WO2019096104A1 - 攻击防范 - Google Patents

攻击防范 Download PDF

Info

Publication number
WO2019096104A1
WO2019096104A1 PCT/CN2018/115132 CN2018115132W WO2019096104A1 WO 2019096104 A1 WO2019096104 A1 WO 2019096104A1 CN 2018115132 W CN2018115132 W CN 2018115132W WO 2019096104 A1 WO2019096104 A1 WO 2019096104A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet
address
source
address list
destination
Prior art date
Application number
PCT/CN2018/115132
Other languages
English (en)
French (fr)
Inventor
王国利
Original Assignee
新华三信息安全技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 新华三信息安全技术有限公司 filed Critical 新华三信息安全技术有限公司
Publication of WO2019096104A1 publication Critical patent/WO2019096104A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL

Definitions

  • DoS Denial of Service
  • DDoS Distributed Denial of Service
  • the attacker uses a large number of data packets or malformed packets in a short period of time to continuously initiate a connection or request a response to the network device.
  • the network device cannot process legitimate packets due to excessive load, and services are abnormal or even device faulty.
  • a common method for preventing a DoS attack is to: the network security device detects the rate of packets sent to a specific destination address, and discards the packets to be sent to the specific destination address when the rate exceeds the set threshold. When the threshold is set, the message is allowed to be sent to the specific destination address.
  • This method has the following disadvantages: When a normal packet is matched with an attack packet, the DoS attack defense will not only discard the attack packet but also discard the normal packet. If multiple normal packets are discarded, normal traffic will be affected. It can be seen that this method does not effectively reduce the impact of the DoS attack on the normal service of the network device.
  • FIG. 2 is a schematic diagram of a processing procedure of a normal message provided by the present application.
  • FIG. 3 is a schematic diagram of a processing procedure of an attack packet provided by the present application.
  • FIG. 4 is a block diagram of a functional block of a device provided by the present application.
  • FIG. 5 is a hardware structural diagram of the apparatus shown in FIG. 4 provided by the present application.
  • first, second, third, etc. may be used to describe various information in this application, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as the second information without departing from the scope of the present application.
  • second information may also be referred to as the first information.
  • word "if” as used herein may be interpreted as "when” or “when” or “in response to a determination.”
  • the existing DoS attack defense technology can not identify the defects of the normal packet and the attack packet.
  • the intermediate device can distinguish the normal packet and the normal packet. The packets are forwarded, and the normal packets are forwarded. The attack packets are discarded.
  • the intermediate device here refers to the device between the source device and the destination device, for example, it may be a network access device (such as a hub, a switch), an inter-network device (such as a router), or a network security device (such as a firewall, an attack defense). Equipment) and so on.
  • a network access device such as a hub, a switch
  • an inter-network device such as a router
  • a network security device such as a firewall, an attack defense). Equipment
  • the present application adds the following two functions to the intermediate device:
  • the IP address of the real device corresponding to the source IP (Internet Protocol) address of the packet received by the device, that is, the source IP address of the normal packet.
  • This application can record such source IP addresses through the first IP address list.
  • the real device here refers to a device that exists in reality, and may include: a physical device and a virtual device.
  • the source IP address of the packet received by the device that is, the source IP address of the normal packet and the attack packet.
  • the source IP address of the received packet may be recorded in the second IP address list, or the source IP address of the normal packet may be recorded in the first IP address list, and the source IP address of the attack packet is recorded in the second address list. Address and source IP address of unknown packets.
  • the intermediate device distinguishes the normal message and the attack message based on the first IP address list and the second IP address list.
  • the method can include the following steps.
  • Step 101 Receive a first packet, where the destination IP address of the first packet is an IP address of a server protected by the intermediate device.
  • the first packet here may be a TCP (Transmission Control Protocol) packet, a UDP (User Datagram Protocol) packet, or an ICMP (Internet Control Message Protocol) packet. Text and so on.
  • TCP Transmission Control Protocol
  • UDP User Datagram Protocol
  • ICMP Internet Control Message Protocol
  • Step 102 If the saved first IP address list includes the source IP address of the first packet, the first packet is forwarded.
  • the intermediate device finds the source IP address of the first packet from the first IP address list, it indicates that the source device has previously detected the source IP address and confirmed that the source IP address corresponds to the real device, so the packet is directly forwarded.
  • the intermediate device does not find the source IP address of the first packet from the first IP address list, there may be two cases at this time. One is that the intermediate device has not detected the source IP address before (or has detected the source). The IP address but the detection result has been aged and deleted. The other is that the intermediate device has previously detected the source IP address and confirmed that the source IP address does not correspond to the real device. As for the current first message, it needs to be determined in conjunction with the second IP address list, as follows.
  • Step 103 If the saved first IP address list and the second IP address list do not include the source IP address of the first packet, add the source IP address of the first packet to the second IP address list, and Send the second message.
  • the source IP address of the second packet is the destination IP address of the first packet or the IP address of the intermediate packet
  • the destination IP address of the second packet is the source IP address of the first packet
  • the second packet is the second packet.
  • the destination port number is any port number within the preset range.
  • the intermediate device may first add the source IP address of the first packet to the second IP address list, and then detect whether the source IP address corresponds to the real device.
  • the intermediate device may construct a second packet according to the source IP address of the first packet, and send the second packet to the source IP address of the first packet to detect whether the source IP address corresponds to the real device.
  • the intermediate device can immediately discard the first packet or temporarily save the first packet, and wait for the detection result of the second packet to determine whether to forward the first packet or discard the packet. First message.
  • Step 104 Add a source IP address of the first packet to the first IP address list, if the response packet indicating the second packet error is received.
  • the second packet may be a packet with a large destination port number.
  • the destination port number of the second packet may be any of 32768 to 65535 (including 32768 and 65535). number. If the source IP address of the first packet corresponds to a real device, the device that returns the ICMP port unreachable packet after receiving the packet with the port number being a non-known port and having a large port number; If the source IP address of the first packet does not correspond to a real device, the device identified by the source IP address does not exist. The device that does not exist will not receive the second packet from the intermediate device. Returns the ICMP port unreachable packet.
  • the intermediate device Based on this, if the intermediate device receives the ICMP port unreachable packet, the source IP address of the first packet corresponds to a real device, and the first packet is a legal packet, so the source IP address of the first packet is obtained. Add to the first IP address list. If the intermediate device does not receive the ICMP port unreachable packet within the preset time, the source IP address of the first packet is not added to the first IP address list.
  • the source IP address of the first packet is not included in the first IP address list and the second IP address list, the source IP address of the first packet is added to the second IP address list.
  • the first type if the intermediate device receives the response packet for indicating the second packet error within the preset time, the source IP address of the first packet recorded in the second IP address list may be deleted; The intermediate device does not receive the response packet indicating the second packet error within the preset time, and may retain the source IP address of the first packet recorded in the second IP address list. In this mode, the source IP address of the attack packet can be recorded in the second IP address list, and the source IP address of the normal packet cannot be recorded. This saves the storage resources of the intermediate device.
  • the second IP address list can record the source IP address of the attack packet
  • the intermediate device does not include the first packet in determining the first IP address list and the second IP address
  • the source IP address can be used to send the second packet. If the response packet for the second packet is received within the preset time, the source IP address of the first packet is not added to the second IP address list. If the response packet for the second packet is not received within the preset time, the source IP address of the first packet is added to the second IP address list.
  • the second type retains the source IP address of the first packet in the second IP address list regardless of whether the intermediate device receives the response packet indicating the second packet error. And after receiving the response message for indicating the second packet error, the source IP address of the first packet is placed in the first IP address list. In this mode, the source IP address of the normal packet and the attack packet is saved in the second IP address list.
  • the advantage of the first method is that it does not need to determine whether the first packet is received within the preset time. The response packet returned by the source IP address of the packet. Therefore, it is not necessary to start a timer indicating whether the preset time is reached. This saves the processing resources of the intermediate device.
  • the source IP address of the first packet may be included in the first IP address list and the second IP address list.
  • the first case may not be included in the first IP address list.
  • the source IP address of the text, and the second IP address list includes the source IP address of the first packet. This situation indicates that the intermediate device has previously detected the source IP address of the first packet. Since the source IP address is recorded in the second IP address list but is not recorded in the first IP address list, the first The source IP address of a packet does not correspond to the real device. The intermediate device can directly discard the first packet.
  • the intermediate device adds the source IP address of the normal packet to the first IP address list.
  • the source IP address of the normal packet can be found in the first IP address list. Address, which forwards the message directly.
  • the intermediate device adds the source IP address of the attack packet to the second IP address list.
  • the intermediate device can find the source IP address in the second IP address list. Address, thereby discarding the message.
  • the above process can not only effectively prevent the DoS attack, but also the intermediate device can distinguish between the normal packet and the attack packet, which reduces the impact of the DoS attack on the normal service of the network device.
  • the intermediate device can perform DoS attacks against certain preset IP addresses. For example, the intermediate device can perform DoS attacks on the packets whose IP addresses are protected by the device. Prevent.
  • the intermediate device may further determine to receive the preset time before receiving the first packet.
  • the destination address is the number of the packets of the IP address of the server to be protected, including the number of normal packets and attack packets. If yes, the DoS attack defense is performed.
  • the intermediate device may forward the first packet when the first condition is met.
  • the first condition may be that, in a preset time before the first packet is received, the number of the third packet received by the intermediate device exceeds the set threshold, and the saved first IP list includes the first packet.
  • Source IP address, where the destination IP address of the third packet is the IP address of the server protected by the intermediate device.
  • the destination IP address of the first packet and the destination IP address of the third packet may be the same.
  • the intermediate device may add the source IP address of the first packet to the second IP address list and send the second packet when the second condition is met.
  • the second condition may be that, in a preset time before the first packet is received, the number of the third packet received by the intermediate device exceeds a set threshold, and the first IP address list and the second IP address list are in the list. Does not include the source IP address of the first packet.
  • the intermediate device may also discard the first packet when the third condition is met.
  • the third condition may be that the number of the third packet received by the intermediate device exceeds the set threshold in the preset time before the first packet is received, and the first packet is not included in the first IP address list.
  • the source IP address but the second IP address list includes the source IP address of the first packet.
  • the intermediate device can directly forward the first packet.
  • the first IP address list and the second IP address list may also be aged.
  • a statistic field may be added to the first IP address list and the second IP address list to collect the number of times the packets sent by the source IP addresses in the list are received in each period. If the number of statistics of the source IP address is 0, the source IP address is deleted from the first IP address list and/or the second IP address list. If not, the source IP address is retained, and the source IP address is retained. The number of statistics corresponding to the source IP address is cleared.
  • the first IP address list and the second IP address list there are two maintenance methods.
  • the intermediate device can maintain a list of the first IP address and a list of the second IP address for each IP address of the server protected by the device.
  • the intermediate device may create a first IP address list and a second IP address list for the address when determining that the IP address of a server meets the DoS attack detection condition, and determine a server When the IP address no longer satisfies the DoS attack detection condition, the first IP address list and the second IP address list associated with the address are deleted.
  • the intermediate device may search for the source IP address of the first packet in the first IP address list and the second IP address list associated with the destination IP address of the first packet.
  • the intermediate device may also maintain a first IP address list and a second IP address list for all IP addresses of servers to be protected by the device. In this way, the two tables can be saved on the intermediate device (or third-party device).
  • the intermediate device may clear the contents of the source IP address associated with the IP address of the server in the two tables.
  • the intermediate device may search for the source IP address of the first packet in the saved first IP address list and the second IP address list.
  • the normal message and the attack message can be distinguished and processed separately.
  • the technical solutions of the present application are described below by using an example of the processing procedure of the normal packet and an example of the processing procedure of the attack packet.
  • Figure 2 shows a process for processing normal packets.
  • the client is a real requester.
  • the DoS attack defense against the IP address of the server is enabled on the intermediate device.
  • the specific process is as follows.
  • the intermediate device receives the packet sent by the client to the server.
  • the intermediate device checks whether the IP address of the client is included in the first IP address list, and the check result is not included.
  • the intermediate device checks whether the IP address of the client is included in the second IP address list, and the check result is not included.
  • the intermediate device adds the client's IP address to the second IP address list.
  • the intermediate device sends a second packet to the client, and the destination port number of the second packet is between 32768 and 65535.
  • the client returns an ICMP port unreachable message to the intermediate device.
  • the intermediate device adds the client's IP address to the first IP address list.
  • the intermediate device receives the packet sent by the client to the server again.
  • the intermediate device checks whether the IP address of the client is included in the first IP address list, and the check result is included.
  • the intermediate device forwards the packet to the server.
  • Figure 3 shows a process for attacking an attack packet.
  • the client is an IP address that does not exist on the network.
  • the DoS attack defense against the IP address of the server is started on the intermediate device.
  • the specific process is as follows.
  • the intermediate device receives the packet sent by the client to the server.
  • the intermediate device checks whether the IP address of the client is included in the first IP address list, and the check result is not included.
  • the intermediate device checks whether the IP address of the client is included in the second IP address list, and the check result is not included.
  • the intermediate device adds the client's IP address to the second IP address list.
  • the intermediate device sends a second packet to the client, and the destination port number of the second packet is between 32768 and 65535.
  • the intermediate device does not add the client's IP address to the first IP address list.
  • the intermediate device receives the packet sent by the client to the server again.
  • the intermediate device checks whether the IP address of the client is included in the first IP address list, and the check result is not included.
  • the intermediate device checks whether the IP address of the client is included in the second IP address list, and the check result is included.
  • the intermediate device discards the message.
  • the intermediate device can not only effectively prevent the DoS attack but also distinguish the normal packet from the attack packet based on the recorded first IP address list and the second IP address list. Text. Therefore, the impact of the DoS attack on the normal service of the network device is reduced.
  • an attack defense device provided by the present application is applied to an intermediate device, and the device may include a transceiver unit 401 and an attack defense unit 402, where:
  • the transceiver unit 401 is configured to receive and receive a message, and includes receiving a first packet, where a destination IP address of the first packet is an IP address of a server protected by the intermediate device.
  • the attack defense unit 402 is configured to: if the saved first IP address list includes the source IP address of the first packet, instruct the transceiver unit 401 to forward the first packet; if the saved first IP address If the source IP address of the first packet is not included in the list and the second IP address list, the source IP address of the first packet is added to the second IP address list, and the sending and receiving is indicated.
  • the unit 401 sends a second packet, where the source IP address of the second packet is the destination IP address of the first packet or the address of the intermediate device, and the destination IP address of the second packet is The source IP address of the first packet, the destination port number of the second packet is any port number in the preset range; if the transceiver unit 401 receives the second packet error The response packet sends the source IP address of the first packet to the first IP address list.
  • the attack defense unit 402 may be further configured to: if the first IP address list does not include the source IP address of the first packet, and the second IP address list is If the source IP address of the first packet is included, the first packet is discarded.
  • the destination port number of the second packet is any port number from 32768 to 65535; the response packet is an ICMP port unreachable message.
  • the attack defense unit 402 is further configured to determine whether the number of the third packet received by the transceiver unit 401 exceeds a preset time before receiving the first packet. a threshold value, wherein the destination IP address of the third packet is an IP address of the server protected by the intermediate device; if it is determined that the number of the third packet received by the transceiver unit 401 exceeds the setting And determining, by the threshold, whether the first IP address list and the second IP address list include a source IP address of the first packet.
  • the attack defense unit 402 is further configured to: if the number of the third packet received by the transceiver unit 401 is lower than a set threshold, instruct the transceiver unit 401 to forward The first message.
  • the division of the unit in the embodiment of the present invention is schematic, and is only a logical function division, and the actual implementation may have another division manner.
  • the functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the present application further provides a hardware structure diagram of an intermediate device, where the intermediate device includes: a communication interface 501, a processor 502, a machine readable storage medium 503, and a bus 504; wherein, the communication interface 501 The processor 502 and the machine readable storage medium 503 complete communication with each other via the bus 504.
  • the communication interface 501 is configured to send and receive a message.
  • the processor 502 can be a CPU (Central Processing Unit), the machine readable storage medium 503 can be a non-volatile machine readable storage medium, and the attack prevention machine executable instructions are stored in the memory 503, and the processor 502
  • the attack defense machine executable instructions stored in the memory 503 can be executed to implement the method shown in any of the above Figures 1 - 3.

Abstract

本申请提供攻击防范的方法和装置，该方法应用于中间设备。根据该方法的一个示例，中间设备可根据第一IP地址列表和第二IP地址列表是否包括所述第一报文的源IP地址来确认是否转发所述第一报文。若第一IP地址列表中包括第一报文的源IP地址，则转发第一报文。若第一IP地址列表和第二IP地址列表中均不包括第一报文的源IP地址，则将第一报文的源IP地址添加到第二IP地址列表中，并发送第二报文。若接收到用于指示第二报文错误的响应报文，则将第一报文的源IP地址添加到第一IP地址列表中。

Description

攻击防范
相关申请的交叉引用
本专利申请要求于2017年11月14日提交的、申请号为201711122077.6、发明名称为“一种攻击防范方法和装置”的中国专利申请的优先权，该申请的全文以引用的方式并入本文中。
背景技术
随着网络的发展，组网环境日趋复杂，随之而来的网络攻击也日益频繁，尤其以DoS(Denial of Service,拒绝服务)攻击(包括DDoS(Distributed Denial of Service，分布式拒绝服务)攻击)最为常见。DoS攻击中，攻击者在短时间内使用大量数据包或畸形报文，向网络设备不断发起连接或请求响应，导致网络设备由于负荷过重而不能处理合法报文，出现业务异常甚至设备瘫痪的情况。
现在防范DoS攻击的一种常用方法是：网络安全设备检测发往特定目的地址的报文速率，当速率超过设定的阈值时丢弃要发往该特定目的地址的报文，当速率低于上述设定的阈值时，允许报文发往该特定目的地址。
这种方法存在以下不足：当正常报文与攻击报文掺杂在一起时，启动DoS攻击防范后，不仅会丢弃攻击报文，还会丢弃正常报文。如果多个正常报文被丢弃，则正常业务将受到影响。可见这种方法并不能有效减小DoS攻击时对网络设备的正常业务造成的影响。
附图说明
图1是本申请提供的方法流程图；
图2是本申请提供的正常报文的处理过程示意图；
图3是本申请提供的攻击报文的处理过程示意图；
图4是本申请提供的装置功能模块框图；
图5是本申请提供的图4所示装置的硬件结构图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本申请相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本申请的一些方面相一致的装置和方法的例子。
在本申请使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本申请。在本申请和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本申请可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本申请范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
在本申请中，弥补了现有DoS攻击防范技术无法识别正常报文和攻击报文的缺陷，当正常报文和攻击报文同时发向同一目的地址时，中间设备可以分辨出正常报文和攻击报文，从而对正常报文进行转发，对攻击报文进行丢弃。
这里的中间设备，指的是源设备和目的设备之间的设备，例如可以是网络接入设备(如集线器、交换机)，网间设备(如路由器)，或网络安全设备(如防火墙、防攻击设备)等。
为了令中间设备具备识别正常报文和攻击报文的能力，本申请为中间设备增加了如下两个功能：
第一，记录本设备接收的报文的源IP(Internet Protocol，互联网协议)地址中对应真实设备的IP地址，也即正常报文的源IP地址。本申请可以通过第一IP地址列表记录这类源IP地址。此处的真实设备指真实存在的设备，可以包括：物理设备和虚拟设备。
第二，记录本设备接收的报文的源IP地址，也即正常报文和攻击报文的源IP地址。本申请可以通过第二IP地址列表记录接收的报文的源IP地址，或者可以在第一IP地址列表中记录正常报文的源IP地址，在第二地址列表中记录攻击报文的源IP地址及未知报文的源IP地址。
至于中间设备如何基于上述第一IP地址列表和第二IP地址列表分辨正常报文和攻击报文，以下将通过图1所示的方法流程说明。参见图1，该方法可包括以下步骤。
步骤101：接收第一报文，第一报文的目的IP地址为中间设备保护的服务器的IP地址。
这里的第一报文，可以是TCP(Transmission Control Protocol，传输控制协议)报文、UDP(User Datagram Protocol，用户数据报协议)报文或ICMP(Internet Control Message Protocol，因特网控制报文协议)报文等。实际应用中，UDP Flood攻击是比较常见的一种DoS攻击，它可以利用协议栈导致服务器产生大量的半连接，也即服务器发出的消息不会被攻击者返回，这些半连接会消耗服务器大量的资源。
步骤102：若保存的第一IP地址列表中包括第一报文的源IP地址，则转发第一报文。
当中间设备从第一IP地址列表中找到第一报文的源IP地址时，表明中间设备之前已检测过该源IP地址并确认该源IP地址对应真实设备，所以直接对报文进行转发。
当中间设备从第一IP地址列表中未找到第一报文的源IP地址时，此时可能有两种情况，一种是中间设备之前未检测过该源IP地址(或曾检测过该源IP地但检测结果已老化删除)，另一种是中间设备之前已检测过该源IP地址并确认该源IP地址不对应真实设备。至于当前的第一报文属于哪种情况，则需要结合第二IP地址列表来确定，具体情况如下。
步骤103：若保存的第一IP地址列表和第二IP地址列表中均不包括第一报文的源IP地址，则将第一报文的源IP地址添加到第二IP地址列表中，并发送第二报文。其中，所述第二报文的源IP地址为第一报文的目的IP地址或中间设备的IP地址，第二报文的目的IP地址为第一报文的源IP地址，第二报文的目的端口号为预设范围内的任一端口号。
当中间设备从第一IP地址列表和第二IP地址列表中均未找到第一报文的源IP地址时，表明中间设备之前未检测过该源IP地址或曾检查过该源IP地址但检测结果已老化删除。所以这里中间设备可以先将第一报文的源IP地址添加到第二IP地址列表中，接下来再去探测该源IP地址是否对应真实设备。中间设备可以根据第一报文的源IP地址构建第二报文，并将第二报文发送给第一报文的源IP地址以探测该源IP地址是否对应真实设备。至于如何处理这种情况下的第一报文，中间设备可以立即丢弃第一报文，或是暂时保存第一报文，等待第二报文的探测结果再决定是转发第一报文还是丢弃第一报 文。
步骤104：若接收到用于指示第二报文错误的响应报文，则将第一报文的源IP地址添加到第一IP地址列表中。
在一种实施方式中，上述第二报文可以是一个目的端口号很大的报文，比如，第二报文的目的端口号可以是32768至65535(包括32768和65535)中的任一端口号。如果第一报文的源IP地址对应着一个真实设备，那么在该真实存在的设备收到一个端口号为非知名端口并且端口号很大的报文后会返回ICMP端口不可达报文；如果第一报文的源IP地址不对应一个真实设备，那么该源IP地址标识的设备本身便不存在，该不存在的设备自然不会收到中间设备发出的第二报文，也自然不会返回ICMP端口不可达报文。基于此，若中间设备收到ICMP端口不可达报文，则可以确定第一报文的源IP地址对应一个真实设备，第一报文为合法报文，所以将第一报文的源IP地址添加至第一IP地址列表中。若中间设备在预设时间内一直未收到ICMP端口不可达报文，则不会将该第一报文的源IP地址添加至第一IP地址列表。
至于步骤103中提到在第一IP地址列表和第二IP地址列表中均不包括第一报文的源IP地址的情况下会将第一报文的源IP地址添加到第二IP地址列表中，这里对于被添加到第二IP地址列表中的第一报文的源IP地址，可以有以下两种处理方式。
第一种，如果中间设备在预设时间内接收到用于指示第二报文错误的响应报文，则可以删除第二IP地址列表中记录的第一报文的源IP地址；反之，如果中间设备在预设时间内没接收到用于指示第二报文错误的响应报文，则可以保留第二IP地址列表中记录的第一报文的源IP地址。这种方式下，第二IP地址列表中可以记录攻击报文的源IP地址，可以不记录正常报文的源IP地址，如此可以节省中间设备的存储资源。当然，为了实现第二IP地址列表可以记录攻击报文的源IP地址的目的，在步骤103中，若中间设备在确定第一IP地址列表和第二IP地址中均不包括第一报文的源IP地址，可以发送第二报文，如果在预设时间内收到针对第二报文的响应报文，则不将第一报文的源IP地址添加到第二IP地址列表中；如果在预设时间内未收到针对第二报文的响应报文，则将第一报文的源IP地址添加到第二IP地址列表中。
第二种，不论中间设备是否接收到用于指示第二报文错误的响应报文，均保留第二IP地址列表中的第一报文的源IP地址。并且，在收到用于指示第二报文错误的响应报文后，将第一报文的源IP地址放入第一IP地址列表。这种方式下，第二IP地址列表中保存的是正常报文和攻击报文的源IP地址，相对于第一种方式的好处在于，由于不需 要在预设时间内判断是否收到第一报文的源IP地址返回的响应报文，因此不需要启动指示是否达到预设时间的定时器，可以节省中间设备的处理资源。
除步骤103所说的情况之外，关于第一IP地址列表和第二IP地址列表中是否包括第一报文的源IP地址还可能存在以下情况：第一IP地址列表中不包括第一报文的源IP地址，且第二IP地址列表中包括第一报文的源IP地址。这种情况表明中间设备之前已检测过第一报文的源IP地址，既然该源IP地址被记录在第二IP地址列表中但没有被记录在第一IP地址列表中，从而可以确定该第一报文的源IP地址不对应真实设备，此时中间设备可以直接丢弃该第一报文。
经过上述过程，中间设备将正常报文的源IP地址加入到第一IP地址列表中，这样当正常报文的源IP地址再次发送报文时，可以在第一IP地址列表中找到该源IP地址，从而直接转发该报文。并且，中间设备将攻击报文的源IP地址加入到第二IP地址列表中，这样当攻击报文的源IP地址再次发送报文时，中间设备可以在第二IP地址列表中找到该源IP地址，从而丢弃该报文。上述过程不仅可以有效地防止DoS攻击，而且中间设备还可以从中区别出正常报文和攻击报文，减小了DoS攻击对网络设备的正常业务造成的影响。
而为了提高防范DoS攻击的效率和减少资源消耗，中间设备可以针对一些预设的IP地址进行DoS攻击防范，比如中间设备可以针对目的地址为本设备要保护的服务器IP地址的报文执行DoS攻击防范。
或者，更进一步地，中间设备在确认接收的第一报文的目的IP地址是本设备保护的服务器的IP地址之后，可以进一步判断在接收到该第一报文之前的预设时间内，接收到的目的地址为该要保护的服务器的IP地址的报文(包括正常报文和攻击报文)的数量是否超过设定的阈值，如果是，才执行DoS攻击防范。具体而言，步骤102中，中间设备可以在满足第一条件时，转发第一报文。第一条件可以是：在收到第一报文之前的预设时间内，中间设备接收到的第三报文的数量超过设置的阈值、且保存的第一IP列表中包括第一报文的源IP地址，其中，第三报文的目的IP地址为被中间设备保护的服务器的IP地址。可选的，第一报文的目的IP地址和第三报文的目的IP地址可以相同。
同理，步骤103中，中间设备可以在满足第二条件时，将第一报文的源IP地址添加到第二IP地址列表中并发送第二报文。第二条件可以是：在收到第一报文之前的预设时间内，中间设备接收到的第三报文的数量超过设定的阈值、且第一IP地址列表和第二IP地址列表中均不包括第一报文的源IP地址。
中间设备还可以在满足第三条件时，丢弃第一报文。第三条件可以是：在收到第一报文之前的预设时间内，中间设备接收到的第三报文的数量超过设定的阈值、且第一IP地址列表中不包括第一报文的源IP地址但第二IP地址列表中包括第一报文的源IP地址。
相应的，如果中间设备在收到第一报文之前的预设时间内收到的第三报文的数量低于设定的阈值，则中间设备可以直接转发第一报文。
作为一个实施例，为进一步保证DoS攻击检测结果的时效性，还可以对第一IP地址列表和第二IP地址列表进行老化。可以有多种老化手段，例如可以为第一IP地址列表和第二IP地址列表中记录的源IP地址配置老化时间。又例如，可以在第一IP地址列表和第二IP地址列表中增加一个统计字段，用于统计每个周期内收到列表中各源IP地址发送的报文的次数，如果某个周期内某个源IP地址对应的统计次数为0，则将该源IP地址从第一IP地址列表和/或第二IP地址列表中删除，如果不为0，则继续保留该源IP地址，并将该源IP地址对应的统计次数清零。
至于第一IP地址列表和第二IP地址列表可以有以下两种维护方式。
在一种方式中，中间设备可以针对每个本设备保护的服务器的IP地址分别维护一张第一IP地址列表和一张第二IP地址列表。此方式下，中间设备可以在确定某个服务器的IP地址满足DoS攻击检测条件时，为这个地址创建一张第一IP地址列表和一张第二IP地址列表，以及，在确定某个服务器的IP地址不再满足DoS攻击检测条件时，删除与这个地址关联的第一IP地址列表和第二IP地址列表。相应的，步骤102至步骤104中，中间设备可以在与第一报文的目的IP地址关联的第一IP地址列表和第二IP地址列表中，查找第一报文的源IP地址。
在另一种方式中，中间设备也可以针对所有本设备要保护的服务器的IP地址统一维护一张第一IP地址列表和一张第二IP地址列表。此方式下，这两张表可以一直保存在中间设备(或第三方设备)上。在确定某个服务器的IP地址不再满足DoS攻击检测条件时，中间设备可以清空这两张表中与该服务器的IP地址关联的源IP地址的内容。相应的，步骤102至步骤104中，中间设备可以在保存的第一IP地址列表和第二IP地址列表中，查找第一报文的源IP地址。
通过图1所示的流程，即可将正常报文和攻击报文区分出来并分别处理。为了更加清楚，下面分别通过正常报文的处理过程示例和攻击报文的处理过程示例，来描述本申 请的技术方案。
图2所示为一种针对正常报文的处理过程，其中客户端是一个真实存在的请求方，中间设备上已启动针对服务端IP地址的DoS攻击防范，具体过程如下。
1)中间设备收到客户端发送给服务端的报文。
2)中间设备检查第一IP地址列表中是否包括客户端的IP地址，检查结果为不包括。
3)中间设备检查第二IP地址列表中是否包括客户端的IP地址，检查结果为不包括。
4)中间设备将客户端的IP地址添加到第二IP地址列表中。
5)中间设备向客户端发送第二报文，第二报文的目的端口号介于32768和65535之间。
6)客户端向中间设备返回ICMP端口不可达报文。
7)中间设备将客户端的IP地址添加到第一IP地址列表中。
8)中间设备再次收到客户端发送给该服务端的报文。
9)中间设备检查第一IP地址列表中是否包括客户端的IP地址，检查结果为包括。
10)中间设备将该报文转发给服务端。
图3所示为一种针对攻击报文的处理过程，其中客户端是一个网络中不存在的IP地址，中间设备上已启动针对服务端IP地址的DoS攻击防范，具体过程如下。
1)中间设备收到客户端发送给服务端的报文。
2)中间设备检查第一IP地址列表中是否包括该客户端的IP地址，检查结果为不包括。
3)中间设备检查第二IP地址列表中是否包括客户端的IP地址，检查结果为不包括。
4)中间设备将客户端的IP地址添加到第二IP地址列表中。
5)中间设备向客户端发送第二报文，第二报文的目的端口号介于32768和65535之间。
因客户端并不是真实设备，所以它不会返回ICMP端口不可达报文，中间设备也不会将客户端的IP地址添加到第一IP地址列表中。
6)中间设备再次收到客户端发送给该服务端的报文。
7)中间设备检查第一IP地址列表中是否包括客户端的IP地址，检查结果为不包括。
8)中间设备检查第二IP地址列表中是否包括客户端的IP地址，检查结果为包括。
9)中间设备丢弃该报文。
综上所述，本申请在防范DoS攻击时，中间设备基于记录的第一IP地址列表和第二IP地址列表，不仅可以有效地防止DoS攻击，而且还可以从中区别出正常报文和攻击报文。从而减小了DoS攻击对网络设备的正常业务造成的影响。
以上对本申请提供的方法进行了描述。下面对本申请提供的装置进行描述。
参见图4，为本申请提供的一种攻击防范装置，所述装置应用于中间设备，所述装置可以包括收发单元401和攻击防范单元402，其中：
收发单元401，用于收发报文，其中，包括接收第一报文，所述第一报文的目的IP地址为所述中间设备保护的服务器的IP地址。
攻击防范单元402，用于若保存的第一IP地址列表中包括所述第一报文的源IP地址，则指示所述收发单元401转发所述第一报文；若保存的第一IP地址列表和第二IP地址列表中均不包括所述第一报文的源IP地址，则将所述第一报文的源IP地址添加到所述第二IP地址列表中，并指示所述收发单元401发送第二报文，其中，所述第二报文的源IP地址为所述第一报文的目的IP地址或所述中间设备的地址，所述第二报文的目的IP地址为所述第一报文的源IP地址，所述第二报文的目的端口号为预设范围内的任一端口号；若所述收发单元401接收到用于指示所述第二报文错误的响应报文，则将所述第一报文的源IP地址添加到所述第一IP地址列表中。
在其中一种实施方式中，所述攻击防范单元402，还可以用于若所述第一IP地址列表中不包括所述第一报文的源IP地址，且所述第二IP地址列表中包括所述第一报文的源IP地址，则丢弃所述第一报文。
在其中一种实施方式中，所述第二报文的目的端口号为32768至65535内的任一端口号；所述响应报文为ICMP端口不可达报文。
在其中一种实施方式中，所述攻击防范单元402还用于判断所述收发单元401在接收到所述第一报文之前的预设时间内，接收到第三报文的数量是否超过设定的阈值，其中，所述第三报文的目的IP地址为所述中间设备保护的服务器的IP地址；若判定所述收发单元401接收到所述第三报文的数量超过所述设定的阈值，则判断所述第一IP地 址列表和所述第二IP地址列表是否包括所述第一报文的源IP地址。
在其中一种实施方式中，所述攻击防范单元402，还用于若判定所述收发单元401接收到所述第三报文的数量低于设定的阈值，则指示所述收发单元401转发所述第一报文。
需要说明的是，本发明实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。在本申请的实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
至此，完成图4所示装置的功能模块描述。
对应地，如图5所示，本申请还提供一种中间设备的硬件结构图，该中间设备包括：通信接口501、处理器502、机器可读存储介质503和总线504；其中，通信接口501、处理器502、机器可读存储介质503通过总线504完成相互间的通信。
其中，通信接口501，用于发送和接收报文。处理器502可以是一个CPU(Central Processing Unit,中央处理器)，机器可读存储介质503可以是非易失性机器可读存储介质，并且存储器503中存储有攻击防范机器可执行指令，处理器502可以执行存储器503中存储的攻击防范机器可执行指令，以实现上述图1-图3任一所示方法。
至此，完成图5所示中间设备的硬件结构描述。
以上所述仅为本申请的较佳实施例而已，并不用以限制本申请，凡在本申请的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本申请保护的范围之内。

Claims (15)

  1. 一种攻击防范方法，所述方法应用于中间设备，包括：
    接收第一报文，所述第一报文的目的IP地址为所述中间设备保护的服务器的IP地址；
    若保存的第一IP地址列表中包括所述第一报文的源IP地址，则转发所述第一报文；
    若所述第一IP地址列表和保存的第二IP地址列表中均不包括所述第一报文的所述源IP地址，则
    将所述第一报文的所述源IP地址添加到所述第二IP地址列表中，
    发送第二报文，其中，所述第二报文的源IP地址为所述第一报文的所述目的IP地址或所述中间设备的IP地址，所述第二报文的目的IP地址为所述第一报文的源IP地址，所述第二报文的目的端口号为预设范围内的任一端口号；
    若接收到用于指示所述第二报文错误的响应报文，则将所述第一报文的源IP地址添加到所述第一IP地址列表中。
  2. 如权利要求1所述的方法，其特征在于，所述方法还包括：
    若所述第一IP地址列表中不包括所述第一报文的源IP地址，且所述第二IP地址列表中包括所述第一报文的源IP地址，则丢弃所述第一报文。
  3. 如权利要求1所述的方法，其特征在于，
    所述第二报文的目的端口号为32768至65535内的任一端口号；
    所述响应报文为ICMP端口不可达报文。
  4. 如权利要求2所述的方法，其特征在于，所述方法还包括：
    在接收到所述第一报文之前的预设时间内，判断接收到的第三报文的数量是否超过设定的阈值，其中，所述第三报文的目的IP地址为所述中间设备保护的服务器的IP地址；
    若判定所述第三报文的数量超过设定的阈值，则判断所述第一IP地址列表和所述第二IP地址列表是否包括所述第一报文的源IP地址。
  5. 如权利要求4所述的方法，其特征在于，所述方法还包括：
    若判定接收到所述第三报文的数量低于所述设定的阈值，则转发所述第一报文。
  6. 一种攻击防范装置，所述装置应用于中间设备，包括：
    收发单元，用于接收第一报文，所述第一报文的目的IP地址为所述中间设备保护的服务器的IP地址；
    攻击防范单元，用于根据保存的第一IP地址列表和保存的第二IP地址列表确认是 否转发所述第一报文，其中，
    若所述第一IP地址列表中包括所述第一报文的源IP地址，则指示所述收发单元转发所述第一报文；
    若所述第一IP地址列表和所述第二IP地址列表中均不包括所述第一报文的所述源IP地址，则
    将所述第一报文的所述源IP地址添加到所述第二IP地址列表中，并
    指示所述收发单元发送第二报文，其中，所述第二报文的源IP地址为所述第一报文的所述目的IP地址或所述中间设备的IP地址，所述第二报文的目的IP地址为所述第一报文的所述源IP地址，所述第二报文的目的端口号为预设范围内的任一端口号；
    若所述收发单元接收到用于指示所述第二报文错误的响应报文，则将所述第一报文的所述源IP地址添加到所述第一IP地址列表中。
  7. 如权利要求6所述的装置，其特征在于，所述攻击防范单元，还用于：
    若所述第一IP地址列表中不包括所述第一报文的所述源IP地址，且所述第二IP地址列表中包括所述第一报文的所述源IP地址，则丢弃所述第一报文。
  8. 如权利要求6所述的装置，其特征在于，
    所述第二报文的所述目的端口号为32768至65535内的任一端口号；
    所述响应报文为ICMP端口不可达报文。
  9. 如权利要求7所述的装置，其特征在于，所述攻击防范单元还用于：
    判断所述收发单元在接收到所述第一报文之前的预设时间内，接收到第三报文的数量是否超过设定的阈值，其中，所述第三报文的目的IP地址为所述中间设备保护的服务器的IP地址；
    若判定所述收发单元接收到所述第三报文的数量超过所述设定的阈值，则判断所述第一IP地址列表和所述第二IP地址列表是否包括所述第一报文的源IP地址。
  10. 如权利要求9所述的装置，其特征在于，所述攻击防范单元，还用于：
    若判定所述收发单元接收到所述第三报文的数量低于所述设定的阈值，则转发所述第一报文。
  11. 一种电子设备，包括：
    处理器，
    存储有机器可执行指令的非易失性机器可读存储介质，
    其中，当执行所述指令时，所述处理器被促使：
    接收第一报文，所述第一报文的目的IP地址为所述中间设备保护的服务器的IP地址；
    若保存的第一IP地址列表中包括所述第一报文的源IP地址，则转发所述第一报文；
    若所述第一IP地址列表和保存的第二IP地址列表中均不包括所述第一报文的所述源IP地址，则
    将所述第一报文的所述源IP地址添加到所述第二IP地址列表中，
    发送第二报文，其中，所述第二报文的源IP地址为所述第一报文的所述目的IP地址或所述中间设备的IP地址，所述第二报文的目的IP地址为所述第一报文的源IP地址，所述第二报文的目的端口号为预设范围内的任一端口号；
    若接收到用于指示所述第二报文错误的响应报文，则将所述第一报文的源IP地址添加到所述第一IP地址列表中。
  12. 如权利要求11所述的电子设备，其特征在于，所述处理器还被促使：
    若所述第一IP地址列表中不包括所述第一报文的源IP地址，且所述第二IP地址列表中包括所述第一报文的源IP地址，则丢弃所述第一报文。
  13. 如权利要求11所述的电子设备，其特征在于，
    所述第二报文的目的端口号为32768至65535内的任一端口号；
    所述响应报文为ICMP端口不可达报文。
  14. 如权利要求12所述的电子设备，其特征在于，所述处理器还被促使：
    在接收到所述第一报文之前的预设时间内，判断接收到的第三报文的数量是否超过设定的阈值，其中，所述第三报文的目的IP地址为所述中间设备保护的服务器的IP地址；
    若判定所述第三报文的数量超过设定的阈值，则判断所述第一IP地址列表和所述第二IP地址列表是否包括所述第一报文的源IP地址。
  15. 如权利要求14所述的电子设备，其特征在于，所述处理器还被促使：
    若判定接收到所述第三报文的数量低于所述设定的阈值，则转发所述第一报文。
PCT/CN2018/115132 2017-11-14 2018-11-13 攻击防范 WO2019096104A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711122077.6 2017-11-14
CN201711122077.6A CN108989275A (zh) 2017-11-14 2017-11-14 一种攻击防范方法和装置

Publications (1)

Publication Number Publication Date
WO2019096104A1 true WO2019096104A1 (zh) 2019-05-23

Family

ID=64542228

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/115132 WO2019096104A1 (zh) 2017-11-14 2018-11-13 攻击防范

Country Status (2)

Country Link
CN (1) CN108989275A (zh)
WO (1) WO2019096104A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111385248B (zh) * 2018-12-28 2021-07-09 华为技术有限公司 攻击防御方法和攻击防御设备
CN112953895B (zh) * 2021-01-26 2022-11-22 深信服科技股份有限公司 一种攻击行为检测方法、装置、设备及可读存储介质
CN113810398B (zh) * 2021-09-09 2023-09-26 新华三信息安全技术有限公司 一种攻击防护方法、装置、设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1954545A (zh) * 2003-03-03 2007-04-25 思科技术公司 利用tcp认证ip源地址
US20080127349A1 (en) * 2006-11-08 2008-05-29 Ormazabal Gaston S PREVENTION OF DENIAL OF SERVICE (DoS) ATTACKS ON SESSION INITIATION PROTOCOL (SIP)-BASED SYSTEMS USING METHOD VULNERABILITY FILTERING
CN101741855A (zh) * 2009-12-16 2010-06-16 中兴通讯股份有限公司 地址解析协议缓存表维护方法和网络设备
CN102231748A (zh) * 2011-08-02 2011-11-02 杭州迪普科技有限公司 一种客户端验证方法及装置
CN105430011A (zh) * 2015-12-25 2016-03-23 杭州朗和科技有限公司 一种检测分布式拒绝服务攻击的方法和装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7526807B2 (en) * 2003-11-26 2009-04-28 Alcatel-Lucent Usa Inc. Distributed architecture for statistical overload control against distributed denial of service attacks
CN102291441B (zh) * 2011-08-02 2015-01-28 杭州迪普科技有限公司 一种防范SYN Flood攻击的方法及安全代理装置
CN105991632A (zh) * 2015-04-20 2016-10-05 杭州迪普科技有限公司 网络安全防护方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1954545A (zh) * 2003-03-03 2007-04-25 思科技术公司 利用tcp认证ip源地址
US20080127349A1 (en) * 2006-11-08 2008-05-29 Ormazabal Gaston S PREVENTION OF DENIAL OF SERVICE (DoS) ATTACKS ON SESSION INITIATION PROTOCOL (SIP)-BASED SYSTEMS USING METHOD VULNERABILITY FILTERING
CN101741855A (zh) * 2009-12-16 2010-06-16 中兴通讯股份有限公司 地址解析协议缓存表维护方法和网络设备
CN102231748A (zh) * 2011-08-02 2011-11-02 杭州迪普科技有限公司 一种客户端验证方法及装置
CN105430011A (zh) * 2015-12-25 2016-03-23 杭州朗和科技有限公司 一种检测分布式拒绝服务攻击的方法和装置

Also Published As

Publication number Publication date
CN108989275A (zh) 2018-12-11

Similar Documents

Publication Publication Date Title
WO2021008028A1 (zh) 网络攻击源定位及防护方法、电子设备及计算机存储介质
US8542684B2 (en) ARP packet processing method, communication system and device
EP2289221B1 (en) Network intrusion protection
JP4545647B2 (ja) 攻撃検知・防御システム
US7818795B1 (en) Per-port protection against denial-of-service and distributed denial-of-service attacks
US20100095351A1 (en) Method, device for identifying service flows and method, system for protecting against deny of service attack
US10505952B2 (en) Attack detection device, attack detection method, and attack detection program
EP3355514A1 (en) Method and device for transmitting network attack defense policy and method and device for defending against network attack
KR20120060655A (ko) 서버 공격을 탐지할 수 있는 라우팅 장치와 라우팅 방법 및 이를 이용한 네트워크
US7854000B2 (en) Method and system for addressing attacks on a computer connected to a network
JP4373306B2 (ja) Ｔｃｐステートレス・ホグによるｔｃｐサーバに対する分散サービス妨害攻撃を防御する方法および装置
US10834125B2 (en) Method for defending against attack, defense device, and computer readable storage medium
WO2019096104A1 (zh) 攻击防范
KR20180052324A (ko) 분산 반사 서비스 거부 공격 탐지 장치 및 방법
WO2008131658A1 (fr) Procédé et dispositif pour fureter le dhcp
Kavisankar et al. A mitigation model for TCP SYN flooding with IP spoofing
WO2016177131A1 (zh) 防止dos攻击方法、装置和系统
US9455953B2 (en) Router chip and method of selectively blocking network traffic in a router chip
JP4602158B2 (ja) サーバ装置保護システム
CN102546587B (zh) 防止网关系统会话资源被恶意耗尽的方法及装置
Kumarasamy et al. An active defense mechanism for TCP SYN flooding attacks
JP4694578B2 (ja) コンピュータネットワークをパケットフラッド（ｆｌｏｏｄ）から保護するための方法及びシステム
EP3133790B1 (en) Message sending method and apparatus
CN113014530B (zh) Arp欺骗攻击防范方法及系统
CN104348785B (zh) IPv6网中防止主机PMTU攻击的方法、装置与系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18878511

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18878511

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 18878511

Country of ref document: EP

Kind code of ref document: A1