WO2017166047A1 - 网络攻击防御策略发送、网络攻击防御的方法和装置 - Google Patents

网络攻击防御策略发送、网络攻击防御的方法和装置 Download PDF

Info

Publication number
WO2017166047A1
WO2017166047A1 PCT/CN2016/077662 CN2016077662W WO2017166047A1 WO 2017166047 A1 WO2017166047 A1 WO 2017166047A1 CN 2016077662 W CN2016077662 W CN 2016077662W WO 2017166047 A1 WO2017166047 A1 WO 2017166047A1
Authority
WO
WIPO (PCT)
Prior art keywords
address
network device
network
edge network
edge
Prior art date
Application number
PCT/CN2016/077662
Other languages
English (en)
French (fr)
Inventor
余舟毅
杨莉
付天福
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP16895828.8A priority Critical patent/EP3355514B1/en
Priority to PCT/CN2016/077662 priority patent/WO2017166047A1/zh
Priority to CN201680034646.9A priority patent/CN107710680B/zh
Publication of WO2017166047A1 publication Critical patent/WO2017166047A1/zh
Priority to IL259132A priority patent/IL259132A/en
Priority to US16/050,313 priority patent/US10798060B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0893—Assignment of logical groups to network elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0894—Policy-based network configuration management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0895—Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/32—Flow control; Congestion control by discarding or delaying data units, e.g. packets or frames
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service

Definitions

  • the present application relates to the field of communications, and in particular, to a method and apparatus for cyber attack defense policy transmission and network attack defense.
  • a denial of service (DoS) attack is a type of network attack.
  • a DoS attack refers to an attack on a victim host vulnerability, causing the victim host network protocol stack to fail, resource exhaustion, host hang, and system crash, thereby causing the victim host to refuse service.
  • a DoS attack a distributed DoS (DDoS) attack is a common DoS attack.
  • a host sends a DoS attack to a target host through multiple hosts on the network.
  • the network device After detecting the network attack packet, the network device sends the received packet to the cleaning device.
  • the cleaning device identifies the network attack packet and discards the network according to the characteristics of the network attack packet.
  • An attack packet is sent to the network device and then the cleaned packet is sent back to the network device.
  • the cost of deploying the cleaning device is high, and the network attack packet has been transmitted in each network device in the network before entering the cleaning device, which occupies a large amount of network resources, and the network device detects the network attack and reports it.
  • the network attack packet is also transmitted between the network device and the cleaning device, and also occupies network resources. Therefore, the scheme has high defense cost and poor defense effect on network attack packets.
  • the embodiment of the present invention provides a method and a device for transmitting a network attack defense policy, and a network attack defense method and device, which can reduce the occupation of network resources by network attack packets and improve the defense effect on network attack packets.
  • the embodiment of the present application provides a method for sending a network attack defense policy, where the method includes:
  • the attack information includes a target Internet Protocol (IP) address, where the attack information is used to indicate that the network attack packet with the destination address being the target IP address exists in the first network;
  • IP Internet Protocol
  • the network attack packet is sent to the first network by using the first edge network device, and the first edge network device is instructed to perform the network attack by sending a defense policy to the first edge network device.
  • the defense reduces the transmission of the network attack packet in the first network, saves the transmission resource of the first network, and improves the defense effect on the network attack packet.
  • the attack information further includes a source IP address of the network attack packet
  • the determining that the network attack packet enters the first network by using the first edge network device includes: Obtaining the source IP address from the attack information, and determining the first edge network device according to the correspondence between the source IP address and the first edge network device.
  • the first edge network device is determined according to the corresponding relationship, so that the first edge network device that is the source of the network attack packet can be quickly determined, and the network attack packet is defended in time.
  • the determining that the network attack packet enters the first network by using the first edge network device includes: acquiring each edge of multiple edge network devices in the first network
  • the destination address received by the network device in the preset time period is the data traffic of the packet of the target IP address
  • the plurality of edge network devices include the first edge network device
  • the first edge network device is determined.
  • the data traffic received during the preset time period satisfies a first preset condition.
  • the data traffic of the packet of the specific destination IP address in the edge network device is obtained, and the data traffic is used as an important indicator for determining the network attack, so that the source of the network attack packet can be quickly determined, thereby timely attacking the network attack. Make defenses to further improve the defense against cyber attack messages.
  • the method further includes: obtaining a correspondence between the source IP address and the first edge network device from a Software Define Network (SDN) controller.
  • SDN Software Define Network
  • the SDN controller obtains the corresponding relationship between the IP address and the edge network device, and can fully utilize the existing information in the network architecture of the SDN to quickly determine the source of the network attack packet, thereby improving the network attack. Defense efficiency.
  • the first preset condition is that the data traffic exceeds a preset value
  • the defense policy is to discard a packet whose destination address is the target IP address.
  • the defense policy of the packet whose destination address is the destination IP address is discarded, so that the attack traffic of the network attack is prevented from seriously threatening the bandwidth of the first network.
  • the defense policy includes: discarding a packet whose destination address is the target IP address.
  • the defense policy of the packet whose destination address is the destination IP address is discarded, and the first edge network device only needs to extract the destination IP address in the received packet and determine whether the destination IP address matches the target IP address. .
  • the strategy does not need to occupy too much computing resources of the first edge network device while implementing a defense against network attacks.
  • the defensive policy can also reduce the occupation of transmission resources caused by network attack packets on the network, thereby reducing the damage of the network attack packets to the network.
  • the defense policy includes: discarding a packet whose destination address is the target IP address and meets a second preset condition.
  • the first edge network device can discard the network attack packet by the targeted network and continue to provide forwarding for the normal packet, thereby improving the defense effect of the network attack.
  • the implementation of the present application provides a network attack defense method, where the method includes:
  • the first edge network device receives the defense policy, where the defense policy includes a target IP address, and the defense policy is used to instruct the first edge network device to process, according to the defense policy, a packet whose destination address is the target IP address.
  • the first edge network device is an edge network device in the first network, and the first network has a network attack packet whose destination address is the target IP address, and the network attack packet passes the first edge.
  • the network device enters the first network;
  • the first edge network device processes, according to the defense policy, a packet whose destination address is the target IP address.
  • the network attack packet enters the first stage by using the first edge network device.
  • a network by performing a defense policy on the first edge network device, can reduce the transmission of the network attack packet in the first network, save the transmission resource of the first network, and improve the network attack packet. Defense effect.
  • the cost of network attack defense is reduced.
  • the data traffic of the packet whose destination address is the target IP address received by the first edge network device in a preset time period exceeds a preset value, and the defense policy is discarding.
  • the destination address is a packet of the target IP address.
  • the defense policy includes: discarding a packet whose destination address is the target IP address. In a possible implementation manner, the defense policy includes discarding a packet whose destination address is the target IP address and meets a second preset condition.
  • the embodiment of the present application provides a defense policy sending apparatus, including: a receiving unit, a determining unit, and a sending unit, where:
  • the receiving unit is configured to receive attack information, where the attack information includes a target internet protocol IP address, where the attack information is used to indicate that a network attack packet whose destination address is the target IP address exists in the first network;
  • the determining unit is configured to determine, according to the attack information received by the receiving unit, that the network attack packet enters the first network by using a first edge network device, where the first edge network device is the first Edge devices in the network;
  • the sending unit is configured to send a defense policy to the first edge network device, where the defense policy is used to instruct the first edge network device to process, according to the defense policy, a packet whose destination address is the target IP address. .
  • the attack information further includes a source IP address of the network attack packet
  • the determining unit is further configured to obtain the source IP address from the attack information, and The correspondence between the source IP address and the first edge network device determines the first edge network device.
  • the determining unit is further configured to acquire, by using each of the plurality of edge network devices in the first network, a destination address received by the edge network device in the preset time period as the target IP.
  • the data traffic of the packet of the address, the plurality of edge network devices including the first edge network device, and the device for determining that the first edge network device receives within the preset time period The data traffic meets the first preset condition.
  • the receiving unit is further configured to acquire, from an SDN controller, a correspondence between the source IP address and the first edge network device.
  • the first preset condition is that the data traffic exceeds a preset value
  • the defense policy is to discard a packet whose destination address is the target IP address.
  • the defense policy sent to the first edge network device includes: discarding a packet whose destination address is the target IP address; or discarding the destination address as the target IP address and satisfying the second A message with a preset condition.
  • the embodiment of the present application provides a first edge network device, including a receiving unit and a processing unit, where:
  • the receiving unit is configured to receive a defense policy, where the defense policy includes a target IP address, where the defense policy is used to instruct the first edge network device to process the destination address as the target IP address according to the defense policy.
  • the first edge network device is an edge network device in the first network, and the first network has a network attack packet whose destination address is the target IP address, and the network attack packet passes the An edge network device enters the first network;
  • the processing unit is configured to process, according to the defense policy received by the receiving unit, a packet whose destination address is the target IP address.
  • the data traffic of the packet whose destination address is the target IP address received by the first edge network device in a preset time period exceeds a preset value, and the defense policy is discarding.
  • the destination address is a packet of the target IP address.
  • the defense policy received by the receiving unit includes: discarding a packet whose destination address is the target IP address; or discarding the destination address as the target IP address and satisfying a second preset condition. Message.
  • an embodiment of the present application provides a defense policy sending apparatus, including: a processor, a network interface, and a memory, where the processor is configured to read a program stored in the memory to perform the following operations:
  • the attack information includes a target internet protocol IP address, where the attack information is used to indicate that the network attack packet with the destination address being the target IP address exists in the first network;
  • the attack information further includes a source IP address of the network attack packet
  • the determining that the network attack packet enters the first network by using the first edge network device includes: Obtaining the source IP address from the attack information, and determining the first edge network device according to the correspondence between the source IP address and the first edge network device.
  • the determining that the network attack packet enters the first network by using the first edge network device includes: acquiring each edge of multiple edge network devices in the first network
  • the destination address received by the network device in the preset time period is the data traffic of the packet of the target IP address, the plurality of edge network devices include the first edge network device, and the first edge network device is determined.
  • the data flow within the preset time period satisfies a first preset condition.
  • the processor before determining the first edge network device according to the correspondence between the source IP address and the first edge network device, the processor is further configured to: obtain from an SDN controller. Corresponding relationship between the source IP address and the first edge network device.
  • the first preset condition is that the data traffic exceeds a preset value
  • the defense policy is to discard a packet whose destination address is the target IP address.
  • the defense policy sent to the first edge network device includes: discarding a packet whose destination address is the target IP address; or discarding the destination address as the target IP address and satisfying the second A message with a preset condition.
  • the embodiment of the present application provides a first edge network device, including: a processor, a network interface, and a memory, where the processor is configured to read a program stored in the memory to perform the following operations:
  • a defense policy where the defense policy includes a target IP address, where the defense policy is used to instruct the first edge network device to process, according to the defense policy, a packet whose destination address is the target IP address,
  • the first edge network device is an edge network device in the first network, and the first network has a network attack packet whose destination address is the target IP address, The network attack packet enters the first network by using the first edge network device;
  • the data traffic of the packet whose destination address is the target IP address received by the first edge network device in a preset time period exceeds a preset value, and the defense policy is discarding.
  • the destination address is a packet of the target IP address.
  • the defense policy received by the device includes: discarding a packet whose destination address is the target IP address, or discarding a packet whose destination address is the target IP address and meets a second preset condition. Text.
  • FIG. 1 is a schematic diagram of an applicable system architecture provided by an embodiment of the present application.
  • FIG. 2 is a schematic structural diagram of another system that can be applied according to an embodiment of the present application.
  • FIG. 3 is a schematic diagram of a method for sending a network attack defense policy and defending against network attacks according to an embodiment of the present application
  • FIG. 4 is a schematic diagram of another network attack defense policy sending and network attack defense method provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of another network attack defense policy sending and network attack defense method according to an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a defense policy sending apparatus according to an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a first edge network device according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of another defense policy sending apparatus according to an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of another first edge network device according to an embodiment of the present application.
  • FIG. 1 is a schematic diagram of an applicable system architecture provided by an embodiment of the present application.
  • the network 101 includes multiple edge network devices, such as an edge network device 11 , an edge network device 12 , and an edge network device. 13.
  • each of the edge network device 11, the edge network device 12, and the edge network device 13 may be a router, a switch, a firewall, a packet transport network device, a wavelength division multiplexing device, an optical transport network device, a base station, or Base station controller.
  • the edge network device 11 in the network 101 is connected to the edge network device in the network 102, receives the message from the network 102, or sends a message to the network 102; the edge network device 12 in the network 101 and the edge network device in the network 103 Connect, receive a message from network 103, or send a message to network 103; edge network device 13 in network 101 is connected to an edge network device in network 104, receives a message from network 104, or sends a message to network 104 Text.
  • each of the network 101, the network 102, the network 103, and the network 104 may be a provider network or a local area network.
  • the edge network device 11, the edge network device 12, and the edge network device 13 may be operator edge (PE) network devices.
  • PE operator edge
  • the edge network device 12 receives the packet from the network 103 from the edge network device in the network 103.
  • the host corresponding to the destination IP address of the packet is the host located in the network 102.
  • the edge network device 12 sends the message to the edge network device 11 through a one-hop or multi-hop network device in the network 101, and the edge network device 11 sends the message to the network 102 and the edge network device 11
  • the connected network device causes the message to enter the network 102.
  • the detecting device 22 for detecting a network attack packet is coupled to a network device in the network, and detects whether a network attack packet exists in the packet received by the network device.
  • the detecting device 22 is coupled to the edge network device 13 in the network 101.
  • the detecting device 22 is configured to detect whether the packet received by the edge network device 13 has a network attack packet, and the host for the network attack packet may be It is a host in the network 101, and may also be a host in another network, such as a host in the network 102.
  • the detecting device 22 When detecting the network attack packet, the detecting device 22 sends the detection result to the defense policy. Transmitting device 21.
  • the defense policy sending device 21 may be an independent physical device, such as a server.
  • the defense policy sending device 21 may also be a functional module deployed on a physical device.
  • the defense policy transmitting device 21 may be a device or a functional module located inside or outside the network 101.
  • the defense policy transmitting device 21 can communicate with each edge network device in the network 101 and send a defense policy to the edge network device in the network 101 that needs to defend against the network attack.
  • each edge network device in the network 101 can communicate with the defense policy transmitting device 21 through a Simple Network Management Protocol (SNMP).
  • SNMP Simple Network Management Protocol
  • each network device in the network 101 communicates with a software-defined networking (SDN) controller 23, and the SDN controller 23 communicates with the defense policy transmitting device 21.
  • the SDN controller 23 collects the information that the network device transmits to the defense policy transmitting device 21, and transmits the information to the defense policy transmitting device 21; or the SDN controller 23 sends the defense policy transmitting device 21 to each through a connection established in advance with each network device.
  • the defense policy sent by the network device is sent to each network device.
  • a network device in network 101 communicates with SDN controller 23 via an internal border gateway protocol (iBGP).
  • the SDN controller 23 can be a separate physical device, such as a server.
  • the SDN controller 23 may also be a functional module that is deployed on the same physical device as the defense policy transmitting device 21.
  • each edge network device can also communicate with the defense policy transmitting device 21.
  • the network attack packet may be a DoS attack packet, for example, a DDoS attack packet.
  • the network attack packet may be a flood attack packet, a malformed packet attack packet, or a scan probe attack packet.
  • the flood attack packet is that the attacker sends a large number of false requests to the target system in a short period of time, causing the target system to be tired of coping with useless information, and failing to provide normal services for legitimate users.
  • the flooding attack packet may be a Synchronous Flood (SYN Flood) packet, a HyperText Transfer Protocol Get Flood packet, and a User Datagram Protocol Flood (User Datagram Protocol Flood).
  • UDP flood Packets, Domain Name System Query Flood (DNS Query Flood) packets, Acknowledgement Flood (ACK Flood) packets, and Internet control Internet Control Message Protocol Flood (ICMP Flood) message, Character Generator Protocol (Chargen), Chargen reflection attack message, and Network Time Protocol Reflection Attack , NTP Reflection Attack) One or more of the messages.
  • the malformed packet attack packet usually refers to an attacker sending a large number of defective packets, thereby causing the host or the server to consume a large amount of resources or system crash when processing such packets.
  • the malformed packet attack packet may be a Session Initiation Protocol Freak (SIP Freak) packet, a BGP malformed packet, or an intermediate system to intermediate system Freak (ISIS Freak).
  • SIP Freak Session Initiation Protocol Freak
  • ISIS Freak intermediate system to intermediate system Freak
  • RTSP Freak Real Time Streaming Protocol Freak
  • TCP Flag Error Transmission Control Protocol Flag Error
  • the scan detection type attack packet may be a potential attack behavior and does not have a direct destruction behavior.
  • the scan detection type attack packet is usually a network detection behavior before the attacker launches a real attack.
  • FIG. 3 is a schematic diagram of a method for sending a network attack defense policy and a network attack defense according to an embodiment of the present application.
  • the method can be applied to the application scenario shown in FIG. 1 or FIG. 2.
  • the first network in the method shown in FIG. 3 may be the network 101 shown in FIG. 1 or 2.
  • the first edge network device in the method shown in FIG. 3 may be the edge network device 12 shown in FIG. 1 or 2.
  • the execution subject of S301, S302, and S303 in the method shown in FIG. 3 may be the defense policy transmitting apparatus 21 shown in FIG. 1 or 2. As shown in Figure 3, it includes:
  • S301 Receive attack information, where the attack information includes a target internet protocol IP address, where the attack information is used to indicate that a network attack packet whose destination address is the target IP address exists in the first network.
  • the attack information received in S301 may come from a network device in the network 101, such as any one of the networks 101 in FIG. 1 or FIG.
  • the attack information may also come from a detection device coupled to any of the network devices 101 in FIG. 1 or FIG. 2, such as the detection device 22 coupled to the edge network device 13 shown in FIG. 1 or 2.
  • the detection device 22 can also be coupled to a non-edge network device in the network 101.
  • the detecting device coupled to the network device may be one or more.
  • the detecting device 22 is coupled to the edge network device 13, and the edge network device 13 copies the received packet and sends it to the detecting device 22.
  • the detecting device 22 analyzes whether the packet has the characteristics of the network attack packet, and if the network attack is available. For the feature of the packet, the detecting device 22 obtains the destination IP address of the network attack packet, and writes the destination IP address of the network attack packet to the attack information. For an example of the specific features of the network attack packet, see the example in S303.
  • the attack information may further include an attack type and a data traffic size of the network attack that the target IP address is subjected to.
  • S302. Determine that the network attack packet enters the first network by using a first edge network device, where the first edge network device is an edge device in the first network.
  • the network attack packet entering the first network by using the first edge network device means that the first edge network device is from an edge network device of another network that is in communication with the first edge network device.
  • Receiving the network attack packet For example, as shown in FIG. 1, the first edge network device is the edge network device 12, the first network is the network 101, and the edge network device 12 communicates with the network 103, and receives the report sent by the edge network device in the network 103. Text.
  • the network attack packet is sent from the second edge network device in the network 103 to the edge network device 12, so that the network attack packet enters the network 101.
  • the first edge network device can be found by using the S302, that is, the source of the network attack packet is found to enter the first network. For an example of a specific method of determining the first edge network device, reference may be made to the description of FIGS. 4 and 5.
  • the defense policy sent by the S303 may include: discarding the packet whose destination address is the destination IP address; or discarding the packet whose destination address is the target IP address and meets the second preset condition.
  • the packet whose destination address is the destination IP address may be the packet with the destination IP address being the destination IP address, and the packet whose destination IP address is the destination IP address may be discarded. All messages received in the time period with the destination address being the destination IP address.
  • the defense policy sending apparatus 21 To The first edge network device sends a defense policy of the packet whose destination address is the destination IP address.
  • the data traffic may be sent by the first edge network device to the defense policy sending device 21 in the manner described in FIG.
  • the defense The policy sending device 21 sends the defense policy of the packet whose destination address is the target IP address to the first edge network device.
  • the data traffic is data traffic received by the network device coupled to the detecting device 22
  • the data traffic may be carried in the attack information described in S301.
  • the defense policy of the packet with the destination address being the destination IP address is discarded.
  • the first edge network device only needs to extract the destination IP address in the received packet and determine the destination IP address and location of the received packet. Whether the destination IP addresses are the same. If they are the same, the received packets are discarded.
  • the defense policy implements defense against network attacks without occupying too many computing resources of the first edge network device.
  • the defensive policy can also reduce the occupation of transmission resources caused by network attack packets on the network, thereby reducing the damage of the network attack packets to the network.
  • the second preset condition is the type of the transmission protocol of the packet.
  • the first edge network device pre-stores the transmission type of the packet that the host corresponding to the target IP address needs to receive, for example, the host only needs to receive the Transmission Control Protocol (TCP).
  • TCP Transmission Control Protocol
  • the transmitted service when the protocol number carried in a packet is not TCP, for example, when the protocol number carried by the packet is a User Datagram Protocol (UDP), the packet satisfies the Two preset conditions. That is, the edge network device 12 discards the packet whose protocol address is not the TCP protocol in the packet whose destination address is the destination IP address according to the defense policy.
  • UDP User Datagram Protocol
  • the second preset condition is a specific type of network attack packet.
  • the network attack packet may be characterized in that the received packet length exceeds a second preset value.
  • the second preset value may be set to exceed a length value of a normal NTP message, for example, set to 500 bytes.
  • the second preset condition may be a typical feature of the malformed message.
  • the TCP header of the TCP packet includes six identifiers: (1) the URG identifier indicates that the emergency pointer field is valid; and (2) the ACK identifier indicates that the packet is acknowledged.
  • the serial number field is valid; (3) the PSH identifier indicates that the receiver should deliver the segment to the application layer as soon as possible; (4) the RST identifier indicating the reconstruction connection; (5) the SYN identifier indicating the synchronization sequence number; (6) the FIN identifier , indicating that there is no subsequent data to send at the originator.
  • the value of the identifiers (1) to (6) in the normal TCP packets will only appear according to the specific rules.
  • the TCP packets that are not identified by the specific rules will affect the response speed of the host that receives the TCP packets. Therefore, when the identifiers (1) to (6) are the following combinations, they may be directly regarded as a malformed message, that is, the second preset condition may be set as the value of the six identifiers in the TCP header. For any of the following:
  • the payload of the SYN identifier with a value of 1 includes the payload.
  • the defense policy sending device pre-stores a defense policy for different types of network attack packets, and selects one of the pre-stored defense policies after receiving the attack information.
  • the defense policy sending device may also adjust the defense policy according to the parameters in the attack information.
  • the first edge network device receives the defense policy.
  • the defense policy is a defense policy generated in S303.
  • the defense policy includes the target IP address, and the defense policy is used to instruct the first edge network device to process, according to the defense policy, a packet whose destination address is the target IP address, where the first edge network device is An edge network device in the first network, where the first network has a network attack packet whose destination address is the target IP address, and the network attack packet enters the first network by using the first edge network device.
  • the first edge network device processes, according to the defense policy, a packet whose destination address is the target IP address.
  • the first edge network device performs the defense policy on a packet whose destination address is the target IP address.
  • the defense policy refer to the description of the defense policy in S303, which is not illustrated here.
  • the method may further include: the defense policy sending device outputs a defense report.
  • the defense report may include the number of packets whose destination address is discarded by the first edge network device according to the defense policy as the target IP address.
  • the defense report may further include an attack type or the like in which the target IP is attacked by a network. By defending the report, the user can know the security status of the network.
  • the source network defends the network attack at the source of the first network, effectively protects the first network, and saves transmission resources in the first network.
  • the network attack packet is processed by the edge network device, and the special cleaning device is not needed, thereby effectively reducing the implementation cost while ensuring the defense effect.
  • FIG. 4 is a schematic diagram of another network attack defense policy transmission and a network attack defense method according to an embodiment of the present application.
  • the solution illustrated in FIG. 4 is based on the solution illustrated in FIG. 3 . Partially modified, only the different parts from Figure 3 are explained below. For the same part, please refer to the description of Figure 3:
  • the attack information further includes a source IP address of the network attack packet, and S302 specifically includes S401 and S402.
  • the source IP address is the source IP address of the network attack packet, that is, the IP address of the host that sends the network attack packet.
  • S402. Determine the first edge network device according to the correspondence between the source IP address and the first edge network device.
  • the correspondence may be obtained from a routing table of the first edge network device.
  • the device searches for the matching entry in the routing table of the first edge network device according to the source IP address of the network attack packet. If the first routing entry exists in the routing table of the first edge device, the destination IP address in the first routing entry is the first IP address, and the storage in the first routing entry is One hop is an IP address of a network device in a network other than the first network that is connected to the first edge network device, and the first IP address and a source IP address of the network attack packet If the address matches, it is determined that the correspondence between the source IP address and the first edge network device exists. For example, the first IP address matches the source IP address of the network attack packet, which may be the longest prefix match.
  • the edge network device 12 in FIG. 1 is the first edge network device, and the source IP address of the network attack packet is 192.168.20.19. And searching for a matching entry in the routing table of the first edge network device according to the source IP address of the network attack packet. If the first routing entry exists in the routing table of the edge network device 12, the destination IP address in the first routing entry is the first IP address 192.168.0.0/16, and the first routing entry The next hop in the network is the IP address of the edge network device in the network 103, and the corresponding relationship between the source IP address and the edge network device 12 is considered to exist.
  • the routing table can be understood as a routing table generated by an External Border Gateway Protocol (eBGP).
  • eBGP External Border Gateway Protocol
  • the defense policy sending device acquires the correspondence between the source IP address and the first edge network device from the SDN controller.
  • the SDN controller 23 acquires the first edge network. Routing table for multiple edge network devices, including devices.
  • the SDN controller 23 acquires a routing table of multiple edge network devices in the first network before or after S301, and generates according to multiple routing entries in the multiple routing tables. a plurality of corresponding relationships, the correspondence relationship between the IP address and the edge network device, and the corresponding relationship is sent to the defense policy sending device 21, and the defense policy sending device 21 according to the network attack in the attack information after S301
  • the source IP address of the packet, and the correspondence between the source IP address and the first edge network device is found from the correspondence between the multiple IP addresses and the edge network device.
  • the defense policy sending apparatus may also send the source IP address to the SDN controller 23 after S301, and the SDN controller 23 finds the correspondence between the source IP address and the first edge network device. After the relationship, the identifier of the first edge network device is sent to the defense policy sending device 21.
  • the defense policy sending apparatus acquires a correspondence between the source IP address and the first edge network device from the first edge network device.
  • each edge network device in the network 101 reports its own routing table to the defense policy sending device 21 through SNMP.
  • the defense policy sending device 21 acquires the correspondence relationship from a routing table sent by each edge network device.
  • the first edge network device is determined according to the corresponding relationship, so that the first edge network device that is the source of the network attack packet in the first network can be quickly determined, and the network attack packet is timely performed. defense.
  • FIG. 5 is a schematic diagram of another network attack defense policy transmission and a network attack defense method according to an embodiment of the present disclosure.
  • the solution illustrated in FIG. 5 is partially modified based on the solution illustrated in FIG. 3, and only Explain the different parts from Figure 3. For the same part, please refer to the description of Figure 3.
  • S302 includes S501 and S502.
  • S501 Obtain data traffic of a packet that is received by the edge network device in the first network, where the destination address is the target IP address, and the multiple edge networks.
  • the first edge network device is included in the device.
  • the defense policy sending device 21 directly sends a data traffic statistics indication to each edge network device, when the respective edge network device receives the data traffic statistics indication, The data traffic is reported to the defense policy sending device.
  • the edge network device can report the data traffic to the defense policy sending device through SNMP.
  • the defense policy sending device 21 may send a statistical indication of the data traffic through the SDN controller 23, and the SDN controller 23 may further collect the data traffic.
  • the indication is sent to each edge network device.
  • the defense policy sending device 21 communicates with the SDN controller 23 through an interface that characterizes a state transition (REST) architecture.
  • the SDN controller 23 communicates with each network device via a network configuration (NETCONF) protocol.
  • the defense policy sending device 21 sends a data traffic statistics indication to the SDN controller 23, and after receiving the data traffic statistics indication, the SDN controller 23 converts the data traffic statistics indication into a network configuration protocol, and then converts the converted data traffic statistics.
  • the indication is sent to each edge network device.
  • the edge network device can directly report the data traffic to the defense policy sending device 21 through SNMP, or report the data traffic to the defense policy sending device 21 through the SDN controller 23.
  • the defense policy sending apparatus may send the data traffic statistics indication to all edge network devices of the first network, where all edge network devices of the first network will respectively calculate the data.
  • the traffic is sent to the defense policy sending device.
  • the defense policy sending apparatus determines, in the first network, an edge network device that includes a routing entry of the target IP address in the attack information, and presents the routing table to the presence The edge network device of the item sends the data traffic statistics indication. It can be understood by those skilled in the art that the defense policy sending apparatus can directly obtain the routing table of the edge network device and search for the routing entry, and can also determine the edge network device that exists the routing entry by using the SDN controller 23.
  • the first preset The condition may be one or more edge network devices with the largest data traffic among the plurality of data traffic.
  • the first preset condition may be that the data traffic exceeds a preset value.
  • the data flow of the packet of the specific destination IP address in the edge network device is obtained.
  • the data traffic is used as an important indicator to determine the network attack.
  • the source of the network attack packet can be quickly determined, so that the network attack can be defended in time to further improve the defense effect on the network attack packet.
  • FIG. 6 is a schematic structural diagram of a defense policy sending apparatus according to an embodiment of the present disclosure.
  • the apparatus includes: a receiving unit 61, a determining unit 62, and a sending unit 63.
  • the defense policy sending device may be a server or a software or hardware module on the server.
  • the receiving unit 61 and the transmitting unit 63 may be network interfaces, for example, may be the network interface 82 shown in FIG.
  • the determining unit 62 can be a processor, such as the processor 81 shown in FIG.
  • the receiving unit 61 is configured to receive attack information, where the attack information includes a target internet protocol IP address, where the attack information is used to indicate that a network attack packet whose destination address is the target IP address exists in the first network.
  • a determining unit 62 configured to determine, according to the attack information received by the receiving unit 61, that the network attack packet enters the first network by using a first edge network device, where the first edge network device is in the first network Edge device
  • the sending unit 63 is configured to send a defense policy to the first edge network device, where the defense policy is used to instruct the first edge network device to process, according to the defense policy, a packet whose destination address is the target IP address.
  • the attack information further includes a source IP address of the network attack packet
  • the determining unit 62 is further configured to obtain the source IP address from the attack information, and configured to use the source IP address according to the source IP address.
  • the first edge network device is determined by a correspondence to the first edge network device.
  • the receiving unit 61 is further configured to acquire, from the SDN controller, the correspondence between the source IP address and the first edge network device; or
  • the receiving unit 61 is further configured to acquire, from the first edge network device, a correspondence between the source IP address and the first edge network device.
  • the determining unit 62 is further configured to obtain, by using each of the plurality of edge network devices in the first network, a packet that is received by the edge network device in the preset time period as the destination IP address.
  • Data traffic the first edge network device includes the first edge network device, and configured to determine that the data traffic received by the first edge network device within the preset time period is satisfied The first preset condition.
  • the first preset condition is that the data traffic exceeds a preset value
  • the defense policy is to discard a packet whose destination address is the target IP address.
  • the defense policy sent to the first edge network device includes:
  • the packet whose destination address is the target IP address and meets the second preset condition is discarded.
  • the defense policy sending apparatus in this embodiment may be the execution subject of the steps in FIGS. 3 to 5.
  • the defense policy sending apparatus in this embodiment may be the defense policy sending apparatus 21 in the system architecture shown in FIG. 1 and FIG. 2.
  • the network attack packet is sent to the first network by using the first edge network device, and the first edge network device is instructed to perform the network attack by sending a defense policy to the first edge network device.
  • the defense reduces the transmission of the network attack packet in the first network, saves the transmission resource of the first network, and improves the defense effect on the network attack packet.
  • FIG. 7 is a schematic structural diagram of a first edge network device according to an embodiment of the present disclosure.
  • the edge network device includes: a receiving unit 71 and a processing unit 72.
  • the first edge network device can be a router.
  • the receiving unit 71 can be a network interface, such as the network interface 92 shown in FIG. 9;
  • the processing unit 72 can be a processor, such as the processor 91 shown in FIG.
  • the receiving unit 71 is configured to receive a defense policy, where the defense policy includes a target IP address, where the defense policy is used to instruct the first edge network device to process, according to the defense policy, a packet whose destination address is the target IP address.
  • the first edge network device is an edge network device in the first network, and the first network has a network attack packet whose destination address is the target IP address, and the network attack packet passes the first The edge network device enters the first network;
  • the processing unit 72 is configured to process, according to the defense policy received by the receiving unit 71, a packet whose destination address is the target IP address.
  • the data traffic of the packet whose destination address is the destination IP address that is received by the first edge network device in the preset time period exceeds a preset value
  • the defense policy is to discard the destination address as The packet of the target IP address.
  • the defense policy received by the receiving unit 71 includes:
  • the packet whose destination address is the target IP address and meets the second preset condition is discarded.
  • the first edge network device in this embodiment may be the first edge network device in the embodiment shown in FIG. 3 to FIG. 5.
  • the first edge network device in this embodiment may be an edge network device in the system architecture shown in FIG. 1 and FIG. 2.
  • the network attack packet is sent to the first network by using the first edge network device, and the network attack packet is reduced in the first network by performing a defense policy on the first edge network device.
  • the transmission saves the transmission resources of the first network and improves the defense effect on the network attack packets.
  • FIG. 8 is a schematic structural diagram of another defense policy sending apparatus according to an embodiment of the present disclosure. As shown in FIG. 8, the method includes: a processor 81, a network interface 82, and a memory 83.
  • the processor 81 includes, but is not limited to, a central processing unit (English: central processing unit, CPU for short), a network processor (English: network processor, referred to as NP), and an application-specific integrated circuit (English: application-specific integrated circuit, referred to as: ASIC) or one or more of programmable logic devices (English: programmable logic device, abbreviation: PLD).
  • the PLD can be a complex programmable logic device (English: complex programmable logic device, abbreviation: CPLD), a field-programmable gate array (English: field-programmable gate array, abbreviated: FPGA), general array logic (English: generic Array logic, abbreviation: GAL) or any combination thereof.
  • the network interface 82 can be a wired interface, such as a Fiber Distributed Data Interface (FDDI) or an Ethernet (English) interface.
  • Network interface 82 can also be a wireless interface, such as a wireless local area network interface.
  • the memory 83 includes, but is not limited to, a random access memory (English: random-access memory, RAM for short), a read only memory (English: read only memory, abbreviated as: ROM), and an erasable programmable read only memory (English: Erasable programmable read only memory, referred to as: EPROM).
  • a random access memory English: random-access memory, RAM for short
  • a read only memory English: read only memory, abbreviated as: ROM
  • EPROM erasable programmable read only memory
  • the processor 81 is configured to read the program stored in the memory 83 to perform the following operations:
  • the attack information is received by the network interface 82, where the attack information includes a target internet protocol IP address, and the attack information is used to indicate that the network attack packet with the destination address being the target IP address exists in the first network;
  • the defense policy Sending, by the network interface 82, the defense policy to the first edge network device, where the defense policy is used to instruct the first edge network device to process, according to the defense policy, a packet whose destination address is the target IP address.
  • the attack information further includes a source IP address of the network attack packet, where the determining that the network attack packet enters the first network by using the first edge network device includes:
  • Determining the first edge network device according to the correspondence between the source IP address and the first edge network device.
  • the determining that the network attack packet enters the first network by using the first edge network device includes:
  • the edge network device Obtaining, by the edge network device, the data traffic of the packet whose destination address is the target IP address received by the edge network device in the first network in the preset network, in the multiple edge network devices Including the first edge network device;
  • the processor 81 is further configured to:
  • the first preset condition is that the data traffic exceeds a preset value
  • the defense policy is to discard a packet whose destination address is the target IP address.
  • the defense policy sent to the first edge network device includes:
  • the packet whose destination address is the target IP address and meets the second preset condition is discarded.
  • the defense policy transmitting apparatus in this embodiment may be an execution subject of the steps in the embodiment shown in FIGS. 3 to 5.
  • the defense policy sending apparatus in this embodiment may be the defense policy sending apparatus 21 in the system architecture shown in FIG. 1 and FIG. 2.
  • the network attack packet is sent to the first network by using the first edge network device, and the first edge network device is instructed to perform the network attack by sending a defense policy to the first edge network device.
  • the defense reduces the transmission of the network attack packet in the first network, saves the transmission resource of the first network, and improves the defense effect on the network attack packet.
  • FIG. 9 is a schematic structural diagram of a first edge network device according to an embodiment of the present disclosure.
  • the processor 91 includes a processor 91, a network interface 92, and a memory 93.
  • the processor 91 includes, but is not limited to, a central processing unit (English: central processing unit, CPU for short), a network processor (English: network processor, referred to as NP), and an application-specific integrated circuit (English: application-specific integrated circuit, referred to as: ASIC) or one or more of programmable logic devices (English: programmable logic device, abbreviation: PLD).
  • the PLD can be a complex programmable logic device (English: complex programmable logic device, abbreviation: CPLD), a field-programmable gate array (English: field-programmable gate array, abbreviated: FPGA), general array logic (English: generic Array logic, abbreviation: GAL) or any combination thereof.
  • the network interface 92 can be a wired interface, such as a Fiber Distributed Data Interface (FDDI) or an Ethernet (English) interface.
  • Network interface 92 can also be a wireless interface, such as a wireless local area network interface.
  • the memory 93 includes, but is not limited to, a random access memory (English: random-access memory, RAM for short), a read only memory (English: read only memory, abbreviated as: ROM), and an erasable programmable read only memory (English: Erasable programmable read only memory, referred to as: EPROM).
  • a random access memory English: random-access memory, RAM for short
  • a read only memory English: read only memory, abbreviated as: ROM
  • EPROM erasable programmable read only memory
  • the processor 91 is configured to read a program stored in the memory 93 to perform the following operations:
  • the first edge network device is configured to process, according to the defense policy, a packet whose destination address is the target IP address, where the first edge network device is an edge network device in the first network, where the A network attack packet with a destination address being the destination IP address exists in a network, and the network attack packet enters the first network by using the first edge network device;
  • the data traffic of the packet whose destination address is the destination IP address that is received by the first edge network device in the preset time period exceeds a preset value
  • the defense policy is to discard the destination address as The packet of the target IP address.
  • the defense policy received by the device includes:
  • the packet whose destination address is the target IP address and meets the second preset condition is discarded.
  • the first edge network device in this embodiment may be the first edge network device in the embodiment shown in FIG. 3 to FIG. 5.
  • the first edge network device in this embodiment may be an edge network device in the system architecture shown in FIG. 1 and FIG. 2.
  • the network attack packet is sent to the first network by using the first edge network device, and the network attack packet is reduced in the first network by performing a defense policy on the first edge network device.
  • the transmission saves the transmission resources of the first network and improves the defense effect on the network attack packets.
  • the storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例公开了一种网络攻击防御策略的发送方法和装置，以及网络攻击防御方法和装置，其中，网络攻击防御策略的发送方法可包括：接收攻击信息，所述攻击信息包括目标网际协议IP地址，所述攻击信息用于指示第一网络中存在目的地址为所述目标IP地址的网络攻击报文；确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，所述第一边缘网络设备为所述第一网络中的边缘设备；向所述第一边缘网络设备发送防御策略，所述防御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文。本申请可以降低网络攻击报文对网络资源的占用，改善对网络攻击报文的防御效果。

Description

网络攻击防御策略发送、网络攻击防御的方法和装置 技术领域
本申请涉及通信领域，尤其涉及网络攻击防御策略发送、网络攻击防御的方法和装置。
背景技术
网络攻击一直是当今网络中重要安全问题，例如：拒绝服务(denial of service，DoS)攻击是一种网络攻击。DoS攻击是指通过对受害主机漏洞的攻击，使受害主机网络协议栈失效、资源耗尽、主机挂起和系统崩溃，从而造成受害主机拒绝服务。在DoS攻击中，分布式拒绝服务(distributed DoS，DDoS)攻击是较为常见的一种DoS攻击，通过网络上多个主机一同对目标主机发起DoS攻击。
在目前对网络攻击的防御方法，通常是在网络中部署专门的清洗设备。在检测到网络设备传输的报文中包括网络攻击报文时，网络设备将接收到的报文发送到清洗设备，该清洗设备根据网络攻击报文特征，识别出网络攻击报文并丢弃该网络攻击报文，即对网络设备接收的报文进行清洗，然后再将清洗后的报文发送回该网络设备。
然而，部署清洗设备的成本较高，且所述网络攻击报文进入清洗设备之前，已经在网络中的各个网络设备中传输，占用了大量的网络资源，在网络设备检测到网络攻击并将报文发送给清洗设备的过程中，网络攻击报文还在网络设备和清洗设备之间传输，也会占用网络资源。因此，该方案对网络攻击报文的防御成本高，防御效果较差。
发明内容
本申请实施例提供了一种网络攻击防御策略的发送方法和装置，以及网络攻击防御方法和装置，可以降低网络攻击报文对网络资源的占用，改善对网络攻击报文的防御效果。
第一方面，本申请实施例提供一种网络攻击防御策略的发送方法，该方法包括：
接收攻击信息，所述攻击信息包括目标网际协议(Internet Protocol，IP)地址，所述攻击信息用于指示第一网络中存在目的地址为所述目标IP地址的网络攻击报文；
确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，所述第一边缘网络设备为所述第一网络中的边缘设备；
向所述第一边缘网络设备发送防御策略，所述防御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文。
该实现方式中，由于所述网络攻击报文通过第一边缘网络设备进入所述第一网络，通过向第一边缘网络设备发送防御策略，指示所述第一边缘网络设备对所述网络攻击进行防御，减少了网络攻击报文在所述第一网络中的传输，节约了所述第一网络的传输资源，改善了对网络攻击报文的防御效果。
在一种可能的实现方式中，所述攻击信息还包括所述网络攻击报文的源IP地址，所述确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，包括：从所述攻击信息中获取所述源IP地址；根据所述源IP地址到所述第一边缘网络设备的对应关系确定所述第一边缘网络设备。该实现方式中，根据所述对应关系确定所述第一边缘网络设备，从而可以快速确定作为网络攻击报文来源的所述第一边缘网络设备，以及时对网络攻击报文进行防御。
在一种可能的实现方式中，所述确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，包括：获取所述第一网络中多个边缘网络设备中的每个边缘网络设备在预设时间段内接收的目的地址为所述目标IP地址的报文的数据流量，所述多个边缘网络设备中包括所述第一边缘网络设备；确定所述第一边缘网络设备在所述预设时间段内接收的所述数据流量满足第一预设条件。该实现方式中，通过获取边缘网络设备中特定目的IP地址的报文的数据流量，并且将数据流量作为判断网络攻击的一个重要指标，可以快速确定网络攻击报文的来源，从而及时对网络攻击作出防御，进一步改善对网络攻击报文的防御效果。
在一种可能的实现方式，根据所述源IP地址到所述第一边缘网络设备的 对应关系确定所述第一边缘网络设备之前，该方法还包括：从软件定义网络(Software Define Network，SDN)控制器获取所述源IP地址到所述第一边缘网络设备的对应关系。该实现方式中，从SDN控制器获取其已经存储的IP地址和边缘网络设备的对应关系，可以充分利用SDN的网络架构中的已有信息，快速确定网络攻击报文的来源，从而提高网络攻击的防御效率。
在一种可能的实现方式中，所述第一预设条件为所述数据流量超过预设值，所述防御策略为丢弃目的地址为所述目标IP地址的报文。该实现方式中，通过当数据流量超过预设值时采取丢弃目的地址为所述目标IP地址的报文的防御策略，避免了网络攻击的攻击流量对第一网络带宽造成严重威胁。
在一种可能的实现方式中，所述防御策略包括：丢弃目的地址为所述目标IP地址的报文。采用丢弃目的地址为所述目标IP地址的报文的防御策略，所述第一边缘网络设备只需要提取接收的报文中的目的IP地址并判断该目的IP地址与所述目标IP地址是否匹配。所述策略在实现防御网络攻击的同时，无需占用过多所述第一边缘网络设备的运算资源。此外，该防御策略还可以快速降低网络中网络攻击报文对整个网络造成的传输资源的占用，从而降低所述网络攻击报文对网络的伤害。
在一种可能的实现方式中，所述防御策略包括：丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文。采用该防御策略，所述第一边缘网络设备可以由针对性的丢弃网络攻击报文，并继续为正常的报文提供转发，从而提高了网络攻击的防御效果。
第二方面，本申请实施提供一种网络攻击防御方法，该方法包括：
第一边缘网络设备接收防御策略，所述防御策略包括目标IP地址，所述防御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文，所述第一边缘网络设备为第一网络中的边缘网络设备，所述第一网络中存在目的地址为所述目标IP地址的网络攻击报文，所述网络攻击报文通过所述第一边缘网络设备进入所述第一网络；
所述第一边缘网络设备根据所述防御策略，处理目的地址为所述目标IP地址的报文。
该实现方式中，由于所述网络攻击报文通过第一边缘网络设备进入所述第 一网络，通过在第一边缘网络设备上执行防御策略，可以减少网络攻击报文在所述第一网络中的传输，节约了所述第一网络的传输资源，改善了对网络攻击报文的防御效果。此外，由于第一网络中不需要设置专门的清洗设备，降低了网络攻击防御的成本。
在一种可能的实现方式中，所述第一边缘网络设备在预设的时间段内接收的目的地址为所述目标IP地址的报文的数据流量超过预设值，所述防御策略为丢弃所述目的地址为所述目标IP地址的报文。
在一种可能的实现方式中，所述防御策略包括：丢弃目的地址为所述目标IP地址的报文。在一种可能的实现方式中，所述防御策略包括丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文。
第三方面，本申请实施例提供一种防御策略发送装置，包括：接收单元、确定单元和发送单元，其中：
所述接收单元，用于接收攻击信息，所述攻击信息包括目标网际协议IP地址，所述攻击信息用于指示第一网络中存在目的地址为所述目标IP地址的网络攻击报文；
所述确定单元，用于根据所述接收单元接收的所述攻击信息确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，所述第一边缘网络设备为所述第一网络中的边缘设备；
所述发送单元，用于向所述第一边缘网络设备发送防御策略，所述防御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文。
在一种可能的实现方式中，所述攻击信息还包括所述网络攻击报文的源IP地址，所述确定单元还用于从所述攻击信息中获取所述源IP地址，以及用于根据所述源IP地址到所述第一边缘网络设备的对应关系确定所述第一边缘网络设备。
在一种可能的实现方式中，所述确定单元还用于获取所述第一网络中多个边缘网络设备中的每个边缘网络设备在预设时间段内接收的目的地址为所述目标IP地址的报文的数据流量，所述多个边缘网络设备中包括所述第一边缘网络设备，以及用于确定所述第一边缘网络设备在所述预设时间段内接收的所 述数据流量满足第一预设条件。
在一种可能的实现方式中，所述接收单元还用于从SDN控制器获取所述源IP地址到所述第一边缘网络设备的对应关系。
在一种可能的实现方式中，所述第一预设条件为所述数据流量超过预设值，所述防御策略为丢弃目的地址为所述目标IP地址的报文。
在一种可能的实现方式中，向所述第一边缘网络设备发送的防御策略包括：丢弃目的地址为所述目标IP地址的报文；或者丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文。
第四方面，本申请实施例提供一种第一边缘网络设备，包括接收单元和处理单元，其中：
所述接收单元，用于接收防御策略，所述防御策略包括目标IP地址，所述防御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文，所述第一边缘网络设备为第一网络中的边缘网络设备，所述第一网络中存在目的地址为所述目标IP地址的网络攻击报文，所述网络攻击报文通过所述第一边缘网络设备进入所述第一网络；
所述处理单元，用于根据所述接收单元接收的所述防御策略，处理目的地址为所述目标IP地址的报文。
在一种可能的实现方式中，所述第一边缘网络设备在预设的时间段内接收的目的地址为所述目标IP地址的报文的数据流量超过预设值，所述防御策略为丢弃所述目的地址为所述目标IP地址的报文。
在一种可能的实现方式中，所述接收单元接收的防御策略包括：丢弃目的地址为所述目标IP地址的报文；或者丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文。
第五方面，本申请实施例提供一种防御策略发送装置，包括：处理器、网络接口和存储器，其中，所述处理器用于读取所述存储器中存储的程序执行以下操作：
通过所述网络接口接收攻击信息，所述攻击信息包括目标网际协议IP地址，所述攻击信息用于指示第一网络中存在目的地址为所述目标IP地址的网络攻击报文；
确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，所述第一边缘网络设备为所述第一网络中的边缘设备；
通过所述网络接口向所述第一边缘网络设备发送防御策略，所述防御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文。
在一种可能的实现方式中，所述攻击信息还包括所述网络攻击报文的源IP地址，所述确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，包括：从所述攻击信息中获取所述源IP地址；根据所述源IP地址到所述第一边缘网络设备的对应关系确定所述第一边缘网络设备。
在一种可能的实现方式中，所述确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，包括：获取所述第一网络中多个边缘网络设备中的每个边缘网络设备在预设时间段内接收的目的地址为所述目标IP地址的报文的数据流量，所述多个边缘网络设备中包括所述第一边缘网络设备；确定所述第一边缘网络设备在所述预设时间段内的所述数据流量满足第一预设条件。
在一种可能的实现方式中，根据所述源IP地址到所述第一边缘网络设备的对应关系确定所述第一边缘网络设备之前，所述处理器还用于执行：从SDN控制器获取所述源IP地址到所述第一边缘网络设备的对应关系。
在一种可能的实现方式中，所述第一预设条件为所述数据流量超过预设值，所述防御策略为丢弃目的地址为所述目标IP地址的报文。
在一种可能的实现方式中，向所述第一边缘网络设备发送的防御策略包括：丢弃目的地址为所述目标IP地址的报文；或者丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文。
第六方面，本申请实施例提供一种第一边缘网络设备，包括：处理器、网络接口和存储器，其中，所述处理器用于读取所述存储器中存储的程序执行以下操作：
通过所述网络接口接收防御策略，所述防御策略包括目标IP地址，所述防御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文，所述第一边缘网络设备为第一网络中的边缘网络设备，所述第一网络中存在目的地址为所述目标IP地址的网络攻击报文，所述 网络攻击报文通过所述第一边缘网络设备进入所述第一网络；
根据所述防御策略，处理目的地址为所述目标IP地址的报文。
在一种可能的实现方式中，所述第一边缘网络设备在预设的时间段内接收的目的地址为所述目标IP地址的报文的数据流量超过预设值，所述防御策略为丢弃所述目的地址为所述目标IP地址的报文。
在一种可能的实现方式中，所述装置接收的防御策略包括：丢弃目的地址为所述目标IP地址的报文；或者丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例提供的一种可应用的系统构架图；
图2是本申请实施例提供的一种可应用的另一系统构架图；
图3是本申请实施例提供的一种网络攻击防御策略发送以及网络攻击防御的方法的示意图；
图4是本申请实施例提供的另一种网络攻击防御策略的发送以及网络攻击防御方法的示意图；
图5是本申请实施例提供的另一种网络攻击防御策略的发送以及网络攻击防御方法的示意图；
图6是本申请实施例提供的一种防御策略发送装置的结构示意图；
图7是本申请实施例提供的一种第一边缘网络设备的结构示意图；
图8是本申请实施例提供的另一种防御策略发送装置的结构示意图；
图9是本申请实施例提供的另一种第一边缘网络设备的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清 楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
图1是本申请实施例提供的一种可应用的系统构架图，如图1所示，包括：网络101中包括多个边缘网络设备，例如边缘网络设备11、边缘网络设备12以及边缘网络设备13。举例来说，边缘网络设备11、边缘网络设备12以及边缘网络设备13中的每个，均可以是路由器、交换机、防火墙、分组传送网设备、波分复用设备、光传送网设备、基站或者基站控制器。
网络101中的边缘网络设备11与网络102中的边缘网络设备连接，接收来自网络102的报文，或向网络102发送报文；网络101中的边缘网络设备12与网络103中的边缘网络设备连接，接收来自网络103的报文，或向网络103发送报文；网络101中的边缘网络设备13与网络104中的边缘网络设备连接，接收来自网络104的报文，或向网络104发送报文。举例来说，所述网络101、网络102、网络103以及网络104中的每个网络均可以是运营商网络(provider network)，也可以是局域网。例如，假设网络101为运营商网络，则边缘网络设备11、边缘网络设备12以及边缘网络设备13可以是运营商边缘(provider edge，PE)网络设备。
举例来说，边缘网络设备12从网络103中的边缘网络设备接收来自网络103的报文，该报文的目的IP地址对应的主机为位于网络102中的主机。边缘网络设备12通过网络101中的一跳或多跳网络设备，将所述报文发送给边缘网络设备11，并由边缘网络设备11将所述报文发送到网络102中与边缘网络设备11相连的网络设备，从而使得该报文进入网络102中。
用于检测网络攻击报文的检测设备22，与网络中的某个网络设备耦合，并检测该网络设备接收的报文中是否存在网络攻击报文。例如，检测设备22与网络101中的边缘网络设备13耦合，该检测设备22用于检测边缘网络设备13接收到的报文中是否具有网络攻击报文，该网络攻击报文针对的主机，可以是网络101当中的主机，也可以是其他网络中的主机，例如网络102中的主机。
检测设备22在检测到该网络攻击报文时，将该检测结果发送给防御策略 发送装置21。本申请实施例中，防御策略发送装置21可以是独立的物理设备，例如服务器。防御策略发送装置21还可以是部署在物理设备上的功能模块。防御策略发送装置21可以是位于网络101内部或者外部的设备或功能模块。
防御策略发送装置21可以与网络101中的各个边缘网络设备通信，并向网络101中需要防御网络攻击的边缘网络设备发送防御策略。
在一种可能的示例中，网络101中的各个边缘网络设备可以通过简单网络管理协议(Simple Network Management Protocol，SNMP)与防御策略发送装置21进行通信。
在另一种可能的示例中，如图2所示，网络101中的各个网络设备与软件定义网络(software-defined networking，SDN)控制器23通信，SDN控制器23与防御策略发送装置21通信。SDN控制器23收集网络设备要向防御策略发送装置21发送的信息，并发送给防御策略发送装置21；或者SDN控制器23通过与各个网络设备预先建立的连接将防御策略发送装置21要向各个网络设备发送的防御策略发送给各个网络设备。例如，网络101中的网络设备通过内部边界网关协议(internal Border Gateway Protocol，iBGP)与SDN控制器23进行通信。其中，SDN控制器23可以是独立的物理设备，例如服务器。SDN控制器23也可以是与防御策略发送装置21部署在同一物理设备上的功能模块。当然，在图2所示的系统架构中各边缘网络设备同样也可以与防御策略发送装置21进行通信。
举例来说，图1或图2的系统架构中，所述网络攻击报文可以是DoS攻击报文，例如具体可以是DDoS攻击报文。
举例来说，所述网络攻击报文可以是泛洪攻击报文、畸形报文攻击报文或者扫描探测类攻击报文。其中，所述泛洪攻击报文是攻击者在短时间内向目标系统发送大量的虚假请求，导致目标系统疲于应付无用信息，而无法为合法用户提供正常服务。例如：所述泛洪攻击报文可以是同步洪水(synchronous Flood，SYN Flood)报文、超文本传输协议获取洪水(HyperText Transfer Protocol Get Flood)报文、用户数据报协议洪水(User Datagram Protocol Flood，UDP Flood)报文、域名系统查询洪水(Domain Name System Query Flood，DNS Query Flood)报文、确认字符洪水(Acknowledgement Flood，ACK Flood)报文、因特网控 制报文协议洪水(Internet Control Message Protocol Flood，ICMP Flood)报文、字符发生器协议(Character Generator Protocol,Chargen)反射攻击(Chargen reflection attack)报文和网络时间协议反射攻击(Network Time Protocol Reflection Attack，NTP Reflection Attack)报文中的一种或多种。
所述畸形报文攻击报文通常指攻击者发送大量有缺陷的报文，从而造成主机或服务器在处理这类报文时消耗大量资源或者系统崩溃。例如：所述畸形报文攻击报文可以是会话初始协议畸形(Session Initiation Protocol Freak，SIP Freak)报文、BGP畸形报文、中间系统到中间系统畸形(Intermediate system to intermediate system Freak，ISIS Freak)报文、实时流传输协议畸形(Real Time Streaming Protocol Freak，RTSP Freak)报文和传输控制协议标识错误(Transmission Control Protocol Flag Error，TCP Flag Error)报文中的一种或多种。
所述扫描探测类攻击报文可以是一种潜在的攻击行为，并不具备直接的破坏行为；所述扫描探测类攻击报文通常是攻击者发动真正攻击前的网络探测行为。
请参阅图3，图3是本申请实施例提供的一种网络攻击防御策略发送以及网络攻击防御的方法的示意图。举例来说，所述方法可以应用于图1或图2所示的应用场景中。图3所示的方法中的第一网络，可以是图1或图2所示的网络101。图3所示的方法中的第一边缘网络设备，可以是图1或图2所示的边缘网络设备12。图3所示的方法中S301，S302和S303的执行主体，可以是图1或图2所示的防御策略发送装置21。如图3所示，包括：
S301、接收攻击信息，所述攻击信息包括目标网际协议IP地址，所述攻击信息用于指示第一网络中存在目的地址为所述目标IP地址的网络攻击报文。
S301中接收的攻击信息，可以来自网络101中的网络设备，例如图1或图2中的网络101中的任何一个网络设备。所述攻击信息也可以来自与图1或图2中的网络101中的任一一个网络设备耦合的检测设备，例如图1或图2中所示的与边缘网络设备13耦合的检测设备22。当然，本领域技术可以理解的是，检测设备22也可以与网络101中的非边缘网络设备耦合。网络101中， 与网络设备耦合的检测设备可以是一个，也可以是多个。
例如：检测设备22与边缘网络设备13耦合，边缘网络设备13复制接收到的报文并发送给检测设备22，检测设备22分析所述报文是否具备网络攻击报文的特征，若具备网络攻击报文的特征，则检测设备22获取该网络攻击报文的目的IP地址，将所述网络攻击报文的目的IP地址写入所述攻击信息。网络攻击报文的具体特征举例，请参见S303中的示例。
举例来说，所述攻击信息中还可以包括所述目标IP地址受到的网络攻击的攻击类型和数据流量大小。
S302、确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，所述第一边缘网络设备为所述第一网络中的边缘设备。
具体来说，所述网络攻击报文通过第一边缘网络设备进入所述第一网络是指，所述第一边缘网络设备从与所述第一边缘网络设备通信的另一个网络的边缘网络设备接收所述网络攻击报文。举例来说，如图1所示，所述第一边缘网络设备为边缘网络设备12，第一网络为网络101，边缘网络设备12与网络103通信，接收网络103中的边缘网络设备发送的报文。所述网络攻击报文从网络103中的第二边缘网络设备发送给边缘网络设备12，这样该网络攻击报文就进入到网络101。通过S302可以查找到所述第一边缘网络设备，即查找到所述网络攻击报文进入第一网络的源头。确定所述第一边缘网络设备的具体方法的示例，可以参见图4和图5的描述。
S303、向所述第一边缘网络设备发送防御策略，所述防御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文。
例如：S303发送的防御策略可以包括：丢弃目的地址为所述目标IP地址的报文；或者丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文。
其中，所述丢弃目的地址为所述目标IP地址的报文可以是丢弃目的地址为所述目标IP地址的所有报文，所述丢弃目的地址为所述目标IP地址的报文可以是丢弃特定时段内收到的、目的地址为所述目标IP地址的所有报文。在一种示例中，当第一边缘网络设备在预设时间段内接收到的目的地址为所述目标IP地址的报文的数据流量超过第一预设值时，所述防御策略发送装置21向 所述第一边缘网络设备发送该丢弃目的地址为所述目标IP地址的报文的防御策略。所述数据流量可以是所述第一边缘网络设备采用图5所述的方式发送给所述防御策略发送装置21的。在另一种示例中，当与检测设备22耦合的网络设备在预设时间段内接收到的目的地址为所述目标IP地址的报文的数据流量超过第一预设值时，所述防御策略发送装置21向所述第一边缘网络设备发送该丢弃目的地址为所述目标IP地址的报文的防御策略。在所述数据流量是与检测设备22耦合的网络设备接收的数据流量的情况下，该数据流量可以携带在S301中所述的攻击信息中。采用丢弃目的地址为所述目标IP地址的报文的防御策略，所述第一边缘网络设备只需要提取接收的报文中的目的IP地址并判断该收到的报文的目的IP地址与所述目标IP地址是否相同，如果相同，则丢弃收到的报文；如果不相同，则正常转发收到的报文。所述防御策略实现防御网络攻击，无需占用过多所述第一边缘网络设备的运算资源。此外，该防御策略还可以快速降低网络中网络攻击报文对整个网络造成的传输资源的占用，从而降低所述网络攻击报文对网络的伤害。
在一种可能的示例中，所述丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文的防御策略中，所述第二预设条件为报文的传输协议的类型。举例来说，所述第一边缘网络设备中预先存储了所述目标IP地址对应的主机所需接收的报文的传输类型，例如该主机只需要接收采用传输控制协议(Transmission Control Protocol，TCP)传输的业务，那么当某个报文携带的协议号不是TCP，例如当该报文携带的协议号是用户数据报协议(User Datagram Protocol，UDP)的时候，则所述报文满足所述第二预设条件。即，边缘网络设备12根据该防御策略将目的地址为所述目标IP地址的报文中协议号不是TCP协议的报文丢弃。
在另一种可能的示例中，所述丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文的防御策略中，所述第二预设条件为特定类型的网络攻击报文的特征。举例来说，网络攻击报文的特征可以是收到的报文长度超过第二预设值。例如，NTP报文一般只有100多字节，而NTP攻击报文往往上千字节。因此，可以将所述第二预设值设置为超过正常NTP报文的长度值，例如设为500字节。
本申请实施例提供了一些典型的网络攻击报文类型和网络攻击报文长度的对应关系，如表1所示。
表1
Figure PCTCN2016077662-appb-000001
举例来说，针对畸形报文，第二预设条件可以是畸形报文的典型特征。例如，如果收到的报文是TCP报文的情况下，在该TCP报文的TCP首部中包括6个标识：(1)URG标识，表示紧急指针字段有效；(2)ACK标识，表示确认序号字段有效；(3)PSH标识，指示接收方应该尽快将这个报文段交给应用层；(4)RST标识，指示重建连接；(5)SYN标识，表示同步序号；(6)FIN标识，表示发端没有后续的数据要发送。由于正常的TCP报文中所述标识(1)～(6)的值只会按照特定的规则出现，不按照特定规则标识的TCP报文会影响接收该TCP报文的主机的响应速度。因此，当所述标识(1)～(6)为以下组合时，可以直接被认为是畸形报文，即可以将所述第二预设条件设为在TCP首部中所述6个标识的值为以下的任一一种：
(1)所述标识(1)～(6)的值均为1；
(2)所述标识(1)～(6)的值均为0；
(3)SYN标识的值为1，且RST标识的值为1；
(4)FIN标识的值为1，且RST标识的值为1；
(5)FIN标识的值、URG标识的值或者PSH标识的值中的只有一个为1，其他5个标识的值均为0；
(6)SYN标识的值为1的报文中包括净荷。
举例来说，防御策略发送装置中预先存储了针对不同类型的网络攻击报文的防御策略，并在接收到攻击信息后从预先存储的防御策略中选择其中的一种。防御策略发送装置还可以根据攻击信息中的参数，对防御策略进行调整。
S304、第一边缘网络设备接收所述防御策略。
其中，该防御策略是S303中生成的防御策略。该防御策略包括所述目标IP地址，所述防御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文，所述第一边缘网络设备为第一网络中的边缘网络设备，所述第一网络中存在目的地址为所述目标IP地址的网络攻击报文，所述网络攻击报文通过所述第一边缘网络设备进入所述第一网络。
S305、第一边缘网络设备根据所述防御策略，处理目的地址为所述目标IP地址的报文。
具体来说，所述第一边缘网络设备对目的地址为所述目标IP地址的报文执行所述防御策略。防御策略的具体示例可以参考S303中对防御策略的举例说明，此处不再举例。
可选的，所述方法还可以进一步包括防御策略发送装置输出防御报表。例如，所述防御报表可以包括所述第一边缘网络设备根据防御策略丢弃的目的地址为所述目标IP地址的报文的数量。所述防御报表还可以包括所述目标IP受到网络攻击的攻击类型等。通过防御报表，用户可以知道网络的安全状态。
本实施例中，通过所述步骤可以实现在第一网络的源头对网络攻击进行防御，有效的保护了第一网络，节约了第一网络中的传输资源。另外，本实施例中，通过边缘网络设备对网络攻击报文进行处理，不需要使用专门的清洗设备，从而在保证防御效果的同时有效的降低实现成本。
图4是本申请实施例提供的另一种网络攻击防御策略发送以及网络攻击的防御方法的示意图，图4所记载的方案是在图3所记载的方案的基础上做了 部分修改，下面仅阐述与图3不同的部分，相同部分请参见图3的说明：
在图4所示的实施例中，所述攻击信息还包括所述网络攻击报文的源IP地址，S302具体包括S401和S402。
S401、从所述攻击信息中获取所述源IP地址。
具体来说，所述源IP地址是发送所述网络攻击报文的源IP地址，即发送该网络攻击报文的主机的IP地址。
S402、根据所述源IP地址到所述第一边缘网络设备的对应关系确定所述第一边缘网络设备。
举例来说，所述对应关系可以从所述第一边缘网络设备的路由表中获得。例如，根据所述网络攻击报文的源IP地址查找所述第一边缘网络设备的路由表中是否存在匹配的表项。如果查找到所述第一边缘设备的路由表中存在第一路由表项，所述第一路由表项中的目的IP地址为第一IP地址，所述第一路由表项中的存储的下一跳是与所述第一边缘网络设备相连的、所述第一网络之外的其他网络中的网络设备的IP地址，并且，所述第一IP地址与所述网络攻击报文的源IP地址匹配，则确定存在所述源IP地址与所述第一边缘网络设备的对应关系。例如，所述第一IP地址与所述网络攻击报文的源IP地址匹配，可以是指最长前缀匹配(英文：longest prefix match)。
假定以图1中边缘网络设备12为所述第一边缘网络设备，所述网络攻击报文的源IP地址是192.168.20.19。根据所述网络攻击报文的源IP地址查找所述第一边缘网络设备的路由表中是否存在匹配的表项。如果查找到所述边缘网络设备12的路由表中存在第一路由表项，所述第一路由表项中的目的IP地址为第一IP地址192.168.0.0/16，所述第一路由表项中的下一跳为网络103中的边缘网络设备的IP地址，则认为存在所述源IP地址与边缘网络设备12的对应关系。
举例来说，所述路由表可以理解为由外部边界网关协议(External Border Gateway Protocol，eBGP)生成的路由表。
在一种可能的示例中，防御策略发送装置从SDN控制器获取所述源IP地址到所述第一边缘网络设备的对应关系。
例如：在图2所示的系统架构中，SDN控制器23获取包括第一边缘网络 设备在内的多个边缘网络设备的路由表。在一种示例中，SDN控制器23在S301之前或者S301之后，获取所述第一网络中多个边缘网络设备的路由表，并且根据所述多个路由表中的多个路由表项，生成多个对应关系，该对应关系包括IP地址与边缘网络设备之间的对应关系，并将所述对应关系发送给防御策略发送装置21，防御策略发送装置21在S301之后根据攻击信息中的网络攻击报文的源IP地址，从所述多个IP地址与边缘网络设备的对应关系中，查找到所述源IP地址与所述第一边缘网络设备的对应关系。在另一种示例中，防御策略发送装置也可以在S301之后将所述源IP地址发送给SDN控制器23，SDN控制器23查找到所述源IP地址与所述第一边缘网络设备的对应关系之后，将所述第一边缘网络设备的标识发送给所述防御策略发送装置21。
在另一种可能的示例中，所述防御策略发送装置从所述第一边缘网络设备获取所述源IP地址到所述第一边缘网络设备的对应关系。
例如，在图1或图2所示的系统架构中，网络101中的各个边缘网络设备通过SNMP向防御策略发送装置21上报各自的路由表。所述防御策略发送装置21从各个边缘网络设备发送的路由表中，获取所述对应关系。
本实施例中，根据所述对应关系确定所述第一边缘网络设备，从而可以快速确定第一网络中作为网络攻击报文来源的所述第一边缘网络设备，以及时对网络攻击报文进行防御。
图5是本申请实施例提供的另一种网络攻击防御策略发送以及网络攻击的防御方法的示意图，图5所记载的方案是在图3所记载的方案的基础上做了部分修改，下面仅阐述与图3不同的部分，相同部分请参见图3的说明。
在图5所示的实施例中，S302包括S501和S502。
S501，获取所述第一网络中多个边缘网络设备中的每个边缘网络设备在预设时间段内接收的目的地址为所述目标IP地址的报文的数据流量，所述多个边缘网络设备中包括所述第一边缘网络设备。
在一种可能的示例中，例如图1的应用场景中，防御策略发送装置21直接向各个边缘网络设备发送数据流量统计指示，当所述各个边缘网络设备接收到所述数据流量统计指示时，向防御策略发送装置上报所述数据流量。举例来 说，边缘网络设备可以通过SNMP向防御策略发送装置上报所述数据流量。
在另一种可能的示例中，例如图2所示的应用场景中，防御策略发送装置21可以通过SDN控制器23发送所述数据流量的统计指示，SDN控制器23再将所述数据流量统计指示发送给各个边缘网络设备。举例来说，所述防御策略发送装置21与SDN控制器23通过表征状态转移(representational state transfer，REST)架构的接口通信。SDN控制器23与各个网络设备通过网络配置(network configuration，NETCONF)协议通信。防御策略发送装置21向SDN控制器23发送数据流量统计指示，SDN控制器23接收到该数据流量统计指示后，将其转换成网络配置协议的数据流量统计指示，再将转换后的数据流量统计指示发送给各边缘网络设备。在该示例中，边缘网络设备可以通过SNMP直接向防御策略发送装置21上报所述数据流量，或者通过SDN控制器23向防御策略发送装置21上报数据流量。
在一种可能的示例中，防御策略发送装置可以向所述第一网络的所有边缘网络设备发送所述数据流量统计指示，所述第一网络的所有边缘网络设备均将各自统计的所述数据流量发送给所述防御策略发送装置。
在另一种可能的示例中，防御策略发送装置确定所述第一网络中，存在包含所述攻击信息中的所述目标IP地址的路由表项的边缘网络设备，并向存在所述路由表项的边缘网络设备发送所述数据流量统计指示。本领域技术人员可以理解的是，防御策略发送装置可以直接获取边缘网络设备的路由表，并查找所述路由表项，也可以通过SDN控制器23确定存在所述路由表项的边缘网络设备。
S502，确定所述第一边缘网络设备在所述预设时间段内接收的所述数据流量满足第一预设条件。
在一种可能的示例中，获取所述第一网络中多个边缘网络设备中的每个边缘网络设备的所述数据流量之后，对所述多个数据流量进行排序，所述第一预设条件可以是所述多个数据流量中数据流量最大的一个或多个边缘网络设备。
在另一种可能的示例中，所述第一预设条件可以是所述数据流量超过预设值。
本实施例中，通过获取边缘网络设备中特定目的IP地址的报文的数据流 量，并且将数据流量作为判断网络攻击的一个重要指标，可以快速确定网络攻击报文的来源，从而及时对网络攻击作出防御，进一步改善对网络攻击报文的防御效果。
请参阅图6，图6是本申请实施例提供的一种防御策略发送装置的结构示意图，如图6所示，所述装置包括：接收单元61、确定单元62和发送单元63。举例来说，所述防御策略发送装置可以是服务器，也可以是服务器上的软件或硬件模块。接收单元61和发送单元63可以是网络接口，例如可以是图8所示的网络接口82。确定单元62可以处理器，例如可以是图8所示的处理器81。
接收单元61，用于接收攻击信息，所述攻击信息包括目标网际协议IP地址，所述攻击信息用于指示第一网络中存在目的地址为所述目标IP地址的网络攻击报文。
确定单元62，用于根据接收单元61接收的所述攻击信息确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，所述第一边缘网络设备为所述第一网络中的边缘设备；
发送单元63，用于向所述第一边缘网络设备发送防御策略，所述防御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文。
可选的，所述攻击信息还包括所述网络攻击报文的源IP地址，确定单元62还可以用于从所述攻击信息中获取所述源IP地址，以及用于根据所述源IP地址到所述第一边缘网络设备的对应关系确定所述第一边缘网络设备。
该实施方式中，接收单元61还用于从SDN控制器获取所述源IP地址到所述第一边缘网络设备的对应关系；或者
接收单元61还用于从所述第一边缘网络设备获取所述源IP地址到所述第一边缘网络设备的对应关系。
可选的，确定单元62还用于获取所述第一网络中多个边缘网络设备中的每个边缘网络设备在预设时间段内接收的为目的地址为所述目标IP地址的报文的数据流量，所述多个边缘网络设备中包括所述第一边缘网络设备，以及用于确定所述第一边缘网络设备在所述预设时间段内接收的所述数据流量满足 第一预设条件。
可选的，所述第一预设条件为所述数据流量超过预设值，所述防御策略为丢弃目的地址为所述目标IP地址的报文。
可选的，向所述第一边缘网络设备发送的防御策略包括：
丢弃目的地址为所述目标IP地址的报文；
丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文。
本实施例中的防御策略发送装置可以是图3至图5中步骤的执行主体。本实施例中的防御策略发送装置可以是图1和图2所示的系统架构中的防御策略发送装置21。
本实施例中，由于所述网络攻击报文通过第一边缘网络设备进入所述第一网络，通过向第一边缘网络设备发送防御策略，指示所述第一边缘网络设备对所述网络攻击进行防御，减少了网络攻击报文在所述第一网络中的传输，节约了所述第一网络的传输资源，改善了对网络攻击报文的防御效果。
请参阅图7，图7是本申请实施例提供的一种第一边缘网络设备的结构示意图，如图7所示，该边缘网络设备包括：接收单元71和处理单元72。举例来说，所述第一边缘网络设备可以是路由器。接收单元71可以是网络接口，例如图9所示的网络接口92；处理单元72可以是处理器，例如图9所示的处理器91。
接收单元71，用于接收防御策略，所述防御策略包括目标IP地址，所述防御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文，所述第一边缘网络设备为第一网络中的边缘网络设备，所述第一网络中存在目的地址为所述目标IP地址的网络攻击报文，所述网络攻击报文通过所述第一边缘网络设备进入所述第一网络；
处理单元72，用于根据接收单元71接收的所述防御策略，处理目的地址为所述目标IP地址的报文。
可选的，所述第一边缘网络设备在预设的时间段内接收的目的地址为所述目标IP地址的报文的数据流量超过预设值，所述防御策略为丢弃所述目的地址为所述目标IP地址的报文。
可选的，接收单元71接收的防御策略包括：
丢弃目的地址为所述目标IP地址的报文；或者，
丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文。
本实施例中的第一边缘网络设备可以是图3至图5所示的实施例中的第一边缘网络设备。本实施例中的第一边缘网络设备可以是图1和图2所示的系统架构中的边缘网络设备。
本实施例中，由于所述网络攻击报文通过第一边缘网络设备进入所述第一网络，通过在第一边缘网络设备执行防御策略，减少了网络攻击报文在所述第一网络中的传输，节约了所述第一网络的传输资源，改善了对网络攻击报文的防御效果。
请参阅图8，图8是本申请实施例提供的另一种防御策略发送装置的结构示意图，如图8所示，包括：处理器81、网络接口82和存储器83。
处理器81包括但不限于中央处理器(英文：central processing unit，简称：CPU)，网络处理器(英文：network processor，简称：NP)，专用集成电路(英文：application-specific integrated circuit，简称：ASIC)或者可编程逻辑器件(英文：programmable logic device，缩写：PLD)中的一个或多个。所述PLD可以是复杂可编程逻辑器件(英文：complex programmable logic device，缩写：CPLD)，现场可编程逻辑门阵列(英文：field-programmable gate array，缩写：FPGA)，通用阵列逻辑(英文：generic array logic,缩写：GAL)或其任意组合。
网络接口82可以是有线接口，例如光纤分布式数据接口(英文：Fiber Distributed Data Interface，简称：FDDI)、以太网(英文：Ethernet)接口。网络接口82也可以是无线接口，例如无线局域网接口。
存储器83包括但不限于是随机存取存储器(英文：random-access memory，简称：RAM)、只读存储器(英文：read only memory，简称：ROM)、可擦除可编程只读存储器(英文：erasable programmable read only memory，简称：EPROM)。
其中，处理器81用于读取存储器83中存储的程序执行以下操作：
通过网络接口82接收攻击信息，所述攻击信息包括目标网际协议IP地址，所述攻击信息用于指示第一网络中存在目的地址为所述目标IP地址的网络攻击报文；
确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，所述第一边缘网络设备为所述第一网络中的边缘设备；
通过网络接口82向所述第一边缘网络设备发送防御策略，所述防御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文。
可选的，所述攻击信息还包括所述网络攻击报文的源IP地址，所述确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，包括：
从所述攻击信息中获取所述源IP地址；
根据所述源IP地址到所述第一边缘网络设备的对应关系确定所述第一边缘网络设备。
可选的，所述确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，包括：
获取所述第一网络中多个边缘网络设备中的每个边缘网络设备在预设时间段内接收的目的地址为所述目标IP地址的报文的数据流量，所述多个边缘网络设备中包括所述第一边缘网络设备；
确定所述第一边缘网络设备在所述预设时间段内的所述数据流量满足第一预设条件。
可选的，根据所述源IP地址到所述第一边缘网络设备的对应关系确定所述第一边缘网络设备之前，处理器81还用于执行：
从SDN控制器获取所述源IP地址到所述第一边缘网络设备的对应关系；或者
从所述第一边缘网络设备获取所述源IP地址到所述第一边缘网络设备的对应关系。
可选的，所述第一预设条件为所述数据流量超过预设值，所述防御策略为丢弃目的地址为所述目标IP地址的报文。
可选的，向所述第一边缘网络设备发送的防御策略包括：
丢弃目的地址为所述目标IP地址的报文；或者，
丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文。
本实施例中的防御策略发送装置可以是图3至图5所示的实施例中的步骤的执行主体。本实施例中的防御策略发送装置可以是图1和图2所示的系统架构中的防御策略发送装置21。
本实施例中，由于所述网络攻击报文通过第一边缘网络设备进入所述第一网络，通过向第一边缘网络设备发送防御策略，指示所述第一边缘网络设备对所述网络攻击进行防御，减少了网络攻击报文在所述第一网络中的传输，节约了所述第一网络的传输资源，改善了对网络攻击报文的防御效果。
请参阅图9，图9是本申请实施例提供的一种第一边缘网络设备的结构示意图，如图9所示，包括：处理器91、网络接口92和存储器93。
处理器91包括但不限于中央处理器(英文：central processing unit，简称：CPU)，网络处理器(英文：network processor，简称：NP)，专用集成电路(英文：application-specific integrated circuit，简称：ASIC)或者可编程逻辑器件(英文：programmable logic device，缩写：PLD)中的一个或多个。所述PLD可以是复杂可编程逻辑器件(英文：complex programmable logic device，缩写：CPLD)，现场可编程逻辑门阵列(英文：field-programmable gate array，缩写：FPGA)，通用阵列逻辑(英文：generic array logic,缩写：GAL)或其任意组合。
网络接口92可以是有线接口，例如光纤分布式数据接口(英文：Fiber Distributed Data Interface，简称：FDDI)、以太网(英文：Ethernet)接口。网络接口92也可以是无线接口，例如无线局域网接口。
存储器93包括但不限于是随机存取存储器(英文：random-access memory，简称：RAM)、只读存储器(英文：read only memory，简称：ROM)、可擦除可编程只读存储器(英文：erasable programmable read only memory，简称：EPROM)。
其中，所述处理器91用于读取存储器93中存储的程序执行以下操作：
通过网络接收92接收防御策略，所述防御策略包括目标IP地址，所述防 御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文，所述第一边缘网络设备为第一网络中的边缘网络设备，所述第一网络中存在目的地址为所述目标IP地址的网络攻击报文，所述网络攻击报文通过所述第一边缘网络设备进入所述第一网络；
根据所述防御策略，处理目的地址为所述目标IP地址的报文。
可选的，所述第一边缘网络设备在预设的时间段内接收的目的地址为所述目标IP地址的报文的数据流量超过预设值，所述防御策略为丢弃所述目的地址为所述目标IP地址的报文。
可选的，所述装置接收的防御策略包括：
丢弃目的地址为所述目标IP地址的报文；或者，
丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文。
本实施例中的第一边缘网络设备可以是图3至图5所示的实施例中的第一边缘网络设备。本实施例中的第一边缘网络设备可以是图1和图2所示的系统架构中的边缘网络设备。
本实施例中，由于所述网络攻击报文通过第一边缘网络设备进入所述第一网络，通过在第一边缘网络设备执行防御策略，减少了网络攻击报文在所述第一网络中的传输，节约了所述第一网络的传输资源，改善了对网络攻击报文的防御效果。
本领域普通技术人员可以理解实现所述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的程序可存储于一计算机可读取存储介质中，该程序在执行时，可包括如所述各方法的实施例的流程。其中，所述的存储介质可为磁碟、光盘、只读存储记忆体(Read-Only Memory，ROM)或随机存取存储器(Random Access Memory，简称RAM)等。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
以上所揭露的仅为本申请较佳实施例而已，当然不能以此来限定本申请之权利范围，因此依本申请权利要求所作的等同变化，仍属本申请所涵盖的范围。

Claims (27)

  1. 一种网络攻击防御策略的发送方法，其特征在于，包括：
    接收攻击信息，所述攻击信息包括目标网际协议IP地址，所述攻击信息用于指示第一网络中存在目的地址为所述目标IP地址的网络攻击报文；
    确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，所述第一边缘网络设备为所述第一网络中的边缘设备；
    向所述第一边缘网络设备发送防御策略，所述防御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文。
  2. 如权利要求1所述的方法，其特征在于，所述攻击信息还包括所述网络攻击报文的源IP地址，所述确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，包括：
    从所述攻击信息中获取所述源IP地址；
    根据所述源IP地址到所述第一边缘网络设备的对应关系确定所述第一边缘网络设备。
  3. 如权利要求2所述的方法，其特征在于，根据所述源IP地址到所述第一边缘网络设备的对应关系确定所述第一边缘网络设备之前，所述方法还包括：
    从软件定义网络SDN控制器获取所述源IP地址到所述第一边缘网络设备的对应关系；或者
    从所述第一边缘网络设备获取所述源IP地址到所述第一边缘网络设备的对应关系。
  4. 如权利要求1至3任一所述的方法，其特征在于，所述确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，包括：
    获取所述第一网络中多个边缘网络设备中的每个边缘网络设备在预设时间段内接收的目的地址为所述目标IP地址的报文的数据流量，所述多个边缘网络设备中包括所述第一边缘网络设备；
    确定所述第一边缘网络设备在所述预设时间段内接收的所述数据流量满 足第一预设条件。
  5. 如权利要求4所述的方法，其特征在于，所述第一预设条件为所述数据流量超过预设值，所述防御策略为丢弃目的地址为所述目标IP地址的报文。
  6. 如权利要求1至5中任一项所述的方法，其特征在于，所述防御策略包括：
    丢弃目的地址为所述目标IP地址的报文；或者
    丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文。
  7. 一种网络攻击防御方法，其特征在于，包括：
    第一边缘网络设备接收防御策略，所述防御策略包括目标IP地址，所述防御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文，所述第一边缘网络设备为第一网络中的边缘网络设备，所述第一网络中存在目的地址为所述目标IP地址的网络攻击报文，所述网络攻击报文通过所述第一边缘网络设备进入所述第一网络；
    所述第一边缘网络设备根据所述防御策略，处理目的地址为所述目标IP地址的报文。
  8. 如权利要求7所述的方法，其特征在于，所述第一边缘网络设备在预设的时间段内接收的目的地址为所述目标IP地址的报文的数据流量超过预设值，所述防御策略为丢弃所述目的地址为所述目标IP地址的报文。
  9. 如权利要求7或8所述的方法，其特征在于，所述防御策略包括：
    丢弃目的地址为所述目标IP地址的报文；或者
    丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文。
  10. 一种防御策略发送装置，其特征在于，包括：接收单元、确定单元和发送单元，其中：
    所述接收单元，用于接收攻击信息，所述攻击信息包括目标网际协议IP地址，所述攻击信息用于指示第一网络中存在目的地址为所述目标IP地址的网络攻击报文；
    所述确定单元，用于根据所述接收单元接收的所述攻击信息确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，所述第一边缘网络设备为所述第一网络中的边缘设备；
    所述发送单元，用于向所述第一边缘网络设备发送防御策略，所述防御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文。
  11. 如权利要求10所述的装置，其特征在于，所述攻击信息还包括所述网络攻击报文的源IP地址，所述确定单元还用于从所述攻击信息中获取所述源IP地址，以及用于根据所述源IP地址到所述第一边缘网络设备的对应关系确定所述第一边缘网络设备。
  12. 如权利要求10或11所述的装置，其特征在于，所述确定单元还用于获取所述第一网络中多个边缘网络设备中的每个边缘网络设备在预设时间段内接收的目的地址为所述目标IP地址的报文的数据流量，所述多个边缘网络设备中包括所述第一边缘网络设备，以及用于确定所述第一边缘网络设备在所述预设时间段内接收的所述数据流量满足第一预设条件。
  13. 如权利要求11所述的装置，其特征在于，所述接收单元还用于从SDN控制器获取所述源IP地址到所述第一边缘网络设备的对应关系；或者
    所述接收单元还用于从所述第一边缘网络设备获取所述源IP地址到所述第一边缘网络设备的对应关系。
  14. 如权利要求12所述的装置，其特征在于，所述第一预设条件为所述数据流量超过预设值，所述防御策略为丢弃目的地址为所述目标IP地址的报文。
  15. 如权利要求10至14中任一项所述的方法，其特征在于，所述防御策略包括：
    丢弃目的地址为所述目标IP地址的报文；或者
    丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文。
  16. 一种第一边缘网络设备，其特征在于，所述边缘网络设备包括：接收单元和处理单元，其中：
    所述接收单元，用于接收防御策略，所述防御策略包括目标IP地址，所述防御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文，所述第一边缘网络设备为第一网络中的边缘网络设备，所述第一网络中存在目的地址为所述目标IP地址的网络攻击报文，所述网络攻击报文通过所述第一边缘网络设备进入所述第一网络；
    所述处理单元，用于根据所述接收单元接收的所述防御策略，处理目的地址为所述目标IP地址的报文。
  17. 如权利要求16所述的边缘网络设备，其特征在于，所述第一边缘网络设备在预设的时间段内接收的目的地址为所述目标IP地址的报文的数据流量超过预设值，所述防御策略为丢弃所述目的地址为所述目标IP地址的报文。
  18. 如权利要求16或17所述的边缘网络设备，其特征在于，所述防御策略包括：
    丢弃目的地址为所述目标IP地址的报文；或者
    丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文。
  19. 一种防御策略发送装置，其特征在于，包括：处理器、网络接口和存储器，其中，所述处理器用于读取所述存储器中存储的程序执行以下操作：
    通过所述网络接口接收攻击信息，所述攻击信息包括目标网际协议IP地址，所述攻击信息用于指示第一网络中存在目的地址为所述目标IP地址的网 络攻击报文；
    确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，所述第一边缘网络设备为所述第一网络中的边缘设备；
    通过所述网络接口向所述第一边缘网络设备发送防御策略，所述防御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文。
  20. 如权利要求19所述的装置，其特征在于，所述攻击信息还包括所述网络攻击报文的源IP地址，所述确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，包括：
    从所述攻击信息中获取所述源IP地址；
    根据所述源IP地址到所述第一边缘网络设备的对应关系确定所述第一边缘网络设备。
  21. 如权利要求19或20所述的装置，其特征在于，所述确定所述网络攻击报文通过第一边缘网络设备进入所述第一网络，包括：
    获取所述第一网络中多个边缘网络设备中的每个边缘网络设备在预设时间段内接收的目的地址为所述目标IP地址的报文的数据流量，所述多个边缘网络设备中包括所述第一边缘网络设备；
    确定所述第一边缘网络设备在所述预设时间段内的所述数据流量满足第一预设条件。
  22. 如权利要求20所述的装置，其特征在于，根据所述源IP地址到所述第一边缘网络设备的对应关系确定所述第一边缘网络设备之前，所述处理器还用于执行：
    从SDN控制器获取所述源IP地址到所述第一边缘网络设备的对应关系；或者
    从所述第一边缘网络设备获取所述源IP地址到所述第一边缘网络设备的对应关系。
  23. 如权利要求21所述的装置，其特征在于，所述第一预设条件为所述数据流量超过预设值，所述防御策略为丢弃目的地址为所述目标IP地址的报文。
  24. 如权利要求19至23中任一项所述的装置，其特征在于，所述防御策略包括：
    丢弃目的地址为所述目标IP地址的报文；或者
    丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文。
  25. 一种第一边缘网络设备，其特征在于，包括：处理器、网络接口和存储器，其中，所述处理器用于读取所述存储器中存储的程序执行以下操作：
    通过所述网络接口接收防御策略，所述防御策略包括目标IP地址，所述防御策略用于指示所述第一边缘网络设备根据所述防御策略处理目的地址为所述目标IP地址的报文，所述第一边缘网络设备为第一网络中的边缘网络设备，所述第一网络中存在目的地址为所述目标IP地址的网络攻击报文，所述网络攻击报文通过所述第一边缘网络设备进入所述第一网络；
    根据所述防御策略，处理目的地址为所述目标IP地址的报文。
  26. 如权利要求25所述的设备，其特征在于，所述第一边缘网络设备在预设的时间段内接收的目的地址为所述目标IP地址的报文的数据流量超过预设值，所述防御策略为丢弃所述目的地址为所述目标IP地址的报文。
  27. 如权利要求25或26所述的设备，其特征在于，所述防御策略包括：
    丢弃目的地址为所述目标IP地址的报文；或者
    丢弃目的地址为所述目标IP地址并且满足第二预设条件的报文。
PCT/CN2016/077662 2016-03-29 2016-03-29 网络攻击防御策略发送、网络攻击防御的方法和装置 WO2017166047A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
EP16895828.8A EP3355514B1 (en) 2016-03-29 2016-03-29 Method and device for transmitting network attack defense policy and method and device for defending against network attack
PCT/CN2016/077662 WO2017166047A1 (zh) 2016-03-29 2016-03-29 网络攻击防御策略发送、网络攻击防御的方法和装置
CN201680034646.9A CN107710680B (zh) 2016-03-29 2016-03-29 网络攻击防御策略发送、网络攻击防御的方法和装置
IL259132A IL259132A (en) 2016-03-29 2018-05-03 Method and device for transmitting network attack protection policy and method and device for network attack protection
US16/050,313 US10798060B2 (en) 2016-03-29 2018-07-31 Network attack defense policy sending method and apparatus, and network attack defending method and apparatus

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/077662 WO2017166047A1 (zh) 2016-03-29 2016-03-29 网络攻击防御策略发送、网络攻击防御的方法和装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/050,313 Continuation US10798060B2 (en) 2016-03-29 2018-07-31 Network attack defense policy sending method and apparatus, and network attack defending method and apparatus

Publications (1)

Publication Number Publication Date
WO2017166047A1 true WO2017166047A1 (zh) 2017-10-05

Family

ID=59962444

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/077662 WO2017166047A1 (zh) 2016-03-29 2016-03-29 网络攻击防御策略发送、网络攻击防御的方法和装置

Country Status (5)

Country Link
US (1) US10798060B2 (zh)
EP (1) EP3355514B1 (zh)
CN (1) CN107710680B (zh)
IL (1) IL259132A (zh)
WO (1) WO2017166047A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109729086A (zh) * 2018-12-28 2019-05-07 北京奇安信科技有限公司 策略管理方法、系统、设备及介质
CN115514501A (zh) * 2021-06-03 2022-12-23 中国移动通信集团四川有限公司 一种封堵网络攻击的方法和装置

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11411967B2 (en) * 2018-11-30 2022-08-09 Cisco Technology, Inc. Synergistic DNS security update
JP7222260B2 (ja) * 2019-02-07 2023-02-15 日本電信電話株式会社 試験装置
CN109617932B (zh) * 2019-02-21 2021-07-06 北京百度网讯科技有限公司 用于处理数据的方法和装置
CN110519273B (zh) * 2019-08-28 2021-11-02 杭州迪普科技股份有限公司 入侵防御方法和装置
CN110620773B (zh) * 2019-09-20 2023-02-10 深圳市信锐网科技术有限公司 一种tcp流量隔离方法、装置及相关组件
CN112702300B (zh) * 2019-10-22 2023-03-28 华为技术有限公司 一种安全漏洞的防御方法和设备
CN111343176B (zh) * 2020-01-16 2022-05-27 郑州昂视信息科技有限公司 一种网络攻击的反制装置、方法、存储介质及计算机设备
CN111835729B (zh) * 2020-06-15 2022-08-02 东软集团股份有限公司 报文转发方法、系统、存储介质和电子设备
CN112953918A (zh) * 2021-01-29 2021-06-11 李阳 结合大数据服务器的网络攻击防护方法及大数据防护设备
CN112565309B (zh) * 2021-02-26 2021-05-14 腾讯科技（深圳）有限公司 报文处理方法、装置、设备以及存储介质
CN115208596B (zh) * 2021-04-09 2023-09-19 中国移动通信集团江苏有限公司 网络入侵防御方法、装置及存储介质
CN113285953B (zh) * 2021-05-31 2022-07-12 西安交通大学 可用于DDoS攻击的DNS反射器检测方法、系统、设备及可读存储介质
CN115987639B (zh) * 2022-12-23 2024-04-09 中国联合网络通信集团有限公司 攻击防御方法、装置、电子设备和存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020035683A1 (en) * 2000-09-07 2002-03-21 Kaashoek Marinus Frans Architecture to thwart denial of service attacks
CN101494639A (zh) * 2008-01-25 2009-07-29 华为技术有限公司 一种分组通信系统中防止攻击的方法及装置
US20100293407A1 (en) * 2007-01-26 2010-11-18 The Trustees Of Columbia University In The City Of Systems, Methods, and Media for Recovering an Application from a Fault or Attack
CN105357180A (zh) * 2015-09-30 2016-02-24 华为技术有限公司 网络系统、攻击报文的拦截方法、装置和设备

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH1168789A (ja) * 1997-08-15 1999-03-09 Nec Corp サーバを用いたレイヤ３スイッチング
US7080129B2 (en) * 2000-12-29 2006-07-18 Intel Corporation Site selection based on Internet Protocol address
US20080127324A1 (en) * 2006-11-24 2008-05-29 Electronics And Telecommunications Research Institute DDoS FLOODING ATTACK RESPONSE APPROACH USING DETERMINISTIC PUSH BACK METHOD
US20110202685A1 (en) * 2010-02-16 2011-08-18 Narayanan Subramaniam System and Method for Communication Between an Information Handling System and Management Controller Through a Shared LOM
JP2011193189A (ja) * 2010-03-15 2011-09-29 Hitachi Ltd ネットワークシステム、エッジノード及び中継ノード
US9888028B2 (en) * 2013-05-03 2018-02-06 Centurylink Intellectual Property Llc Combination of remote triggered source and destination blackhole filtering
US9258742B1 (en) * 2013-09-30 2016-02-09 Juniper Networks, Inc. Policy-directed value-added services chaining
CN104580168B (zh) * 2014-12-22 2019-02-26 华为技术有限公司 一种攻击数据包的处理方法、装置及系统
US9935968B2 (en) * 2015-11-04 2018-04-03 Avaya, Inc. Selective traffic analysis at a communication network edge
CN105429975B (zh) * 2015-11-11 2018-07-31 上海斐讯数据通信技术有限公司 一种基于云终端的数据安全防御系统、方法及云终端安全系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020035683A1 (en) * 2000-09-07 2002-03-21 Kaashoek Marinus Frans Architecture to thwart denial of service attacks
US20100293407A1 (en) * 2007-01-26 2010-11-18 The Trustees Of Columbia University In The City Of Systems, Methods, and Media for Recovering an Application from a Fault or Attack
CN101494639A (zh) * 2008-01-25 2009-07-29 华为技术有限公司 一种分组通信系统中防止攻击的方法及装置
CN105357180A (zh) * 2015-09-30 2016-02-24 华为技术有限公司 网络系统、攻击报文的拦截方法、装置和设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3355514A4 *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109729086A (zh) * 2018-12-28 2019-05-07 北京奇安信科技有限公司 策略管理方法、系统、设备及介质
CN109729086B (zh) * 2018-12-28 2021-02-23 奇安信科技集团股份有限公司 策略管理方法、系统、设备及介质
CN115514501A (zh) * 2021-06-03 2022-12-23 中国移动通信集团四川有限公司 一种封堵网络攻击的方法和装置

Also Published As

Publication number Publication date
EP3355514B1 (en) 2019-08-21
US20180337888A1 (en) 2018-11-22
IL259132A (en) 2018-06-28
EP3355514A1 (en) 2018-08-01
EP3355514A4 (en) 2018-08-01
CN107710680A (zh) 2018-02-16
CN107710680B (zh) 2021-02-09
US10798060B2 (en) 2020-10-06

Similar Documents

Publication Publication Date Title
WO2017166047A1 (zh) 网络攻击防御策略发送、网络攻击防御的方法和装置
WO2017148263A1 (zh) 网络攻击的防控方法、装置及系统
Yaar et al. SIFF: A stateless Internet flow filter to mitigate DDoS flooding attacks
US8397284B2 (en) Detection of distributed denial of service attacks in autonomous system domains
EP2127313B1 (en) A containment mechanism for potentially contaminated end systems
Handley et al. Internet denial-of-service considerations
US7925766B2 (en) Method for distributed denial-of-service attack mitigation by selective black-holing in MPLS VPNS
US7818795B1 (en) Per-port protection against denial-of-service and distributed denial-of-service attacks
US9455995B2 (en) Identifying source of malicious network messages
WO2016150253A1 (zh) 基于sdn的ddos攻击防护方法、装置及系统
US8879388B2 (en) Method and system for intrusion detection and prevention based on packet type recognition in a network
EP3846406A1 (en) Dynamic security actions for network tunnels against spoofing
US8677480B2 (en) Anomaly information distribution with threshold
WO2011131076A1 (zh) 建立流转发表项的方法及数据通信设备
Hugelshofer et al. OpenLIDS: a lightweight intrusion detection system for wireless mesh networks
WO2019096104A1 (zh) 攻击防范
JP5178573B2 (ja) 通信システムおよび通信方法
Kumarasamy et al. An active defense mechanism for TCP SYN flooding attacks
WO2022267490A1 (zh) 攻击识别方法、装置及系统、计算机可读存储介质
US9912643B2 (en) Attack defense processing method and protection device
Barbhuiya et al. An active detection mechanism for detecting icmp based attacks
EP3270569A1 (en) Network protection entity and method for protecting a communication network against malformed data packets
US20230367875A1 (en) Method for processing traffic in protection device, and protection device
Kimiyama et al. Autonomous and distributed internet security (AIS) infrastructure for safe internet
WO2023142493A1 (zh) 一种攻击防御方法、设备及系统

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 2016895828

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 259132

Country of ref document: IL

NENP Non-entry into the national phase

Ref country code: DE