WO2016188294A1

WO2016188294A1 - Network attack processing method and device

Info

Publication number: WO2016188294A1
Application number: PCT/CN2016/080311
Authority: WO
Inventors: 张倩; 孙磊
Original assignee: 阿里巴巴集团控股有限公司; 张倩; 孙磊
Priority date: 2015-05-28
Filing date: 2016-04-27
Publication date: 2016-12-01
Also published as: CN106302347A; CN106302347B

Abstract

Embodiments of the present application provide a network attack processing method and device. The network attack processing method comprises: acquiring a first IP address connected to a server and a connection number corresponding to the first IP address; determining whether the connection number corresponding to the first IP address is greater than or equal to a first threshold value or not; and if so, shielding a source IP address connected to the first IP address. The embodiments of the present application not only ensure overall stability of a server and a network, but also reduce service influence on an attacked IP address by shielding a source IP address, thereby reducing the influence on website visiting.

Description

Network attack processing method and device

Technical field

The present application relates to the field of communications technologies, and in particular, to a network attack processing method and a network attack processing device.

Background technique

A virtual host, also called "web space", divides a server running on the Internet into a plurality of hard disk spaces of a certain size, each of which is given the corresponding FTP (File Transfer Protocol) permission and Web access rights for use in website publishing.

To protect the stability and security of the server as a whole, the firewall of the server monitors the network attack on each virtual host. Once the firewall determines that the attack size reaches a certain threshold, the firewall automatically masks the IP address of the attacked virtual host.

However, the shielding of the attack target IP address can ensure the overall stability of the server and the network. However, after the IP address of the attacked IP address is blocked, the service of the IP address is also affected, which affects website access.

Therefore, a technical problem that needs to be solved urgently by those skilled in the art is how to reduce the business impact of network attacks on the attacked IP address.

Summary of the invention

The technical problem to be solved by the embodiments of the present application is to provide a network attack processing method, which can reduce the impact of network attacks on the attacked IP address.

Correspondingly, the embodiment of the present application further provides a network attack device to ensure implementation and application of the foregoing method.

In order to solve the above problem, the present application discloses a network attack processing method, including:

Obtaining a first IP address of the connection server and a connection number corresponding to the first IP address;

Determining whether the number of connections corresponding to the first IP address is greater than or equal to a first threshold;

If yes, the source IP address connected to the first IP address is masked.

Further, the shielding is connected to the source IP address of the first IP address, including:

Obtaining, by the source IP addresses connected to the first IP address, the number of connections corresponding to the source IP addresses;

Determining whether there is a source IP address in the source IP address that is greater than or equal to a second threshold;

If yes, the source IP address whose number of connections is greater than or equal to the second threshold is masked.

Further, the method further includes:

The first IP address is masked when there is no source IP address in the source IP address that is greater than or equal to the second threshold.

Further, the masking the source IP address that the number of connections is greater than or equal to the second threshold includes:

Determining whether a sum of the number of connections corresponding to the source IP address whose connection number is greater than or equal to the second threshold is greater than or equal to the first threshold;

Further, the method further includes:

The first IP address is masked when a sum of the number of connections corresponding to the source IP address whose number of connections is greater than or equal to the second threshold is less than the first threshold.

Further, the method further includes:

The masking of the first IP address is stopped when the preset condition is satisfied.

The embodiment of the present application further discloses a network attack processing apparatus, including:

An obtaining unit, configured to acquire a first IP address of the connection server and a connection number corresponding to the first IP address;

The determining unit is configured to determine whether the number of connections corresponding to the first IP address is greater than or equal to a first threshold;

The processing unit is configured to block the source IP address connected to the first IP address when the determining unit determines that the number of connections corresponding to the first IP address is greater than or equal to the first threshold.

Further, the processing unit includes:

Obtaining a subunit, configured to obtain each source IP address connected to the first IP address and a connection number corresponding to each source IP address;

a determining subunit configured to determine whether the number of connections in the source IP addresses is greater than or a source IP address equal to the second threshold;

The masking subunit is configured to, when the determining subunit determines that the source IP address of the source IP address is greater than or equal to the second threshold, masking the source IP whose connection number is greater than or equal to the second threshold address.

Further, the processing unit is further configured to block the first IP address when there is no source IP address in the source IP address that is greater than or equal to the second threshold.

Further, the shielding subunit includes:

a lower layer determining subunit, configured to determine whether a sum of the number of connections corresponding to the source IP address whose connection number is greater than or equal to the second threshold is greater than or equal to the first threshold;

a lower layer masking subunit, configured to: when the lower layer determining subunit determines that the sum of the number of connections corresponding to the source IP address whose number of connections is greater than or equal to the second threshold is greater than or equal to the first threshold, The source IP address whose number of connections is greater than or equal to the second threshold.

Further, the lower layer masking subunit is further configured to block the first IP address when a sum of the number of connections corresponding to the source IP address whose number of connections is greater than or equal to the second threshold is less than the first threshold. .

Compared with the prior art, the embodiments of the present application include the following advantages:

In the embodiment of the present application, the number of connections of the IP address of the connection server is detected, and when the number of connections exceeds a certain threshold, the IP address is confirmed to be attacked by the network, and then all or part of the source IP addresses connected to the attacked IP address are blocked. Not only ensures the overall stability of the server and the network, but also reduces the impact on the attacked IP address by shielding the source IP address, and reduces the impact on the website access. Moreover, the method can detect the attacked IP address by monitoring the number of connections, and can more accurately determine the object of the network attack, and is more suitable for the virtual host itself, compared with the monitoring methods of the hardware firewall and the black hole in the prior art. Network attack protection.

DRAWINGS

1 is a flow chart of steps of an embodiment of a network attack processing method according to the present application;

2 is a flow chart of steps of another embodiment of a network attack processing method of the present application;

3 is a structural block diagram of an embodiment of a network attack processing apparatus of the present application;

4 is a structural block diagram of a processing unit in an embodiment of the present application;

FIG. 5 is a structural block diagram of a mask subunit in the embodiment of the present application.

detailed description

The above described objects, features and advantages of the present application will become more apparent and understood.

Referring to FIG. 1 , a flow chart of steps of an embodiment of a network attack processing method of the present application is shown, which may specifically include the following steps:

Step 101: Obtain a first IP address of the connection server and a connection number corresponding to the first IP address.

In this embodiment, multiple virtual hosts can be divided on the server, and the server can be connected to each virtual host through a public port such as port 80.

The network attack processing device may be the server itself, or a device disposed in the server, or a device that is independent of the server but can communicate with the server.

The device is different from the server's firewall in detecting cyber attacks on each virtual host through metrics such as bandwidth. In this step, the device acquires the IP address of each virtual host connected to the server, and the number of connections corresponding to each IP address. The first IP address is the IP address of any virtual host connected to the server, and the “first” is merely for convenience of presentation, and is not specifically for an IP address. The number of connections corresponding to the first IP address refers to the number of connections of all the source IP addresses to the first IP address.

The device can periodically acquire the first IP address and the number of connections, and can also monitor and acquire the first IP address and the number of connections in real time.

Step 102: Determine whether the number of connections corresponding to the first IP address is greater than or equal to a first threshold.

After obtaining the first IP address and the corresponding number of connections, the device determines whether the number of connections is greater than or equal to a preset first threshold. The first threshold may be set according to the size of the server, the application scenario of the virtual host, and the experience value of the connection.

If the number of connections corresponding to the first IP address is greater than or equal to the first threshold, the first IP address is subjected to a network attack, and then step 103 is performed; if the first threshold is smaller than the first threshold, the first IP address is not received by the network. Attack, in a safe state.

Step 103: Shield the source IP address connected to the first IP address.

When the number of connections corresponding to the first IP address is greater than or equal to the first threshold, in this embodiment, The first IP address is directly masked, and some or all of the source IP addresses connected to the first IP address are masked. Specifically, the device may determine the source IP address to be masked according to the number of connections of the source IP address connected to the first IP address.

The device can detect and process the IP addresses of all virtual hosts connected to the server according to the above method.

Referring to FIG. 2, a flow chart of steps of another embodiment of the network attack processing method of the present application is shown, which may specifically include the following steps:

Step 201: Acquire a first IP address of the connection server and a connection number corresponding to the first IP address.

Step 202: Determine whether the number of connections corresponding to the first IP address is greater than or equal to a first threshold.

The steps 201 to 202 are similar to the steps 101 to 102 in the foregoing embodiment, and are not described herein again.

In this embodiment, when the number of connections corresponding to the first IP address is less than the first threshold, the network attack processing apparatus confirms that the first IP address is not attacked by the network.

When the number of connections corresponding to the first IP address is greater than or equal to the first threshold, the network attack processing device needs to block the source IP address that is connected to the first IP address, and the process may specifically include the following steps:

Step 203: Acquire each source IP address connected to the first IP address and the number of connections corresponding to each source IP address.

The device further obtains each source IP address connected to the first IP address and its corresponding connection number, such as source IP address 1, connection number is 10; source IP address 2, connection number is 100; source IP address 3, connection The number is 1000;

Step 204: Determine whether a source having a connection number greater than or equal to a second threshold exists in each source IP address. IP address.

The device checks, from the result obtained in the previous step, whether there is a source IP address whose connection number is greater than or equal to the second threshold, and the setting method of the second threshold is similar to the first threshold. The second threshold may be less than the first threshold.

If the result is that there is no source IP address whose connection number is greater than or equal to the second threshold, the device may consider that the first IP address is subjected to a large-scale attack by multiple source IP addresses, and the source cannot be determined. In this case, all the source IP addresses may be directly blocked according to the specific situation, and step 205 may also be performed.

If the result is that the source IP address is greater than or equal to the second threshold, the device may directly block the source IP addresses whose connection number is greater than or equal to the second threshold, or may first record that the number of connections is greater than or equal to the second. The source IP address of the threshold and its corresponding number of connections, such as IP N1 connection number Y1; IP N2 connection number Y2; IP N3 connection number Y3, and then step 206 is performed.

Step 205, masking the first IP address.

After the first IP address is masked, the user may be further notified that the first IP address is attacked and wait for the attack to end. When the detection of the end of the attack, or when the preset condition is met, the masking of the first IP address can be automatically stopped.

Step 206: Determine whether the sum of the number of connections corresponding to the source IP address whose connection number is greater than or equal to the second threshold is greater than or equal to the first threshold.

The device calculates a sum of the number of connections corresponding to the source IP address whose connection number is greater than or equal to the second threshold, for example, Y1+Y2+Y3, and then determines whether the sum is greater than or equal to the first threshold.

If the sum of the number of connections is greater than or equal to the first threshold, the cyber attack on the first IP address is a network attack initiated by a few source IP addresses. Step 207 can be performed.

If the sum of the number of connections is less than the first threshold, the first IP address is subjected to a large-scale attack by multiple source IP addresses, and the source cannot be determined. In this case, all the source IP addresses may be directly blocked according to the specific situation, and step 205 may also be performed.

Step 207, masking the source IP address whose connection number is greater than or equal to the second threshold.

After the source IP address is blocked, the user can be notified that the attack protection is successful. The user can continue to access the first IP address.

In this embodiment, the number of network connections is monitored, and the network attack is determined according to the number of connections. The size and source, and according to different network attacks, respectively, the source IP address of the attack or the attacked IP address is shielded. For example, for a large-scale attack initiated by a small number of IPs, the method of shielding this part of IP can be adopted. Defense is provided; for attacks that cannot be judged to be initiated by a small number of IPs, the attacked IP is shielded, the server and the overall network are protected, thereby achieving the purpose of protecting the overall stability and security of the server. In this method, the attacked IP address is not simply shielded from the firewall side of the virtual host, but is analyzed according to the quantitative source of the attack source. This method can more accurately determine the object of the network attack and perform corresponding protection processing.

It should be noted that, for the method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should understand that the embodiments of the present application are not limited by the described action sequence, because In accordance with embodiments of the present application, certain steps may be performed in other sequences or concurrently. In the following, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required in the embodiments of the present application.

Referring to FIG. 3, a structural block diagram of an embodiment of a network attack processing apparatus of the present application is shown, which may specifically include the following units:

The obtaining unit 301 is configured to acquire a first IP address of the connection server and a connection number corresponding to the first IP address.

The determining unit 302 is configured to determine whether the number of connections corresponding to the first IP address is greater than or equal to a first threshold.

The processing unit 303 is configured to block the source IP address connected to the first IP address when the determining unit 302 determines that the number of connections corresponding to the first IP address is greater than or equal to the first threshold.

The device detects the number of connections of the IP address of the connection server through the above unit, and confirms that the IP address is attacked by the network when the number of connections exceeds a certain threshold, and then blocks all or part of the source IP address of the IP address connected to the attacked IP address. Not only ensures the overall stability of the server and the network, but also reduces the impact on the attacked IP address by shielding the source IP address, and reduces the impact on the website access. Moreover, the device can confirm the attacked IP address by monitoring the number of connections, and can more accurately determine the object of the network attack, and is more suitable for the virtual host itself, compared with the monitoring methods of the hardware firewall and the black hole in the prior art. Network attack protection.

In another embodiment, as shown in FIG. 4, the processing unit 303 may further include:

The obtaining sub-unit 401 is configured to obtain each source IP address connected to the first IP address and a connection number corresponding to each source IP address;

The determining sub-unit 402 is configured to determine whether the source IP address of the source IP address is greater than or equal to a second threshold.

The masking sub-unit 403 is configured to: when the determining sub-unit 402 determines that the source IP address of the source IP address is greater than or equal to the second threshold, the number of the connections is greater than or equal to the second threshold. Source IP address.

In another embodiment, the processing unit 303 is further configured to mask the first IP address when there is no source IP address in the source IP address that is greater than or equal to the second threshold.

In another embodiment, as shown in FIG. 5, the shielding subunit 403 may further include:

The lower layer determining subunit 501 is configured to determine whether the sum of the number of connections corresponding to the source IP address whose number of connections is greater than or equal to the second threshold is greater than or equal to the first threshold;

The lower layer masking sub-unit 502 is configured to, when the lower layer determining sub-unit 501 determines that the sum of the number of connections corresponding to the source IP address whose number of connections is greater than or equal to the second threshold is greater than or equal to the first threshold, The source IP address is greater than or equal to the second threshold.

The lower layer masking sub-unit 502 may be further configured to mask the first IP address when the sum of the number of connections corresponding to the source IP address whose number of connections is greater than or equal to the second threshold is less than the first threshold.

The device monitors the number of network connections, determines the size and source of the network attack according to the number of connections, and performs masking operations on the source IP address or the attacked IP address according to different network attacks. For a large-scale attack initiated by a small number of IPs, it can be defended by blocking the part of the IP; for attacks that cannot be judged to be initiated by a small number of IPs, the attacked IP is shielded, the server and the overall network are protected, thereby protecting the entire server. Stable and safe for the purpose. The device is not only shielded from the firewall end of the virtual host, but is analyzed according to the source of the attack. The device can more accurately determine the object of the network attack and perform corresponding protection processing.

The embodiment of the present application also discloses a server, which includes a memory and a processor.

The processor and the memory are connected to each other through a bus; the bus may be an ISA bus, a PCI bus, or EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, and the like.

Wherein, the memory is used to store a program, and specifically, the program may include program code, and the program code includes computer operation instructions. The memory may include a high speed RAM memory and may also include a non-volatile memory such as at least one disk memory.

The processor is used to read the program code in the memory and perform the following steps:

If yes, the source IP address connected to the first IP address is masked.

For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.

The various embodiments in the present specification are described in a progressive manner, and each embodiment focuses on differences from other embodiments, and the same similar parts between the various embodiments can be referred to each other.

Those skilled in the art will appreciate that embodiments of the embodiments of the present application can be provided as a method, apparatus, or computer program product. Therefore, the embodiments of the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, embodiments of the present application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

In a typical configuration, the computer device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory. The memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory. Memory is an example of a computer readable medium. Computer readable media includes both permanent and non-persistent, removable and non-removable media. Information storage can be implemented by any method or technology. The information can be computer readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory Memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, read only CD only Read memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape storage or other magnetic storage device or any other non-transportable medium that can be used to store access that can be accessed by a computing device. information. As defined herein, computer readable media does not include non-persistent computer readable media, such as modulated data signals and carrier waves.

Embodiments of the present application are described with reference to flowcharts and/or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing terminal device to produce a machine such that instructions are executed by a processor of a computer or other programmable data processing terminal device Means are provided for implementing the functions specified in one or more of the flow or in one or more blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The instruction device implements the functions specified in one or more blocks of the flowchart or in a flow or block of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device such that a series of operational steps are performed on the computer or other programmable terminal device to produce computer-implemented processing, such that the computer or other programmable terminal device The instructions executed above provide steps for implementing the functions specified in one or more blocks of the flowchart or in a block or blocks of the flowchart.

While a preferred embodiment of the embodiments of the present application has been described, those skilled in the art can make further changes and modifications to the embodiments once they are aware of the basic inventive concept. Therefore, the appended claims are intended to be interpreted as including all the modifications and the modifications

Finally, it should also be noted that in this context, relational terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these entities. There is any such actual relationship or order between operations. Furthermore, the terms "comprises" or "comprising" or "comprising" or any other variations are intended to encompass a non-exclusive inclusion, such that a process, method, article, or terminal device that includes a plurality of elements includes not only those elements but also Other elements that are included, or include elements inherent to such a process, method, article, or terminal device. An element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or terminal device that comprises the element, without further limitation.

The foregoing describes a network attack processing method and a network attack processing device provided by the present application in detail. In this paper, a specific example is applied to explain the principle and implementation manner of the present application. The description of the above embodiment is only used. To help understand the method of the present application and its core ideas; at the same time, for those of ordinary skill in the art, in accordance with the idea of the present application, there will be changes in the specific embodiments and application scope. The content should not be construed as limiting the application.

Claims

A network attack processing method, comprising:

Obtaining a first IP address of the connection server and a connection number corresponding to the first IP address;

Determining whether the number of connections corresponding to the first IP address is greater than or equal to a first threshold;

If yes, the source IP address connected to the first IP address is masked.
The method according to claim 1, wherein the shielding is connected to a source IP address of the first IP address, including:

Obtaining, by the source IP addresses connected to the first IP address, the number of connections corresponding to the source IP addresses;

Determining whether there is a source IP address in the source IP address that is greater than or equal to a second threshold;

If yes, the source IP address whose number of connections is greater than or equal to the second threshold is masked.
The method of claim 2, wherein the method further comprises:

The first IP address is masked when there is no source IP address in the source IP address that is greater than or equal to the second threshold.
The method according to claim 2, wherein the masking the source IP address whose number of connections is greater than or equal to the second threshold comprises:

Determining whether a sum of the number of connections corresponding to the source IP address whose connection number is greater than or equal to the second threshold is greater than or equal to the first threshold;

If yes, the source IP address whose number of connections is greater than or equal to the second threshold is masked.
The method of claim 4, wherein the method further comprises:

The first IP address is masked when a sum of the number of connections corresponding to the source IP address whose number of connections is greater than or equal to the second threshold is less than the first threshold.
The method according to claim 3 or 5, wherein the method further comprises:

The masking of the first IP address is stopped when the preset condition is satisfied.
A network attack processing device, comprising:

An obtaining unit configured to acquire a first IP address of the connection server and the first IP address Corresponding number of connections;

The determining unit is configured to determine whether the number of connections corresponding to the first IP address is greater than or equal to a first threshold;

The processing unit is configured to block the source IP address connected to the first IP address when the determining unit determines that the number of connections corresponding to the first IP address is greater than or equal to the first threshold.
The device according to claim 7, wherein the processing unit comprises:

Obtaining a subunit, configured to obtain each source IP address connected to the first IP address and a connection number corresponding to each source IP address;

a determining subunit, configured to determine whether the source IP address of the source IP address is greater than or equal to a second threshold;

The masking subunit is configured to, when the determining subunit determines that the source IP address of the source IP address is greater than or equal to the second threshold, masking the source IP whose connection number is greater than or equal to the second threshold address.
The device of claim 8 wherein:

The processing unit is further configured to mask the first IP address when there is no source IP address in the source IP address that is greater than or equal to the second threshold.
The device according to claim 8, wherein the shielding subunit comprises:

a lower layer determining subunit, configured to determine whether a sum of the number of connections corresponding to the source IP address whose connection number is greater than or equal to the second threshold is greater than or equal to the first threshold;

a lower layer masking subunit, configured to: when the lower layer determining subunit determines that the sum of the number of connections corresponding to the source IP address whose number of connections is greater than or equal to the second threshold is greater than or equal to the first threshold, The source IP address whose number of connections is greater than or equal to the second threshold.
The device of claim 10 wherein:

The lower layer masking subunit is further configured to mask the first IP address when a sum of the number of connections corresponding to the source IP address whose number of connections is greater than or equal to the second threshold is less than the first threshold.