacks, which is applied to a message receiver, such as Figure 4 As shown, the device includes:

[0149] The receiving unit 410 is configured to receive an Internet Control Message Protocol (ICMP) message sent by a message sender;

[0150] a discarding unit 420, configured to discard the ICMP message if the source IP address in the ICMP message is in a blacklist;

[0151] an acquiring unit 430 configured to acquire, if the source IP address in the ICMP message is not in the blacklist, a dynamic obfuscation rule corresponding to a target time, wherein the target time is a timestamp contained in a data portion of the ICMP message, indicating a time when the message sender encapsulated the ICMP message, and the dynamic obfuscation rule is an obfuscation rule dynamically updated according to the time;

[0152] a verification unit 440 configured to verify, based on a dynamic verification rule determined by the dynamic obfuscation rule corresponding to the target time, whether a field value of at least one target field in the header of the ICMP message is a field value specified by the dynamic obfuscation rule;

[0153] The discarding unit 420 is further configured to discard the ICMP message when verifying that a field value of the at least one target field contains a field value that is not specified by the dynamic obfuscation rule.

[0154] In a possible implementation, the acquiring unit 430 includes:

[0155] an acquisition module, configured to acquire a dynamic obfuscation strategy most recently synchronized between the message sender and the message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number for each time window, and a key seed;

[0156] a determination module, configured to determine the target time window to which the target time belongs and the number of the target time window;

[0157] A generation module is used to generate a dynamic obfuscation rule corresponding to the target time according to the key seed and the number of the target time window.

[0158] In a possible implementation, the dynamic obfuscation rules corresponding to the target time include:

[0159] Concatenate the key seed and the target time window number, and perform hash calculation on the concatenation result to obtain a target hash value;

[0160] Obtain at least one byte corresponding to each of the target fields from the target hash value;

[0161] In a case where the target field includes a type field, performing an exclusive OR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the exclusive OR operation result as the type field value of the ICMP message to be sent;

[0162] In the case that the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields is determined as the field value of the other fields.

[0163] In a possible implementation, the device further includes:

[0164] an updating unit, configured to update current message feature information using the ICMP message after successfully parsing the ICMP message, wherein the current message feature information includes message feature information of ICMP messages received in a recent time period;

[0165] a detection unit, configured to perform attack behavior detection on the updated current message feature information based on a pre-trained message attack detection model, wherein the message attack detection model is trained by performing contextual analysis on normal traffic and attack traffic of ICMP messages using a machine learning model;

[0166] The discarding unit 420 is further configured to discard the ICMP message if it is determined that the message sender has an ICMP message attack behavior.

[0167] Compared with related technologies that defend against ICMP attacks by only limiting the number or frequency of ICMP messages, the ICMP attack defense device provided by the embodiment of the present application is no longer a passive static defense, but a dynamic active defense. It can not only modify the field value of at least one target field in the ICMP message by dynamically updating the obfuscation rules according to time, thereby preventing attackers from identifying and forging legitimate traffic, but also stipulate that the message recipient directly discards the ICMP message sent by the IP address in the blacklist. This method can ensure that the recipient can verify the legitimacy of the message. It can be seen that the embodiment of the present application can build a more flexible and intelligent ICMP defense system by combining dynamic obfuscation rules with blacklists. This combination can not only increase the attacker's attack cost through dynamic obfuscation rules, but also quickly block known malicious traffic through the blacklist mechanism, thereby achieving a multi-level and three-dimensional defense effect.

[0168] In addition, by dividing a valid time period into multiple time windows and dynamically adjusting the dynamic obfuscation rules according to the time window number, the dynamic obfuscation rules used for messages sent in different time windows are different, which not only reduces the frequency of synchronizing the dynamic obfuscation rules between the two parties, but also, for example, in a longer period of time, it is only necessary to synchronize the seed and algorithm at the initial moment. The dynamic obfuscation rules for this time period can be automatically generated, and the dynamic obfuscation rules are fixed in each time window (such as 10 minutes), reducing the need for real-time synchronization. Moreover, the mapping rules for each time window are unique, and attackers cannot reuse old messages. Based on the irreversibility of the hash algorithm, attackers are prevented from cracking the dynamic obfuscation rules.

[0169] After the message receiver successfully parses the ICMP message, attack detection can be performed using a pre-trained message attack detection model combined with the message context, which can further improve the reliability of ICMP message defense.

[0170] Based on the above method embodiment, another embodiment of the present application provides a system for defending against ICMP attacks, the system including a message sender and a message receiver, the message sender including:

[0171] one or more first processors;

[0172] The first processor is coupled to a first memory, and the first memory is used to store one or more programs;

[0173] When the one or more programs stored in the first memory are executed by the one or more first processors, the message sender implements the method described in any embodiment of the method for defending against ICMP attacks in which the message sender is the execution subject;

[0174] The message receiver includes:

[0175] one or more second processors;

[0176] The second processor is coupled to a second memory, and the second memory is used to store one or more programs;

[0177] When one or more programs stored in the second memory are executed by the one or more second processors, the message receiver implements the method described in any embodiment of the method for defending against ICMP attacks with the message receiver as the execution subject.

[0178] like Figure 5 As shown in the figure, the interaction process between the two parties includes:

[0179] On the message sender:

[0180] S510: Obtain the target IP address.

[0181] S520: Determine whether the target IP address is in the whitelist; if yes, execute step S530; if no, execute step S540.

[0182] S530: Determine the dynamic obfuscation rule corresponding to the current time, and use the dynamic obfuscation rule to encapsulate the ICMP message to be sent, and then execute step S550.

[0183] S540: Do not send an ICMP message to the target IP address.

[0184] S550: Send an ICMP message to the target IP address.

[0185] On the message receiver:

[0186] S560: Receive the ICMP message sent by the message sender.

[0187] S570: Determine whether the source IP address in the ICMP message is in the blacklist; if so, execute step S5120; if not, execute step S580.

[0188] S580: Obtain dynamic obfuscation rules corresponding to the target time.

[0189] S590: Verify the ICMP message based on the dynamic verification rule determined by the dynamic obfuscation rule corresponding to the target time; if the verification passes, execute step S5110; if the verification fails, execute step S5120.

[0190] S5110: Obtain the data content of the message and perform subsequent processing.

[0191] S5120: Discard the ICMP message.

[0192] To further protect against ICMP message attacks, after successfully parsing an ICMP message, the message receiver can first use the AI ​​model to perform further attack detection, and then process or respond to the data content of the ICMP message after determining that there is no danger. For specific implementation methods, please refer to the method embodiment performed by the message receiver.

[0193] The ICMP attack defense system provided by the embodiment of the present application can not only modify the field value of at least one target field in the ICMP message by dynamically updating the obfuscation rules according to time, thereby preventing attackers from identifying and forging legitimate traffic, but can also stipulate that the message sender only sends ICMP messages to the IP addresses in the whitelist, and the message receiver directly discards the ICMP messages sent by the IP addresses in the blacklist. This method can effectively prevent the message from being sent to unknown or malicious targets, while ensuring that the receiver can verify the legitimacy of the message. It can be seen that the embodiment of the present application can build a more flexible and intelligent ICMP defense system by combining dynamic obfuscation rules with black and white lists. This combination can not only increase the attack cost of attackers through dynamic obfuscation rules, but also quickly block known malicious traffic through the black and white list mechanism, thereby achieving a multi-level and three-dimensional defense effect.

[0194] In addition, by dividing a valid time period into multiple time windows and dynamically adjusting the dynamic obfuscation rules according to the time window number, the dynamic obfuscation rules used for messages sent in different time windows are different, which not only reduces the frequency of synchronizing the dynamic obfuscation rules between the two parties, but also, for example, in a longer period of time, it is only necessary to synchronize the seed and algorithm at the initial moment. The dynamic obfuscation rules for this time period can be automatically generated, and the dynamic obfuscation rules are fixed in each time window (such as 10 minutes), reducing the need for real-time synchronization. Moreover, the mapping rules for each time window are unique, and attackers cannot reuse old messages. Based on the irreversibility of the hash algorithm, attackers are prevented from cracking the dynamic obfuscation rules.

[0195] After the message receiver successfully parses the ICMP message, attack detection can be performed using a pre-trained message attack detection model combined with the message context, which can further improve the reliability of ICMP message defense.

[0196] Based on the above method embodiments, another embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any of the above embodiments.

[0197] Based on the above embodiments, another embodiment of the present application provides a computer program product, which includes instructions. When the instructions are executed on a computer or a processor, the computer or the processor executes the method described in any of the above embodiments.

[0198] The above-mentioned device embodiments and system embodiments all correspond to the method embodiments and have the same technical effects as the method embodiments. For specific descriptions, please refer to the method embodiments. The device embodiments and system embodiments are obtained based on the method embodiments. For specific descriptions, please refer to the method embodiments section and will not be repeated here. It should be understood by those skilled in the art that the accompanying drawings are only schematic diagrams of one embodiment, and the modules or processes in the accompanying drawings are not necessarily required to implement this application.

[0199] Those skilled in the art will appreciate that the modules in the apparatuses of the embodiments may be distributed in the apparatuses of the embodiments as described in the embodiments, or may be located in one or more apparatuses different from the embodiments with corresponding changes. The modules in the above embodiments may be combined into one module or further divided into multiple sub-modules.

[0200] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for defending against ICMP attacks, characterized in that: The method is applied to a message sender, and the method includes: Determine whether the target IP address is in the whitelist, wherein the target IP address is the IP address of the message receiver; If the target IP address is in the whitelist, determining a dynamic obfuscation rule corresponding to the current time, and based on the dynamic obfuscation rule corresponding to the current time, modifying at least one target field value in the header of a generated standard Internet Control Message Protocol (ICMP) message, adding the current time to the data portion of the standard ICMP message, and sending the modified ICMP message to the message recipient, wherein the dynamic obfuscation rule is an obfuscation rule that is dynamically updated according to time; Determine the dynamic obfuscation rules corresponding to the current time, including: Obtaining a dynamic obfuscation strategy that is most recently synchronized between the message sender and the message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number for each time window, and a key seed; Determine the target time window to which the current time belongs, and the number of the target time window; Generate a dynamic obfuscation rule corresponding to the current time according to the key seed and the number of the target time window; The dynamic obfuscation rules corresponding to the current time include: Concatenate the key seed and the target time window number, and perform hash calculation on the concatenation result to obtain a target hash value; Obtain at least one byte corresponding to each of the target fields from the target hash value; In a case where the target field includes a type field, performing an exclusive OR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the exclusive OR operation result as the type field value of the ICMP message to be sent; In the case that the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields is determined as the field value of the other fields.

2. A method for defending against ICMP attacks, characterized in that: The method is applied to a message receiver, and includes: Receive Internet Control Message Protocol (ICMP) messages from the message sender; If the source IP address in the ICMP message is in the blacklist, discard the ICMP message; When the source IP address in the ICMP message is not in the blacklist, a dynamic obfuscation rule corresponding to a target time is obtained, and based on a dynamic verification rule determined by the dynamic obfuscation rule corresponding to the target time, a field value of at least one target field in a header of the ICMP message is verified to be a field value specified by the dynamic obfuscation rule; if the field value of the at least one target field is not a field value specified by the dynamic obfuscation rule, the ICMP message is discarded, wherein the target time is a timestamp included in the data portion of the ICMP message, indicating the time when the message sender encapsulated the ICMP message, and the dynamic obfuscation rule is an obfuscation rule that is dynamically updated according to time; Get the dynamic obfuscation rules corresponding to the target time, including: Obtaining a dynamic obfuscation strategy that is most recently synchronized between the message sender and the message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number for each time window, and a key seed; Determine the target time window to which the target time belongs and the number of the target time window; Generate a dynamic obfuscation rule corresponding to the target time according to the key seed and the number of the target time window; The dynamic obfuscation rules corresponding to the target time include: Concatenate the key seed and the target time window number, and perform hash calculation on the concatenation result to obtain a target hash value; Obtain at least one byte corresponding to each of the target fields from the target hash value; In a case where the target field includes a type field, performing an exclusive OR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the exclusive OR operation result as the type field value of the ICMP message to be sent; In the case that the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields is determined as the field value of the other fields.

3. The method according to claim 2, characterized in that After successfully parsing the ICMP message, the method further includes: Updating current message feature information using the ICMP message, wherein the current message feature information includes message feature information of ICMP messages received in a recent time period; Based on a pre-trained message attack detection model, attack behavior detection is performed on the updated current message feature information, wherein the message attack detection model is trained by using a machine learning model to perform contextual analysis on normal traffic and attack traffic of ICMP messages; If it is determined that the message sender has an ICMP message attack behavior, the ICMP message is discarded.

4. A device for defending against ICMP attacks, characterized in that: The device is applied to a message sender, and includes: a determination unit, configured to determine whether a target IP address is in a whitelist, wherein the target IP address is an IP address of a message receiver; a determining unit, configured to determine a dynamic obfuscation rule corresponding to a current time when the target IP address is in the whitelist, wherein the dynamic obfuscation rule is an obfuscation rule dynamically updated according to time; a modification unit, configured to modify at least one target field value in a header of a generated standard Internet Control Message Protocol (ICMP) message based on a dynamic obfuscation rule corresponding to the current time, and to add the current time to a data portion of the standard ICMP message; A sending unit, configured to send the modified ICMP message to the message receiver; The determining unit includes: an acquisition module, configured to acquire a dynamic obfuscation strategy most recently synchronized between the message sender and the message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number for each time window, and a key seed; a determination module, configured to determine the target time window to which the current time belongs and the number of the target time window; A generation module, configured to generate a dynamic obfuscation rule corresponding to the current time according to the key seed and the number of the target time window; The dynamic obfuscation rules corresponding to the current time include: Concatenate the key seed and the target time window number, and perform hash calculation on the concatenation result to obtain a target hash value; Obtain at least one byte corresponding to each of the target fields from the target hash value; In a case where the target field includes a type field, performing an exclusive OR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the exclusive OR operation result as the type field value of the ICMP message to be sent; In the case that the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields is determined as the field value of the other fields.

5. A device for defending against ICMP attacks, characterized in that: The device is applied to a message receiver, and includes: A receiving unit, configured to receive an Internet Control Message Protocol (ICMP) message sent by a message sender; a discarding unit, configured to discard the ICMP message if the source IP address in the ICMP message is in a blacklist; an acquiring unit, configured to acquire, when the source IP address in the ICMP message is not in the blacklist, a dynamic obfuscation rule corresponding to a target time, wherein the target time is a timestamp contained in a data portion of the ICMP message, indicating a time when the message sender encapsulated the ICMP message, and the dynamic obfuscation rule is an obfuscation rule dynamically updated according to the time; a verification unit, configured to verify, based on a dynamic verification rule determined by the dynamic obfuscation rule corresponding to the target time, whether a field value of at least one target field in the header of the ICMP message is a field value specified by the dynamic obfuscation rule; The discarding unit is further configured to discard the ICMP message when verifying that a field value of the at least one target field is not a field value specified by the dynamic obfuscation rule; The acquisition unit includes: an acquisition module, configured to acquire a dynamic obfuscation strategy most recently synchronized between the message sender and the message receiver, wherein the dynamic obfuscation strategy includes a valid time period divided into a plurality of time windows, a number for each time window, and a key seed; a determination module, configured to determine the target time window to which the target time belongs and the number of the target time window; A generation module, configured to generate a dynamic obfuscation rule corresponding to the target time according to the key seed and the number of the target time window; The dynamic obfuscation rules corresponding to the target time include: Concatenate the key seed and the target time window number, and perform hash calculation on the concatenation result to obtain a target hash value; Obtain at least one byte corresponding to each of the target fields from the target hash value; In a case where the target field includes a type field, performing an exclusive OR operation on the type field value of the message type of the ICMP message to be sent under the standard ICMP protocol and the value of at least one byte corresponding to the type field obtained from the target hash value, and using the exclusive OR operation result as the type field value of the ICMP message to be sent; In the case that the target field includes other fields except the type field, the value of at least one byte corresponding to the other fields is determined as the field value of the other fields.

6. A system for defending against ICMP attacks, comprising a message sender and a message receiver, characterized in that: The message sender includes: one or more first processors; The first processor is coupled to a first memory, and the first memory is used to store one or more programs; When the one or more programs stored in the first memory are executed by the one or more first processors, the message sender implements the method according to claim 1; The message receiver includes: one or more second processors; The second processor is coupled to a second memory, and the second memory is used to store one or more programs; When the one or more programs stored in the second memory are executed by the one or more second processors, the message receiver implements the method according to any one of claims 2 to 3.

Images