Bypass reject method and apparatus, and device and storage medium

Abstract

The present application relates to a bypass reject method and apparatus, and a device and a storage medium. The method comprises: acquiring a session message during the establishment of a TCP connection; if the session message matches reject rules, determining a matched IP address and a matched port number on the basis of the value of an acknowledgment flag of the session message and the value of a synchronization flag of the session message; on the basis of the matched IP address and the matched port number, determining records to be matched; matching a quintuple hash value in the session message with quintuple hash values in the records to be matched, and determining a target record of successful matching; and if it is determined on the basis of a hit rate of the target record hitting the reject rules that the current session connection state of the session message needs to be forged into an established state, constructing a reject message on the basis of the session message, such that a client or a server terminates the corresponding TCP connection on the basis of the reject message. The present application can solve the problem of the success rate of TCP bypass reject not being high because reject messages are not sent in a timely manner.

Description

A bypass blocking method, device, equipment and storage medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the Intellectual Property Office of the People's Republic of China on October 23, 2023, with application number 202311370831.3 and invention name "A bypass blocking method, device, equipment and storage medium", the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of network security technology, and in particular to a bypass blocking method, device, equipment and storage medium. Background Art

[0004] At present, the TCP (Transmission Control Protocol) bypass blocking method of the intrusion detection system is to perform TCP blocking by deploying an intrusion detection system in the bypass. The bypass deployment method of the intrusion detection system is to split or mirror the messages in the export direction of the switch or router to the bypass intrusion detection system. When the intrusion detection system detects a suspicious message, it constructs a blocking message, i.e., RST (ReSeT, reset) message, according to the message information of the suspicious message, and sends the constructed RST message to the client or server. When the client or server receives the RST message, it terminates the corresponding session, thereby achieving the purpose of blocking the suspicious attack.

[0005] The current network environment is becoming increasingly complex, and latency jitter is becoming increasingly uncontrollable. During the TCP connection establishment process, session packets are captured in real time and matched against blocking rules. Only when the session connection status in the session packet indicates that the session connection is established can the session packet successfully match the blocking rule and be identified as a suspicious session packet. An RST packet is then constructed based on the suspicious session packet and sent to the client or server. However, the client or server will most likely receive the RST packet later than it sends its own request or response packet, making it unable to terminate the corresponding TCP connection and, consequently, unable to block the suspicious attack. Consequently, the success rate of TCP bypass blocking in current intrusion detection systems is low.

[0006] Summary of the Invention

[0007] The present application provides a bypass blocking method, apparatus, device and storage medium to solve the problem of low TCP bypass blocking success rate due to untimely sending of blocking messages.

[0008] According to a first aspect of an embodiment of the present application, a bypass blocking method is provided, the method comprising:

[0009] Get the session message during the TCP connection establishment process of the Transmission Control Protocol;

[0010] If the session message matches the blocking rule, determining the matching IP address and matching port number of the session message based on the value of the confirmation flag bit and the value of the synchronization flag bit of the session message;

[0011] Determine, based on the matching IP address and matching port number of the session message, each to-be-matched record corresponding to the blocking rule in the blocking bucket;

[0012] Matching the five-tuple hash value in the session message with the five-tuple hash value in each record to be matched, and determining a target record that has been successfully matched;

[0013] If it is determined based on the hit rate of the target record hitting the blocking rule that the current session connection state of the session message needs to be forged into a session connection established state, a blocking message is constructed based on the session message so that the client or server terminates the TCP connection based on the blocking message.

[0014] In the case where the session message obtained during the TCP connection establishment process matches the blocking rule, the present application determines the records to be matched in the blocking bucket corresponding to the blocking rule based on the matching IP address and matching port number of the session message, and matches the five-tuple hash value in the session message with the five-tuple hash value in each record to be matched, and determines the target record that has been successfully matched, that is, the historical matching of the message that is the same as the session message with the blocking rule. Based on the hit rate of the target record hitting the blocking rule, the present application determines that the current session connection state of the session message needs to be forged into the session connection established state, thereby triggering the construction of the blocking message in advance, so that the client or server receives the blocking message earlier, and constructs the blocking message based on the session message, so that the client or server terminates the TCP connection based on the blocking message. The present application can dynamically forge the current session connection state of the session message into the session connection established state, thereby triggering the construction of the blocking message in advance, solving the problem of low TCP bypass blocking success rate caused by untimely sending of the blocking message, and improving the success rate of TCP bypass blocking.

[0015] In a possible implementation, determining the matching IP address and the matching port number of the session message based on the value of the confirmation flag bit and the value of the synchronization flag bit of the session message includes:

[0016] If, based on the value of the confirmation flag bit and the value of the synchronization flag bit of the session message, it is determined that the session message is a first handshake message or a third handshake message, then the matching IP address is determined to be the destination IP address of the session message, and the matching port number is determined to be the destination port number of the session message;

[0017] If the session message is determined to be a second handshake message based on the values ​​of the confirmation flag and the synchronization flag of the session message, the matching IP address is determined to be the source IP address of the session message, and the matching port number is determined to be the source port number of the session message.

[0018] In a possible implementation, determining each to-be-matched record corresponding to the blocking rule based on the matching IP address and the matching port number of the session message includes:

[0019] Determining a hash index value of the session message based on the matching address and the matching port number;

[0020] Based on the hash index value of the session message and the hash index value of each rule in the blocking bucket, the records to be matched corresponding to the blocking rule are determined, wherein the hash index value of each rule is determined according to the destination IP address and destination port number of the rule.

[0021] This application can determine the records to be matched corresponding to the blocking rule, that is, the historical matching status of each message with the blocking rule, based on the hash index value of the session message and the hash index value of each rule in the blocking bucket.

[0022] In a possible implementation, the hit rate is determined by the following method:

[0023] Determine the hit time difference based on the sending time of the session message and the earliest historical hit time in the target record; wherein the earliest historical hit time is the earliest time among the hit times of each matching message that matches the blocking rule and is the same as the session message;

[0024] The hit rate is determined based on the rule hit count and the hit time difference in the target record; wherein the rule hit count is the number of matching messages that match the blocking rule and are identical to the session message.

[0025] The present application determines a hit rate based on the sending time of the session message, the earliest historical hit time in the target record, and the number of rule hits, thereby reflecting the probability that the session message is a suspicious session message according to the hit rate.

[0026] In a possible implementation, determining, based on the hit rate of the blocking rule in the target record, that the current session connection state of the session message needs to be forged into a session connection established state includes:

[0027] If the hit rate exceeds the set threshold and the session message is the first handshake message, the synchronization sent state SYN_SENT of the session message is forged into the session connection established state;

[0028] If the hit rate does not exceed the set threshold, and the session message is a second handshake message, the synchronization received state SYN_RECV of the session message is forged into a session connection established state.

[0029] Based on the relationship between the hit rate and the set threshold and the current session connection status of the session message, this application determines that the current session connection status of the session message needs to be forged into a session connection established state, thereby triggering the construction of a blocking message in advance, solving the problem of low TCP bypass blocking success rate caused by untimely sending of blocking messages.

[0030] In a possible implementation, after determining the successfully matched target record, the method further includes:

[0031] Based on the session message, the rule hit count in the target record is updated.

[0032] In a possible implementation, after determining the matching IP address and the matching port number of the session message, the method further includes:

[0033] Based on the matching IP address and matching port number of the session message, determining that no corresponding to-be-matched record exists in the blocking bucket for the blocking rule;

[0034] A record is generated based on the session message and stored in the storage space corresponding to the hash index value of the blocking rule in the blocking bucket.

[0035] In a possible implementation, after matching the five-tuple hash value in the session message with the five-tuple hash value in each to-be-matched record, the method further includes:

[0036] If there is no successfully matched target record, a record is generated based on the session message and saved in the storage space corresponding to the hash index value of the blocking rule in the blocking bucket.

[0037] In one possible implementation, each record in the blocking bucket includes a five-tuple hash value, a rule hit number, a source IP address of the matching message, and the earliest historical hit time; wherein the five-tuple hash value is obtained by performing a hash operation on the five-tuple in the matching message; the five-tuple includes the source IP address, source port number, destination IP address, destination port number, and protocol number of the matching message.

[0038] In a possible implementation, constructing a blocking message based on the session message includes:

[0039] Constructing a TCP header of the blocking message based on the sequence number seq and the acknowledgment number ack of the session message;

[0040] Constructing an IP header of the blocking message based on the source IP address and the destination IP address of the session message;

[0041] The physical address MAC of the switch is used as the destination MAC of the Ethernet header of the blocking message, and the source MAC or the destination MAC of the session message is used as the source MAC of the Ethernet header of the blocking message.

[0042] According to a second aspect of an embodiment of the present application, a bypass blocking device is provided, the device comprising:

[0043] An acquisition module is used to acquire session messages during the process of establishing a Transmission Control Protocol TCP connection;

[0044] A first determining module is used to determine the matching IP address and matching port number of the session message based on the value of the confirmation flag bit and the value of the synchronization flag bit of the session message if the session message matches the blocking rule;

[0045] A second determination module is used to determine each to-be-matched record corresponding to the blocking rule in the blocking bucket based on the matching IP address and matching port number of the session message;

[0046] A matching module, configured to match the five-tuple hash value in the session message with the five-tuple hash value in each to-be-matched record, and determine a target record that has been successfully matched;

[0047] A blocking module is used to construct a blocking message based on the session message if it is determined based on the hit rate of the target record hitting the blocking rule that the current session connection state of the session message needs to be forged into a session connection established state, so that the client or server terminates the TCP connection based on the blocking message.

[0048] According to a third aspect of an embodiment of the present application, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor implements the steps of the above-mentioned bypass blocking method by running the executable instructions.

[0049] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which computer instructions are stored. When the instructions are executed by a processor, the steps of the above-mentioned bypass blocking method are implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0051] FIG1 is a schematic diagram of an application scenario according to an exemplary embodiment;

[0052] FIG2 is a flow chart showing a bypass blocking method according to an exemplary embodiment;

[0053] FIG3 is a specific flow chart of a bypass blocking method according to an exemplary embodiment;

[0054] FIG4 is a schematic diagram showing a method for establishing a TCP connection according to an exemplary embodiment;

[0055] 5 is a flowchart illustrating a method for determining each to-be-matched record corresponding to a blocking rule in a blocking bucket according to an exemplary embodiment;

[0056] FIG6 is a flowchart showing a method for constructing a blocking message based on a session message according to an exemplary embodiment;

[0057] FIG7 is a schematic diagram of a bypass blocking device according to an exemplary embodiment;

[0058] FIG8 is a schematic diagram of an electronic device showing a bypass blocking method according to an exemplary embodiment;

[0059] FIG9 is a schematic diagram of a program product showing a bypass blocking method according to an exemplary embodiment. DETAILED DESCRIPTION

[0060] To make the objectives, technical solutions, and advantages of this application more clear, this application will be further described in detail below with reference to the accompanying drawings. It is obvious that the embodiments described are only some of the embodiments of this application, not all of them. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of this application without creative effort are intended to fall within the scope of protection of this application.

[0061] The following are explanations of some of the words that appear in the text:

[0062] 1. In the embodiments of this application, the term "and / or" describes the relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0063] 2. The terms "first," "second," and the like in the specification and claims of this application and the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, such that the embodiments of the present application described herein can be practiced in orders other than those illustrated or described herein.

[0064] The application scenarios described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Persons skilled in the art will appreciate that, as new application scenarios emerge, the technical solutions provided by the embodiments of this application are equally applicable to similar technical problems. In the description of this application, unless otherwise specified, "multiple" means two or more.

[0065] At present, the TCP bypass blocking method of the intrusion detection system is to perform TCP blocking through an intrusion detection system deployed in the bypass. The bypass deployment method of the intrusion detection system is to split or mirror the messages in the export direction of the switch or router to the bypass intrusion detection system. When the intrusion detection system detects a suspicious message, it constructs a blocking message, i.e., an RST message, based on the message information of the suspicious message, and sends the constructed RST message to the client or server. When the client or server receives the RST message, it terminates the corresponding session, thereby achieving the purpose of blocking the suspicious attack.

[0066] The current network environment is becoming increasingly complex, and latency jitter is becoming increasingly uncontrollable. During the TCP connection establishment process, session packets are captured in real time and matched against blocking rules. Only when the session connection status in the session packet indicates that the session connection is established can the session packet successfully match the blocking rule and be identified as a suspicious session packet. An RST packet is then constructed based on the suspicious session packet and sent to the client or server. However, the client or server will most likely receive the RST packet later than it sends its own request or response packet, making it unable to terminate the corresponding TCP connection and, consequently, unable to block the suspicious attack. Consequently, the success rate of TCP bypass blocking in current intrusion detection systems is low.

[0067] In addition, current intrusion detection systems generally use DPDK (Data Plane Development Kit) packet capture technology, high-performance regular matching technology (Hyperscan technology), RSS technology (Receive Side Scaling), CPU (Central Processing Unit) affinity technology and lock-free technology to improve the processing performance of the intrusion detection system. However, as long as the intrusion detection system establishes a session connection after the TCP three-way handshake and matches and determines that it is a suspicious session message attack, and then sends an RST message, the time when the RST message arrives at the client or server is still likely to be later than the time when the client or server sends the session message. Therefore, the success rate of TCP bypass blocking of the intrusion detection system has not been significantly improved.

[0068] Therefore, in order to solve the above problems, the present application provides a bypass blocking method, device, equipment and storage medium to solve the problem of low TCP bypass blocking success rate caused by untimely sending of blocking messages.

[0069] First, refer to Figure 1, which is a schematic diagram of an application scenario of an embodiment of the present application, including a client 11, a server 12, a switch 13, a load balancing and traffic distribution device 14, and a blocking device 15. Specifically, client 11 is the initiator of a network session and actively initiates TCP communication with server 12; server 12 is the service provider of the network session, receiving the network session request from client 11 and providing corresponding network services; switch 13 is connected to load balancing and traffic distribution device 14 through a dual-fiber connection, and load balancing and traffic distribution device 14 is connected to blocking device 15 through a dual-fiber connection. The switch 13 outputs a mirror image of the data traffic to the load balancing diversion device 14 by means of optical splitting; the load balancing diversion device 14 outputs the data traffic to the blocking device 15 in a load-balanced manner through the same-source and same-destination balancing mechanism; the blocking device 15 is used to determine the session message based on the data traffic, configure the blocking rules, and match the session message with the blocking rules. After the session message successfully matches the blocking rule, a blocking message is constructed based on the session message and sent to the load balancing diversion device 14 from the designated port; the load balancing diversion device 14 configures the forwarding rule to send the received blocking message from the designated port to the switch 13; the switch 13 sends the blocking message to the client 11 or the server 12; the client 11 or the server 12 terminates the corresponding TCP connection according to the received blocking message.

[0070] In an embodiment of the present application, the blocking device 15 obtains a session message during the TCP connection establishment process; if the session message matches the blocking rule, the matching IP address and the matching port number of the session message are determined based on the value of the confirmation flag bit and the value of the synchronization flag bit of the session message; based on the matching IP address and the matching port number of the session message, each to-be-matched record corresponding to the blocking rule in the blocking bucket is determined; the five-tuple hash value in the session message is matched with the five-tuple hash value in each to-be-matched record to determine a target record with a successful match; if the session connection state of the session message is forged based on the hit rate of the target record hitting the blocking rule, a blocking message is constructed based on the session message, so that the client or server terminates the TCP connection based on the blocking message.

[0071] In some embodiments, a bypass blocking method provided by the present application is described below through a specific embodiment, as shown in FIG2 , including:

[0072] Step 201: Acquire session messages during the TCP connection establishment process;

[0073] The above session messages may be the first handshake message, the second handshake message and the third handshake message during the TCP connection establishment process. This application obtains the session messages during the TCP connection establishment process in real time.

[0074] Step 202: If the session message matches the blocking rule, the matching IP address and matching port number of the session message are determined based on the value of the confirmation flag bit and the value of the synchronization flag bit of the session message;

[0075] The above blocking rules include parameters such as rule action, source IP address, source port number, destination IP address, destination port number, etc., among which the rule actions include destination blocking (reject), destination and source blocking (rejectboth) and source blocking (rejectsrc).

[0076] Step 203: Determine each to-be-matched record corresponding to the blocking rule in the blocking bucket based on the matching IP address and matching port number of the session message;

[0077] The reject bucket includes a node chain corresponding to each rejection rule. Each node chain corresponding to each rejection rule can include at least one node, and each node corresponds to a record. Each record includes a five-tuple hash value, the number of rule hits, the source IP address of the matching message, and the earliest historical hit time. The five-tuple hash value is obtained by hashing the five-tuple in the matching message. The five-tuple includes the matching message's source IP address, source port number, destination IP address, destination port number, and protocol number.

[0078] Each session thread in the present application is individually allocated space in the blocking bucket, and the space in the blocking bucket is initialized and dedicated to each session thread, so there is no problem of resource competition.

[0079] Step 204: Match the five-tuple hash value in the session message with the five-tuple hash value in each record to be matched, and determine a target record that has been successfully matched;

[0080] The five-tuple hash value of the session message is obtained by performing a hash operation on the five-tuple in the session message. The five-tuple of the session message includes the source IP address, source port number, destination IP address, destination port number and protocol number of the session message.

[0081] Step 205: If it is determined based on the hit rate of the target record hitting the blocking rule that the current session connection state of the session message needs to be forged into a session connection established state, a blocking message is constructed based on the session message so that the client or server terminates the TCP connection based on the blocking message.

[0082] The blocking message may be a TCP RST message, which is a message used by the message receiver in the TCP protocol to end the current TCP connection through TCP RST, referred to as an RST message.

[0083] In the case where the session message obtained during the TCP connection establishment process matches the blocking rule, the present application determines the records to be matched in the blocking bucket corresponding to the blocking rule based on the matching IP address and matching port number of the session message, and matches the five-tuple hash value in the session message with the five-tuple hash value in each record to be matched, and determines the target record that has been successfully matched, that is, the historical matching of the message that is the same as the session message with the blocking rule. Based on the hit rate of the target record hitting the blocking rule, the present application determines that the current session connection state of the session message needs to be forged into the session connection established state, thereby triggering the construction of the blocking message in advance, so that the client or server receives the blocking message earlier, and constructs the blocking message based on the session message, so that the client or server terminates the TCP connection based on the blocking message. The present application can dynamically forge the current session connection state of the session message into the session connection established state, thereby triggering the construction of the blocking message in advance, solving the problem of low TCP bypass blocking success rate caused by untimely sending of the blocking message, and improving the success rate of TCP bypass blocking.

[0084] The specific steps of the bypass blocking method provided above are described in detail below, as shown in FIG3 , including:

[0085] Step 301: Acquire the session message during the TCP connection establishment process.

[0086] The above-mentioned TCP connection establishment process is described below. Figure 4 is a schematic diagram of a TCP connection establishment method according to an exemplary embodiment. As shown in Figure 4, taking the TCP protocol three-way handshake between the client and the server as an example, before the handshake, the client that actively opens the connection ends the Close phase, and the server that passively opens the connection also ends the Close phase and enters the Listen phase.

[0087] First handshake: The client sends the first handshake message to the server and waits for the server to confirm. The client then enters the Synchronize Sent (SYN_SENT) state. The first handshake message is a SYN (Synchronize Sequence Numbers) packet, which includes the synchronization flag SYN = 1 and the sequence number seq = x, where x is typically a random number. The synchronization flag SYN = 1 indicates a request to establish a connection.

[0088] Second handshake: The server receives the first handshake message sent by the client, confirms the first handshake message and ends the Listen phase, and sends the second handshake message to the client. The server enters the synchronous reception (SYN-RECV) phase. Among them, the second handshake message is a SYN+ACK (Acknowledgement, confirmation character) packet, which includes the synchronization flag SYN=1, the confirmation flag ACK=1, the sequence number seq=y, and the confirmation number ack=x+1. Among them, the synchronization flag SYN=1 and the confirmation ACK=1 indicate that the server confirms that the sequence number seq in the client's first handshake message is valid, it can normally receive the data sent by the client, and agrees to create a new connection; the confirmation number ack indicates that the server receives the client's sequence number seq=x, and adds 1 to its value as the value of its own confirmation number ack.

[0089] The third handshake: The client receives the second handshake message sent by the server, confirms that the data transmission from the client to the server is normal, thus ending the SYN-SENT phase and sending the third handshake message to the server. The client enters the established phase of the session connection. After the server receives the third handshake message, it enters the established phase, thus realizing the TCP connection, at which point data transmission can be carried out. Among them, the third handshake message is an ACK packet, which includes an acknowledgment flag ACK=1, a sequence number seq=x+1, and an acknowledgment number ack=y+1. Among them, the acknowledgment flag ACK=1 indicates that the client has received a signal from the server agreeing to connect; the sequence number seq indicates that the client has received the acknowledgment number ack=x+1 sent by the server and uses its value as its own sequence number; the acknowledgment number ack indicates that the client has received the sequence number seq=y sent by the server and adds 1 to its value as the value of its own acknowledgment number ack.

[0090] Step 302: Determine whether the session message matches a blocking rule.

[0091] Optionally, if the session message does not match the blocking rule, the blocking process ends.

[0092] The above blocking rules include parameters such as rule action, source IP address, source port number, destination IP address, and destination port number.

[0093] For example, if the client's IP address is 16.0.117.217 and the server's IP address is 148.2.115.216, and a Web (World Wide Web) service is deployed on port 8080, you need to block the client's access. Therefore, the configured blocking rule can be:

[0094] reject http 16.0.117.217 any->148.2.115.216 8080(msg:"reject-rules for testing"; flow:established; classtype: misc-attack; sid:10001002; rev:1;)

[0095] Among them, reject is the blocking action; http (Hypertext Transfer Protocol) is the protocol; 16.0.117.217 is the source IP address; any is the source port number that this blocking rule is applicable to; 148.2.115.216 is the destination IP address; 8080 is the destination port number; msg is the prompt message of this blocking rule, that is, this blocking rule is used for testing; flow is the session state of this blocking rule, that is, the session state of this blocking rule is established; classtype is the rule type of this blocking rule, that is, the rule type of this blocking rule is misc-attack; sid is the number of this blocking rule, that is, the number of this blocking rule is 10001002; rev is the version number of this blocking rule, that is, the version number of this blocking rule is 1.

[0096] The specific process of matching the above session message with the blocking rule and determining whether the session message matches the blocking rule is prior art and will not be described in detail here.

[0097] Step 303: Determine the matching IP address and matching port number of the session message based on the value of the confirmation flag bit and the value of the synchronization flag bit of the session message.

[0098] The present application may also determine the matching IP address and matching port number of the session message based on the value of the confirmation flag ACK, the value of the synchronization flag SYN, the sequence number seq and the confirmation number ack of the session message.

[0099] Taking the determination of the matching IP address and the matching port number of the session message based on the value of the confirmation flag bit and the value of the synchronization flag bit of the session message as an example, the above step 303 specifically includes the following two cases:

[0100] In the first case, if the session message is determined to be the first handshake message or the third handshake message based on the value of the confirmation flag bit and the value of the synchronization flag bit of the session message, then the matching IP address is determined to be the destination IP address of the session message, and the matching port number is determined to be the destination port number of the session message.

[0101] In the second case, if the session message is determined to be a second handshake message based on the value of the confirmation flag bit and the value of the synchronization flag bit of the session message, the matching IP address is determined to be the source IP address of the session message, and the matching port number is determined to be the source port number of the session message.

[0102] For example, the first handshake message includes the synchronization flag SYN=1 and the sequence number seq=x; the second handshake message includes the synchronization flag SYN=1, the confirmation flag ACK=1, the sequence number seq=y, and the confirmation number ack=x+1; the third handshake message includes the confirmation flag ACK=1, the sequence number seq=x+1, and the confirmation number ack=y+1.

[0103] If the value of the acknowledgment flag ACK in session message 1 is 0 and the value of the synchronization flag SYN is 1, it is determined that session message 1 is the first handshake message, and the matching IP address of session message 1 is determined to be the destination IP address of session message 1, and the matching port number of session message 1 is determined to be the destination port number of session message 1. If the value of the acknowledgment flag ACK in session message 2 is 1 and the value of the synchronization flag SYN is 1, it is determined that session message 2 is the second handshake message, and the matching IP address of session message 2 is determined to be the source IP address of session message 2, and the matching port number of session message 2 is the source port number of session message 2. If the value of the acknowledgment flag ACK in session message 3 is 1 and the value of the synchronization flag SYN is 0, it is determined that session message 3 is the third handshake message, and the matching IP address of session message 3 is determined to be the destination IP address of session message 3, and the matching port number of session message 3 is the destination port number of session message 3.

[0104] Optionally, after determining the matching IP address and matching port number of the session message, the present application further includes:

[0105] Based on the matching IP address and matching port number of the session message, determining that no corresponding to-be-matched record exists in the blocking bucket for the blocking rule;

[0106] A record is generated based on the session message and stored in the storage space corresponding to the hash index value of the blocking rule in the blocking bucket.

[0107] Specifically, based on the matching IP address and matching port number of the session message, a hash index value of the session message is determined; the hash index value of the session message is matched with the hash index value of each rule in the blocking bucket, and it is determined that the hash index value of the session message successfully matches the hash index value of the blocking rule in the blocking bucket, but at least one to-be-matched record does not exist in the storage space corresponding to the hash index value of the blocking rule. A record is generated based on the session message and stored in the storage space corresponding to the hash index value of the blocking rule in the blocking bucket.

[0108] The hash index value of the blocking rule is obtained by performing a hash calculation based on the destination IP address and destination port number of the blocking rule.

[0109] Optionally, based on the matching IP address and matching port number of the session message, the hash index value of the session message is determined; the hash index value of the session message is matched with the hash index value of each rule in the blocking bucket, and it is determined that there is no storage space corresponding to the hash index value of the blocking rule in the blocking bucket, and the corresponding processing flow is executed based on the matching rule, without participating in the process processing of blocking detection.

[0110] Step 304: Based on the matching IP address and matching port number of the session message, determine each to-be-matched record corresponding to the blocking rule in the blocking bucket.

[0111] FIG5 is a flowchart illustrating a method for determining each to-be-matched record corresponding to a blocking rule in a blocking bucket according to an exemplary embodiment. As shown in FIG5 , step 304 includes at least the following steps:

[0112] Step 501: Determine a hash index value of the session message based on the matching address and the matching port number;

[0113] Step 502: Determine each to-be-matched record corresponding to the blocking rule based on the hash index value of the session message and the hash index value of each rule in the blocking bucket.

[0114] The hash index value of each rule is determined according to the destination IP address and destination port number of the rule.

[0115] Step 305 : Match the five-tuple hash value in the session message with the five-tuple hash value in each record to be matched, and determine a target record that has been successfully matched.

[0116] For example, the five-tuple hash value in the session message is A1. Assume there are three records to be matched: record 1, record 2, and record 3. The five-tuple hash value in record 1 is A1; the five-tuple hash value in record 2 is A2; and the five-tuple hash value in record 3 is A3. The five-tuple hash value in the session message is matched against the five-tuple hash values ​​in the three records to be matched, and record 1 is determined to be the target record.

[0117] Optionally, after determining the target record that matches successfully, the present application updates the rule hit count in the target record based on the session message.

[0118] Optionally, after matching the five-tuple hash value in the session message with the five-tuple hash value in each to-be-matched record, the method further includes:

[0119] If there is no successfully matched target record, a record is generated based on the session message and saved in the storage space corresponding to the hash index value of the blocking rule in the blocking bucket.

[0120] For example, the five-tuple hash value in the session message is A1. Assume that there are two records to be matched, namely record 1 to be matched and record 2 to be matched. The five-tuple hash value in record 1 to be matched is A2; the five-tuple hash value in record 2 to be matched is A3. Match the five-tuple hash value in the session message with the five-tuple hash values ​​in the two records to be matched respectively to determine that there is no target record that is successfully matched. Generate a record based on the session message and save it in the storage space corresponding to the hash index value of the blocking rule in the blocking bucket, that is, hang the node corresponding to the generated record at the end of the node chain corresponding to the blocking rule.

[0121] Optionally, each storage space in the blocking bucket is dynamically allocated, and the records in the blocking bucket can be aged and recycled according to a set aging period. The aging period can be set according to actual conditions, for example, the set aging period can be 3 minutes. The present application can also set a corresponding aging period for each record in the blocking bucket, so that each record can be aged and recycled according to the corresponding aging period. The aging period corresponding to each record can be set according to actual conditions.

[0122] Step 306: Determine based on the hit rate of the target record hitting the blocking rule whether the current session connection state of the session message needs to be forged into a session connection established state.

[0123] Specifically, the above hit rate can be determined by the following method:

[0124] Determine the hit time difference based on the sending time of the session message and the earliest historical hit time in the target record; wherein the earliest historical hit time is the earliest time among the hit times of each matching message that matches the blocking rule and is the same as the session message;

[0125] The hit rate is determined based on the rule hit count and the hit time difference in the target record; wherein the rule hit count is the number of matching messages that match the blocking rule and are identical to the session message.

[0126] Specifically, the ratio between the number of rule hits in the target record and the hit time difference is used as the hit rate

[0127] For example, if the session message is sent at time t0, the target record includes the hit times of five matching messages: matching message 1, matching message 2, matching message 3, matching message 4, and matching message 5. The hit time of matching message 1 is t1, the hit time of matching message 2 is t2, the hit time of matching message 3 is t3, the hit time of matching message 4 is t4, and the hit time of matching message 5 is t5. The hit time of each matching message can be the time when the target record was updated based on the matching message. If the hit time t5 of matching message 5 is the earliest, then the earliest historical hit time is t5, and the hit time difference Δt = t0 - t5. Based on the number of rule hits D in the target record and the hit time difference Δt, the hit rate p = D / Δt is determined, where the number of rule hits equals the number of matching messages plus 1, so D is 6.

[0128] In step 306, based on the hit rate of the target record hitting the blocking rule, it is determined that the current session connection state of the session message needs to be forged into a session connection established state, specifically including the following two situations:

[0129] Case 1: If the hit rate exceeds the set threshold and the session message is the first handshake message, the synchronization sent state SYN_SENT of the session message is forged into the session connection established state Established;

[0130] The above threshold value can be set according to actual conditions. For example, the threshold value can be 5.

[0131] For example, if the threshold is set to 5 and the hit rate is 6, it is determined that the hit rate exceeds the set threshold, and the session message is the first handshake message, then the synchronization sent state SYN_SENT of the session message is forged into the session connection established state Established.

[0132] Case 2: If the hit rate does not exceed the set threshold, and the session message is a second handshake message, the synchronization received state SYN_RECV of the session message is forged into the session connection established state Established.

[0133] For example, if the threshold is set to 5 and the hit rate is 4, it is determined that the hit rate does not exceed the set threshold, and the session message is the second handshake message, then the synchronization received state SYN_RECV of the session message is forged into the session connection established state Established.

[0134] Based on the relationship between the hit rate and the set threshold and the session message, this application determines that the current session connection state of the session message needs to be forged into the session connection established state, thereby triggering the construction of the blocking message in advance, solving the problem of low TCP bypass blocking success rate caused by untimely sending of the blocking message, and improving the success rate of TCP bypass blocking.

[0135] Step 307: construct a blocking message based on the session message, so that the client or server terminates the TCP connection based on the blocking message.

[0136] FIG6 is a flowchart illustrating a method for constructing a blocking message based on a session message according to an exemplary embodiment. As shown in FIG6 , the specific method for constructing a blocking message based on the session message in step 307 includes at least the following steps:

[0137] Step 601: constructing the TCP header of the blocking message based on the sequence number seq and the acknowledgment number ack of the session message;

[0138] Specifically, if the blocking message is a RST message, a TCP header of the RST message is constructed according to the confirmation number ack and sequence number seq of the matching message.

[0139] Step 602: constructing the IP header of the blocking message based on the source IP address and the destination IP address of the session message;

[0140] Step 603: Use the physical address MAC of the switch as the destination MAC of the Ethernet header of the blocking message, and use the source MAC or destination MAC of the session message as the source MAC of the Ethernet header of the blocking message.

[0141] Specifically, if the blocking message is an RST message, the Ethernet header of the RST message is constructed. The destination MAC of the Ethernet header of the RST message must use the MAC of the switch. The source MAC address of the Ethernet header of the RST message uses the source MAC or destination MAC of the session message depending on the blocking direction.

[0142] In some embodiments, based on the same inventive concept, the embodiments of the present application also provide a bypass blocking device. Since the device is the device in the method in the embodiments of the present application, and the principle of solving the problem by the device is similar to that of the method, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0143] As shown in FIG7 , the above device includes the following modules:

[0144] An acquisition module 701 is configured to acquire session messages during a Transmission Control Protocol (TCP) connection establishment process;

[0145] A first determining module 702 is configured to determine a matching IP address and a matching port number of the session message based on a value of a confirmation flag bit and a value of a synchronization flag bit of the session message if the session message matches a blocking rule;

[0146] A second determining module 703 is configured to determine, based on the matching IP address and matching port number of the session message, each to-be-matched record corresponding to the blocking rule in the blocking bucket;

[0147] A matching module 704 is configured to match the five-tuple hash value in the session message with the five-tuple hash value in each to-be-matched record, and determine a target record that has been successfully matched;

[0148] The blocking module 705 is used to construct a blocking message based on the session message if it is determined based on the hit rate of the target record hitting the blocking rule that the current session connection state of the session message needs to be forged into a session connection established state, so that the client or server terminates the TCP connection based on the blocking message.

[0149] As an optional implementation manner, the first determining module 702 is configured to:

[0150] If, based on the value of the confirmation flag bit and the value of the synchronization flag bit of the session message, it is determined that the session message is a first handshake message or a third handshake message, then the matching IP address is determined to be the destination IP address of the session message, and the matching port number is determined to be the destination port number of the session message;

[0151] If the session message is determined to be a second handshake message based on the values ​​of the confirmation flag and the synchronization flag of the session message, the matching IP address is determined to be the source IP address of the session message, and the matching port number is determined to be the source port number of the session message.

[0152] As an optional implementation manner, the second determining module 703 is configured to:

[0153] Determining a hash index value of the session message based on the matching address and the matching port number;

[0154] Based on the hash index value of the session message and the hash index value of each rule in the blocking bucket, the records to be matched corresponding to the blocking rule are determined, wherein the hash index value of each rule is determined according to the destination IP address and destination port number of the rule.

[0155] As an optional implementation manner, the blocking module 705 is configured to determine the hit rate by the following method:

[0156] Determine the hit time difference based on the sending time of the session message and the earliest historical hit time in the target record; wherein the earliest historical hit time is the earliest time among the hit times of each matching message that matches the blocking rule and is the same as the session message;

[0157] The hit rate is determined based on the rule hit count and the hit time difference in the target record; wherein the rule hit count is the number of matching messages that match the blocking rule and are identical to the session message.

[0158] As an optional implementation, the blocking module 705 is configured to:

[0159] If the hit rate exceeds the set threshold and the session message is the first handshake message, the synchronization sent state SYN_SENT of the session message is forged into the session connection established state;

[0160] If the hit rate does not exceed the set threshold, and the session message is a second handshake message, the synchronization received state SYN_RECV of the session message is forged into a session connection established state.

[0161] As an optional implementation, after determining the successfully matched target record, the matching module 704 is further configured to:

[0162] Based on the session message, the rule hit count in the target record is updated.

[0163] As an optional implementation manner, after determining the matching IP address and matching port number of the session message, the first determining module 702 is further configured to:

[0164] Based on the matching IP address and matching port number of the session message, determining that no corresponding to-be-matched record exists in the blocking bucket for the blocking rule;

[0165] A record is generated based on the session message and stored in the storage space corresponding to the hash index value of the blocking rule in the blocking bucket.

[0166] As an optional implementation manner, after matching the quintuple hash value in the session message with the quintuple hash value in each to-be-matched record, the matching module 704 is further configured to:

[0167] If there is no successfully matched target record, a record is generated based on the session message and saved in the storage space corresponding to the hash index value of the blocking rule in the blocking bucket.

[0168] As an optional implementation, each record in the blocking bucket includes a five-tuple hash value, a rule hit number, a source IP address of the matching message, and the earliest historical hit time; wherein, the five-tuple hash value is obtained by performing a hash operation on the five-tuple in the matching message; the five-tuple includes the source IP address, source port number, destination IP address, destination port number, and protocol number of the matching message.

[0169] As an optional implementation, the blocking module 705 is configured to:

[0170] Constructing a TCP header of the blocking message based on the sequence number seq and the acknowledgment number ack of the session message;

[0171] Constructing an IP header of the blocking message based on the source IP address and the destination IP address of the session message;

[0172] The physical address MAC of the switch is used as the destination MAC of the Ethernet header of the blocking message, and the source MAC or the destination MAC of the session message is used as the source MAC of the Ethernet header of the blocking message.

[0173] In some embodiments, based on the same inventive concept, embodiments of the present application further provide a bypass blocking device, which can implement the bypass blocking function discussed above. Referring to FIG8 , the device includes a processor 801 and a memory 802 , wherein the memory 802 is used to store program instructions;

[0174] The processor 801 calls the program instructions stored in the memory and executes the program instructions to implement:

[0175] Get the session message during the TCP connection establishment process of the Transmission Control Protocol;

[0176] If the session message matches the blocking rule, determining the matching IP address and matching port number of the session message based on the value of the confirmation flag bit and the value of the synchronization flag bit of the session message;

[0177] Determine, based on the matching IP address and matching port number of the session message, each to-be-matched record corresponding to the blocking rule in the blocking bucket;

[0178] Matching the five-tuple hash value in the session message with the five-tuple hash value in each record to be matched, and determining a target record that has been successfully matched;

[0179] If it is determined based on the hit rate of the target record hitting the blocking rule that the current session connection state of the session message needs to be forged into a session connection established state, a blocking message is constructed based on the session message so that the client or server terminates the TCP connection based on the blocking message.

[0180] As an optional implementation manner, determining the matching IP address and matching port number of the session message based on the value of the confirmation flag bit and the value of the synchronization flag bit of the session message includes:

[0181] If, based on the value of the confirmation flag bit and the value of the synchronization flag bit of the session message, it is determined that the session message is a first handshake message or a third handshake message, then the matching IP address is determined to be the destination IP address of the session message, and the matching port number is determined to be the destination port number of the session message;

[0182] If the session message is determined to be a second handshake message based on the values ​​of the confirmation flag and the synchronization flag of the session message, the matching IP address is determined to be the source IP address of the session message, and the matching port number is determined to be the source port number of the session message.

[0183] As an optional implementation manner, determining each to-be-matched record corresponding to the blocking rule based on the matching IP address and matching port number of the session message includes:

[0184] Determining a hash index value of the session message based on the matching address and the matching port number;

[0185] Based on the hash index value of the session message and the hash index value of each rule in the blocking bucket, the records to be matched corresponding to the blocking rule are determined, wherein the hash index value of each rule is determined according to the destination IP address and destination port number of the rule.

[0186] As an optional implementation manner, the hit rate is determined by the following method:

[0187] Determine the hit time difference based on the sending time of the session message and the earliest historical hit time in the target record; wherein the earliest historical hit time is the earliest time among the hit times of each matching message that matches the blocking rule and is the same as the session message;

[0188] The hit rate is determined based on the rule hit count and the hit time difference in the target record; wherein the rule hit count is the number of matching messages that match the blocking rule and are identical to the session message.

[0189] As an optional implementation manner, determining the need to forge the current session connection state of the session message into a session connection established state based on the hit rate of the blocking rule in the target record includes:

[0190] If the hit rate exceeds the set threshold and the session message is the first handshake message, the synchronization sent state SYN_SENT of the session message is forged into the session connection established state;

[0191] If the hit rate does not exceed the set threshold, and the session message is a second handshake message, the synchronization received state SYN_RECV of the session message is forged into a session connection established state.

[0192] As an optional implementation, after determining a successfully matched target record, the processor 801 further executes:

[0193] Based on the session message, the rule hit count in the target record is updated.

[0194] As an optional implementation manner, after determining the matching IP address and matching port number of the session message, the processor 801 further executes:

[0195] Based on the matching IP address and matching port number of the session message, determining that no corresponding to-be-matched record exists in the blocking bucket for the blocking rule;

[0196] A record is generated based on the session message and stored in the storage space corresponding to the hash index value of the blocking rule in the blocking bucket.

[0197] As an optional implementation manner, after matching the quintuple hash value in the session message with the quintuple hash value in each to-be-matched record, the processor 801 further executes:

[0198] If there is no successfully matched target record, a record is generated based on the session message and saved in the storage space corresponding to the hash index value of the blocking rule in the blocking bucket.

[0199] As an optional implementation, each record in the blocking bucket includes a five-tuple hash value, a rule hit number, a source IP address of the matching message, and the earliest historical hit time; wherein, the five-tuple hash value is obtained by performing a hash operation on the five-tuple in the matching message; the five-tuple includes the source IP address, source port number, destination IP address, destination port number, and protocol number of the matching message.

[0200] As an optional implementation manner, constructing a blocking message based on the session message includes:

[0201] Constructing a TCP header of the blocking message based on the sequence number seq and the acknowledgment number ack of the session message;

[0202] Constructing an IP header of the blocking message based on the source IP address and the destination IP address of the session message;

[0203] The physical address MAC of the switch is used as the destination MAC of the Ethernet header of the blocking message, and the source MAC or the destination MAC of the session message is used as the source MAC of the Ethernet header of the blocking message.

[0204] In some possible implementations, various aspects of the present application may also be implemented in the form of a program product. As shown in FIG9 , the computer program product 90 includes computer program code. When the computer program code is executed on a computer, the computer executes any of the bypass blocking methods discussed above. Since the principles for solving the problems of the computer program products are similar to those of the bypass blocking methods, the implementation of the computer program products can be referred to as the implementation of the methods, and the repeated parts will not be repeated here.

[0205] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage and optical storage, etc.) containing computer-usable program code.

[0206] The present application is described with reference to the flow chart and / or block diagram of the method, device (system), and computer program product according to the embodiment of the present application. It should be understood that each flow process and / or box in the flow chart and / or block diagram and the combination of the flow process and / or box in the flow chart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processing machine or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one flow chart flow or multiple flows and / or one box or multiple boxes of the block diagram.

[0207] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0208] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0209] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0210] It should be understood that the present application is not limited to the exact structures described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A bypass blocking method, characterized in that: The method includes: Get the session message during the TCP connection establishment process of the Transmission Control Protocol; If the session message matches the blocking rule, determining the matching IP address and matching port number of the session message based on the value of the confirmation flag bit and the value of the synchronization flag bit of the session message; Based on the matching IP address and matching port number of the session message, determine each to-be-matched record corresponding to the blocking rule in the blocking bucket; Matching the five-tuple hash value in the session message with the five-tuple hash value in each record to be matched respectively, and determining a target record that matches successfully; If it is determined based on the hit rate of the target record hitting the blocking rule that the current session connection state of the session message needs to be forged into a session connection established state, a blocking message is constructed based on the session message so that the client or server terminates the TCP connection based on the blocking message.

2. The method according to claim 1, characterized in that The determining the matching IP address and the matching port number of the session message based on the value of the confirmation flag bit and the value of the synchronization flag bit of the session message comprises: If the session message is determined to be a first handshake message or a third handshake message based on the value of the confirmation flag bit and the value of the synchronization flag bit of the session message, the matching IP address is determined to be the destination IP address of the session message, and the matching port number is determined to be the destination port number of the session message; If the session message is determined to be a second handshake message based on the values ​​of the confirmation flag and the synchronization flag of the session message, the matching IP address is determined to be the source IP address of the session message, and the matching port number is determined to be the source port number of the session message.

3. The method according to claim 1, characterized in that The determining, based on the matching IP address and the matching port number of the session message, each to-be-matched record corresponding to the blocking rule comprises: Determine a hash index value of the session message based on the matching address and the matching port number; Based on the hash index value of the session message and the hash index value of each rule in the blocking bucket, each to-be-matched record corresponding to the blocking rule is determined, wherein the hash index value of each rule is based on the The destination IP address and destination port number are determined by the above rule.

4. The method according to claim 1, characterized in that: The hit rate is determined by: Determine the hit time difference based on the sending time of the session message and the earliest historical hit time in the target record; wherein the earliest historical hit time is the earliest time among the hit times of the matching messages that match the blocking rule and are the same as the session message; The hit rate is determined based on the rule hit count in the target record and the hit time difference; wherein the rule hit count is the number of matching messages that match the blocking rule and are the same as the session message.

5. The method according to claim 1, characterized in that The determining, based on the hit rate of the blocking rule in the target record, that the current session connection state of the session message needs to be forged into a session connection established state includes: If the hit rate exceeds the set threshold and the session message is the first handshake message, the synchronization sent state SYN_SENT of the session message is forged into a session connection established state; If the hit rate does not exceed the set threshold, and the session message is a second handshake message, the synchronization received state SYN_RECV of the session message is forged into a session connection established state.

6. The method according to claim 1, characterized in that After the matching target record is determined, it also includes: Based on the session message, the rule hit count in the target record is updated.

7. The method according to claim 1, characterized in that After determining the matching IP address and the matching port number of the session message, the method further includes: Based on the matching IP address and the matching port number of the session message, determining that there is no corresponding to-be-matched record in the blocking rule in the blocking bucket; A record is generated based on the session message and stored in the storage space corresponding to the hash index value of the blocking rule in the blocking bucket.

8. The method according to claim 1, characterized in that: After matching the five-tuple hash value in the session message with the five-tuple hash value in each to-be-matched record respectively, the method further includes: If there is no successfully matched target record, a record is generated based on the session message and saved in the storage space corresponding to the hash index value of the blocking rule in the blocking bucket.

9. The method according to any one of claims 1 to 8, characterized in that: Each record in the blocking bucket includes a five-tuple hash value, a rule hit number, a source IP address of a matching message, and an earliest historical hit time; wherein the five-tuple hash value is obtained by performing a hash operation on the five-tuple in the matching message; the five-tuple includes the source IP address, source port number, destination IP address, destination port number, and protocol number of the matching message.

10. The method according to claim 1, characterized in that The constructing a blocking message based on the session message includes: Based on the sequence number seq and the confirmation number ack of the session message, construct the TCP header of the blocking message; Constructing an IP header of the blocking message based on the source IP address and the destination IP address of the session message; The physical address MAC of the switch is used as the destination MAC of the Ethernet header of the blocking message, and the source MAC or the destination MAC of the session message is used as the source MAC of the Ethernet header of the blocking message.

11. A bypass blocking device, characterized in that: The device includes: An acquisition module is used to acquire session messages during the process of establishing a Transmission Control Protocol TCP connection; A first determination module, used for determining a matching IP address and a matching port number of the session message based on a value of a confirmation flag bit and a value of a synchronization flag bit of the session message if the session message matches the blocking rule; A second determination module, configured to determine each to-be-matched record corresponding to the blocking rule in the blocking bucket based on the matching IP address and the matching port number of the session message; A matching module, used to match the five-tuple hash value in the session message with the five-tuple hash value in each record to be matched, and determine a target record that matches successfully; A blocking module is used to determine the need for blocking based on the hit rate of the target record hitting the blocking rule. To forge the current session connection state of the session message into a session connection established state, a blocking message is constructed based on the session message, so that the client or server terminates the TCP connection based on the blocking message.

12. An electronic device, characterized in that: include: processor; A memory for storing processor-executable instructions; wherein the processor implements the steps of the method according to any one of claims 1 to 10 by running the executable instructions.

13. A computer readable and writable storage medium having computer instructions stored thereon, characterized in that: When the instruction is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images