Protection method, system, product, equipment and storage medium

Abstract

The invention discloses a protection method and system, a product, equipment and a storage medium, and the method comprises the steps: obtaining an exit IP address set of a cooperation CDN service provider and a minimum credible threat IP address set of a threat intelligence service provider, and judging whether a request is a direct connection request or a CDN forwarding request according to four layers of source IP addresses; the direct connection request directly compares four layers of source IPs with a minimum trusted threat IP address set, the CDN forwards the request to analyze an X-Forwarded-For field at the head of an HTTP message and check whether any IP in the threat IP set is included, and if yes, interception is executed; the method has the main technical effects that traffic types are accurately distinguished, interference caused by X-Forwarded-For field counterfeiting and CDN equipment record rule difference is avoided, the calculation overhead of a protection system is reduced, meanwhile, mistaken blocking and missing blocking conditions are reduced, and the accuracy and efficiency of enterprise network protection are remarkably improved.

Description

Technical Field

[0001] This application relates to the field of network information security, and in particular to a protection method, system, product, device and storage medium. Background Technology

[0002] In the field of enterprise network security, Web Application Firewalls (WAFs), as core devices for defending against Web application layer attacks, rely heavily on the accurate identification of the real accessing IP address. Currently, to improve application access speed and user experience, most enterprises use CDNs (Content Delivery Networks) for traffic acceleration. This trend has shifted the IP characteristics of real visitors from the traditional network layer 4 to the application layer 7. The X-Forwarded-For field in the HTTP header has gradually become a key basis for WAFs to trace the real source IP of requests.

[0003] However, this model, which relies on the X-Forwarded-For field to identify the real IP, faces unavoidable challenges in practical applications. On one hand, the field lacks a unified anti-tampering mechanism; attackers often maliciously forge IP information in the field to hide the true attack source, resulting in a large amount of fake IP data. On the other hand, CDN devices from different vendors have significant differences in the recording format of the X-Forwarded-For field and IP appending rules, further increasing the complexity of the IP list. These two factors combined make it difficult for WAFs to accurately filter out the real access IPs from the chaotic IP list. This not only significantly increases the computational overhead of the protection system and reduces protection response efficiency, but also easily leads to the problem of mistakenly blocking normal business traffic or missing malicious attack traffic, seriously affecting the overall effectiveness of enterprise network security protection and failing to meet enterprises' needs for accurate and efficient web application security protection. Summary of the Invention

[0004] In view of the above problems, this application provides a protection method, system, product, device and storage medium.

[0005] The embodiments of this application disclose the following technical solutions: The first aspect of this application provides a protection method, including: Obtain the set of outgoing IP addresses from the cooperating CDN service provider, and the minimum set of trusted threat IP addresses from the threat intelligence service provider; Determine whether the Layer 4 source IP address of the request arriving at the firewall belongs to the set of egress IP addresses; If the Layer 4 source IP address does not belong to the set of outgoing IP addresses, the request is determined to be a direct connection request that has not gone through CDN; if the Layer 4 source IP address belongs to the set of minimum trusted threat IP addresses, then blocking is performed. If the Layer 4 source IP address belongs to the set of outgoing IP addresses, then the request is determined to be a request forwarded by CDN. The X-Forwarded-For field in the HTTP header of the request is parsed, and it is checked whether the value of the X-Forwarded-For field contains any IP address in the set of minimum trusted threat IP addresses. If it does, then interception is performed.

[0006] In one possible implementation, the method further includes: Based on the attack behavior detected by the WAF, update the set of minimum trusted threat IP addresses; The dynamic updating of the minimum trusted threat IP address set based on WAF-detected attack behavior includes: For direct connection requests that are identified as attacks, the Layer 4 source IP address is added to the minimum trusted threat IP address set; For requests that are identified as attacks and forwarded via CDN, the real attacker's IP address is identified from the value of the X-Forwarded-For field, and the real attacker's IP address is added to the minimum trusted threat IP address set.

[0007] In one possible implementation, the method further includes: Synchronize the malicious IP addresses in the updated set of minimum trusted threat IP addresses to the perimeter firewall.

[0008] In one possible implementation, the method of identifying the real attacker's IP address from the value of the X-Forwarded-For field includes: The value of the X-Forwarded-For field is split into a sequence of IP addresses based on the delimiter; Starting from the rightmost IP address in the IP address sequence, check each IP address sequentially to the left to see if it belongs to the CDN egress IP address set; The first IP address that does not belong to the CDN egress IP address set is identified as the real attacker's IP address.

[0009] In one possible implementation, before adding the real attacker's IP address to the minimum trusted threat IP address set, the method further includes: Establish a statistical time window for the IP address of the real attacker, and count the number of attacks within the time window; Adding the real attacker's IP address to the minimum trusted threat IP address set includes: When the number of attacks by the real attacker's IP address within the statistical window reaches a preset threshold, the real attacker's IP address is added to the minimum trusted threat IP address set.

[0010] One possible implementation also includes: Set the lifespan of each IP address in the set of exiting IP addresses; Based on a preset period, remove IP addresses from the set of exiting IP addresses that have exceeded their lifespan.

[0011] This application provides a protection system in embodiment two, including: The acquisition unit is used to acquire the set of outgoing IP addresses from cooperating CDN service providers and the minimum set of trusted threat IP addresses from threat intelligence service providers. The judgment unit is used to determine whether the Layer 4 source IP address of the request arriving at the firewall belongs to the set of outgoing IP addresses; The first interception unit is used to determine that the request is a direct connection request that has not gone through CDN if the Layer 4 source IP address does not belong to the set of outgoing IP addresses, and to perform interception if the Layer 4 source IP address belongs to the set of minimum trusted threat IP addresses. The second interception unit is used to determine that the request is a CDN-forwarded request if the Layer 4 source IP address belongs to the set of exit IP addresses, parse the X-Forwarded-For field in the HTTP header of the request, check whether the value of the X-Forwarded-For field contains any IP address in the set of minimum trusted threat IP addresses, and if it does, then perform interception.

[0012] A third aspect of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the protection method described in the first aspect above.

[0013] A fourth aspect of this application provides a computer program product that, when run on a computer, executes the protection method described in the first aspect above.

[0014] A fifth aspect of this application provides a computer-readable storage medium storing instructions that, when executed on a terminal device, cause the terminal device to perform the protection method described in the first aspect above.

[0015] Compared with the prior art, this application has the following beneficial effects: This system obtains the egress IP address set of cooperating CDN service providers and the minimum trusted threat IP address set of threat intelligence service providers, providing accurate basis for traffic assessment and threat identification. Then, by determining whether the Layer 4 source IP address of the request belongs to the CDN egress IP address set, it quickly distinguishes between direct connection requests and CDN forwarded requests, avoiding identification confusion caused by IP feature shifting. For direct connection requests that do not go through the CDN, the Layer 4 source IP address is directly compared with the minimum trusted threat IP address set; if a match is found, blocking is executed, eliminating the need for complex parsing and reducing computational overhead. For requests forwarded by the CDN, the X-Forwarded-For field in the HTTP header is parsed to check if it contains any IP address from the minimum trusted threat IP address set. Leveraging the inevitable existence of threat IPs avoids the influence of field forgery and differences in CDN record rules, accurately identifying and blocking malicious attacks. This solves the problem of difficulty in extracting real IPs, reduces false positives and false negatives, and improves the accuracy and efficiency of protection. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A flowchart illustrating a protection method provided in an embodiment of this application; Figure 2 This is a structural diagram of a protection system provided in an embodiment of this application. Detailed Implementation

[0018] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0019] To facilitate understanding of the technical solutions provided in the embodiments of this application, the terms involved in the embodiments of this application will be explained below.

[0020] The X-Forwarded-For field, also known as the XFF field, is an extended request header field in the HTTP protocol. Its core function is to record the IP addresses of each node a network request passes through in the transmission link, helping backend services identify the true origin of the request. When a request is forwarded through intermediate devices such as CDNs and proxy servers, these devices append the IP address of the previous hop to the end of the X-Forwarded-For field according to specific rules, forming a comma-separated list of IPs.

[0021] This field is particularly important in enterprise applications that leverage CDN acceleration. The original client IP is recorded in this field by the first CDN device, and each subsequent CDN node appends its own egress IP, ultimately allowing the backend WAF or server to trace the request's transmission path through this field. However, because this field lacks a mandatory anti-tampering mechanism, attackers may forge parts of the IP in the field to hide the real attack source. Furthermore, differences in the recording format and appending logic of CDN devices from different vendors pose challenges to IP identification. This application's solution addresses these issues by designing targeted parsing and verification logic.

[0022] To facilitate understanding of the technical solutions provided in the embodiments of this application, the background technology involved in the embodiments of this application will be described below.

[0023] In a typical enterprise network architecture, client traffic accessing enterprise application servers typically passes through the following nodes in sequence: CDN device, perimeter firewall, and Web Application Firewall (WAF). The CDN accelerates and caches content, the perimeter firewall handles network layer access control, and the WAF specifically detects and blocks application layer attacks.

[0024] When a client request passes through a CDN device, the CDN inserts or updates the X-Forwarded-For field in the HTTP request header to record the original client IP (denoted as IP_Client). If the request passes through multiple CDN nodes (assuming there are n nodes), each CDN node appends its previous hop's ingress IP (i.e., the egress IP of the previous CDN) to the end of this field, separated by commas. Ultimately, the field format is: X-Forwarded-For: IP_Client, IP_CDN1, IP_CDN2, ..., IP_CDN(n-1).

[0025] At this point, the egress IP (IP_CDN_n) of the last CDN node (the nth node) will not appear in this field. Instead, it will be represented by the real source IP of the Layer 4 network connection, i.e., the remote_addr field value seen by the border firewall or WAF. Attackers can proactively inject a forged X-Forwarded-For field into the HTTP request, for example, by filling in multiple fake client IPs: X-Forwarded-For: IP_Client1, IP_Client2,..., IP_Client_n. When this forged request passes through the CDN device, the CDN will still follow standard behavior and append its own egress IP to the end of this field. Therefore, after passing through multiple CDNs, the header actually seen by the WAF will look like: X-Forwarded-For: IP_Client1, IP_Client2,..., IP_Client_n, IP_CDN1, IP_CDN2,..., IP_CDN(n-1).

[0026] Furthermore, some CDN implementations may ignore the existing X-Forwarded-For field and instead add a new line to record the actual link information, further increasing the complexity of field parsing. This forgery makes it difficult for WAFs to accurately extract the real attack source IP from the X-Forwarded-For field, posing a challenge to security policies based on this field.

[0027] Currently, solutions relying on external threat intelligence databases (denoted as IP_X) for protection have significant drawbacks. First, if an IP (IP_X_i) in the database happens to belong to the CDN egress IP pool currently used by the enterprise (i.e., IP_X_i = IP_CDN_j), then when interception is performed at Layer 4 (firewall) or Layer 7 (WAF) based on this intelligence, all normal business traffic forwarded through that CDN node will be blocked, causing widespread service unavailability. Second, because attackers may forge the X-Forwarded-For field, the large number of attack records captured by the WAF contain fake IPs, making it difficult for the security system to accurately extract the real malicious source IP and feed it back to the intelligence database. This results in low efficiency in updating threat intelligence, making it difficult for the defense system to form an effective adaptive closed loop.

[0028] To address the aforementioned issues, this application tackles the problems of insufficient protection performance and accuracy caused by the shift of real visitor IPs from Layer 4 to Layer 7 after the widespread adoption of CDNs, the spoofing of the X-Forwarded-For field, and differences in CDN device recording schemes. This application first obtains a complete set of CDN egress IPs (IP_CDN) from cooperating CDN service providers. Based on this, it quickly distinguishes between direct access traffic and CDN forwarded traffic. For direct access traffic, it achieves rapid interception by directly comparing remote_addr with the threat intelligence database, without complex parsing. For CDN forwarded traffic, it fully utilizes the feature of CDN devices appending the real egress IP to the end of the X-Forwarded-For field, identifying the rightmost CDN-related IP in this field as trusted content. By traversing and filtering from the right, it eliminates interference from spoofed IPs and accurately locates the real attack source. Meanwhile, for services that do not wish to bypass the CDN, this application agrees with the CDN provider on exclusive variables and random values, performs pre-verification at the WAF end, and directly discards requests that do not carry valid variables, thereby preventing illegal access that bypasses the CDN from the source, avoiding protection interference caused by such traffic, significantly improving the accuracy of attack identification, and reducing unnecessary computational overhead.

[0029] To address the shortcomings of existing threat IP intelligence databases in terms of accuracy and timeliness, this application constructs a minimum trusted intelligence database, IP_XR, and establishes a dynamic update and optimization mechanism. The initial IP_XR selects the minimum trusted threat IPs to ensure the accuracy of basic protection. Subsequent attacks detected by WAF are continuously supplemented and improved. For attack traffic directly accessing the network, the remote_addr is directly included in IP_XR; for attack traffic forwarded by CDN, the real attack IPs are accurately identified and added to IP_XR to ensure the timeliness of the intelligence database. Simultaneously, this application sets attack count thresholds and IP lifespan validity periods. Only IPs that meet the attack count threshold within a set time window are included in IP_XR, avoiding misjudgments caused by single-instance errors. Malicious IPs exceeding their lifespan validity period are periodically removed, and invalid or misjudged IP addresses are eliminated to consistently ensure the accuracy of IP_XR and avoid the risk of service interruption or missed detection due to inaccurate intelligence databases.

[0030] Furthermore, this application configures the identified malicious IP set IP_XR into the Layer 4 blocking rules of the perimeter firewall, blocking malicious traffic as soon as it enters the network front-end. This significantly reduces the scale of malicious traffic flowing through the WAF, alleviating the WAF's computational burden and allowing it to concentrate resources on handling more complex application-layer attack detection, further improving overall protection performance. Through this series of coordinated measures, this application forms a complete protection loop of "traffic classification - precise identification - intelligence optimization - layered blocking," comprehensively addressing the pain points of existing solutions.

[0031] It should be noted that the protection methods, systems, products, devices, and media provided in this application can be applied to the field of computer technology. The above are merely examples and do not limit the application areas of the protection methods, systems, products, devices, and media provided in this application. Furthermore, the embodiments of this application may not limit the implementing entity of the protection; for example, the protection method of this application embodiment can be applied to data processing devices such as terminal devices or servers. The terminal device can be an electronic device such as a computer or a personal digital assistant (PDA). The server can be a standalone server, a cloud server, or a cluster server composed of multiple servers.

[0032] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0033] The following embodiment illustrates a protection method provided in this application. See also... Figure 1 ,Should Figure 1 A flowchart of a protection method provided in this application embodiment, the method comprising: S101. Obtain the set of exit IP addresses from the cooperating CDN service provider, and the minimum set of trusted threat IP addresses from the threat intelligence service provider.

[0034] Obtain IP_CDN={IP_CDN1,IP_CDN2,IP_CDN3,…IP_CDNm} from the cooperating CDN service provider, and obtain the initial minimum trusted intelligence database IP_XR from the threat intelligence service provider.

[0035] The set of CDN egress IP addresses needs to be actively obtained from the CDN provider, and is usually provided in the form of a list of IP address ranges. Because CDN infrastructure may be dynamically adjusted or expanded, this set needs to have a regular synchronization or change notification mechanism to ensure its completeness and timeliness. This set is the sole basis for distinguishing between direct traffic and traffic forwarded via the CDN, and its accuracy directly affects the correctness of subsequent path determination.

[0036] The minimum trusted threat IP address set originates from one or more threat intelligence service providers, and its key characteristic is minimum trust. This means it is not a complete, unfiltered raw threat intelligence database, but rather a subset of malicious IPs that has undergone preliminary verification and has a high degree of confidence. Initially, intelligence sources that have been evaluated by authoritative third parties or have reliable false positive rate records can be used. Using the minimum trusted set as the initial list aims to reduce the risk of normal business interruption due to false positives and to provide a reliable and controllable baseline for subsequent intelligence expansion based on one's own traffic.

[0037] S102. Determine whether the Layer 4 source IP address of the request arriving at the firewall belongs to the set of outgoing IP addresses.

[0038] The system extracts the remote_addr (the actual source IP at Layer 4) of the request and determines whether it belongs to the pre-obtained set of CDN service provider egress IP addresses (IP_CDN). This step is crucial for distinguishing the type of request traffic, quickly separating direct access traffic from traffic forwarded through the CDN. If the remote_addr is not within the range of IP_CDN, it means the request has not been accelerated or forwarded by CDN devices and is a direct connection request to the enterprise network. At this point, the system further queries whether the remote_addr exists in the minimum trusted threat intelligence database IP_XR. If the query result shows its existence, it means the request originates from a known malicious IP. To prevent attacks from threatening the enterprise network, the request can be directly blocked, achieving rapid interception of known risks.

[0039] S103a. If the Layer 4 source IP address does not belong to the set of outgoing IP addresses, then the request is determined to be a direct connection request that has not gone through CDN. If the Layer 4 source IP address belongs to the set of the minimum trusted threat IP addresses, then interception is performed.

[0040] For all requests passing through the WAF, the first step is to identify whether remote_addr belongs to IP_CDN={IP_CDN1,IP_CDN2,IP_CDN3,…IP_CDNm}. If it does not belong to IP_CDN, it is a direct request traffic that does not bypass the CDN. In this case, if remote_addr is included in the minimum trusted intelligence database IP_XR, it can be blocked directly.

[0041] If the requested remote_addr is not in the IP_CDN set, it is determined to be a direct connection request. For this type of traffic, since there is no proxy or CDN IP replacement, its remote_addr directly corresponds to the client's (potentially an attacker's) real terminal or last-hop node, thus possessing extremely high credibility. In this case, the protection logic becomes extremely direct and efficient: simply compare the remote_addr with the minimum trusted threat intelligence database IP_XR. Once a match is found, it can be confirmed as a known threat and directly blocked. The advantages of this approach are a short decision chain, low computational overhead, low false positive risk, and the ability to quickly filter out a large number of low-level attacks with clear sources, saving resources for subsequent processing of complex traffic.

[0042] S103b. If the Layer 4 source IP address belongs to the set of exit IP addresses, then the request is determined to be a request forwarded by CDN. The X-Forwarded-For field in the HTTP header of the request is parsed, and it is checked whether the value of the X-Forwarded-For field contains any IP address in the set of minimum trusted threat IP addresses. If it does, then interception is performed.

[0043] If `remote_addr` belongs to the `IP_CDN` set, it's determined that the request was forwarded through a CDN. In this case, `remote_addr` is only the exit IP of the last CDN node, while the actual original client IP information is recorded in the `X-Forwarded-For` field of the HTTP header. However, because attackers may pre-forge this field, the leftmost client IP portion of its value (`IP_Client1`, `IP_Client2`...`IP_Clientn`, `IP_CDN1`, `IP_CDN2`,...`IP_CDNn-1`) is untrusted. In the IP sequence of this field, only the rightmost IP (i.e., `IP_CDNn-1`) is 100% trustworthy because it is the entry IP of the last CDN node, appended by the second-to-last CDN node. This information cannot be forged by the client, providing a foothold for effective analysis amidst chaotic information.

[0044] In traffic forwarded via CDN, if the attacker's real IP, denoted as IP_XRi, is already included in the minimum trusted threat intelligence database IP_XR, then regardless of how the attacker forges the beginning of the X-Forwarded-For field, IP_XRi will inevitably appear somewhere in the entire field string—either in the forged beginning or in the real end. Therefore, for such requests, there's no need to concern ourselves with the authenticity and order of each IP in the IP sequence. The protection system can adopt a more robust strategy: directly check if the complete string of the X-Forwarded-For field contains IP_XRi. If it does, the request can be determined to be associated with a known threat, and blocking can be executed. This string inclusion matching method avoids the tracing difficulties caused by field forgery and achieves effective detection of known threats in CDN scenarios.

[0045] If a request forwarded by the CDN fails to find any IP address belonging to IP_XR after a comprehensive search of its X-Forwarded-For field, two reasonable conclusions can be drawn. One is that the request originates from a normal user, lacks malicious intent, and constitutes legitimate business access traffic. The other is that the attacker's IP address has not yet been included in the current minimum trusted intelligence database IP_XR, meaning the attack originates from an unknown threat. This method ensures the smooth flow of normal business traffic while preventing the oversight and handling of unknown threats, providing a basis for future improvements to IP_XR.

[0046] In one possible implementation, when a WAF determines a request to be an attack using detection methods other than IP matching, such as rule engines, behavioral analysis, and machine learning models, the system can trace back from the attack message to extract the attacker's real or spoofed IP address and feed it back as new intelligence to the minimum trusted threat IP address set (IP_XR). This mechanism allows the defense system to no longer rely solely on external intelligence input, but to automatically accumulate and refine internal intelligence based on the actual attacks it suffers, thereby achieving continuous evolution of defense capabilities.

[0047] When a WAF detects an attack packet, it first determines whether the corresponding remote_addr belongs to the pre-obtained CDN egress IP set IP_CDN. If the remote_addr is not within the range of IP_CDN, it means that the request has not been forwarded by CDN devices and belongs to the request traffic directly to the enterprise network. Since this type of direct traffic does not have the IP obfuscation problem caused by CDN forwarding, the remote_addr field directly corresponds to the real IP of the client that initiated the request. Since the WAF has clearly identified the packet as an attack packet, it can directly identify this remote_addr as the attacker's real IP and add it to the minimum trusted intelligence database IP_XR to quickly supplement the malicious IPs for direct attack behavior.

[0048] If the remote_addr of an attack packet belongs to the IP_CDN set, it indicates that the attack traffic arrived at the WAF after being forwarded by a CDN device. In this case, the remote_addr displays the CDN's exit IP, not the attacker's real IP. Since the WAF has already confirmed the attack, it can be determined that the attacker's real IP must be hidden in the IP list contained in the X-Forwarded-For field of the HTTP header. This list may contain various information such as client-spoofed IPs and the IPs of various forwarding nodes, requiring specific parsing logic to filter out the true attack source IP.

[0049] To accurately pinpoint the attacker's true IP address, the system filters by traversing the IP list in the X-Forwarded-For field from the right. The reason for starting the traversal from the right is that the IPs on the right side of the X-Forwarded-For field are typically forwarding node IPs closer to the current network boundary. Furthermore, CDN devices strictly adhere to rules by appending their own egress IPs to the end of the field during forwarding. These CDN-related IPs are already included in the IP_CDN set, possessing clear credibility. During the traversal, the system checks each IP against the IP_CDN set. If an IP belongs to IP_CDN, it continues traversing to the left for the next IP. Once an IP is found not to belong to IP_CDN, it is identified as the final, true attack source IP after multiple layers of forwarding and is added to the minimum trusted intelligence database IP_XR, ensuring a high degree of accuracy for the IPs added to the database.

[0050] In one possible implementation, as the protection system continues to operate, the number of IPs extracted from attack packets and nominated for IP_XR may continue to increase. If these IPs are directly added to the database without restriction, the IP_XR will expand too quickly, which will not only consume too many system resources and affect protection efficiency, but may also increase the risk of normal business access being blocked due to a single misjudged abnormal IP entering the database. Therefore, a targeted control mechanism needs to be established.

[0051] The primary step in expanding IP_XR control is verifying the attack behavior of identified attacker IPs. After identifying a suspected attacker IP through the aforementioned logic, the system establishes a fixed-duration time window for that IP, continuously counting the number of attacks initiated by that IP within this window. The system pre-sets a reasonable attack threshold, based on the normal access frequency of the enterprise network and historical attack data. Only when the number of attacks by an IP within the time window reaches or exceeds the set threshold is it confirmed to possess the attributes of a sustained malicious attack, and the IP is officially added to the minimum trusted intelligence database IP_XR, preventing accidental inclusion of IPs in the database due to single misoperations or occasional abnormal traffic.

[0052] Meanwhile, considering the dynamic changes in the network environment, the offensive capabilities of malicious IPs are not permanent. Some malicious IPs may be dynamically assigned addresses, which may later be allocated to legitimate users. Retaining them in the IP_XR for an extended period could lead to false positives. Furthermore, some attackers may abandon their existing malicious IPs, resulting in IP_XR redundancy. Therefore, a clear lifespan must be defined for each malicious IP in the IP_XR. This lifespan is determined based on the IP's attack intensity, attack type, and the activity cycle data of malicious IPs within the industry. The system will periodically check all malicious IPs in the IP_XR. IPs that have exceeded their lifespan and have not exhibited new attack behavior within that period will be automatically removed from the IP_XR. This ensures that the IP_XR remains streamlined and accurate, guaranteeing effective protection while avoiding unnecessary resource consumption and the risk of false positives.

[0053] In one possible implementation, the IP_XR set, after multiple rounds of verification and supplementation, explicitly includes various malicious IPs. The threat attributes of these IPs have been confirmed as highly credible through actual attack behavior. Based on the deployment order of the perimeter firewall and WAF in the network architecture, the perimeter firewall is positioned further forward at the network ingress, offering rapid response and low resource consumption at Layer 4 protection. Configuring the malicious IPs from IP_XR into the Layer 4 blocking rules of the perimeter firewall allows malicious traffic to be blocked directly before entering the core network area.

[0054] This pre-emptive interception method significantly reduces the amount of traffic that needs to pass through the WAF, especially requests initiated by IPs that are clearly malicious. This eliminates the need for the WAF to perform complex calculations such as subsequent packet parsing and signature matching. As a device focused on web application layer protection, the WAF can concentrate the saved computing resources on handling more complex application layer attack detection and deep packet analysis, avoiding delays or missed detections caused by a large amount of invalid malicious traffic consuming resources. Meanwhile, the perimeter firewall's Layer 4 IP interception mechanism is simple and efficient, forming a layered cooperation with the WAF's application layer protection. This improves the timeliness of malicious traffic interception and optimizes the resource allocation of the entire protection system, ensuring the overall performance and stability of the enterprise network protection.

[0055] In one possible implementation, certain services within an enterprise network, for security efficiency or business stability reasons, may not allow users to bypass the CDN for direct access. These services require a dedicated access verification mechanism to ensure that traffic must be forwarded through the CDN. To achieve this, enterprises can make specific agreements with their CDN partners based on their specific business needs, uniformly inserting dedicated variable information into the request header of the CDN forwarding message. This variable includes a variable name, `somevar`, known only to both parties beforehand, and its corresponding random value. This dedicated configuration is unique and confidential, and cannot be easily obtained or forged by external attackers.

[0056] When a request arrives at the WAF, the system prioritizes the verification of this variable, without waiting for subsequent IP analysis or deep packet inspection. The WAF checks the packet header for the correct `somevar` variable and a matching random value according to agreed-upon rules. If the verification result shows that the variable is missing, the variable name is incorrect, or the random value does not match, the request is determined to be an illegal access attempt to bypass the CDN.

[0057] For requests that fail verification, the WAF will directly discard them, preventing them from being passed to the backend service. This pre-verification method can accurately intercept unauthorized access that bypasses the CDN, ensuring that the service only receives traffic that has been filtered and accelerated by the CDN. It can also quickly filter invalid requests with simple and efficient variable verification logic, reducing the resource consumption of subsequent protection steps. At the same time, it further strengthens the closed loop of CDN and WAF linkage protection, improving the access security and controllability of specific services.

[0058] In one possible implementation, a lifespan validity period is set for each IP address in the set of egress IP addresses; based on a preset period, IP addresses in the set of egress IP addresses that have exceeded their lifespan validity period are removed.

[0059] The validity period needs to be determined by combining the CDN service provider's IP address change patterns, the iteration cycle of CDN nodes in the industry, and the enterprise's own network access data statistics. The validity period should be neither too short, causing frequent expiration of normal CDN egress IPs and affecting protection logic, nor too long, leaving obsolete CDN egress IPs in the collection for an extended period. Simultaneously, the system will be configured with a fixed preset period, which can be flexibly adjusted according to actual business needs and is usually consistent with the IP address update notification period provided by the CDN service provider.

[0060] At the end of each preset period, the system automatically initiates a verification process for the IP_CDN egress IP address set, checking the current lifespan of each IP address in the set to determine if it has exceeded the preset validity period. For IP addresses confirmed to have exceeded their validity period after verification, the system automatically removes them from the IP_CDN egress IP address set to prevent expired CDN egress IPs from interfering with traffic type determination.

[0061] This dynamic maintenance method ensures that the IP_CDN set of outgoing IP addresses remains accurate and effective, providing a reliable basis for distinguishing between direct access traffic and CDN forwarding traffic. This, in turn, ensures that a series of protection rules based on this set can function stably, avoiding misjudgments in protection or obstruction of normal business access caused by invalid IP addresses.

[0062] The above are some specific implementations of the protection method provided in the embodiments of this application. Based on this, this application also provides a corresponding protection system. The system provided in the embodiments of this application will be described below from the perspective of functional modularity. Figure 2 This is a structural diagram of a protection system provided in an embodiment of this application.

[0063] The system includes: The acquisition unit 110 is used to acquire the set of exit IP addresses from the cooperating CDN service provider and the minimum set of trusted threat IP addresses from the threat intelligence service provider. The judgment unit 111 is used to determine whether the Layer 4 source IP address of the request arriving at the firewall belongs to the set of outgoing IP addresses; The first interception unit 112 is used to determine that the request is a direct connection request without CDN if the Layer 4 source IP address does not belong to the set of outgoing IP addresses, and to perform interception if the Layer 4 source IP address belongs to the set of minimum trusted threat IP addresses. The second interception unit 113 is used to determine that the request is a CDN-forwarded request if the Layer 4 source IP address belongs to the set of exit IP addresses, parse the X-Forwarded-For field in the HTTP header of the request, check whether the value of the X-Forwarded-For field contains any IP address in the set of minimum trusted threat IP addresses, and if it does, then perform interception.

[0064] This application also provides corresponding devices and computer storage media for implementing the protection scheme provided in this application.

[0065] The device includes a memory and a processor. The memory stores instructions or code, and the processor executes the instructions or code to cause the device to perform the protection method described in any embodiment of this application.

[0066] The computer storage medium stores code, and when the code is executed, the device running the code implements the protection method described in any embodiment of this application.

[0067] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems or apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and relevant parts can be referred to the method section.

[0068] It should be understood that in this application, "at least one" refers to one or more items, and "more" refers to two or more items. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one" or similar expressions refer to any combination of these items, including any combination of singular or plural items. For example, "at least one" of a, b, or c can represent: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, and c can be single or multiple.

[0069] It should be understood that the terms center, longitudinal, transverse, up, down, front, back, left, right, vertical, horizontal, top, bottom, inside, outside, etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the present invention.

[0070] It should be noted that, unless otherwise explicitly specified and limited, the terms installation, connection, and linking should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections or electrical connections; they can refer to direct connections or indirect connections through an intermediate medium; and they can refer to the internal communication between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0071] It should also be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the statement "comprising a..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0072] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0073] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A protection method, characterized in that, include: Obtain the set of outgoing IP addresses from the cooperating CDN service provider, and the minimum set of trusted threat IP addresses from the threat intelligence service provider; Determine whether the Layer 4 source IP address of the request arriving at the firewall belongs to the set of outgoing IP addresses; If the Layer 4 source IP address does not belong to the set of outgoing IP addresses, the request is determined to be a direct connection request that has not gone through CDN; if the Layer 4 source IP address belongs to the set of minimum trusted threat IP addresses, then blocking is performed. If the Layer 4 source IP address belongs to the set of outgoing IP addresses, then the request is determined to be a request forwarded by CDN. The X-Forwarded-For field in the HTTP header of the request is parsed, and it is checked whether the value of the X-Forwarded-For field contains any IP address in the set of minimum trusted threat IP addresses. If it does, then interception is performed.

2. The method according to claim 1, characterized in that, The method further includes: Based on the attack behavior detected by the WAF, update the set of minimum trusted threat IP addresses; The dynamic updating of the minimum trusted threat IP address set based on WAF-detected attack behavior includes: For direct connection requests that are identified as attacks, the Layer 4 source IP address is added to the minimum trusted threat IP address set; For requests that are identified as attacks and forwarded via CDN, the real attacker's IP address is identified from the value of the X-Forwarded-For field, and the real attacker's IP address is added to the minimum trusted threat IP address set.

3. The method according to claim 2, characterized in that, The method further includes: Synchronize the malicious IP addresses in the updated set of minimum trusted threat IP addresses to the perimeter firewall.

4. The method according to claim 2, characterized in that, The method for identifying the real attacker's IP address from the value of the X-Forwarded-For field includes: The value of the X-Forwarded-For field is split into a sequence of IP addresses based on the delimiter; Starting from the rightmost IP address in the IP address sequence, check each IP address sequentially to the left to see if it belongs to the CDN egress IP address set; The first IP address that does not belong to the CDN egress IP address set is identified as the real attacker's IP address.

5. The method according to claim 2, characterized in that, Before adding the real attacker's IP address to the minimum trusted threat IP address set, the method further includes: Establish a statistical time window for the IP address of the real attacker, and count the number of attacks within the time window; Adding the real attacker's IP address to the minimum trusted threat IP address set includes: When the number of attacks by the real attacker's IP address within the statistical window reaches a preset threshold, the real attacker's IP address is added to the minimum trusted threat IP address set.

6. The method according to claim 1, characterized in that, Also includes: Set the lifespan of each IP address in the set of exiting IP addresses; Based on a preset period, remove IP addresses from the set of exiting IP addresses that have exceeded their lifespan.

7. A protection system, characterized in that, include: The acquisition unit is used to acquire the set of outgoing IP addresses from cooperating CDN service providers and the minimum set of trusted threat IP addresses from threat intelligence service providers. The judgment unit is used to determine whether the Layer 4 source IP address of the request arriving at the firewall belongs to the set of outgoing IP addresses; The first interception unit is used to determine that the request is a direct connection request that has not gone through CDN if the Layer 4 source IP address does not belong to the set of outgoing IP addresses, and to perform interception if the Layer 4 source IP address belongs to the set of minimum trusted threat IP addresses. The second interception unit is used to determine that the request is a CDN-forwarded request if the Layer 4 source IP address belongs to the set of exit IP addresses, parse the X-Forwarded-For field in the HTTP header of the request, check whether the value of the X-Forwarded-For field contains any IP address in the set of minimum trusted threat IP addresses, and if it does, then perform interception.

8. A computer program product, characterized in that, The computer program product stores instructions that, when executed on a terminal device, cause the terminal device to perform the protection method as described in any one of claims 1-6.

9. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the protection method as described in any one of claims 1-6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed on a terminal device, cause the terminal device to perform the protection method as described in any one of claims 1-6.

Images