WO2016101870A1 - 网络攻击分析方法和装置 - Google Patents

网络攻击分析方法和装置 Download PDF

Info

Publication number
WO2016101870A1
WO2016101870A1 PCT/CN2015/098282 CN2015098282W WO2016101870A1 WO 2016101870 A1 WO2016101870 A1 WO 2016101870A1 CN 2015098282 W CN2015098282 W CN 2015098282W WO 2016101870 A1 WO2016101870 A1 WO 2016101870A1
Authority
WO
WIPO (PCT)
Prior art keywords
mac address
network attack
network
protocol
protocol packet
Prior art date
Application number
PCT/CN2015/098282
Other languages
English (en)
French (fr)
Inventor
杨钊
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016101870A1 publication Critical patent/WO2016101870A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • This application relates to, but is not limited to, the field of data communication technology.
  • Network devices are mostly divided into a forwarding plane and a control plane.
  • the forwarding plane is responsible for forwarding data traffic, mainly based on hardware forwarding.
  • the control plane is responsible for the processing and business interaction of various protocol packets, mainly based on the software platform.
  • the attacks on network devices are mainly denial-of-service attacks, that is, DoS (Deny of Service) attacks.
  • DoS Densy of Service
  • the principle of a denial-of-service attack is to increase the CPU load of the control plane processing service of the device by sending packets of large data traffic to the device. This prevents the network device from responding to normal service requests and may even cause the device to hang.
  • DoS Denial of Service
  • the analysis of the attack behavior and the location of the attack source by the network device of the related art are mostly performed by a control plane or software.
  • the control plane determines whether the device encounters an attack and performs monitoring analysis through the load of the CPU or whether the service module of the control plane processes abnormality.
  • the disadvantage is that when the network module causes the service module of the control plane to be paralyzed, the service information of the control plane can no longer be used to analyze and locate the attack behavior, and the monitoring behavior also increases the load of the control plane CPU.
  • This paper provides a network attack analysis method and device, which can solve the problem that the related network attack analysis technology can no longer use the control plane to analyze the network attack when the network attack leads to the control plane. Problems.
  • a method for analyzing network attacks including:
  • the step of counting, in the data forwarding plane, the number of network attack protocol packets currently received by the network device includes:
  • the data forwarding plane statistics the network attack protocol packet currently received by the network device and corresponding to the MAC address of the protocol packet.
  • the step of determining, according to the number of currently received network attack protocol packets, whether the network device encounters a network attack includes:
  • the method before the statistics of the number of network attack protocol packets currently received by the network device, the method further includes:
  • the network device After receiving the protocol packet, the network device determines, on the data forwarding plane, whether the MAC address of the protocol packet needs to be learned, and if yes, learns the MAC address of the protocol packet, and if not, updates the MAC address. The aging time of the corresponding entry in the address table.
  • the step of counting, by the data forwarding plane, the number of network attack protocol packets that are currently received by the network device and corresponding to the protocol packet MAC address includes:
  • the step of determining, according to the currently received number of network attack protocol packets corresponding to the protocol packet MAC address, whether the network device encounters a network attack includes:
  • determining, in the data forwarding plane, whether the MAC address of the protocol packet needs to be learned The steps of the address include:
  • the data forwarding plane finds a matching entry in the MAC address according to the MAC address, the VLAN ID, and the port number of the protocol packet, determining that the MAC address of the protocol packet is not required to be learned;
  • the data forwarding plane When the data forwarding plane does not find a matching entry in the MAC address table according to the MAC address, the VLAN ID, and the port number of the protocol packet, it is determined that the MAC address of the protocol packet needs to be learned;
  • the entry in the MAC address table includes: a MAC address, a VLAN ID, a port number, and a network attack protocol packet count corresponding to the MAC address;
  • the step of learning the MAC address of the protocol packet includes: creating an entry in the MAC address table;
  • the step of updating the network attack protocol packet corresponding to the MAC address in the data forwarding plane includes:
  • the step of determining, according to the network attack protocol packet count corresponding to the MAC address, whether the network device encounters a network attack includes:
  • the method further includes:
  • the network attack protocol packet includes at least one of an ARP packet, a DHCP packet, an IGMP packet, and a customized protocol packet.
  • a network attack analysis device includes: a statistics module and a judgment module;
  • the statistic module is configured to: categorize the network currently received by the network device in the data forwarding plane. Number of attack protocol packets;
  • the determining module is configured to: determine, according to the number of currently received network attack protocol packets, whether the network device encounters a network attack.
  • the statistic module is configured to: when the protocol packet currently received by the network device is a network attack protocol packet, the data forwarding plane currently receives the protocol report currently received by the network device. Number of network attack protocol packets corresponding to the MAC address;
  • the determining module is configured to: determine, according to the currently received number of network attack protocol packets corresponding to the protocol message MAC address, whether the network device encounters a network attack.
  • the device further includes: a learning module
  • the learning module is configured to: after the statistics module receives the number of network attack protocol packets currently received by the network device, after the network device receives the protocol packet, determine, on the data forwarding plane, whether the learning The MAC address of the protocol packet, if yes, learns the MAC address of the protocol packet. If not, the aging time of the corresponding entry in the MAC address table is updated.
  • the learning module is set to:
  • the data forwarding plane finds a matching entry in the MAC address according to the MAC address, the VLAN ID, and the port number of the protocol packet, it is determined that the MAC address of the protocol packet is not required to be learned, and the MAC address table is updated.
  • the data forwarding plane When the data forwarding plane does not find a matching entry in the MAC address table according to the MAC address, the VLAN ID, and the port number of the protocol packet, it is determined that the MAC address of the protocol packet needs to be learned, where the MAC address is Create an entry in the table;
  • the entry in the MAC address table includes: a MAC address, a VLAN ID, a port number, and a network attack protocol packet count corresponding to the MAC address;
  • the statistic module is configured to: in the data forwarding plane, update a network attack protocol packet count in an entry corresponding to the MAC address in the MAC address table;
  • the determining module is configured to: determine whether the network attack protocol packet count corresponding to the MAC address in the MAC address table is greater than a first preset threshold, and if yes, determine that the network device encounters a network attack.
  • the determining module is further configured to:
  • a computer readable storage medium storing computer executable instructions for performing the method of any of the above.
  • the embodiment of the present invention provides a network attack analysis method and device.
  • the network attack analysis method in the embodiment of the present invention includes: counting the number of network attack protocol packets currently received by the network device in the data forwarding plane; The number of the network attack protocol packets is determined to determine whether the network device encounters a network attack.
  • the network attack analysis method in the embodiment of the present invention can analyze the network attack on the data forwarding plane to determine whether the network device encounters a network attack.
  • the data forwarding plane is based on the hardware of the network device, and the data forwarding plane does not smash during the network attack, and the network attack can be monitored all the time, and the related technology cannot analyze the network attack when the control plane is in the control plane.
  • the method of the embodiment of the present invention is applied.
  • a potential network attack can be analyzed, so that the network device can perform corresponding network attack processing, for example, issuing an alarm to notify the control plane to perform network attack processing, thereby effectively reducing the load on the control plane and the risk of being attacked.
  • FIG. 1 is a schematic flowchart of a first network attack analysis method according to Embodiment 1 of the present invention
  • FIG. 2 is a schematic flowchart of a second network attack analysis method according to Embodiment 1 of the present invention.
  • FIG. 3 is a schematic diagram of a first MAC (Media Access Control) address entry according to Embodiment 1 of the present invention
  • FIG. 4 is a schematic flowchart of a third network attack analysis method according to Embodiment 1 of the present invention.
  • FIG. 5 is a schematic diagram of a second type of MAC address entry according to Embodiment 1 of the present invention.
  • FIG. 6 is a schematic diagram of a third MAC address entry according to Embodiment 1 of the present invention.
  • FIG. 7 is a schematic structural diagram of a network attack analysis apparatus according to Embodiment 2 of the present invention.
  • FIG. 8 is a schematic structural diagram of another network attack analysis apparatus according to Embodiment 2 of the present invention.
  • Embodiment 1 is a diagrammatic representation of Embodiment 1:
  • this embodiment provides a network attack analysis method, as shown in FIG. 1 , including the following steps:
  • Step 101 Count the number of network attack protocol packets currently received by the network device in the data forwarding plane.
  • the network attack protocol packet in this step refers to the protocol packet used for the network attack, and may include, for example, an ARP (Address Resolution Protocol) packet and a DHCP (Dynamic Host Configuration Protocol). At least one of a packet, an IGMP (Internet Group Management Protocol) packet, and a customized protocol packet.
  • the number of the protocol packets, such as the ICMP (Internet Control Message Protocol) packet, and the routing protocol packet can be customized according to the requirements of the network environment and the user.
  • This step is a statistical process, which can count the number of network attack protocol packets received by the current network device, for example, the number of ARP packets and DHCP packets received by the current network device.
  • Step 102 Determine, according to the number of currently received network attack protocol packets, whether the network device encounters a network attack.
  • the network device can determine whether the network device is in a network attack according to the number of ARP packets and DHCP packets received by the network device. If the number of ARP packets or DHCP packets is greater than a preset threshold, the network device can be determined. Encountered a network attack.
  • the network attack analysis method in this embodiment can analyze the network attack on the data forwarding plane to determine whether the network device encounters a network attack. Since the data forwarding plane is based on the hardware of the network device, the data forwarding plane does not smash during the network attack. Can always monitor network attacks and avoid The related technology can not analyze the network attack when the control plane is in use; the method of the embodiment can be used to analyze the potential network attack, so that the network device can perform corresponding network attack processing, for example, sending an alarm to notify the control plane to perform a network attack. Processing effectively reduces the load on the control plane and the risk of being attacked.
  • the network attack analysis method in this embodiment may include the following steps:
  • Step 201 When the protocol packet currently received by the network device is a network attack protocol packet, the network forwarding protocol report corresponding to the MAC address of the protocol packet currently received by the network device is counted in the data forwarding plane. The number of texts.
  • the protocol packet is a network attack protocol packet.
  • the protocol type of the protocol packet is the same as the protocol type of the network attack protocol packet.
  • Step 202 Determine, according to the currently received number of network attack protocol packets corresponding to the protocol message MAC address, whether the network device encounters a network attack.
  • the network device determines whether the protocol packet is a network attack protocol packet. If yes, the data forwarding plane collects the current network device to receive the source MAC address as a. The number of network attack protocol packets (the number includes the sum of the number of network attack protocol packets whose source MAC address is a and the number of network attack protocol packets whose source MAC address is a). If the number is greater than the preset threshold, the network device may be determined to be in a network attack. If the number is less than or equal to the preset threshold, the network device may be determined to encounter a network attack.
  • the method in this embodiment may further include a process of MAC address learning before step 201, including:
  • the network device After receiving the protocol packet, the network device determines, on the data forwarding plane, whether the MAC address of the protocol packet needs to be learned, and if yes, learns the MAC address of the protocol packet, and if not, updates the MAC address. The aging time of the corresponding entry in the address table.
  • the device receives the MAC address learning process and learns the source MAC address of the packet so that the packet can be forwarded normally.
  • the source MAC address of the packet the Virtual Local Area Network Identification (VLAN ID), and the port number are searched for. If found, Update the aging time of the MAC address; if it is not found, add a new entry. When the aging time is reduced to 0, the MAC address entry is automatically deleted.
  • the MAC address entries of the switch are used.
  • the MAC address is used by the switch to forward data packets.
  • the main entries include: MAC address, VLAN ID, port number, and aging time.
  • the VLAN ID is a label used by IEEE 802.1Q to distinguish Ethernet broadcast domains.
  • the method in this embodiment may be used to count the number of the network attack protocol.
  • the foregoing step 201 may include: updating, by the data forwarding plane, a network attack protocol packet corresponding to the MAC address;
  • the method includes: determining, according to the counting, whether the network device encounters a network attack.
  • the method can update the number of the network attack protocol packets when receiving the network attack protocol packet, so that the current count value is the total number of network attack protocol packets received by the current network device.
  • the method in this embodiment can count the number of network attack protocol packets with different MAC addresses, such as the total number of ARP packets with the MAC address being 1 and the total number of ARP packets with the MAC address being 2.
  • the network attack method in this embodiment includes the following steps:
  • Step 401 After receiving the protocol packet, the network device obtains the MAC address, the VLAN ID, and the port number of the protocol packet.
  • Step 402 Find a matching entry in the MAC address according to the MAC address, the VLAN ID, and the port number of the protocol packet.
  • the entries in the MAC address table in this step include: a MAC address, a VLAN ID, a port number, and a network attack protocol packet count corresponding to the MAC address. That is, a field is added to the existing MAC address table, and a field is added to store the number of the network attack protocol packets. As shown in FIG. 5, the ARP packet count, the DHCP packet count, the IGMP packet count, and the customized protocol are added to the entry of the MAC address entry shown in FIG. Message count.
  • Step 403 Determine whether a matching entry is found. If not, execute step 404; if yes, execute step 405.
  • Step 404 Create an entry in the MAC address table, and go to step 406.
  • Step 405 Update the aging time of the entry corresponding to the protocol packet MAC in the MAC address table, and go to step 406.
  • Step 406 Determine whether the protocol packet is a network protocol packet. If yes, go to step 407. If no, go to step 410.
  • Step 407 Update the network attack protocol packet count in the entry corresponding to the MAC address in the MAC address table in the data forwarding plane.
  • Step 408 Determine whether the network attack protocol packet count corresponding to the MAC address in the MAC address table is greater than a first preset threshold. If yes, go to step 409. If no, go to step 410.
  • Step 409 Determine that the network device encounters a network attack and ends.
  • Step 410 Perform a normal service processing process, receive the next protocol packet, and return to step 401.
  • the method further includes: determining whether there is a network corresponding to the port number in the MAC address table. The sum of the attack protocol packet counts is greater than a second preset threshold, and if so, the network device is determined to be in a network attack. That is, when a network attack protocol packet under a port exceeds a certain threshold, it can be determined that the network device encounters a network attack.
  • the network device may perform abnormal processing, for example, generating an alarm signal to notify the control plane to perform corresponding processing.
  • the switch function unit may be further configured to perform the network attack analysis method of the embodiment when the system is turned on, and perform a normal service flow when the system is shut down.
  • the value of the protocol packet is set to the ICMP packet type.
  • the ARP, DHCP, IGMP packets, and ICMP packets are counted in the 20s.
  • the alarm threshold is set to 10000.
  • the device receives the MAC address of 0000.1234.1234 and the vlan id is 100.
  • the packet type is ARP request packet.
  • the device adds the corresponding entry in the MAC address table, as shown in Figure 6. It is 0000.1234.1234, the vlan id is 100, the port number is 10, and the aging time is System settings (for example, 300s), and update the protocol packet count, adding 1 to the ARP packet count.
  • the access switch When the access switch receives the same packet again, it searches for the MAC address table. Because the corresponding MAC address entry already exists, the aging time in the MAC address table is updated, and the ARP packet count is increased.
  • the attack source spoofs 1000 MAC addresses to send ARP attack packets.
  • the device receives the MAC address table and monitors the MAC address table. When a port is found in the MAC address table (port 10), there are a large number of MAC address ARP reports. When the number is counted and the count is significantly higher than the normal traffic, the network can be regarded as abnormal. The alarm is generated on the device to notify the control plane.
  • the data forwarding plane analyzes, locates, and monitors the network behavior through hardware, and reports the network anomaly and the suspected attack behavior, and effectively reduces the load on the control plane and the risk of being attacked.
  • Embodiment 2 is a diagrammatic representation of Embodiment 1:
  • this embodiment provides a network attack analysis apparatus, including: a statistics module 71 and a determination module 72;
  • the statistics module 71 is configured to: count, in the data forwarding plane, the number of network attack protocol packets currently received by the network device;
  • the determining module 72 is configured to: determine, according to the number of currently received network attack protocol packets, whether the network device encounters a network attack.
  • the statistic module 71 is configured to: when the protocol packet currently received by the network device is a network attack protocol packet, the data forwarding plane currently receives the protocol and the protocol currently received by the network device. Number of network attack protocol packets corresponding to the MAC address of the packet;
  • the determining module 72 is configured to: according to the currently received and the protocol message The number of network attack protocol packets corresponding to the MAC address determines whether the network device encounters a network attack.
  • FIG. 8 may further include a learning module 73;
  • the learning module 73 is configured to: before the statistics module 71 counts the number of network attack protocol packets currently received by the network device, after the network device receives the protocol packet, determine whether the data forwarding plane needs to learn after the network device receives the protocol packet. The MAC address of the protocol packet, if yes, learns the MAC address of the protocol packet, and if not, updates the aging time of the corresponding entry in the MAC address table.
  • the learning module 73 is configured to:
  • the data forwarding plane finds a matching entry in the MAC address according to the MAC address, the VLAN ID, and the port number of the protocol packet, it is determined that the MAC address of the protocol packet is not required to be learned, and the MAC address table is updated.
  • the data forwarding plane When the data forwarding plane does not find a matching entry in the MAC address table according to the MAC address, the VLAN ID, and the port number of the protocol packet, it is determined that the MAC address of the protocol packet needs to be learned, where the MAC address is Create an entry in the table;
  • the entry in the MAC address table includes: a MAC address, a VLAN ID, a port number, and a network attack protocol packet count corresponding to the MAC address;
  • the statistic module 71 is configured to: in the data forwarding plane, update a network attack protocol packet count in an entry corresponding to the MAC address in the MAC address table;
  • the determining module 72 is configured to: determine whether the network attack protocol packet count corresponding to the MAC address in the MAC address table is greater than a first preset threshold, and if yes, determine that the network device encounters a network attack .
  • the determining module 72 is further configured to:
  • the network attack analysis apparatus of this embodiment can divide the network attack on the data forwarding plane. Analysis, determine whether the network device encounters a network attack. Since the data forwarding plane is based on the hardware of the network device, the data forwarding plane will not be paralyzed during the network attack, and the network attack can be monitored all the time, thereby avoiding the related technology being unable to control the plane. Analysis of the network attack; the device of the embodiment can be used to analyze the potential network attack, so that the network device can perform corresponding network attack processing, for example, sending an alarm to notify the control plane to perform network attack processing, thereby effectively reducing the load on the control plane. And the risk of being attacked.
  • all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve.
  • the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
  • the device/function module/functional unit in the above embodiment When the device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
  • the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
  • the network attack can be analyzed on the data forwarding plane to determine whether the network device encounters a network attack. Since the data forwarding plane is based on the hardware of the network device, the data forwarding plane does not smash during the network attack. The network attack is always monitored, and the related technology cannot be analyzed in the control plane.
  • the application of the embodiment of the present invention can analyze the potential network attack, so that the network device can perform corresponding network attack processing, for example, issuing an alarm notification control.
  • the network performs network attack processing, which effectively reduces the load on the control plane and the risk of being attacked.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种网络攻击分析方法和装置，所述网络攻击分析方法包括：在数据转发平面统计网络设备当前接收到的网络攻击协议报文的数量；根据所述当前接收到的网络攻击协议报文的数量判断所述网络设备是否遇到网络攻击。

Description

网络攻击分析方法和装置 技术领域
本申请涉及但不限于数据通信技术领域。
背景技术
随着网络技术的发展，网络环境越来越复杂，网络中的流量和报文类型越来越多，大流量协议报文和各种网络攻击对网络的性能会造成巨大影响。因此，对网络攻击和异常的快速定位分析变得十分困难。
网络设备大都分为转发平面和控制平面。转发平面负责数据流量的转发，主要基于硬件转发。控制平面负责各种协议报文的处理和业务交互，主要基于软件平台。已有对网络设备的攻击手段主要是拒绝服务型攻击，即DoS(Deny of Service)攻击。拒绝服务型攻击的原理是通过向设备发送大数据流量的报文攻击，使得设备的控制平面处理业务的CPU负载增高，从而使网络设备不能对正常服务请求进行相应，甚至会导致设备挂起，严重影响网络的正常运行。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
相关技术的网络设备对于攻击行为的分析和攻击源的定位多是通过控制平面或软件来完成的。控制平面通过CPU的负载或控制平面的业务模块处理是否异常来判断设备是否遇到攻击并进行监控分析。缺点在于当网络攻击导致控制平面的业务模块瘫痪时，无法再利用控制平面的业务信息对攻击行为进行分析定位，同时监控行为也会增加控制平面CPU的负载。
本文提供一种网络攻击分析方法和装置，能够解决相关网络攻击分析技术在网络攻击导致控制平面瘫痪时无法再利用控制平面对网络攻击分析的技 术问题。
一种网络攻击分析方法，包括：
在数据转发平面统计网络设备当前接收到的网络攻击协议报文的数量；
根据所述当前接收到的网络攻击协议报文的数量判断所述网络设备是否遇到网络攻击。
可选地，所述在数据转发平面统计网络设备当前接收到的网络攻击协议报文的数量的步骤包括：
当所述网络设备当前接收到的协议报文为网络攻击协议报文时，在所述数据转发平面统计网络设备当前接收到的与所述协议报文的MAC地址对应的网络攻击协议报文的数量；
所述根据所述当前接收到的网络攻击协议报文的数量判断所述网络设备是否遇到网络攻击的步骤包括:
根据所述当前接收到的与所述协议报文MAC地址对应的网络攻击协议报文的数量判断所述网络设备是否遇到网络攻击。
可选地，统计网络设备当前接收到的网络攻击协议报文的数量之前，所述方法还包括：
在所述网络设备接收到协议报文之后，在所述数据转发平面判断是否需要学习所述协议报文的MAC地址，若是，则学习所述协议报文的MAC地址，若否，则更新MAC地址表中对应表项的老化时间。
可选地，在所述数据转发平面统计网络设备当前接收到的与所述协议报文MAC地址对应的网络攻击协议报文的数量的步骤包括：
在所述数据转发平面更新与所述MAC地址对应的网络攻击协议报文的计数；
所述根据所述当前接收到的与所述协议报文MAC地址对应的网络攻击协议报文的数量判断所述网络设备是否遇到网络攻击的步骤包括：
根据所述计数判断所述网络设备是否遇到网络攻击。
可选地，在所述数据转发平面判断是否需要学习所述协议报文的MAC 地址的步骤包括：
当在所述数据转发平面根据协议报文的MAC地址、VLAN ID和端口号在MAC地址中查找到匹配的表项时，判定不需要学习所述协议报文的MAC地址；
当所述数据转发平面根据协议报文的MAC地址、VLAN ID和端口号在MAC地址表中查找不到匹配的表项时，判定需要学习所述协议报文的MAC地址；
所述MAC地址表中的表项包括：MAC地址、VLAN ID、端口号、和与MAC地址对应的网络攻击协议报文计数；
所述学习所述协议报文的MAC地址的步骤包括：在所述MAC地址表中创建一个表项；
在所述数据转发平面更新与所述MAC地址对应的网络攻击协议报文计数的步骤包括：
在所述数据转发平面更新所述MAC地址表中与所述MAC地址对应的表项中网络攻击协议报文计数；
根据与所述MAC地址对应的网络攻击协议报文计数判断所述网络设备是否遇到网络攻击的步骤包括：
判断在MAC地址表中与所述MAC地址对应表项的网络攻击协议报文计数是否大于第一预设阈值，若是，则判定所述网络设备遇到网络攻击。
可选地，当判断在MAC地址表中与所述MAC地址对应的网络攻击协议报文计数是不大于第一预设阈值时，所述方法还包括：
判断在MAC地址表中是否有端口号对应的网络攻击协议报文计数之和大于第二预设阈值，若是，判定所述网络设备遇到网络攻击。
可选地，所述网络攻击协议报文包括：ARP报文、DHCP报文、IGMP报文和自定义的协议报文中的至少一种。
一种网络攻击分析装置，包括：统计模块和判断模块；
所述统计模块设置为：在数据转发平面统计网络设备当前接收到的网络 攻击协议报文的数量；
所述判断模块设置为：根据所述当前接收到的网络攻击协议报文的数量判断所述网络设备是否遇到网络攻击。
可选地，所述统计模块是设置为：当所述网络设备当前接收到的协议报文为网络攻击协议报文时，在所述数据转发平面统计网络设备当前接收到的与所述协议报文MAC地址对应的网络攻击协议报文的数量；
所述判断模块是设置为：根据所述当前接收到的与所述协议报文MAC地址对应的网络攻击协议报文的数量判断所述网络设备是否遇到网络攻击。
可选地，所述装置，还包括：学习模块；
所述学习模块设置为：在统计模块统计网络设备当前接收到的网络攻击协议报文的数量之前，在所述网络设备接收到协议报文之后，在所述数据转发平面判断是否需要学习所述协议报文的MAC地址，若是，则学习所述协议报文的MAC地址，若否，则更新MAC地址表中对应表项的老化时间。
可选地，所述学习模块是设置为：
当在所述数据转发平面根据协议报文的MAC地址、VLAN ID和端口号在MAC地址中查找到匹配的表项时，判定不需要学习所述协议报文的MAC地址，更新MAC地址表中对应表项的老化时间；
当所述数据转发平面根据协议报文的MAC地址、VLAN ID和端口号在MAC地址表中查找不到匹配的表项时，判定需要学习所述协议报文的MAC地址，在所述MAC地址表中创建一个表项；
所述MAC地址表中的表项包括：MAC地址、VLAN ID、端口号、和与MAC地址对应的网络攻击协议报文计数；
所述统计模块是设置为：在所述数据转发平面更新所述MAC地址表中与所述MAC地址对应的表项中网络攻击协议报文计数；
所述判断模块是设置为：判断在MAC地址表中与所述MAC地址对应表项的网络攻击协议报文计数是否大于第一预设阈值，若是，则判定所述网络设备遇到网络攻击。
可选地，所述判断模块还设置为：
当判断在MAC地址表中与所述MAC地址对应的网络攻击协议报文计数是不大于第一预设阈值时，判断在MAC地址表中是否有端口号对应的网络攻击协议报文计数之和大于第二预设阈值，若是，判定所述网络设备遇到网络攻击。
一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行上述任一项的方法。
本发明实施例提供了一种网络攻击分析方法和装置，本发明实施例的网络攻击分析方法包括：在数据转发平面统计网络设备当前接收到的网络攻击协议报文的数量；根据所述当前接收到的网络攻击协议报文的数量判断所述网络设备是否遇到网络攻击；本发明实施例的网络攻击分析方法可以在数据转发平面对网络攻击进行分析，判断网络设备是否遇到网络攻击，由于数据转发平面是基于网络设备的硬件的，数据转发平面在网络攻击时不会瘫痪，可以一直监控网络攻击，避免了相关技术在控制平面瘫痪时无法对网络攻击分析；应用本发明实施例的方法可以分析出潜在的网络攻击，这样网络设备就可以进行相应的网络攻击处理，例如发出告警通知控制平面进行网络攻击处理，有效的降低了控制平面的负载和遭受攻击的风险。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
图1为本发明实施例一提供的第一种网络攻击分析方法的流程示意图；
图2为本发明实施例一提供的第二种网络攻击分析方法的流程示意图；
图3为本发明实施例一提供的第一种MAC(媒介访问控制，Media Access Control)地址表项的示意图；
图4为本发明实施例一提供的第三种网络攻击分析方法的流程示意图；
图5为本发明实施例一提供的第二种MAC地址表项的示意图；
图6为本发明实施例一提供的第三种MAC地址表项的示意图；
图7为本发明实施例二提供的一种网络攻击分析装置的结构示意图；
图8为本发明实施例二提供的另一种网络攻击分析装置的结构示意图。
本发明的实施方式
下面结合附图对本发明的实施方式进行说明。
实施例一：
考虑到相关技术网络攻击分析技术在网络攻击导致控制平面瘫痪时无法再利用控制平面对网络攻击分析，本实施例提供了一种网络攻击分析方法，如图1所示，包括如下步骤：
步骤101：在数据转发平面统计网络设备当前接收到的网络攻击协议报文的数量。
本步骤中网络攻击协议报文指的是：用于网络攻击的协议报文，例如可以包括：ARP(Address Resolution Protocol，地址解析协议)报文、DHCP(Dynamic Host Configuration Protocol，动态主机配置协议)报文、IGMP(Internet Group Management Protocol，网际组管理协议)报文和自定义的协议报文中的至少一种。其中自定义协议报文可以根据网络环境和用户的需要自定义需要统计的协议报文的数量，如ICMP(Internet Control Message Protocol，网际控制报文协议)报文,路由协议报文等。
本步骤是一个统计过程，其可以统计当前网络设备接收到的网络攻击协议报文的数量，例如统计当前网络设备接收到ARP报文、DHCP报文的数量。
步骤102：根据所述当前接收到的网络攻击协议报文的数量判断所述网络设备是否遇到网络攻击。
例如可以根据网络设备接收到ARP报文、DHCP报文的数量判断所述网络设备是否遇到网络攻击，此时若ARP报文或者DHCP报文的数量大于预设阈值时，即可判定网络设备遇到网络攻击。
本实施例的网络攻击分析方法可以在数据转发平面对网络攻击进行分析，判断网络设备是否遇到网络攻击，由于数据转发平面是基于网络设备的硬件的，数据转发平面在网络攻击时不会瘫痪，可以一直监控网络攻击，避 免了相关技术在控制平面瘫痪时无法对网络攻击分析；应用本实施例的方法可以分析出潜在的网络攻击，这样网络设备就可以进行相应的网络攻击处理，例如发出告警通知控制平面进行网络攻击处理，有效的降低了控制平面的负载和遭受攻击的风险。
如图2所示，本实施例的网络攻击分析方法，可以包括如下步骤：
步骤201：当所述网络设备当前接收到的协议报文为网络攻击协议报文时，在所述数据转发平面统计网络设备当前接收到的与所述协议报文MAC地址对应的网络攻击协议报文的数量。
本步骤中协议报文为网络攻击协议报文指的是：协议报文的协议类型与网络攻击协议报文的协议类型相同。
步骤202：根据所述当前接收到的与所述协议报文MAC地址对应的网络攻击协议报文的数量判断所述网络设备是否遇到网络攻击。
例如，网络设备接收到一个源MAC地址为a的协议报文后，判断该协议报文是否为网络攻击协议报文，若是，则在数据转发平面统计当前网络设备接收到源MAC地址为a的网络攻击协议报文的数量(该数量包括：网络设备之前接收到源MAC地址为a的网络攻击协议报文数量与当前源MAC地址为a的网络攻击协议报文数量之和)；此时，若数量大于预设阈值时，则可以判定所述网络设备遇到网络攻击，若数量小于等于预设阈值时，则可以判断网络设备遇到网络攻击。
本实施例方法在步骤201之前还可以包括一个MAC地址学习的过程，包括：
在所述网络设备接收到协议报文之后，在所述数据转发平面判断是否需要学习所述协议报文的MAC地址，若是，则学习所述协议报文的MAC地址，若否，则更新MAC地址表中对应表项的老化时间。
对于接入交换机等网络设备，设备收到网络报文均会先进行MAC地址学习过程，学习报文的源MAC地址使得报文可以正常转发。学习过程中，先根据报文的源MAC地址，VLAN ID(Virtual Local Area Network Identification，虚拟局域网标识)和端口号为索引进行查找，如果查找到，则 更新MAC地址的老化时间；如果没有查找到，则添加新的表项。MAC地址表项在老化时间减少到0时，则自动删除此表项。如图3所示为一般交换机的MAC地址表项，MAC地址用于交换机进行数据报文的转发，主要条目包括：MAC地址、VLAN ID、端口号和老化时间。VLAN ID为IEEE802.1Q用来区分以太网广播域的标签。
可选地，本实施例方法可以通过计数的方式来统计数量，上述步骤201可以包括：在所述数据转发平面更新与所述MAC地址对应的网络攻击协议报文的计数；此时步骤202可以包括：根据所述计数判断所述网络设备是否遇到网络攻击。
例如当前接收到的ARP报文时，若之前对该协议报文的计数为0时，则此时计数加1。
本实施例方法可以每次在接收到网络攻击协议报文时更新对该网络攻击协议报文的计数，这样当前计数值即为当前网络设备接收到网络攻击协议报文的总数量。本实施例方法可以统计是不同MAC地址的网络攻击协议报文的数量，例如MAC地址为1的ARP协议报文的总数量，MAC地址为2的ARP协议报文的总数量。
如图4所述，本实施例的网络攻击方法包括，如下步骤：
步骤401：在网络设备接收协议报文之后，获取所述协议报文的MAC地址、VLAN ID和端口号。
步骤402：根据协议报文的MAC地址、VLAN ID和端口号在MAC地址中查找匹配的表项。
本步骤中的MAC地址表中的表项包括：MAC地址、VLAN ID、端口号、和与MAC地址对应的网络攻击协议报文计数。即对已有的MAC地址表添加字段，添加字段用于存放对网络攻击协议报文的计数。如图5所示，对图3所示的MAC地址表项修改后的表项，在图3表项中扩展添加了ARP报文计数、DHCP报文计数、IGMP报文计数和自定义的协议报文计数。
步骤403：判断是否查找到匹配的表项，若否，则执行步骤404；若是，则执行步骤405。
步骤404：在所述MAC地址表中创建一个表项，转步骤406。
步骤405：更新MAC地址表中与协议报文MAC对应的表项的老化时间，转步骤406。
步骤406：判断所述协议报文是否为网络协议报文，若是，则执行步骤407，若否，则执行步骤410。
步骤407：在所述数据转发平面更新所述MAC地址表中与所述MAC地址对应的表项中网络攻击协议报文计数。
步骤408：判断在MAC地址表中与所述MAC地址对应表项的网络攻击协议报文计数是否大于第一预设阈值，若是，则执行步骤409，若否，则执行步骤410。
步骤409：判定所述网络设备遇到网络攻击，结束。
步骤410：进行正常业务处理流程，接收下一个协议报文，返回步骤401。
考虑到对于特定攻击源伪装多个MAC地址进行DoS攻击的应用场景，本实施例在步骤408判定为否的情况下，还进一步地还包括：判断在MAC地址表中是否有端口号对应的网络攻击协议报文计数之和大于第二预设阈值，若是，判定所述网络设备遇到网络攻击。即当一个端口下的网络攻击协议报文超过一定阈值时，就可以判定网络设备遇到网络攻击。
在本实施例判定网络设备遇到网络攻击之后，还可以进行网络设备异常处理，例如产生告警信号通知控制平面进行相应的处理。
在本实施例中还可以设置开关功能单元用于在开启时，执行本实施例的网络攻击分析方法，在关闭时，执行正常的业务流程。
下面以交互机为例来说明本实施例的网络攻击分析方法：
自定义的协议报文类型设置为ICMP报文类型，统计20s内ARP、DHCP、IGMP报文和设置的ICMP报文计数，告警门限值设置为10000。
设备第一次从端口10收到MAC地址为0000.1234.1234，vlan id为100，报文类型为ARP请求报文，会在MAC地址表里添加相应的表项，如图6所示，MAC地址为0000.1234.1234，vlan id为100，端口号为10，老化时间为 系统设定(例如300s)，并更新协议报文计数，在ARP报文计数里加1。
当接入交换机后续再次收到同样的报文时，查找MAC地址表，由于已经存在相应的MAC地址表项，因此更新MAC地址表里的老化时间，并且增加ARP报文的计数。
假设此MAC地址的ARP请求报文以每秒1000个的速度攻击设备，当APR报文计数超过10000个时，查看MAC地址表项如图6所示，向设备控制平面发送告警信息等进行进一步处理。
此外，对于特定攻击源伪装多个MAC地址进行DoS攻击的应用场景，该方案同样可以适用。例如攻击源伪装1000个MAC地址发送ARP攻击报文，设备从端口10收到，通过对MAC地址表进行监控，当发现MAC地址表中一端口下(端口10)存在大量的MAC地址的ARP报文计数，且计数明显高于正常业务量时，同样可以视为网络异常，在设备上产生告警等通知控制平面进行处理。
本实施例方法在数据转发平面通过硬件对网络行为进行分析定位和监控，对网络异常和疑似攻击行为进行上报告警等处理，有效的降低了控制平面的负载和遭受攻击的风险。
实施例二：
如图7所示，本实施例提供了一种网络攻击分析装置，包括：统计模块71和判断模块72；
所述统计模块71设置为：在数据转发平面统计网络设备当前接收到的网络攻击协议报文的数量；
所述判断模块72设置为：根据所述当前接收到的网络攻击协议报文的数量判断所述网络设备是否遇到网络攻击。
可选地，所述统计模块71是设置为：当所述网络设备当前接收到的协议报文为网络攻击协议报文时，在所述数据转发平面统计网络设备当前接收到的与所述协议报文MAC地址对应的网络攻击协议报文的数量；
所述判断模块72是设置为：根据所述当前接收到的与所述协议报文 MAC地址对应的网络攻击协议报文的数量判断所述网络设备是否遇到网络攻击。
在上述装置的基础上，如图8所示，还可以包括学习模块73；
所述学习模块73设置为：在统计模块71统计网络设备当前接收到的网络攻击协议报文的数量之前，在所述网络设备接收到协议报文之后，在所述数据转发平面判断是否需要学习所述协议报文的MAC地址，若是，则学习所述协议报文的MAC地址，若否，则更新MAC地址表中对应表项的老化时间。
可选地，所述学习模块73是设置为：
当在所述数据转发平面根据协议报文的MAC地址、VLAN ID和端口号在MAC地址中查找到匹配的表项时，判定不需要学习所述协议报文的MAC地址，更新MAC地址表中对应表项的老化时间；
当所述数据转发平面根据协议报文的MAC地址、VLAN ID和端口号在MAC地址表中查找不到匹配的表项时，判定需要学习所述协议报文的MAC地址，在所述MAC地址表中创建一个表项；
所述MAC地址表中的表项包括：MAC地址、VLAN ID、端口号、和与MAC地址对应的网络攻击协议报文计数；
所述统计模块71是设置为：在所述数据转发平面更新所述MAC地址表中与所述MAC地址对应的表项中网络攻击协议报文计数；
所述判断模块72是设置为：判断在MAC地址表中与所述MAC地址对应表项的网络攻击协议报文计数是否大于第一预设阈值，若是，则判定所述网络设备遇到网络攻击。
可选地，所述判断模块72还设置为：
当判断在MAC地址表中与所述MAC地址对应的网络攻击协议报文计数是不大于第一预设阈值时，判断在MAC地址表中是否有端口号对应的网络攻击协议报文计数之和大于第二预设阈值，若是，判定所述网络设备遇到网络攻击。
本实施例的网络攻击分析装置可以在数据转发平面对网络攻击进行分 析，判断网络设备是否遇到网络攻击，由于数据转发平面是基于网络设备的硬件的，数据转发平面在网络攻击时不会瘫痪，可以一直监控网络攻击，避免了相关技术在控制平面瘫痪时无法对网络攻击分析；应用本实施例的装置可以分析出潜在的网络攻击，这样网络设备就可以进行相应的网络攻击处理，例如发出告警通知控制平面进行网络攻击处理，有效的降低了控制平面的负载和遭受攻击的风险。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计算机程序流程来实现，所述计算机程序可以存储于一计算机可读存储介质中，所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件等)执行，在执行时，包括方法实施例的步骤之一或其组合。
可选地，上述实施例的全部或部分步骤也可以使用集成电路来实现，这些步骤可以被分别制作成一个个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。
上述实施例中的装置/功能模块/功能单元可以采用通用的计算装置来实现，它们可以集中在单个的计算装置上，也可以分布在多个计算装置所组成的网络上。
上述实施例中的装置/功能模块/功能单元以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。上述提到的计算机可读取存储介质可以是只读存储器，磁盘或光盘等。
工业实用性
通过本发明实施例，可以在数据转发平面对网络攻击进行分析，判断网络设备是否遇到网络攻击，由于数据转发平面是基于网络设备的硬件的，数据转发平面在网络攻击时不会瘫痪，可以一直监控网络攻击，避免了相关技术在控制平面瘫痪时无法对网络攻击分析；应用本发明实施例可以分析出潜在的网络攻击，这样网络设备就可以进行相应的网络攻击处理，例如发出告警通知控制平面进行网络攻击处理，有效的降低了控制平面的负载和遭受攻击的风险。

Claims (13)

  1. 一种网络攻击分析方法，包括：
    在数据转发平面统计网络设备当前接收到的网络攻击协议报文的数量；
    根据所述当前接收到的网络攻击协议报文的数量判断所述网络设备是否遇到网络攻击。
  2. 如权利要求1所述的方法，其中，所述在数据转发平面统计网络设备当前接收到的网络攻击协议报文的数量的步骤包括：
    当所述网络设备当前接收到的协议报文为网络攻击协议报文时，在所述数据转发平面统计网络设备当前接收到的与所述协议报文的媒介访问控制MAC地址对应的网络攻击协议报文的数量；
    所述根据所述当前接收到的网络攻击协议报文的数量判断所述网络设备是否遇到网络攻击的步骤包括:
    根据所述当前接收到的与所述协议报文MAC地址对应的网络攻击协议报文的数量判断所述网络设备是否遇到网络攻击。
  3. 如权利要求2所述的方法，其中，在统计网络设备当前接收到的网络攻击协议报文的数量之前，还包括：
    在所述网络设备接收到协议报文之后，在所述数据转发平面判断是否需要学习所述协议报文的MAC地址，若是，则学习所述协议报文的MAC地址，若否，则更新MAC地址表中对应表项的老化时间。
  4. 如权利要求3所述的方法，其中，在所述数据转发平面统计网络设备当前接收到的与所述协议报文MAC地址对应的网络攻击协议报文的数量的步骤包括：
    在所述数据转发平面更新与所述MAC地址对应的网络攻击协议报文的计数；
    所述根据所述当前接收到的与所述协议报文MAC地址对应的网络攻击协议报文的数量判断所述网络设备是否遇到网络攻击的步骤包括：
    根据所述计数判断所述网络设备是否遇到网络攻击。
  5. 如权利要求4所述的方法，其中，
    在所述数据转发平面判断是否需要学习所述协议报文的MAC地址的步骤包括：
    当在所述数据转发平面根据协议报文的MAC地址、虚拟局域网标识VLAN ID和端口号在MAC地址中查找到匹配的表项时，判定不需要学习所述协议报文的MAC地址；
    当所述数据转发平面根据协议报文的MAC地址、VLAN ID和端口号在MAC地址表中查找不到匹配的表项时，判定需要学习所述协议报文的MAC地址；
    所述MAC地址表中的表项包括：MAC地址、VLAN ID、端口号、和与MAC地址对应的网络攻击协议报文计数；
    所述学习所述协议报文的MAC地址的步骤包括：在所述MAC地址表中创建一个表项；
    在所述数据转发平面更新与所述MAC地址对应的网络攻击协议报文计数的步骤包括：
    在所述数据转发平面更新所述MAC地址表中与所述MAC地址对应的表项中网络攻击协议报文计数；
    根据与所述MAC地址对应的网络攻击协议报文计数判断所述网络设备是否遇到网络攻击的步骤包括：
    判断在MAC地址表中与所述MAC地址对应表项的网络攻击协议报文计数是否大于第一预设阈值，若是，则判定所述网络设备遇到网络攻击。
  6. 如权利要求5所述的方法，其中，当判断在MAC地址表中与所述MAC地址对应的网络攻击协议报文计数是不大于第一预设阈值时，还包括：
    判断在MAC地址表中是否有端口号对应的网络攻击协议报文计数之和大于第二预设阈值，若是，判定所述网络设备遇到网络攻击。
  7. 如权利要求1-6任一项所述的方法，其中，所述网络攻击协议报文包括：地址解析协议ARP报文、动态主机配置协议DHCP报文、网际组管理协 议IGMP报文和自定义的协议报文中的至少一种。
  8. 一种网络攻击分析装置，包括：统计模块和判断模块；
    所述统计模块设置为：在数据转发平面统计网络设备当前接收到的网络攻击协议报文的数量；
    所述判断模块设置为：根据所述当前接收到的网络攻击协议报文的数量判断所述网络设备是否遇到网络攻击。
  9. 如权利要求8所述的装置，其中，所述统计模块是设置为：当所述网络设备当前接收到的协议报文为网络攻击协议报文时，在所述数据转发平面统计网络设备当前接收到的与所述协议报文的MAC地址对应的网络攻击协议报文的数量；
    所述判断模块是设置为：根据所述当前接收到的与所述协议报文MAC地址对应的网络攻击协议报文的数量判断所述网络设备是否遇到网络攻击。
  10. 如权利要求9所述的装置，还包括：学习模块；
    所述学习模块设置为：在统计模块统计网络设备当前接收到的网络攻击协议报文的数量之前，在所述网络设备接收到协议报文之后，在所述数据转发平面判断是否需要学习所述协议报文的MAC地址，若是，则学习所述协议报文的MAC地址，若否，则更新MAC地址表中对应表项的老化时间。
  11. 如权利要求10所述的装置，其中，所述学习模块是设置为：
    当在所述数据转发平面根据协议报文的MAC地址、VLAN ID和端口号在MAC地址中查找到匹配的表项时，判定不需要学习所述协议报文的MAC地址，更新MAC地址表中对应表项的老化时间；
    当所述数据转发平面根据协议报文的MAC地址、VLAN ID和端口号在MAC地址表中查找不到匹配的表项时，判定需要学习所述协议报文的MAC地址，在所述MAC地址表中创建一个表项；
    所述MAC地址表中的表项包括：MAC地址、VLAN ID、端口号、和与MAC地址对应的网络攻击协议报文计数；
    所述统计模块是设置为：在所述数据转发平面更新所述MAC地址表中与所述MAC地址对应的表项中网络攻击协议报文计数；
    所述判断模块是设置为：判断在MAC地址表中与所述MAC地址对应表项的网络攻击协议报文计数是否大于第一预设阈值，若是，则判定所述网络设备遇到网络攻击。
  12. 如权利要求11所述的装置，其中，所述判断模块还设置为：
    当判断在MAC地址表中与所述MAC地址对应的网络攻击协议报文计数是不大于第一预设阈值时，判断在MAC地址表中是否有端口号对应的网络攻击协议报文计数之和大于第二预设阈值，若是，判定所述网络设备遇到网络攻击。
  13. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求1-7任一项的方法。
PCT/CN2015/098282 2014-12-26 2015-12-22 网络攻击分析方法和装置 WO2016101870A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410829970.2 2014-12-26
CN201410829970.2A CN105791248A (zh) 2014-12-26 2014-12-26 网络攻击分析方法和装置

Publications (1)

Publication Number Publication Date
WO2016101870A1 true WO2016101870A1 (zh) 2016-06-30

Family

ID=56149277

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/098282 WO2016101870A1 (zh) 2014-12-26 2015-12-22 网络攻击分析方法和装置

Country Status (2)

Country Link
CN (1) CN105791248A (zh)
WO (1) WO2016101870A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111835735A (zh) * 2020-06-29 2020-10-27 新华三信息安全技术有限公司 一种防攻击方法、装置、设备及机器可读存储介质
CN112367313A (zh) * 2020-10-30 2021-02-12 新华三技术有限公司合肥分公司 一种报文防攻击方法及设备
CN113364722A (zh) * 2020-03-04 2021-09-07 阿里巴巴集团控股有限公司 网络安全防护方法和装置

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106911590B (zh) * 2017-03-15 2020-04-14 迈普通信技术股份有限公司 报文处理方法、装置及分布式设备
CN107241307B (zh) * 2017-04-26 2023-08-08 北京立思辰计算机技术有限公司 一种基于报文内容的自学习的网络隔离安全装置和方法
CN106982225B (zh) * 2017-04-28 2020-05-12 新华三技术有限公司 防攻击方法及装置
CN107086965B (zh) * 2017-06-01 2020-04-03 杭州迪普科技股份有限公司 一种arp表项的生成方法、装置及交换机
CN107547535B (zh) * 2017-08-24 2021-01-01 新华三技术有限公司 防攻击的mac地址学习方法、装置和网络设备
CN107483507B (zh) * 2017-09-30 2020-11-13 北京东土军悦科技有限公司 一种会话分析方法、设备及存储介质
CN110535861B (zh) 2019-08-30 2022-01-25 杭州迪普信息技术有限公司 一种识别syn攻击行为中统计syn包数量的方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1529462A (zh) * 2003-10-21 2004-09-15 中兴通讯股份有限公司 一种实现异常流量控制的装置及方法
CN101106518A (zh) * 2006-07-10 2008-01-16 中兴通讯股份有限公司 为中央处理器提供负载保护的拒绝服务方法
CN101640666A (zh) * 2008-08-01 2010-02-03 北京启明星辰信息技术股份有限公司 一种面向目标网络的流量控制装置及方法
CN101729389A (zh) * 2008-10-21 2010-06-09 北京启明星辰信息技术股份有限公司 基于流量预测和可信网络地址学习的流量控制装置和方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1529462A (zh) * 2003-10-21 2004-09-15 中兴通讯股份有限公司 一种实现异常流量控制的装置及方法
CN101106518A (zh) * 2006-07-10 2008-01-16 中兴通讯股份有限公司 为中央处理器提供负载保护的拒绝服务方法
CN101640666A (zh) * 2008-08-01 2010-02-03 北京启明星辰信息技术股份有限公司 一种面向目标网络的流量控制装置及方法
CN101729389A (zh) * 2008-10-21 2010-06-09 北京启明星辰信息技术股份有限公司 基于流量预测和可信网络地址学习的流量控制装置和方法

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113364722A (zh) * 2020-03-04 2021-09-07 阿里巴巴集团控股有限公司 网络安全防护方法和装置
CN113364722B (zh) * 2020-03-04 2023-04-25 阿里巴巴集团控股有限公司 网络安全防护方法和装置
CN111835735A (zh) * 2020-06-29 2020-10-27 新华三信息安全技术有限公司 一种防攻击方法、装置、设备及机器可读存储介质
CN111835735B (zh) * 2020-06-29 2023-12-29 新华三信息安全技术有限公司 一种防攻击方法、装置、设备及机器可读存储介质
CN112367313A (zh) * 2020-10-30 2021-02-12 新华三技术有限公司合肥分公司 一种报文防攻击方法及设备

Also Published As

Publication number Publication date
CN105791248A (zh) 2016-07-20

Similar Documents

Publication Publication Date Title
WO2016101870A1 (zh) 网络攻击分析方法和装置
US11502922B2 (en) Technologies for managing compromised sensors in virtualized environments
Tan et al. A new framework for DDoS attack detection and defense in SDN environment
JP6453976B2 (ja) ネットワークシステム、制御装置、通信制御方法および通信制御プログラム
JP6535809B2 (ja) 異常検出装置、異常検出システム、及び、異常検出方法
CN107683597B (zh) 用于异常检测的网络行为数据收集和分析
US9094288B1 (en) Automated discovery, attribution, analysis, and risk assessment of security threats
JP5050781B2 (ja) マルウエア検出装置、監視装置、マルウエア検出プログラム、およびマルウエア検出方法
US9521154B2 (en) Detecting suspicious network activity using flow sampling
US9246774B2 (en) Sample based determination of network policy violations
CN102487339A (zh) 一种网络设备攻击防范方法及装置
US20180248908A1 (en) Algorithmically detecting malicious packets in ddos attacks
CN103929334A (zh) 网络异常通知方法和装置
US20220239575A1 (en) Method and system for congestion detection and validation in a network
JP6675608B2 (ja) 異常検出装置、異常検出方法及び異常検出プログラム
US11863584B2 (en) Infection spread attack detection device, attack origin specification method, and program
CN106453367B (zh) 一种基于sdn的防地址扫描攻击的方法及系统
JP5752020B2 (ja) 攻撃対策装置、攻撃対策方法及び攻撃対策プログラム
CN113114588B (zh) 数据处理方法、装置、电子设备和存储介质
CN111865661B (zh) 一种面向网络设备管理协议的异常配置检测装置及方法
JP2019208180A (ja) 異常検出装置、異常検出方法および異常検出プログラム
CN116185598A (zh) 地址处理方法、装置、电子设备及可读存储介质
CN107911358B (zh) 一种保护网络安全的方法及系统
Zhu et al. A research review on SDN-based DDOS attack detection
JP4361570B2 (ja) パケット制御命令管理方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15871938

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15871938

Country of ref document: EP

Kind code of ref document: A1