Network attack countering method, system and device, computer equipment, storage medium and program product

Abstract

The invention relates to a network attack countering method, system and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: receiving an attack request forwarded by a trapping gateway; analyzing a script type of the attack request; and sending countering data corresponding to the script type to a sending end of the attack request, so that the sending end executes a self-destruction instruction associated with the countering data. An attack request is forwarded to a trap server through a trapping gateway, the trap server analyzes the attack request, determines the script type of a sending end and sends corresponding countering data in a targeted manner, and the countering data can guide the sending end to execute a self-destruction instruction and enter a self-destruction process of self destruction, so that automatic clearing of the sending end is realized; and the fundamental treatment of the network attack is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a network attack countermeasure method, system, device, computer equipment, computer readable storage medium and computer program product. BACKGROUND

[0002] DDoS (Distributed Denial of Service Attack) attack refers to that a large number of zombie devices controlled by an attack script send massive requests to a target device at the same time, so that resources of the target device are exhausted and the service of the target device is unavailable.

[0003] In the face of DDoS attack, the requests sent by the zombie devices can be intercepted through traffic cleaning, honeypot monitoring, SDN (Software-Defined Networking) dynamic scheduling and the like. However, these means can only temporarily alleviate the attack, and the attack script still survives and can be regenerated, which may launch an attack on the target device again, and cannot fundamentally solve the DDoS attack. SUMMARY

[0004] Therefore, it is necessary to provide a network attack countermeasure method, system, device, computer equipment, computer readable storage medium and computer program product to fundamentally solve the DDoS attack in view of the above technical problems.

[0005] In a first aspect, the present application provides a network attack countermeasure method, and the method comprises the steps that: receiving an attack request forwarded by a luring gateway; analyzing a script type of the attack request; sending countermeasure data corresponding to the script type to a sending end of the attack request, so that the sending end executes a self-destruction instruction associated with the countermeasure data.

[0006] In one of the embodiments, the step of sending the countermeasure data corresponding to the script type to the sending end of the attack request comprises the steps that: analyzing a first communication protocol between the sending end and a receiving end of the attack request; sending the countermeasure data corresponding to the script type to the sending end based on the first communication protocol.

[0007] In one of the embodiments, the method further comprises the steps that: After receiving the acknowledgment message returned by the sending end, a status report is generated and sent to the control server of the sending end; the acknowledgment message is used to indicate that the self-destruct instruction has been executed, and the status report is used to indicate that the sending end has successfully sent the attack request, so that the control server may mistakenly judge that the sending end is alive.

[0008] In one embodiment, generating and sending a status report to the control server of the sending end includes: Analyze the second communication protocol between the sending end and the control server; Based on the second communication protocol, a status report is generated and sent to the control server.

[0009] In one embodiment, the countermeasure data includes the download address of the fake upgrade package, and sending the countermeasure data corresponding to the script type to the sender of the attack request includes: The download address is sent to the sending end, so that the sending end downloads and executes the pseudo-upgrade package from the download address, wherein the pseudo-upgrade package encapsulates the self-destruct instruction.

[0010] In one embodiment, the countermeasure data includes a self-destruct instruction, and sending the countermeasure data corresponding to the script type to the sender of the attack request includes: Send the self-destruct command corresponding to the script type to the sender of the attack request.

[0011] Secondly, this application also provides a network attack countermeasure system, the system comprising: A trap gateway is used to forward attack requests to a trap server; The trap server is used to analyze the script type of the attack request; and send the countermeasure data corresponding to the script type to the sender of the attack request, so that the sender executes the self-destruct instruction associated with the countermeasure data.

[0012] In one embodiment, the trap server is further configured to generate and send a status report to the control server of the sender after receiving an acknowledgment message returned by the sender; the acknowledgment message is used to indicate that the self-destruct instruction has been executed, and the status report is used to indicate that the sender has successfully sent the attack request, so that the control server may mistakenly determine that the sender is alive.

[0013] Thirdly, this application also provides a network attack countermeasure device, the device comprising: The receiving module is used to receive attack requests forwarded by the trapping gateway; The analysis module is used to analyze the script type of the attack request; The sending module is used to send the countermeasure data corresponding to the script type to the sending end of the attack request, so that the sending end executes the self-destruct instruction associated with the countermeasure data.

[0014] Fourthly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps described in any of the above method embodiments.

[0015] Fifthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps described in any of the above method embodiments.

[0016] Sixthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps described in any of the above method embodiments.

[0017] The aforementioned network attack countermeasures methods, devices, computer equipment, computer-readable storage media, and computer program products forward attack requests to a trap server through a trapping gateway. The trap server analyzes the attack request, determines the script type of the sender, and sends corresponding countermeasure data accordingly. The countermeasure data can guide the sender to execute a self-destruct command and enter a self-destruction process, thereby achieving automatic removal of the sender and fundamentally controlling network attacks. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of a network attack countermeasure method in one embodiment; Figure 2 This is a logical architecture diagram of a network attack countermeasure method in one embodiment; Figure 3 This is an architecture diagram of a network attack countermeasure system in one embodiment; Figure 4 This is a structural block diagram of a network attack countermeasure device in one embodiment; Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0020] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not to limit the present application.

[0021] It should be noted that the terms "first", "second", etc. used in the present application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "include" and "have" and any variations thereof used in the present application are intended to cover non-exclusive inclusion. The term "a plurality of" used in the present application refers to two or more. The term "and / or" used in the present application refers to one of the options or any combination of multiple options.

[0022] In the face of DDoS attacks, traditional methods can only passively intercept the requests sent by zombie devices, temporarily relieve the attack, and the surviving attack scripts may continue to launch attacks on target devices, which cannot fundamentally solve the DDoS attack.

[0023] Based on this, the present application provides a network attack countermeasure method, which can be applied to a trap server. The trap server can be a virtual server deployed in a trap gateway, or an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The trap gateway is a network device that connects different networks and implements protocol conversion, used to forward received network requests, such as dedicated routers, firewall devices, modems, or integrated home smart routers with gateway functions, etc.

[0024] As shown in Figure 1 The network attack countermeasure method can implement the following flow: Step 101, receiving the attack request forwarded by the trap gateway.

[0025] It can be understood that the trap gateway is usually at the network entrance, and the access request entering the current network needs to be forwarded by the trap gateway to reach its corresponding target device. Based on this, the trap gateway needs to identify the received access request, distinguish the attack request from the zombie device from the normal business request, so as to avoid the attack request from penetrating into the network to cause impact on the core device, resulting in service response delay, resource occupation soaring and other failures.

[0026] Specifically, the trapping gateway can identify the attack features of the access request through a DPI (Deep Packet Inspection) technology, so as to determine the attack request. For example, the attack features can be embodied as specific User-Agent strings. The User-Agent string is a standard request header field in the HTTP (HyperText Transfer Protocol) protocol, but in many attack scenarios, the attack requests sent by the zombie devices controlled by the attack scripts will carry specific User-Agent strings, which can be special strings customized by the attack scripts or fixed identifiers associated with known attack tools and malicious programs. The trapping gateway compares the parsed User-Agent strings of each access request with a predefined attack feature library, and once a matching item is found, it can quickly determine that the access request is an attack request, thereby efficiently and accurately screening attack requests from a large number of access requests.

[0027] Alternatively, the trapping gateway can also identify attack requests through traffic behavior analysis, protocol feature matching, resource occupation monitoring and other means, which are not limited in the present application.

[0028] In the embodiments of the present application, when the trapping gateway identifies attack requests, these attack requests will not be directed to the target devices they are actually intended for, but will be redirected or mirrored to the current trap server by the trapping gateway, so as to ensure that the attack requests will not directly impact the target devices.

[0029] Step 102, analyze the script type of the attack request.

[0030] After receiving the attack request, it can be parsed by the script interaction agent inside the trap server to determine the type of the attack script that generates the attack request, wherein the type of the attack script usually depends on the underlying operating platform or programming environment it depends on, such as Windows, Linux or IoT (Internet of Things).

[0031] For example, the type of attack script can be determined based on the construction manner of the attack payload. For example, attack scripts dependent on Windows platform often contain command interpreters, object models and file path structures specific to Windows platform, such as invoking cmd.exe / c to execute command line instructions, executing encoded PowerShell scripts through powershell.exe-enc, or directly invoking specific APIs (Application Programming Interface) of.NET framework; attack scripts dependent on Linux platform tend to use standard Shell command syntax, such as executing command fragments through bash-c, or using a large number of system tools such as grep, awk, wget, etc., and the file paths involved generally follow the Unix-style directory structure; attack scripts dependent on IoT devices often have attack payloads that are compiled binary executable files directly targeting specific hardware architectures, or are simplified command sets commonly found in device firmware with limited functionality.

[0032] In addition, the type of attack script can also be determined based on the HTTP request header. For example, the User-Agent string can directly expose the programming language or underlying tool library on which the attack script depends, and this information is often related to a specific operating platform; different platforms or programming environments may have systematic differences in the naming habits and arrangement order of the request header when constructing HTTP requests.

[0033] In addition, the behavior pattern of the attack request can also be used to determine the type of attack script. For example, attack scripts for Windows platform may deploy commands to download and execute.exe executable files or PowerShell scripts in attack requests; attack scripts for Linux platform are more likely to deploy ELF (Executable and Linkable Format) executable files or attempt to move horizontally and elevate privileges through SSH (Secure Shell) protocol; attack scripts for IoT platform usually attempt to download a pre-compiled, cross-architecture worm program after obtaining initial privileges through specific vulnerabilities.

[0034] In addition, the type of attack script can also be determined based on the IP address of the attack request, the type of transmission protocol, and the platform type of the target device, without limitation.

[0035] In this step, information from multiple dimensions can be integrated to analyze the script type of the attack request, laying the foundation for subsequent targeted countermeasures and ensuring that the countermeasure data sent later matches the attack script, thus avoiding ineffective countermeasures.

[0036] Step 103: Send the countermeasure data corresponding to the script type to the sender of the attack request so that the sender executes the self-destruct command associated with the countermeasure data.

[0037] After identifying the attack script type, the script interaction agent can obtain the corresponding countermeasure data and send it back to the source of the attack request, i.e., the sender of the attack script. This countermeasure data exploits security vulnerabilities or logical flaws inherent in the script itself. When the sender (i.e., the botnet device exploited by the attacked script) receives the countermeasure data, it can trigger a self-destruct command associated with the countermeasure data, thereby disabling or eliminating the attack script and terminating the DDoS attack on the current network at its source.

[0038] For example, self-destruct commands can include uninstalling the attack script, overwriting the core code of the attack script, forcibly terminating the attack script process, clearing the attack script configuration and persistent files, disabling the attack script's execution permissions, etc., without being specifically limited.

[0039] It's understandable that the type of self-destruct instruction will differ depending on the type of the attack script. For example, for Windows attack scripts, the self-destruct instructions can be packaged into a batch file (.bat). The sending end executes this batch file, reading and executing these self-destruct instructions line by line in sequence. For Linux attack scripts, the self-destruct instructions must be Bash commands or shell scripts that can be read and parsed by a shell (command parsing shell). For IoT attack scripts, the self-destruct instructions can be firmware erasure commands.

[0040] As can be seen from the above, the solution provided in this application forwards attack requests to a trap server through a trapping gateway. The trap server analyzes the attack requests, determines the script type of the sender, and sends corresponding countermeasure data. The countermeasure data can guide the sender to execute a self-destruct command and enter a self-destruction process, thereby achieving automatic removal of the sender and fundamentally managing network attacks.

[0041] In one exemplary embodiment, step 103 includes: Analyze the first communication protocol between the sender and the receiver of the attack request; Based on the first communication protocol, the countermeasure data corresponding to the script type is sent to the sending end.

[0042] In this example embodiment, the first communication protocol between the sending end and the receiving end of the attack request can be analyzed first. The first communication protocol can be a transport layer protocol such as TCP, UDP, etc., an application layer protocol such as HTTP, MQTT, SSH, etc., or an industrial control protocol between IoT devices such as Modbus, CoAP, etc.

[0043] It can be understood that the first communication protocol can have different protocol versions, authentication mechanisms, session state maintenance methods, and data encapsulation formats, etc., which can determine the encapsulation method and sending strategy of the countermeasure data. Based on the analysis of the first communication protocol, the countermeasure data corresponding to the script type can be encapsulated according to the protocol specification and sent to the sending end to ensure the reliability of data transmission, avoid data loss due to protocol mismatch, and ensure that the countermeasure data can be accurately delivered to the sending end and effectively parsed.

[0044] Through protocol adaptation of the first communication protocol, the countermeasure data can enter the sending end in a compliant form under different network environments and different device types, providing reliable transmission guarantee for subsequent attack script execution self-destruction instructions, and improving the compatibility and effectiveness of the entire countermeasure process.

[0045] In an example embodiment, the method further comprises, after step 103: After receiving the return message returned by the sending end, a status report is generated and sent to the control server of the sending end; the return message is used to prompt that the self-destruction instruction has been executed, and the status report is used to prompt that the sending end has successfully sent the attack request, so as to make the control server misjudge that the sending end is alive.

[0046] In this embodiment, after the sending of the countermeasure data is completed, when the return message returned by the sending end is received, which is used to confirm that the self-destruction instruction has been successfully executed, a false feedback engine can be triggered to generate a fake status report. This status report simulates the report message returned by the sending end to the control server after normally sending the attack request. After the status report is sent to the control server to which the sending end belongs, the control server will misjudge that the attack script of the sending end is still alive and has successfully completed the sending task of the attack request. The control server refers to the central control server that issues attack instructions to the sending end.

[0047] In this way, on the one hand, the attack script controlled by the control server has been removed; on the other hand, the control server still believes that the attack script is in an active state and is still continuing to dispatch new attack instructions to it. The control server cannot accurately perceive the real downsizing of the attack network, not only effectively breaking down the single attack, but also continuously destroying the subsequent resource scheduling of the control server, achieving the resource consumption of the control server.

[0048] In one implementation, step 104 comprises: analyzing a second communication protocol between the sending end and the control server; generating and sending a status report to the control server based on the second communication protocol.

[0049] In this implementation, the function implementation of the false feedback engine relies on the analysis of the communication protocol between the sending end and the control server. Specifically, after receiving the attack request, or after receiving the return message returned by the sending end, the analysis of the second communication link between the sending end and its control server can be started.

[0050] The second communication protocol is usually a command and control channel protocol dedicated to the attack network, which can be TCP (Transmission Control Protocol), HTTP / HTTPS (HyperText Transfer Protocol Secure), IRC (Internet Relay Chat), or even a relay instruction relying on a third-party platform, etc. The analysis of the second communication protocol includes but is not limited to analyzing its encryption method, message structure, authentication mechanism and heartbeat interval. Based on these protocol specifications, a fully compliant status report can be constructed, which has the same data format, encryption key, signature and sequence number as the real report generated by the attack script.

[0051] Further, a connection from the current trap server to the control server can be established, or through the relay of the sending end, the forged status report is encapsulated and sent to the control server according to the standard of the second communication protocol.

[0052] In this way, the control server will misjudge that the attack script is still alive and the task execution is successful, thereby effectively covering up the self-destruction action, maintaining the information difference between the control server's cognition and the real state, and gaining longer response time for the current network and disrupting the resource scheduling of the control server.

[0053] In one exemplary embodiment, the countermeasure data includes a download address of a pseudo-upgrade package, and step 103 comprises: sending the download address to the sending end to make the sending end download and execute the pseudo-upgrade package from the download address, and the pseudo-upgrade package encapsulates the self-destruction instruction.

[0054] In the exemplary embodiment, the countermeasure data is designed as a download address of a pseudo upgrade package. After the trap server confirms the script type of the attack request and determines the corresponding self-destroying instruction, the self-destroying instruction can be encapsulated as a seemingly legitimate upgrade package, i.e. a pseudo upgrade package. The pseudo upgrade package can be a.bin executable file, which is highly consistent with the real upgrade package in external version information, digital signature and file structure.

[0055] Then, the download address of the pseudo upgrade package is sent as the countermeasure data to the sending end. For example, the download address can be embedded in the HTTP 302 status code and returned to the sending end as a response to the attack request. The download address can be disguised as an official or commonly used update server address of the malware family to which the attack script belongs, so as to pass the basic security check of the sending end more safely.

[0056] After receiving the download address, the sending end can determine it as trusted by the inherent update mechanism or instruction execution logic thereof, and then automatically initiate a download request for the pseudo upgrade package. When the sending end completes the download and executes the pseudo upgrade package, the encapsulated self-destroying instruction is triggered, so as to achieve self-cleaning in the environment where the attack script is located. The execution permission and behavior characteristics of the entire process are the same as those of normal software update behavior, which effectively avoids the detection of the security mechanism of the attack script.

[0057] In another exemplary embodiment, the countermeasure data includes self-destroying instructions, and step 103 includes: sending the self-destroying instructions corresponding to the script type to the sending end of the attack request.

[0058] In the exemplary embodiment, the countermeasure data can be directly designed as self-destroying instructions that can be immediately executed. After accurately identifying the script type of the attack request, the trap server calls the self-destroying instructions matched therewith from a self-destroying instruction library. These self-destroying instructions are final payloads that do not need intermediate interpretation or secondary download and can be natively identified and executed by the sending end. The self-destroying instruction library can be an internal database of the trap server or an external database, which is not limited in particular.

[0059] Subsequently, the accurately countermeasured self-destroying instructions can be directly sent to the sending end. After receiving the self-destroying instructions, the sending end can directly trigger execution without triggering a security alarm, and achieve rapid failure and cleaning of the attack script through a series of operations such as process termination, file deletion and system configuration cleaning.

[0060] This way eliminates the step of downloading resources by the sending end, significantly shortens the countermeasure effective time, and greatly improves the efficiency and concealment of the cleaning action.

[0061] For example, Figure 2As shown, in an implementation, a logic architecture diagram of the network attack countermeasure method provided by the present application includes the following processes: The attack script initiates an attack request to the target device of the current network; The trap gateway identifies the received access request and dynamically redirects the attack request to the trap server. The trap server can be a virtual server deployed in the resource pool of the trap gateway, the cloud, or a distributed system, or can be an independent physical server. The trap server internally includes a script interaction agent, a self-destruction instruction library, and a false feedback engine. The script interaction agent is used to analyze the script type of the attack request and send the countermeasure data corresponding to the script type to the sending end of the attack request, so that the sending end executes the self-destruction instruction associated with the countermeasure data to trigger script self-destruction. The self-destruction instruction library is used to store these self-destruction instructions. The false feedback engine is used to generate and send a status report to the control server of the sending end after receiving the return message from the sending end. The return message is used to prompt that the self-destruction instruction has been executed, and the status report is used to prompt that the sending end has successfully sent the attack request, so that the control server misjudges that the sending end is alive.

[0062] The network attack countermeasure method provided by the present application is described below through a specific embodiment.

[0063] The attack script in the Internet of Things performs a DDoS attack on the camera; The trap gateway identifies the attack request by detecting the User-Agent string of each access request and redirects these attack requests to the trap server. Then, the script interaction agent of the trap server analyzes and determines that the script type of the attack request is a Linux script, and determines that the first communication protocol between the sending end of the attack script and the camera is the HTTP protocol. Therefore, the self-destruction instruction corresponding to the Linux script is queried from the self-destruction instruction library, encapsulated into a pseudo-upgrade package in the.bin format, and the download address of the pseudo-upgrade package is embedded into the HTTP 302 status code and returned to the sending end of the attack script. The sending end responds to the HTTP 302 status code, jumps to download the pseudo-upgrade package and executes the self-destruction instruction, and the attack script is disabled immediately. After receiving the return message from the sending end, the false feedback engine of the trap server generates and sends [SUCCESS] 10000 requests sent to the control server of the attack script. The status report falsely prompts the control server that the attack instruction has been successfully sent 1000 times.

[0064] In this way, the attack script initiating the attack request is cleared, while the control server continues to misjudge that the attack script is alive, which can disturb the decision chain of the control server and fundamentally solve the DDoS attack.

[0065] Based on the same inventive concept, the embodiments of the present application also provide a network attack countermeasure system for implementing the network attack countermeasure method described above. The implementation scheme for solving the problem provided by the system is similar to the implementation scheme described in the above method, so the specific limitations in one or more network attack countermeasure system embodiments provided below can refer to the limitations of the network attack countermeasure method described above, which will not be repeated here.

[0066] In an exemplary embodiment, as shown in Figure 3 The present application also provides a network attack countermeasure system, which is used to implement the following steps: The trap gateway is used to forward the attack request to the trap server. The trap server is used to analyze the script type of the attack request, and send the countermeasure data corresponding to the script type to the sending end of the attack request, so that the sending end executes the self-destruction instruction associated with the countermeasure data.

[0067] In an exemplary embodiment, the trap server is specifically configured to analyze the first communication protocol between the sending end and the receiving end of the attack request, and send the countermeasure data corresponding to the script type to the sending end based on the first communication protocol.

[0068] In an exemplary embodiment, the trap server is further configured to generate and send a status report to the control server of the sending end after receiving a receipt message returned by the sending end, the receipt message being used to prompt that the self-destruction instruction has been executed, and the status report being used to prompt that the sending end has successfully sent the attack request, so that the control server misjudges that the sending end is alive.

[0069] In an exemplary embodiment, the trap server is specifically configured to analyze the second communication protocol between the sending end and the control server, and generate and send a status report to the control server based on the second communication protocol.

[0070] In an exemplary embodiment, the countermeasure data includes a download address of a pseudo-upgrade package, and the trap server is specifically configured to send the download address to the sending end, so that the sending end downloads and executes the pseudo-upgrade package from the download address, and the pseudo-upgrade package encapsulates the self-destruction instruction.

[0071] In an exemplary embodiment, the countermeasure data includes a self-destruct instruction, and the trap server is specifically used to send the self-destruct instruction corresponding to the script type to the sending end of the attack request.

[0072] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0073] Based on the same inventive concept, this application also provides a network attack countermeasure device for implementing the network attack countermeasure method described above. The solution provided by this device is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more network attack countermeasure device embodiments provided below can be found in the limitations of the network attack countermeasure method above, and will not be repeated here.

[0074] In one exemplary embodiment, such as Figure 4 As shown, a network attack countermeasure device is provided, comprising: The receiving module 201 is used to receive attack requests forwarded by the trapping gateway; Analysis module 202 is used to analyze the script type of the attack request; The sending module 203 is used to send the countermeasure data corresponding to the script type to the sending end of the attack request, so that the sending end executes the self-destruct instruction associated with the countermeasure data.

[0075] In an exemplary embodiment, the sending module 203 is specifically used for: Analyze the first communication protocol between the sending end and the receiving end of the attack request; Based on the first communication protocol, the countermeasure data corresponding to the script type is sent to the sending end.

[0076] In one exemplary embodiment, the device further includes a feedback module for: After receiving the acknowledgment message returned by the sending end, a status report is generated and sent to the control server of the sending end; the acknowledgment message is used to indicate that the self-destruct instruction has been executed, and the status report is used to indicate that the sending end has successfully sent the attack request, so that the control server may mistakenly judge that the sending end is alive.

[0077] In one exemplary embodiment, the feedback module is specifically used for: Analyze the second communication protocol between the sending end and the control server; Based on the second communication protocol, a status report is generated and sent to the control server.

[0078] In an exemplary embodiment, the countermeasure data includes the download address of the fake upgrade package, and the sending module 203 is specifically used for: The download address is sent to the sending end, so that the sending end downloads and executes the pseudo-upgrade package from the download address, wherein the pseudo-upgrade package encapsulates the self-destruct instruction.

[0079] In an exemplary embodiment, the countermeasure data includes a self-destruct command, and the sending module 203 is specifically used for: Send the self-destruct command corresponding to the script type to the sender of the attack request.

[0080] Each module in the aforementioned network attack countermeasure device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0081] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5The computer device shown in the figure includes a processor, a memory, an input / output interface (I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The database of the computer device is used to store measurement data and / or positioning information. The input / output interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with external terminals through network connection. The computer program is executed by the processor to implement a network attack countermeasure method.

[0082] Those skilled in the art can understand that, Figure 5 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement.

[0083] In one exemplary embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the following steps: receiving an attack request forwarded by a bait gateway; analyzing a script type of the attack request; sending countermeasure data corresponding to the script type to a sending end of the attack request, so that the sending end executes a self-destruction instruction associated with the countermeasure data.

[0084] In one embodiment, a computer readable storage medium is provided, which stores a computer program, and the computer program is executed by a processor to implement the following steps: receiving an attack request forwarded by a bait gateway; analyzing a script type of the attack request; sending countermeasure data corresponding to the script type to a sending end of the attack request, so that the sending end executes a self-destruction instruction associated with the countermeasure data.

[0085] In one embodiment, a computer program product is provided, including a computer program, and the computer program is executed by a processor to implement the following steps: receiving an attack request forwarded by a bait gateway; analyze a script type of the attack request; send countermeasure data corresponding to the script type to a sending end of the attack request, so that the sending end executes a self-destruction instruction associated with the countermeasure data.

[0086] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of the related data need to comply with relevant regulations.

[0087] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0088] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0089] The above-described embodiments are merely illustrative of several embodiments of the present application, and the description is relatively specific and detailed, but should not be understood as a limitation on the scope of the patent. It should be noted that for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. A cyber attack countermeasure method characterized by comprising: The method comprises: receiving an attack request forwarded by a trapping gateway; analyzing a script type of the attack request; sending countermeasure data corresponding to the script type to a sending end of the attack request, so that the sending end executes a self-destruction instruction associated with the countermeasure data.

2. The method of claim 1, wherein, The sending of the countermeasure data corresponding to the script type to the sending end of the attack request comprises: analyzing a first communication protocol between the sending end and a receiving end of the attack request; based on the first communication protocol, sending the countermeasure data corresponding to the script type to the sending end.

3. The method of claim 1, wherein, The method further comprises: after receiving a return message returned by the sending end, generating and sending a status report to a control server of the sending end; the return message is used to prompt that the self-destruction instruction has been executed, and the status report is used to prompt that the sending end successfully sends an attack request, so that the control server misjudges that the sending end is alive.

4. The method of claim 3, wherein, The generation and sending of the status report to the control server of the sending end comprises: analyzing a second communication protocol between the sending end and the control server; based on the second communication protocol, generating and sending the status report to the control server.

5. The method of claim 1, wherein, The countermeasure data comprises a download address of a pseudo-upgrade package, and the sending of the countermeasure data corresponding to the script type to the sending end of the attack request comprises: sending the download address to the sending end, so that the sending end downloads and executes the pseudo-upgrade package from the download address, and the pseudo-upgrade package encapsulates the self-destruction instruction.

6. The method of claim 1, wherein, The countermeasure data comprises a self-destruction instruction, and the sending of the countermeasure data corresponding to the script type to the sending end of the attack request comprises: sending the self-destruction instruction corresponding to the script type to the sending end of the attack request.

7. A cyber attack countermeasure system characterized by comprising: The system comprises: a trapping gateway configured to forward an attack request to a trap server; the trap server is configured to analyze a script type of the attack request; and send countermeasure data corresponding to the script type to a sending end of the attack request, so that the sending end executes a self-destruction instruction associated with the countermeasure data.

8. The system of claim 7, wherein the trap server is further configured to, after receiving a return message returned by the sending end, generate and send a status report to a control server of the sending end; the return message is used to prompt that the self-destruction instruction has been executed, and the status report is used to prompt that the sending end successfully sends an attack request, so that the control server misjudges that the sending end is alive.

9. A cyber attack countermeasure apparatus characterized by comprising: The device comprises: a receiving module configured to receive an attack request forwarded by a trapping gateway; an analyzing module configured to analyze a script type of the attack request; a sending module configured to send countermeasure data corresponding to the script type to a sending end of the attack request, so that the sending end executes a self-destruction instruction associated with the countermeasure data. 10.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-9. The processor executes the computer program to realize the steps of the method of any one of claims 1 to 6.

11. A computer readable storage medium having stored thereon a computer program, characterized in that The computer program is executed by the processor to realize the steps of the method of any one of claims 1 to 6.

12. A computer program product comprising a computer program, characterized in that, The computer program, which is executed by a processor, implements the steps of the method according to any one of claims 1 to 6.

Images