WO2019178966A1 - 抵抗网络攻击方法、装置、计算机设备及存储介质 - Google Patents

抵抗网络攻击方法、装置、计算机设备及存储介质 Download PDF

Info

Publication number
WO2019178966A1
WO2019178966A1 PCT/CN2018/092628 CN2018092628W WO2019178966A1 WO 2019178966 A1 WO2019178966 A1 WO 2019178966A1 CN 2018092628 W CN2018092628 W CN 2018092628W WO 2019178966 A1 WO2019178966 A1 WO 2019178966A1
Authority
WO
WIPO (PCT)
Prior art keywords
login
security
user
client
access request
Prior art date
Application number
PCT/CN2018/092628
Other languages
English (en)
French (fr)
Inventor
李洋
陈春璐
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2019178966A1 publication Critical patent/WO2019178966A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection

Definitions

  • the present application relates to the field of network security, and in particular, to a method, device, computer device, and storage medium for resisting network attacks.
  • the existing server anti-DDOS (Distributed Denial of Service) system/mechanism in the market mainly includes: a local anti-DDOS traffic cleaning mechanism and a cloud traffic cleaning mechanism. Either way, it is impossible to avoid the server in the DDOS scenario, the real access request sent by the client is rejected (because the real access request sent by the client and the abnormal attack traffic are mixed together), so it is difficult to satisfy the server pair.
  • the guarantee of QoS (Quality of Service) for user services is particularly serious in the financial industry. How to ensure that the server can receive the real access request sent by the client when it is attacked by the DDOS network traffic becomes an urgent problem to be solved.
  • the embodiment of the present application provides a method, a device, a computer device, and a storage medium for resisting network attacks, so as to solve the problem that a real access request sent by a client is rejected when a DDOS network traffic attack is received.
  • the embodiment of the present application provides a method for resisting network attacks, including:
  • the access request further carries the security identifier and the security identifier is secure, the service request information corresponding to the user ID is processed, and the service processing result is obtained;
  • the user obtains the feedback message carrying the security identifier based on the user ID and the login terminal information.
  • the service processing result or the feedback message is sent to the client corresponding to the user ID.
  • the embodiment of the present application provides a device for resisting network attacks, including:
  • Obtaining an access request module configured to obtain an access request sent by the client, where the access request includes a user ID and login terminal information or service request information;
  • Obtaining a processing result module configured to: if the access request further carries a security identifier and the security identifier is secure, processing the service request information corresponding to the user ID, and acquiring the service processing result;
  • Obtaining a feedback message module configured to obtain a feedback message carrying a security identifier based on the user ID and the login terminal information if the access request does not carry the security identifier;
  • the sending processing result module is configured to send the service processing result or the feedback message to the client corresponding to the user ID.
  • an embodiment of the present application provides a computer device, including a memory, a processor, and computer readable instructions stored in the memory and executable on the processor, where the processor implements the following steps when executing the computer readable instructions:
  • the access request further carries the security identifier and the security identifier is secure, the service request information corresponding to the user ID is processed, and the service processing result is obtained;
  • the user obtains the feedback message carrying the security identifier based on the user ID and the login terminal information.
  • the service processing result or the feedback message is sent to the client corresponding to the user ID.
  • embodiments of the present application provide one or more non-volatile readable storage media storing computer readable instructions that are executed by one or more processors such that one or more processors Perform the following steps:
  • the access request further carries the security identifier and the security identifier is secure, the service request information corresponding to the user ID is processed, and the service processing result is obtained;
  • the user obtains the feedback message carrying the security identifier based on the user ID and the login terminal information.
  • the service processing result or the feedback message is sent to the client corresponding to the user ID.
  • Embodiment 1 is a flowchart of a method for resisting network attacks in Embodiment 1 of the present application
  • Embodiment 3 is another specific flowchart of a method for resisting network attacks in Embodiment 1 of the present application;
  • FIG. 5 is a schematic block diagram of a device for resisting network attacks in Embodiment 2 of the present application.
  • FIG. 6 is a schematic diagram of a computer device in Embodiment 4 of the present application.
  • DDOS attacks can be completely synonymous with "large-scale network attacks.”
  • attack traffic can reach hundreds of Gbits per second, but this situation is relatively rare.
  • an attacker can use 1Gbits per second or less of traffic to flood a corporate or organization's servers.
  • the duration of these attacks is generally not too long, and most DDOS attacks will only last for about thirty minutes.
  • the server almost rejects all access requests including real access requests for security reasons, seriously affecting or even blocking access requests initiated by normal clients.
  • This application is directed to the problem that the server is difficult to ensure that the server receives the access request sent by the normal client and responds when the server is attacked by the DDOS network traffic.
  • FIG. 1 shows a flow chart of a method for resisting network attacks in this embodiment.
  • the resistance network attack method is applied in the field of network security.
  • the method for resisting network attacks includes the following steps:
  • the access request is a request by the client to authenticate the server or provide service support. If the server performs identity authentication, the client needs to provide the user ID, and the login terminal information is also required. If the server provides service support, not only the user ID but also the client provides the service request information.
  • the user ID is equivalent to the user's network ID card. It is a unique number assigned to the user when the user first registers the system to distinguish other registered users in the system.
  • the login terminal information is the login IP address used by the client to log in to the server, such as 192.168.1.100.
  • the service request information is to initiate a confirmation transfer service request to the server.
  • the server receives all the access requests sent by the client without distinguishing the types of access requests of the client, thereby saving the time for the server to perform type determination on the access request.
  • the subsequent server directly performs the corresponding service operation by accessing the content carried by the request (that is, the login terminal information or the service request information), for example, if the access request submitted by the client carries the service request information that conforms to the service support request format, the access request is obtained.
  • the business request information carried in and carried out further processing is efficient and convenient.
  • the access request further carries the security identifier and the security identifier is secure, the service request information corresponding to the user ID is processed, and the service processing result is obtained.
  • the security identifier is a segment of the login message sent when the client logs in to the server to indicate whether the client is secure.
  • the security identifier can be set according to the specific application environment.
  • the security identifier of the security client can be configured as “security” or “0”, and the security identifier of the dangerous client is configured as “dangerous” or “1”.
  • the service request information is specific content related to the service support in the access request that the client makes to the server. For example, if the service request information in the access request is the transfer service support, the service request information includes the transferor, the transfer account number, the transfer amount, and Transfer time, etc.
  • the client that sent the access request has sent the identity authentication request to the server and received the feedback message carrying the security identifier sent by the server.
  • the server receives the access request carrying the security identifier and the security identifier is secure, indicating that the access request is a service support request and the login client is a secure client, and may respond to the access request made by the client.
  • the security server can process the service request information filed by the normal client in time.
  • the feedback message carrying the security identifier is obtained based on the user ID and the login terminal information.
  • the feedback packet is a TCP packet returned by the server to the client, and is used to display the result of the identity verification of the corresponding client of the server.
  • the feedback message includes a TCP header segment, a security identifier segment, and a TCP data segment.
  • the security identifier segment carries the identifier information when the client initiates the service processing request, and the server determines the security of the service request by using the identifier information carried by the client.
  • the minimum length of the TCP header segment is 20 bytes, including information such as source port and destination port for session confirmation.
  • the TCP data segment part carries the data content of the specific service request. As shown in the following Table 1, Table 1 shows the format of the feedback message carrying the security identifier provided in this embodiment.
  • the access request received by the server does not carry the security identifier, indicating that the access request is an identity authentication request, and the client needs to be authenticated.
  • the verification result is added to the feedback message fed back to the client in the form of a security identifier, so that the feedback message fed back to the client carries the security identifier.
  • this step adds a security identifier to the feedback packet, which is used to delay the response to the traffic sent by the client with the dangerous identifier to ensure that the server is protected from network attacks.
  • the technical support is such that the server only responds to the service request for providing the service support sent by the client carrying the security identifier, that is, the service information in the access request is processed to obtain the service processing result.
  • the access request server based on the identity authentication returns a feedback message (ie, step S30), and sends the feedback message to the client corresponding to the user ID; accordingly, based on the access request server that provides service support
  • the business process result is returned (ie, step S20), and the business process result is fed back to the client corresponding to the user ID.
  • the server returns the corresponding content in time according to different types of access requests, without first classifying the access request and then accepting the access request, thereby improving the information transmission efficiency between the server and the client.
  • the server When the server receives an access request carrying a security identifier, it first reads the security identifier. If the security identifier is secure, continue to read the specific service request information carried by the access request; if the security identifier is dangerous, the server may receive an attack from the network traffic, and the server refuses to respond to the access request to ensure the server is normal. run.
  • the method for resisting the network attack further includes:
  • the access request further carries the security identifier and the security identifier is dangerous, the user ID is locked, and the reminder information is sent to the client corresponding to the user ID.
  • the lock user ID is used to freeze the user ID when the server obtains the security identifier carried in the access request sent by the client, and no longer receives any information sent by the user ID.
  • the freeze time can be set to a specific duration or permanently frozen. If the client steals another user's common user ID for network attack, the user ID can be set to a specific duration to avoid false freezing of the common user ID. If the client uses the new registration ID for network attack, the user ID can be set to Permanently frozen, that is, the server no longer accepts any information sent by this user ID.
  • the server is prevented from receiving the user ID for multiple purposes for attack purposes or other purposes, and the server is repeatedly used for judgment, which wastes server resources.
  • the method for resisting the network attack provided by the embodiment of the present invention, when the access request sent by the client is obtained, and the access request carries the security identifier and the security identifier is secure, the service request information in the access request is processed to ensure the real access request. If the access request does not carry the security identifier, the security identifier of the client is obtained based on the user ID and the login terminal information, and the server can effectively block the attack of the malicious network traffic based on the security identifier. This embodiment can also avoid wasting server resources by locking the security ID as a dangerous user ID.
  • step S30 the feedback message carrying the security identifier is obtained based on the user ID and the login terminal information, and specifically includes the following steps:
  • the risk detection algorithm is used to process the user ID and the login terminal information, and obtain the login security of the client.
  • the login security includes normal login and abnormal login.
  • the risk detection algorithm is an algorithm for detecting whether the client is a secure client, including but not limited to an abnormal traffic detection algorithm, a user pattern recognition algorithm, a protocol stack behavior pattern analysis, a specific application protection, a user behavior pattern analysis, and a dynamic fingerprint identification.
  • An algorithm used for risk monitoring to mark the client with a security identity including but not limited to an abnormal traffic detection algorithm, a user pattern recognition algorithm, a protocol stack behavior pattern analysis, a specific application protection, a user behavior pattern analysis, and a dynamic fingerprint identification.
  • the detection method of the risk detection algorithm includes detecting whether the user ID of the client is a normal login, whether the login IP address in the login terminal information is consistent with the location of the client, and whether the login IP address is a normal login IP address. For example, after the attacker hijacks the user ID, the attack server can be tested with more than one million abnormal login IP addresses, and the server initiates hundreds of millions of access requests. If the server determines in time that the attacker's login IP address is an abnormal login IP address and refuses to accept all the access requests sent by the login IP address, the server resources can be saved a lot, and the server can be protected from network brute force attacks.
  • the detection results of the risk detection algorithm include normal login and abnormal login.
  • the normal login refers to the normal login that the client does not use brute force attack or password cracking.
  • the abnormal login includes abnormal login using brute force attack, and the login IP is inconsistent with the location.
  • the login IP address is a high-risk address, etc.
  • the high-risk address is a login IP that is logged in by means of abnormal login.
  • the client's login security is determined to determine the security of the client that sends the access request, so that the client that normally logs in can continue to be successfully launched.
  • a feedback packet is formed, a security identifier is added to the feedback packet, and the security identifier is set to be secure.
  • the security packet sent by the server to the client that is, the security packet is set in the TCP packet, so that the subsequent client sends the security identifier to the server when the service processing-based access request is sent to the server, indicating the login security.
  • security identifier added by the server to the client whose detection result is normal login is "secure".
  • "security” can also be identified by other symbols, such as "0".
  • This step generates a concise and secure security identifier and sets a security packet with the security identifier as "secure".
  • the client sends a security request to the same server again.
  • the security identifier is convenient for the server to respond to the access request sent by the client in time.
  • the server also adds the security identifier added to the client whose detection result is abnormal login as “dangerous”.
  • "danger” can also be identified by other symbols, such as "1".
  • the server sends a dangerous security identifier to the client. So that the server can refuse to respond to the access request sent by the client in time.
  • the server determines the login security of the client through the risk detection algorithm, and adds a simple and clear security identifier to the feedback message of the client, so that the server can respond in time or reject the access request sent by the client.
  • the risk detection algorithm may employ an abnormal traffic detection algorithm.
  • Abnormal traffic is a network traffic that has a significant change relative to smooth network traffic. It comes from congestion in the network and resource overload on the router.
  • the server needs to detect abnormal traffic in a timely and accurate manner, otherwise the network where the server is located cannot run effectively and reliably.
  • the user ID and the login terminal information are processed by using the risk detection algorithm to obtain the login security of the client, which specifically includes the following steps:
  • the current traffic characteristic is a basic feature data of the network traffic that is used to extract the user ID from the network traffic and log in to the server through the login terminal, and the information exchanges with the server, including the traffic size, the packet length information, the protocol information, and the port traffic information.
  • traffic characteristic data sets such as TCP flag information, based on these traffic feature data sets, can describe the running status of network traffic in a comprehensive and detailed manner.
  • the traffic characteristic data set is the basis of the entire network traffic anomaly detection algorithm.
  • the server further determines the abnormality of the network traffic based on the risk detection algorithm.
  • the abnormality detection model formed by the abnormal flow detection algorithm is used to identify the current traffic characteristics and obtain the recognition result.
  • the abnormal traffic detection algorithm is one of the risk detection algorithms, and is based on a model established by abnormal states such as user behavior, user process, and network abnormal traffic to determine whether the server encounters a network attack and what kind of network attack is encountered.
  • the anomaly detection model in this embodiment is implemented based on the idea of hierarchically dividing traffic characteristics, and is used to divide traffic characteristics into two levels: a basic feature set and a combined feature set.
  • the basic feature set includes traffic size, packet length information, protocol information, port traffic information, and TCP flag bit information.
  • the combined feature set can be changed in real time according to actual needs. For a specific attack behavior, a subset of the basic features related to the attack behavior is taken as a feature describing the attack behavior. For example, for DDOS attacks, the combined feature set can select information such as traffic packets/second, average packet length, and number of DDOS packets.
  • the model for identifying the combination of the attack behavior as normal traffic or abnormal traffic can be obtained in real time, that is, the abnormality detection based on the abnormal traffic detection algorithm. model.
  • TCP SYN flood denial of service attack
  • SYN Flood is a well-known DDOS (Distributed Denial of Service Attack) method, which is a kind of TCP protocol defect, sending a large number of forged TCP connection requests, which makes the attacker resources exhausted (the server is full or insufficient memory) ) attack method.
  • DDOS Distributed Denial of Service Attack
  • the client sends a large number of TCP request packets to the target host, and the source IP address in the IP header is forged. As a result, the target host cannot receive the confirmation information sent by the client, and the TCP three-way handshake cannot be established. Typically, the target host will retry and wait until it is discarded. SYN TIMEOUT is 30 seconds to 2 minutes.
  • the data collected by Netflow is an example: 11.*.64.3
  • the typical characteristic of this abnormal traffic is that the packet protocol type is 6 (TCP) and the data stream size is 40 bytes (usually a TCP SYN connection request).
  • the packet corresponding to each attack is filtered, and the number of packets and the number of bytes of each attack packet are calculated by statistical thinking, and the threshold is respectively defined to determine whether or not a DDOS attack is encountered, and what kind of encounter is encountered. DDOS attack.
  • the abnormality detection model is formed in advance based on the abnormal traffic detection algorithm, so that the current traffic feature of the attack behavior on the network can be detected in real time in the step S312 to achieve timely and effective. Identify whether the current traffic characteristics are abnormal traffic.
  • the server can continue to receive the access request sent by the client.
  • the server recognizes that the login security of the client is a normal login, and the persistent connection of the client and the server can be ensured, and the access request sent by the client can be timely responded by the server.
  • the server may refuse to respond to the access request sent by the client.
  • the server identifies the current traffic characteristic corresponding to the access request sent by the client, and determines that the login security of the client is abnormal login, so that the server may reject the access request sent by the client, so that the server is protected from the server. The client's malicious attack.
  • the abnormal traffic detection algorithm is used to determine the login security of the client when the client logs in to the server for the first time, so that the client that normally logs in can continue to successfully initiate the access request.
  • the risk detection algorithm may also employ a user pattern recognition algorithm.
  • Different network applications exhibit different behavioral characteristics at the transport layer during the transmission and interaction of the network. Therefore, by using the behavior characteristics of known network applications to match the behavior characteristics of unknown traffic, the network traffic application type can be classified, which is based on the principle of transport layer behavior pattern recognition. The method does not need to parse the traffic load content, and does not need to collect information such as port number and feature field, and the overhead is small.
  • step S31 the user ID and the login terminal information are processed by using the risk detection algorithm to obtain the login security of the client, which specifically includes the following steps:
  • the current user traffic is a real-time record of the behavior traffic generated by the user after logging in to the server through the user ID and the login terminal information, including the login IP address of the user ID login server, the access log, the user browsing path, and the access request.
  • the server further determines the abnormality of the network traffic based on the user pattern recognition algorithm.
  • the abnormal feature database formed by the user pattern recognition algorithm is used to identify the current user traffic, and obtain the recognition result.
  • the abnormal feature database is a set of abnormal traffic scenarios formed by statistical analysis of abnormal traffic according to an abnormal traffic scenario. For example, statistics on the access to a specific web page or file when abnormal traffic occurs, access in different areas and regions, such as the distribution of domain name network traffic such as edu/cn/com, and the abnormal relationship between users and regional time. Wait.
  • the server compares the current user traffic and the abnormal feature database to timely and effectively identify whether the current user traffic is abnormal traffic.
  • the recognition result is normal traffic, it is proved that the client is normally logged in, and the server can continue to receive the access request sent by the client. This step ensures the login security of the client to the server, and ensures the continuous connection between the client and the server. The access request sent by the client can be timely responded by the server.
  • the server may refuse to respond to the access request sent by the client. This step protects the server from malicious attacks from this client.
  • the user mode identification algorithm is used to determine the login security of the client when the client logs in to the server for the first time, so that the client that normally logs in can continue to successfully initiate the access request.
  • the method for resisting the network attack provided by the embodiment of the present invention, when the access request sent by the client is obtained, and the access request carries the security identifier and the security identifier is secure, the service request information in the access request is processed to ensure the real access request. If the access request does not carry the security identifier, the security identifier of the client is obtained based on the user ID and the login terminal information, and the server can effectively block the attack of the malicious network traffic based on the security identifier. This embodiment can also avoid wasting server resources by locking the security ID as a dangerous user ID.
  • the server uses the risk detection algorithm to determine the login security of the client, and adds a simple and clear security identifier to the feedback message of the client, so that the server can respond in time or reject the access request sent by the client.
  • FIG. 5 is a block diagram showing the principle of resisting a network attack device corresponding to the one against the network attack method in Embodiment 1.
  • the anti-network attack device includes an acquisition access request module 10, an acquisition processing result module 20, a retrieval feedback message module 30, and a transmission processing result module 40.
  • the implementation functions of the access requesting module 10, the obtaining processing result module 20, the obtaining feedback message module 30, and the sending processing result module 40 are in one-to-one correspondence with the steps corresponding to the network attacking method in the embodiment. To avoid redundancy, the implementation The examples are not detailed one by one.
  • the access requesting module 10 is configured to obtain an access request sent by the client, where the access request includes a user ID and login terminal information or service request information.
  • the processing result module 20 is configured to process the service request information corresponding to the user ID and obtain the service processing result if the access request further carries the security identifier and the security identifier is secure.
  • the feedback message module 30 is configured to obtain a feedback message carrying the security identifier based on the user ID and the login terminal information if the access request does not carry the security identifier.
  • the sending processing result module 40 is configured to send the service processing result or the feedback message to the client corresponding to the user ID.
  • the resisting network attack device further comprises sending a reminder information module 50.
  • the sending reminding information module 50 is configured to: if the access request further carries the security identifier and the security identifier is dangerous, the user ID is locked, and the reminder information is sent to the client corresponding to the user ID.
  • the acquiring feedback message module 30 further includes acquiring the login security unit 31, forming the feedback message unit 32, and adding the security identification unit 33.
  • the login security unit 31 is configured to process the user ID and the login terminal information by using a risk detection algorithm to obtain login security of the client, where the login security includes normal login and abnormal login.
  • the feedback message unit 32 is configured to form a feedback message if the login security is normal login, add a security identifier to the feedback message, and set the security identifier to be secure.
  • the security identification unit 33 is configured to form a feedback message if the login security is abnormal, add a security identifier to the feedback message, and set the security identifier to be dangerous.
  • the acquisition login security module 31 further includes an acquisition flow feature unit 311, an acquisition recognition result unit 312, a recognition normal flow unit 313, and an identification abnormal flow unit 314.
  • the obtaining traffic feature unit 311 is configured to acquire current traffic characteristics corresponding to the user ID and the login terminal information.
  • the acquisition result unit 312 is configured to identify the current traffic feature by using the abnormality detection model formed by the abnormal traffic detection algorithm, and obtain the recognition result.
  • the normal traffic unit 313 is identified, and if the recognition result is normal traffic, the login security of the client is normal login.
  • the abnormality traffic unit 314 is configured to use the abnormality of the traffic, and the login security of the client is abnormal login.
  • the acquisition login security module 31 further includes an acquisition flow unit 315, a recognition flow unit 316, a recognition normal flow unit 317, and an identification abnormal flow unit 318.
  • the obtaining traffic unit 315 is configured to acquire current user traffic corresponding to the user ID and the login terminal information.
  • the identification flow unit 316 is configured to identify the current user traffic by using an abnormal feature database formed based on the user pattern recognition algorithm, and obtain the recognition result.
  • the normal traffic unit 317 is identified, and if the recognition result is normal traffic, the login security of the client is normal login.
  • the abnormality traffic unit 318 is configured to use the abnormality of the traffic, and the login security of the client is abnormal login.
  • the embodiment provides a computer readable storage medium on which computer readable instructions are stored, and when the computer readable instructions are executed by the processor, the method for resisting network attacks in Embodiment 1 is implemented, in order to avoid duplication, here No longer.
  • the computer readable instructions are executed by the processor, the functions of the modules/units in the network attack device in Embodiment 2 are implemented. To avoid repetition, details are not described herein again.
  • the computer readable storage medium may include any entity or device capable of carrying the computer readable instruction code, a recording medium, a USB flash drive, a removable hard disk, a magnetic disk, an optical disk, a computer memory, a read only memory (ROM, Read-Only Memory), Random Access Memory (RAM), electrical carrier signals, and telecommunications signals.
  • FIG. 6 is a schematic diagram of a computer device according to an embodiment of the present application.
  • computer device 60 of this embodiment includes a processor 61, a memory 62, and computer readable instructions 63 stored in memory 62 and executable on processor 61.
  • the processor 61 implements the steps of the above-described first embodiment against the network attack method when the computer readable instructions 63 are executed, such as steps S10 to S40 shown in FIG.
  • the processor 61 executes the computer readable instructions 63
  • the functions of the modules in the foregoing device embodiments are implemented, for example, the acquisition access request module 10, the acquisition processing result module 20, the acquisition feedback message module 30, and the transmission processing shown in FIG. The function of the result module 40.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请公开了一种抵抗网络攻击方法、装置、计算机设备及存储介质。该抵抗网络攻击方法包括：获取客户端发送的访问请求，访问请求包括用户ID和登录终端信息或业务请求信息；若访问请求还携带有安全标识且安全标识为安全时，则处理用户ID对应的业务请求信息，获取业务处理结果；若访问请求未携带有安全标识，则基于用户ID和登录终端信息，获取携带有安全标识的反馈报文；将业务处理结果或反馈报文发送给与用户ID相对应的客户端。本申请提供的抵抗网络攻击方法通过服务器识别客户端携带的安全标识，可以有效屏蔽恶意网络流量的攻击，且保障真正访问请求得以及时处理。

Description

抵抗网络攻击方法、装置、计算机设备及存储介质
本申请以2018年03月22日提交的申请号为201810239771.4，名称为“抵抗网络攻击方法、装置、计算机设备及存储介质”的中国发明申请为基础，并要求其优先权。
技术领域
本申请涉及网络安全领域，尤其涉及一种抵抗网络攻击方法、装置、计算机设备及存储介质。
背景技术
市面现有的服务器抗DDOS(Distributed Denial of Service，分布式拒绝服务)系统/机制，主要包括：本地抗DDOS流量清洗机制和云端流量清洗机制。无论哪一种机制，都不能避免服务器在发生DDOS的场景下,客户端发送的真正访问请求遭到拒绝(因为客户端发送的真正访问请求和异常攻击流量混杂在一起)，这样难以满足服务器对用户服务进行的QoS(Quality of Service，服务质量)的保障，这种现象在金融行业尤为严重。如何在受到DDOS网络流量攻击时，保障服务器可接收客户端发送的真正访问请求，成为目前亟需解决的问题。
发明内容
本申请实施例提供一种抵抗网络攻击方法、装置、计算机设备及存储介质，以解决在受到DDOS网络流量攻击时，客户端发送的真正访问请求遭到拒绝的问题。
第一方面，本申请实施例提供一种抵抗网络攻击方法，包括：
获取客户端发送的访问请求，访问请求包括用户ID和登录终端信息或业务请求信息；
若访问请求还携带有安全标识且安全标识为安全时，则处理用户ID对应的业务请求信息，获取业务处理结果；
若访问请求未携带有安全标识，则基于用户ID和登录终端信息，获取携带有安全标识的反馈报文；
将业务处理结果或反馈报文发送给与用户ID相对应的客户端。
第二方面，本申请实施例提供一种抵抗网络攻击装置，包括：
获取访问请求模块，用于获取客户端发送的访问请求，访问请求包括用户ID和登录终端信息或业务请求信息；
获取处理结果模块，用于若访问请求还携带有安全标识且安全标识为安全时，则处理用户ID对应的业务请求信息，获取业务处理结果；
获取反馈报文模块，用于若访问请求未携带有安全标识，则基于用户ID和登录终端信息，获取携带有安全标识的反馈报文；
发送处理结果模块，用于将业务处理结果或反馈报文发送给与用户ID相对应的客户端。
第三方面，本申请实施例提供一种计算机设备，包括存储器、处理器以及存储在存储器中并可在处理器上运行的计算机可读指令，处理器执行计算机可读指令时实现如下步骤：
获取客户端发送的访问请求，访问请求包括用户ID和登录终端信息或业务请求信息；
若访问请求还携带有安全标识且安全标识为安全时，则处理用户ID对应的业务请求信息，获取业务处理结果；
若访问请求未携带有安全标识，则基于用户ID和登录终端信息，获取携带有安全标识的反馈报文；
将业务处理结果或反馈报文发送给与用户ID相对应的客户端。
第四方面，本申请实施例提供一个或多个存储有计算机可读指令的非易失性可读存储介质，计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行如下步骤：
获取客户端发送的访问请求，访问请求包括用户ID和登录终端信息或业务请求信息；
若访问请求还携带有安全标识且安全标识为安全时，则处理用户ID对应的业务请求信息，获取业务处理结果；
若访问请求未携带有安全标识，则基于用户ID和登录终端信息，获取携带有安全标识的反馈报文；
将业务处理结果或反馈报文发送给与用户ID相对应的客户端。
本申请的一个或多个实施例的细节在下面的附图和描述中提出，本申请的其他特征和优点将从说明书、附图以及权利要求变得明显。
附图说明
为了更清楚地说明本申请实施例的技术方案，下面将对本申请实施例的描述中所需要 使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例1中抵抗网络攻击方法的一流程图；
图2是本申请实施例1中抵抗网络攻击方法的另一具体流程图；
图3是本申请实施例1中抵抗网络攻击方法的另一具体流程图；
图4是本申请实施例1中抵抗网络攻击方法的另一具体流程图；
图5是本申请实施例2中抵抗网络攻击装置的一原理框图；
图6是本申请实施例4中计算机设备的一示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
现有DDOS攻击完全可以被当作“大规模网络攻击”的代名词。在某些特殊的攻击场景中，攻击流量可以达到每秒几百Gbits，但是这种情况相对来说比较罕见。在大多数情况下，攻击者可以用每秒1Gbits甚至更少的流量来对企业或组织的服务器发动洪泛攻击。这些攻击的持续时间一般不会太长，大多数DDOS攻击只会持续三十分钟左右。服务器出于安全考虑几乎拒绝包括真正访问请求的所有访问请求，严重影响甚至阻断正常客户端发起的访问请求。
本申请就是针对服务器在受到DDOS网络流量攻击时，难以保障服务器接收正常客户端发送的访问请求并进行响应的问题而提出的。
实施例1
图1示出本实施例中抵抗网络攻击方法的流程图。该抵抗网络攻击方法应用在网络安全领域。如图1所示，该抵抗网络攻击方法包括如下步骤：
S10.获取客户端发送的访问请求，访问请求包括用户ID和登录终端信息或业务请求信息。
其中，访问请求是客户端向服务器提出进行身份认证，或者提供业务支持的请求。若服务器进行身份认证，需要客户端提供用户ID，还需要提供登录终端信息；若服务器提供 业务支持，不仅需要用户ID，还需要客户端提供业务请求信息。
用户ID相当于用户网络身份证，是用户第一次注册系统时，系统给用户分配的一个唯一号码，用以区别系统内的其他注册用户。登录终端信息就是本次客户端登录服务器时使用的登录IP地址,比如192.168.1.100，业务请求信息是向服务器发起确认转账业务申请。
本步骤中，服务器通过接收客户端发送的所有访问请求，而不对客户端的访问请求类型进行区分，节省了服务器对访问请求进行类型判定的时间。后续服务器通过访问请求携带的内容(即登录终端信息还是业务请求信息)直接进行对应的业务操作，比如，若客户端提出的访问请求中携带符合业务支持请求格式的业务请求信息，则获取访问请求中携带的业务请求信息并进行进一步处理，高效便捷。
S20.若访问请求还携带有安全标识且安全标识为安全时，则处理用户ID对应的业务请求信息，获取业务处理结果。
其中，安全标识是配置在客户端登录服务器时发送的登录报文中的一段标识，以表示该客户端是否安全。安全标识可以根据具体应用环境进行设定，于本实施例可将安全客户端的安全标识配置为“安全”或者“0”，将危险客户端的安全标识配置为“危险”或者“1”。
业务请求信息是客户端向服务器提出的访问请求中有关业务支持的具体内容，比如，如果该访问请求中的业务请求信息为转账业务支持，则业务请求信息包括转账人、转账账号、转账数目和转账时间等。
可以理解地，若访问请求中还携带有安全标识，则说明发送该访问请求的客户端在此之前已经向服务器发送过身份认证请求并接收过服务器发送的携带安全标识的反馈报文。本步骤中服务器通过接收携带有安全标识、且安全标识为安全的访问请求，说明该访问请求为业务支持请求且登录客户端为安全的客户端，可以对该客户端提出的访问请求进行响应，保障服务器可以及时处理正常客户端提起的业务请求信息。
S30.若访问请求未携带有安全标识，则基于用户ID和登录终端信息，获取携带有安全标识的反馈报文。
其中，反馈报文是服务器给客户端返回的一段TCP报文，用以显示服务器相应客户端身份验证的结果。该反馈报文包括TCP首部段、安全标识段和TCP数据段。该安全标识段用以后续客户端提起业务处理请求时携带该标识信息，服务器通过该客户端携带的标识信息来判定业务请求的安全性。TCP首部段的最小长度是20字节，包括源端口和目的端口等 用于进行会话确认的信息。TCP数据段部分则携带具体业务请求的数据内容。如下表一所示，表一示出本实施例提供的携带有安全标识的反馈报文格式。
Figure PCTCN2018092628-appb-000001
表一
进一步地，服务器接收到的访问请求未携带安全标识，说明该访问请求为身份认证请求，需对该客户端的进行身份验证。将验证结果以安全标识的形式添加到反馈给客户端的反馈报文中，以使反馈给客户端的反馈报文携带安全标识。
相对于现有没有携带安全标识段的TCP反馈报文，本步骤通过给反馈报文添加安全标识，用以给后期拒绝响应带有危险标识的客户端发送的流量，保障服务器避免受到网络攻击提供技术支持，使得服务器只响应携带安全标识的客户端发送的提供业务支持的访问请求，即对该访问请求中的业务信息进行处理，以获取业务处理结果。
S40.将业务处理结果或反馈报文发送给与用户ID相对应的客户端。
可以理解地，基于进行身份认证的访问请求服务器返回反馈报文(即步骤S30)，并将该反馈报文发送给与用户ID相对应的客户端；相应地，基于提供业务支持的访问请求服务器返回业务处理结果(即步骤S20)，并将该业务处理结果反馈给与用户ID相对应的客户端。
本步骤中，服务器基于不同类型的访问请求分别及时返回对应的内容，而不需要先对访问请求进行分类后再接受访问请求，提高服务器和客户端之间的信息传输效率。
服务器接收到携带有安全标识的访问请求时，首先读取安全标识。若安全标识为安全，则继续读取该访问请求携带的具体的业务请求信息；若安全标识为危险，说明服务器可能接受到来自网络流量的攻击，则服务器拒绝响应该访问请求，以保障服务器正常运行。
优选地，在获取客户端发送的访问请求的步骤之后，该抵抗网络攻击方法还包括：
S50.若访问请求还携带有安全标识且安全标识为危险时，则锁定用户ID，给用户ID对应的客户端发送提醒信息。
其中，锁定用户ID是指当服务器获取客户端发送的访问请求中携带的安全标识为危险时，冻结该用户ID，不再接收该用户ID发送的任何信息。冻结时间可设置为特定时长或者永久冻结。若客户端盗用他人的常用用户ID进行网络攻击，可将该用户ID设置为特定时长，以避免误冻结该常用用户ID；若客户端采用新注册ID进行网络攻击，可将该用户ID设置为永久冻结，也即服务器不再接受该用户ID发送的任何信息。
本步骤通过锁定安全标识为危险的用户ID，避免服务器继续接收该用户ID出于攻击目的或者其他目的多次发送访问请求，多次占用服务器进行判定，浪费服务器资源。
本申请实施例提供的抵抗网络攻击方法，通过获取客户端发送的访问请求，且该访问请求携带有安全标识且安全标识为安全时，才处理访问请求中的业务请求信息，保障真正访问请求得以及时处理；对于未携带有安全标识的访问请求，则基于用户ID和登录终端信息获取客户端的安全标识，服务器基于该安全标识可以有效屏蔽恶意网络流量的攻击。本实施例还可通过锁定安全标识为危险的用户ID，避免浪费服务器资源。
在一具体实施方式中，如图2所示，步骤S30中，即基于用户ID和登录终端信息，获取携带有安全标识的反馈报文，具体包括如下步骤：
S31.采用风险检测算法对用户ID和登录终端信息进行处理，获取客户端的登录安全性，其中，登录安全性包括正常登录和异常登录。
其中，风险检测算法是用于检测客户端是否为安全客户端的算法，包括但不限于异常流量检测算法、用户模式识别算法、协议栈行为模式分析、特定应用防护、用户行为模式分析和动态指纹识别等用于进行风险监测的算法，用以给客户端标记安全标识。
风险检测算法的检测途径包括检测客户端的用户ID是否为正常登陆、登录终端信息中的登陆IP地址是否与客户端的所在地一致、该登陆IP地址是否为正常登陆IP地址等。比如，攻击者劫持用户ID后可利用超过百万个非正常登陆IP地址测试登录服务器，对服务器发起上亿次的访问请求。若服务器及时判定攻击者的登录IP地址为非正常登录IP地址，拒绝接受所有该登录IP地址发送的访问请求，即可大量节省服务器资源，并可保护服务器免于收到网络暴力攻击。
风险检测算法的检测结果包括正常登录和异常登录，其中正常登陆是指客户端没有采用暴力攻击、密码破解等手段实现的正常登陆；异常登陆包括采用暴力攻击进行非正常登录、登录IP与所在地不一致和登录IP地址为高危地址等。其中，高危地址是通过异常登陆的方式进行登录的登录IP。
本步骤通过采用风险检测算法，在客户端首次登录服务器时，就对客户端的登录安全性进行判定，以确定发送该访问请求的客户端的安全，以便为后续保障正常登录的客户端能继续顺利发起访问请求以及拒绝异常登录的客户端提供技术支持。
S32.若登录安全性为正常登录，则形成反馈报文，在反馈报文中添加安全标识，并将安全标识设置为安全。
其中，服务器给客户端发回的反馈报文也即TCP报文中建立一个安全标识段，使得后 续客户端向服务器提起基于业务处理的访问请求时携带该安全标识，表明登录安全性。
可以理解地，服务器给检测结果为正常登录的客户端添加的安全标识为“安全”。于本实施例，“安全”也可用其它符号进行标识，比如“0”。
本步骤通过生成简洁明了的安全标识，并设置安全标识为“安全”的反馈报文，在将该反馈报文发送给客户端后，客户端再次向同一服务器发送访问请求时均携带有安全的安全标识，便于服务器及时响应该客户端发送的访问请求。
S33.若登录安全性为异常登录，则形成反馈报文，在反馈报文中添加安全标识，并将安全标识设置为危险。
本步骤中，服务器同样给检测结果为异常登录的客户端添加的安全标识为“危险”。于本实施例，“危险”也可用其它符号进行标识，比如“1”。服务器通过生成简洁明了的安全标识，且安全标识为“危险”的反馈报文，在将该反馈报文发送给客户端后，客户端再次向同一服务器发送访问请求时均携带有危险的安全标识，便于服务器及时拒绝响应该客户端发送的访问请求。
本实施例中服务器通过风险检测算法判定客户端的登录安全性，给客户端的反馈报文中添加简洁明了的安全标识，便于服务器及时响应或者拒绝客户端发送的访问请求。
在一具体实施方式中，风险检测算法可以采用异常流量检测算法。异常流量是相对于平稳的网络流量有着显著变化的网络流量，它来自于网络中的拥塞和路由器上的资源过载。服务器需要及时准确地检测异常流量，否则服务器所在的网络无法有效、可靠地运行。如图3所示，步骤S31中，即采用风险检测算法对用户ID和登录终端信息进行处理，获取客户端的登录安全性，具体包括如下步骤：
S311.获取与用户ID和登录终端信息相对应的当前流量特征。
其中，当前流量特征是实时从网络流量中提取用户ID通过登录终端登录服务器后，与服务器之间进行信息交互的网络流量的基本特征数据，包括流量大小、包长信息、协议信息、端口流量信息和TCP标志位信息等流量特征数据集，基于这些流量特征数据集可以详细全面地描述网络流量的运行状态。流量特征数据集是整个网络流量异常检测算法的基础。
本步骤中通过获取网络中的当前流量特征，以便于服务器基于风险检测算法进一步判定该网络流量的异常性。
S312.采用基于异常流量检测算法形成的异常检测模型对当前流量特征进行识别，获取识别结果。
其中，异常流量检测算法是风险检测算法中的一种，基于用户行为、用户进程、网络异常流量等异常状态建立的模型，以判断服务器是否遭遇网络攻击，以及遭遇何种网络攻击。本实施例中的异常检测模型是基于将流量特征分层划分的思想实现的，用于将流量特征分为两个层次：基本特征集合和组合特征集合。
基本特征集合包括流量大小、包长信息、协议信息、端口流量信息和TCP标志位信息等。组合特征集合是可以根据实际需要实时改变设置的。针对某种特定的攻击行为，将涉及该攻击行为的基本特征的子集作为描述该种攻击行为的特征。比如对于DDOS攻击，组合特征集合就可以选取流量包/秒、平均包长、DDOS包的个数等信息。利用以往基本特征集合的数据对该种攻击行为的特征进行学习和训练，就可以实时得到用于识别该攻击行为组合特征为正常流量或异常流量的模型，即基于异常流量检测算法形成的异常检测模型。
以TCP SYN flood(拒绝服务攻击)为例说明基于异常流量检测算法形成的异常检测模型的过程：
SYN Flood是一种广为人知的DDOS(分布式拒绝服务攻击)的方式，这是一种利用TCP协议缺陷，发送大量伪造的TCP连接请求，从而使得被攻击方资源耗尽(服务器满负荷或内存不足)的攻击方式。
特点：客户端向目标主机发送大量TCP请求包，且IP包头中的源IP是伪造的，导致目标主机收不到客户端发来的确认信息，TCP三次握手无法建立。一般，目标主机会重试并等待，直至丢弃。SYN TIMEOUT为30秒至2分钟。
Netflow(流量监控分析软件)采集到的数据为例：11.*.64.3|2.*.38.180|6482|as10|5|4|1013|18|6|1|40|1；这一组数据中的参数分别对应于源地址|目的地址|源自治域|目的自治域|流入接口号|源端口|目的端口|协议类型|包数量|字节数|流数量。
从Netflow的采集数据可看出，此异常流量的典型特征是数据包协议类型为6(TCP)，数据流大小为40字节(通常为TCP的SYN连接请求)。
通过这种方式筛选出每种攻击对应的数据包，并用统计学的思维计算每种攻击的数据包的包数和字节数，分别定义阈值，即可判断是否遭遇DDOS攻击，以及遭遇何种DDOS攻击。
本实施例中，预先采用基于异常流量检测算法形成异常检测模型，以便在本步骤S312中采用该异常检测模型就可以实时地对网络上该种攻击行为的当前流量特征进行检测，以实现及时有效地识别当前流量特征是否为异常流量。
S313.若识别结果为正常流量，则客户端的登录安全性为正常登录。
可以理解地，若当前流量特征的识别结果为正常流量，也即当前客户端发送的的网络流量是正常流量，证明该客户端是正常登录的，服务器可继续接收该客户端发送的访问请求。本步骤中，服务器识别出客户端的登录安全性为正常登录时，可通过保障该客户端和服务器的持续连接，该客户端发送的访问请求可以得到服务器的及时响应。
S314.若识别结果为异常流量，则客户端的登录安全性为异常登录。
可以理解地，若当前流量特征的识别结果为异常流量，也即当前客户端发送的的网络流量是异常流量，证明该客户端是非正常登录的，服务器可拒绝响应该客户端发送的访问请求。本步骤中，服务器通过识别出客户端发送的访问请求对应的当前流量特征，确定该客户端的登录安全性为异常登录时，可使服务器拒绝该客户端发送的访问请求，以使服务器避免受到来自该客户端的恶意攻击。
本步骤通过采用异常流量检测算法，在客户端首次登录服务器时，就对客户端的登录安全性进行判定，保障正常登录的客户端能继续顺利发起访问请求。
在一具体实施方式中，风险检测算法还可以采用用户模式识别算法。不同的网络应用在网络传输和交互的过程中，会在传输层表现出互不相同的行为特征。因此利用已知的网络应用的行为特征与未知流量所表现出的行为特征进行匹配，就可以分类其网络流量应用类型，这就是基于传输层行为模式识别的原理。该方法无需解析流量负载内容，不需要采集端口号和特征字段等信息，额外开销小。
如图4所示，步骤S31中，即采用风险检测算法对用户ID和登录终端信息进行处理，获取客户端的登录安全性，具体包括如下步骤：
S315.获取与用户ID和登录终端信息相对应的当前用户流量。
其中，当前用户流量是实时记录用户通过用户ID和登录终端信息登录服务器后产生的行为流量，包括用户ID登录服务器的登录IP地址，访问日志、用户浏览路径和访问请求等。
本步骤中通过获取网络中的当前流量，以便于服务器基于用户模式识别算法进一步判定该网络流量的异常性。
S316.采用基于用户模式识别算法形成的异常特征数据库对当前用户流量进行识别，获取识别结果。
其中，异常特征数据库是根据异常流量场景，将异常流量进行统计分析后形成的异常流量场景的集合。比如，统计当发生异常流量时，对特定网页或文件的访问情况的场景， 不同领域和地区的访问情况，如edu/cn/com等域名网络流量的分布场景，用户和地区时间的异常关联场景等。
本步骤中服务器通过比对当前用户流量和异常特征数据库，可及时有效地识别当前用户流量是否为异常流量。
S317.若识别结果为正常流量，则客户端的登录安全性为正常登录。
可以理解地，若识别结果为正常流量，证明该客户端是正常登录的，服务器可继续接收该客户端发送的访问请求。本步骤向服务器保障客户端的登录安全性，保障该客户端和服务器的持续连接，该客户端发送的访问请求可以得到服务器的及时响应。
S318.若识别结果为异常流量，则客户端的登录安全性为异常登录。
可以理解地，若识别结果为异常流量，证明该客户端是非正常登录的，服务器可拒绝响应该客户端发送的访问请求。本步骤可保障服务器受到来自该客户端的恶意攻击。
本步骤通过采用用户模式识别算法，在客户端首次登录服务器时就对客户端的登录安全性进行判定，保障正常登录的客户端能继续顺利发起访问请求。
本申请实施例提供的抵抗网络攻击方法，通过获取客户端发送的访问请求，且该访问请求携带有安全标识且安全标识为安全时，才处理访问请求中的业务请求信息，保障真正访问请求得以及时处理；对于未携带有安全标识的访问请求，则基于用户ID和登录终端信息获取客户端的安全标识，服务器基于该安全标识可以有效屏蔽恶意网络流量的攻击。本实施例还可通过锁定安全标识为危险的用户ID，避免浪费服务器资源。
进一步地，服务器采用风险检测算法判定客户端的登录安全性，给客户端的反馈报文中添加简洁明了的安全标识，便于服务器及时响应或者拒绝客户端发送的访问请求。
应理解，上述实施例中各步骤的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
实施例2
图5示出与实施例1中抵抗网络攻击方法一一对应的抵抗网络攻击装置的原理框图。如图5所示，该抵抗网络攻击装置包括获取访问请求模块10、获取处理结果模块20、获取反馈报文模块30和发送处理结果模块40。其中，获取访问请求模块10、获取处理结果模块20、获取反馈报文模块30和发送处理结果模块40的实现功能与实施例中抵抗网络攻击方法对应的步骤一一对应，为避免赘述，本实施例不一一详述。
获取访问请求模块10，用于获取客户端发送的访问请求，访问请求包括用户ID和登录终端信息或业务请求信息。
获取处理结果模块20，用于若访问请求还携带有安全标识且安全标识为安全时，则处理用户ID对应的业务请求信息，获取业务处理结果。
获取反馈报文模块30，用于若访问请求未携带有安全标识，则基于用户ID和登录终端信息，获取携带有安全标识的反馈报文。
发送处理结果模块40，用于将业务处理结果或反馈报文发送给与用户ID相对应的客户端。
优选地，该抵抗网络攻击装置还包括发送提醒信息模块50。
发送提醒信息模块50，用于若访问请求还携带有安全标识且安全标识为危险时，则锁定用户ID，给用户ID对应的客户端发送提醒信息。
优选地，该获取反馈报文模块30还包括获取登录安全性单元31、形成反馈报文单元32和添加安全标识单元33。
获取登录安全性单元31，用于采用风险检测算法对用户ID和登录终端信息进行处理，获取客户端的登录安全性，其中，登录安全性包括正常登录和异常登录。
形成反馈报文单元32，用于若登录安全性为正常登录，则形成反馈报文，在反馈报文中添加安全标识，并将安全标识设置为安全。
添加安全标识单元33，用于若登录安全性为异常登录，则形成反馈报文，在反馈报文中添加安全标识，并将安全标识设置为危险。
优选地，该获取登录安全性模块31还包括获取流量特征单元311、获取识别结果单元312、识别正常流量单元313和识别异常流量单元314。
获取流量特征单元311，用于获取与用户ID和登录终端信息相对应的当前流量特征。
获取识别结果单元312，用于采用基于异常流量检测算法形成的异常检测模型对当前流量特征进行识别，获取识别结果。
识别正常流量单元313，用于若识别结果为正常流量，则客户端的登录安全性为正常登录。
识别异常流量单元314，用于若识别结果为异常流量，则客户端的登录安全性为异常登录。
优选地，该获取登录安全性模块31还包括获取流量单元315、识别流量单元316、识别正常流量单元317和识别异常流量单元318。
获取流量单元315，用于获取与用户ID和登录终端信息相对应的当前用户流量。
识别流量单元316，用于采用基于用户模式识别算法形成的异常特征数据库对当前用 户流量进行识别，获取识别结果。
识别正常流量单元317，用于若识别结果为正常流量，则客户端的登录安全性为正常登录。
识别异常流量单元318，用于若识别结果为异常流量，则客户端的登录安全性为异常登录。
实施例3
本实施例提供一计算机可读存储介质，该计算机可读存储介质上存储有计算机可读指令，该计算机可读指令被处理器执行时实现实施例1中抵抗网络攻击方法，为避免重复，这里不再赘述。或者，该计算机可读指令被处理器执行时实现实施例2中抵抗网络攻击装置中各模块/单元的功能，为避免重复，这里不再赘述。
可以理解地，计算机可读存储介质可以包括：能够携带所述计算机可读指令代码的任何实体或装置、记录介质、U盘、移动硬盘、磁碟、光盘、计算机存储器、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、电载波信号和电信信号等。
实施例4
图6是本申请一实施例提供的计算机设备的示意图。如图6所示，该实施例的计算机设备60包括：处理器61、存储器62以及存储在存储器62中并可在处理器61上运行的计算机可读指令63。处理器61执行计算机可读指令63时实现上述实施例1中抵抗网络攻击方法的步骤，例如图1所示的步骤S10至S40。或者，处理器61执行计算机可读指令63时实现上述各装置实施例中各模块的功能，例如图5所示获取访问请求模块10、获取处理结果模块20、获取反馈报文模块30和发送处理结果模块40的功能。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，仅以上述各功能单元、模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能单元、模块完成，即将所述装置的内部结构划分成不同的功能单元或模块，以完成以上描述的全部或者部分功能。
以上所述实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围，均应包含在本申请的保护范围之内。

Claims (20)

  1. 一种抵抗网络攻击方法，其特征在于，包括：
    获取客户端发送的访问请求，所述访问请求包括用户ID和登录终端信息或业务请求信息；
    若所述访问请求还携带有安全标识且所述安全标识为安全时，则处理所述用户ID对应的业务请求信息，获取业务处理结果；
    若所述访问请求未携带有安全标识，则基于所述用户ID和所述登录终端信息，获取携带有安全标识的反馈报文；
    将所述业务处理结果或所述反馈报文发送给与所述用户ID相对应的客户端。
  2. 如权利要求1所述的抵抗网络攻击方法，其特征在于，所述基于所述用户ID和所述登录终端信息，获取携带有安全标识的反馈报文，包括：
    采用风险检测算法评估所述用户ID和所述登录终端信息进行处理，获取所述客户端的登录安全性，其中，所述登录安全性包括正常登录和异常登录；
    若登录安全性为正常登录，则形成反馈报文，在所述反馈报文中添加安全标识，并将所述安全标识设置为安全；
    若登录安全性为异常登录，则形成反馈报文，在所述反馈报文中添加安全标识，并将所述安全标识设置为危险。
  3. 如权利要求1所述的抵抗网络攻击方法，其特征在于，所述采用风险检测算法评估所述用户ID和所述登录终端信息进行处理，获取所述客户端的登录安全性，包括：
    获取与所述用户ID和所述登录终端信息相对应的当前流量特征；
    采用基于异常流量检测算法形成的异常检测模型对所述当前流量特征进行识别，获取识别结果；
    若识别结果为正常流量，则所述客户端的登录安全性为正常登录；
    若识别结果为异常流量，则所述客户端的登录安全性为异常登录。
  4. 如权利要求1所述的抵抗网络攻击方法，其特征在于，所述采用风险检测算法评估所述用户ID和所述登录终端信息进行处理，获取所述客户端的登录安全性，包括：
    获取与所述用户ID和所述登录终端信息相对应的当前用户流量；
    采用基于用户模式识别算法形成的异常特征数据库对所述当前用户流量进行识别，获取识别结果；
    若识别结果为正常流量，则所述客户端的登录安全性为正常登录；
    若识别结果为异常流量，则所述客户端的登录安全性为异常登录。
  5. 如权利要求1所述的抵抗网络攻击方法，其特征在于，在所述获取客户端发送的访问请求的步骤之后，所述抵抗网络攻击方法还包括：
    若所述访问请求还携带有安全标识且所述安全标识为危险时，则丢弃所述访问请求。
  6. 如权利要求1所述的抵抗网络攻击方法，其特征在于，在所述获取客户端发送的访问请求的步骤之后，所述抵抗网络攻击方法还包括：
    若所述访问请求还携带有安全标识且所述安全标识为危险时，则锁定所述用户ID，给所述用户ID对应的客户端发送提醒信息。
  7. 一种抵抗网络攻击装置，其特征在于，包括：
    获取访问请求模块，用于获取客户端发送的访问请求，所述访问请求包括用户ID和登录终端信息或业务请求信息；
    获取处理结果模块，用于若所述访问请求还携带有安全标识且所述安全标识为安全时，则处理所述用户ID对应的业务请求信息，获取业务处理结果；
    获取反馈报文模块，用于若所述访问请求未携带有安全标识，则基于所述用户ID和所述登录终端信息，获取携带有安全标识的反馈报文；
    发送处理结果模块，用于将所述业务处理结果或所述反馈报文发送给与所述用户ID相对应的客户端。
  8. 如权利要求7所述的抵抗网络攻击装置，其特征在于，还包括：
    获取登录安全性模块，用于采用风险检测算法评估所述用户ID和所述登录终端信息进行处理，获取所述客户端的登录安全性，其中，所述登录安全性包括正常登录和异常登录；
    形成反馈报文模块，用于若登录安全性为正常登录，则形成反馈报文，在所述反馈报文中添加安全标识，并将所述安全标识设置为安全；
    添加安全标识模块，用于若登录安全性为异常登录，则形成反馈报文，在所述反馈报文中添加安全标识，并将所述安全标识设置为危险。
  9. 一种计算机设备，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机可读指令，其特征在于，所述处理器执行所述计算机可读指令时实现如下步骤：
    获取客户端发送的访问请求，所述访问请求包括用户ID和登录终端信息或业务请求 信息；
    若所述访问请求还携带有安全标识且所述安全标识为安全时，则处理所述用户ID对应的业务请求信息，获取业务处理结果；
    若所述访问请求未携带有安全标识，则基于所述用户ID和所述登录终端信息，获取携带有安全标识的反馈报文；
    将所述业务处理结果或所述反馈报文发送给与所述用户ID相对应的客户端。
  10. 如权利要求9所述的计算机设备，其特征在于，所述基于所述用户ID和所述登录终端信息，获取携带有安全标识的反馈报文，包括：
    采用风险检测算法评估所述用户ID和所述登录终端信息进行处理，获取所述客户端的登录安全性，其中，所述登录安全性包括正常登录和异常登录；
    若登录安全性为正常登录，则形成反馈报文，在所述反馈报文中添加安全标识，并将所述安全标识设置为安全；
    若登录安全性为异常登录，则形成反馈报文，在所述反馈报文中添加安全标识，并将所述安全标识设置为危险。
  11. 如权利要求9所述的计算机设备，其特征在于，所述采用风险检测算法评估所述用户ID和所述登录终端信息进行处理，获取所述客户端的登录安全性，包括：
    获取与所述用户ID和所述登录终端信息相对应的当前流量特征；
    采用基于异常流量检测算法形成的异常检测模型对所述当前流量特征进行识别，获取识别结果；
    若识别结果为正常流量，则所述客户端的登录安全性为正常登录；
    若识别结果为异常流量，则所述客户端的登录安全性为异常登录。
  12. 如权利要求9所述的计算机设备，其特征在于，所述采用风险检测算法评估所述用户ID和所述登录终端信息进行处理，获取所述客户端的登录安全性，包括：
    获取与所述用户ID和所述登录终端信息相对应的当前用户流量；
    采用基于用户模式识别算法形成的异常特征数据库对所述当前用户流量进行识别，获取识别结果；
    若识别结果为正常流量，则所述客户端的登录安全性为正常登录；
    若识别结果为异常流量，则所述客户端的登录安全性为异常登录。
  13. 如权利要求9所述的计算机设备，其特征在于，在所述获取客户端发送的访问请求的步骤之后，所述处理器执行所述计算机可读指令时还实现如下步骤：
    若所述访问请求还携带有安全标识且所述安全标识为危险时，则丢弃所述访问请求。
  14. 如权利要求9所述的计算机设备，其特征在于，在所述获取客户端发送的访问请求的步骤之后，所述处理器执行所述计算机可读指令时还实现如下步骤：
    若所述访问请求还携带有安全标识且所述安全标识为危险时，则锁定所述用户ID，给所述用户ID对应的客户端发送提醒信息。
  15. 一个或多个存储有计算机可读指令的非易失性可读存储介质，其特征在于，所述计算机可读指令被一个或多个处理器执行时，使得所述一个或多个处理器执行如下步骤：
    获取客户端发送的访问请求，所述访问请求包括用户ID和登录终端信息或业务请求信息；
    若所述访问请求还携带有安全标识且所述安全标识为安全时，则处理所述用户ID对应的业务请求信息，获取业务处理结果；
    若所述访问请求未携带有安全标识，则基于所述用户ID和所述登录终端信息，获取携带有安全标识的反馈报文；
    将所述业务处理结果或所述反馈报文发送给与所述用户ID相对应的客户端。
  16. 如权利要求15所述的非易失性可读存储介质，其特征在于，所述基于所述用户ID和所述登录终端信息，获取携带有安全标识的反馈报文，包括：
    采用风险检测算法评估所述用户ID和所述登录终端信息进行处理，获取所述客户端的登录安全性，其中，所述登录安全性包括正常登录和异常登录；
    若登录安全性为正常登录，则形成反馈报文，在所述反馈报文中添加安全标识，并将所述安全标识设置为安全；
    若登录安全性为异常登录，则形成反馈报文，在所述反馈报文中添加安全标识，并将所述安全标识设置为危险。
  17. 如权利要求15所述的非易失性可读存储介质，其特征在于，所述采用风险检测算法评估所述用户ID和所述登录终端信息进行处理，获取所述客户端的登录安全性，包括：
    获取与所述用户ID和所述登录终端信息相对应的当前流量特征；
    采用基于异常流量检测算法形成的异常检测模型对所述当前流量特征进行识别，获取识别结果；
    若识别结果为正常流量，则所述客户端的登录安全性为正常登录；
    若识别结果为异常流量，则所述客户端的登录安全性为异常登录。
  18. 如权利要求15所述的非易失性可读存储介质，其特征在于，所述采用风险检测算 法评估所述用户ID和所述登录终端信息进行处理，获取所述客户端的登录安全性，包括：
    获取与所述用户ID和所述登录终端信息相对应的当前用户流量；
    采用基于用户模式识别算法形成的异常特征数据库对所述当前用户流量进行识别，获取识别结果；
    若识别结果为正常流量，则所述客户端的登录安全性为正常登录；
    若识别结果为异常流量，则所述客户端的登录安全性为异常登录。
  19. 如权利要求15所述的非易失性可读存储介质，其特征在于，在所述获取客户端发送的访问请求的步骤之后，所述计算机可读指令被一个或多个处理器执行时，使得所述一个或多个处理器还执行如下步骤：
    若所述访问请求还携带有安全标识且所述安全标识为危险时，则丢弃所述访问请求。
  20. 如权利要求15所述的非易失性可读存储介质，其特征在于，在所述获取客户端发送的访问请求的步骤之后，所述计算机可读指令被一个或多个处理器执行时，使得所述一个或多个处理器还执行如下步骤：
    若所述访问请求还携带有安全标识且所述安全标识为危险时，则锁定所述用户ID，给所述用户ID对应的客户端发送提醒信息。
PCT/CN2018/092628 2018-03-22 2018-06-25 抵抗网络攻击方法、装置、计算机设备及存储介质 WO2019178966A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810239771.4A CN108521408B (zh) 2018-03-22 2018-03-22 抵抗网络攻击方法、装置、计算机设备及存储介质
CN201810239771.4 2018-03-22

Publications (1)

Publication Number Publication Date
WO2019178966A1 true WO2019178966A1 (zh) 2019-09-26

Family

ID=63433991

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/092628 WO2019178966A1 (zh) 2018-03-22 2018-06-25 抵抗网络攻击方法、装置、计算机设备及存储介质

Country Status (2)

Country Link
CN (1) CN108521408B (zh)
WO (1) WO2019178966A1 (zh)

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109474672B (zh) * 2018-10-25 2022-03-25 平安科技（深圳）有限公司 业务执行状态的确定方法及系统
CN109743325B (zh) * 2019-01-11 2021-06-18 北京中睿天下信息技术有限公司 一种暴力破解攻击检测方法、系统、设备及存储介质
CN109922013B (zh) * 2019-01-28 2022-08-19 天翼数字生活科技有限公司 服务访问流量控制方法、装置、服务器和存储介质
CN109787869B (zh) * 2019-03-29 2020-11-06 新华三技术有限公司 一种路径故障检测方法及设备
CN112751815B (zh) * 2019-10-31 2021-11-19 华为技术有限公司 报文处理方法、装置、设备及计算机可读存储介质
CN111131235B (zh) * 2019-12-23 2022-02-22 杭州安恒信息技术股份有限公司 一种业务系统的安全维护方法、装置、设备及存储介质
CN113132308B (zh) * 2019-12-31 2022-05-17 华为技术有限公司 一种网络安全防护方法及防护设备
CN111934949A (zh) * 2020-07-23 2020-11-13 广东电网有限责任公司 一种基于数据库注入测试的安全测试系统
CN112953921A (zh) * 2021-02-02 2021-06-11 深信服科技股份有限公司 一种扫描行为识别方法、装置、设备及存储介质
CN113923048B (zh) * 2021-11-09 2023-07-04 中国联合网络通信集团有限公司 网络攻击行为识别方法、装置、设备及存储介质
CN115102712B (zh) * 2022-05-17 2024-04-16 刘勇 一种增强的终端标识的方法、装置、电子设备及储存介质
CN115514681B (zh) * 2022-09-16 2024-02-06 北京天融信网络安全技术有限公司 一种测试设备稳定性的方法、装置、系统、设备及介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101631026A (zh) * 2008-07-18 2010-01-20 北京启明星辰信息技术股份有限公司 一种防御拒绝服务攻击的方法及装置
CN101834866A (zh) * 2010-05-05 2010-09-15 北京来安科技有限公司 一种cc攻击防护方法及其系统
US20150195293A1 (en) * 2014-01-09 2015-07-09 International Business Machines Corporation Security level and status exchange between tcp/udp client(s) and server(s) for secure transactions
CN106063222A (zh) * 2014-03-07 2016-10-26 三菱电机株式会社 用于对传送http业务的tcp连接进行分类的方法和装置
CN107426181A (zh) * 2017-06-20 2017-12-01 竞技世界（北京）网络技术有限公司 恶意Web访问请求的拦截方法及装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9735964B2 (en) * 2008-06-19 2017-08-15 Microsoft Technology Licensing, Llc Federated realm discovery
CN104092665A (zh) * 2014-06-19 2014-10-08 小米科技有限责任公司 访问请求过滤方法、装置及设备
CN105610856A (zh) * 2016-01-26 2016-05-25 深圳一卡易网络科技有限公司 一种基于多重特征识别的应用层DDoS攻击防御系统
CN106603513A (zh) * 2016-11-30 2017-04-26 中国人民解放军理工大学 基于主机标识的资源访问控制方法以及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101631026A (zh) * 2008-07-18 2010-01-20 北京启明星辰信息技术股份有限公司 一种防御拒绝服务攻击的方法及装置
CN101834866A (zh) * 2010-05-05 2010-09-15 北京来安科技有限公司 一种cc攻击防护方法及其系统
US20150195293A1 (en) * 2014-01-09 2015-07-09 International Business Machines Corporation Security level and status exchange between tcp/udp client(s) and server(s) for secure transactions
CN106063222A (zh) * 2014-03-07 2016-10-26 三菱电机株式会社 用于对传送http业务的tcp连接进行分类的方法和装置
CN107426181A (zh) * 2017-06-20 2017-12-01 竞技世界（北京）网络技术有限公司 恶意Web访问请求的拦截方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
CHEN, XUESONG: "Marking the TCP Data Package Used in Foreseeingly Instrusion Detection System", COMPUTER & DIGITAL ENGINEERING, vol. 33, no. 4, 20 April 2005 (2005-04-20), pages 8 - 10, ISSN: 1672-9722 *

Also Published As

Publication number Publication date
CN108521408B (zh) 2021-03-12
CN108521408A (zh) 2018-09-11

Similar Documents

Publication Publication Date Title
WO2019178966A1 (zh) 抵抗网络攻击方法、装置、计算机设备及存储介质
US20220045990A1 (en) Methods and systems for api deception environment and api traffic control and security
US7536552B2 (en) Upper-level protocol authentication
US10693908B2 (en) Apparatus and method for detecting distributed reflection denial of service attack
KR20000054538A (ko) 네트워크 침입탐지 시스템 및 방법 그리고 그 방법을기록한 컴퓨터로 읽을 수 있는 기록매체
WO2008131667A1 (fr) Procédé, dispositif d'identification des flux de services et procédé, système de protection contre une attaque par déni de service
US11909606B2 (en) Systems and methods for determining flow and path analytics of an application of a network using sampled packet inspection
WO2015078388A1 (zh) 针对拒绝服务攻击的处理方法及装置
KR20130014226A (ko) 공격 트래픽 형태별 특성에 따른 ｄｎｓ 플러딩 공격 탐지 방법
US11777960B2 (en) Detection of DNS (domain name system) tunneling and exfiltration through DNS query analysis
CN108270722B (zh) 一种攻击行为检测方法和装置
JP7388613B2 (ja) パケット処理方法及び装置、デバイス、並びに、コンピュータ可読ストレージ媒体
US20120030351A1 (en) Management server, communication cutoff device and information processing system
CN111131310A (zh) 访问控制方法、装置、系统、计算机设备和存储介质
US20210126940A1 (en) Mitigation of network denial of service attacks using ip location services
US20150026806A1 (en) Mitigating a Cyber-Security Attack By Changing a Network Address of a System Under Attack
US8978138B2 (en) TCP validation via systematic transmission regulation and regeneration
Jeyanthi et al. Packet resonance strategy: a spoof attack detection and prevention mechanism in cloud computing environment
CN108566384B (zh) 一种流量攻击防护方法、装置、防护服务器及存储介质
Sahri et al. Protecting DNS services from IP spoofing: SDN collaborative authentication approach
Salim et al. Preventing ARP spoofing attacks through gratuitous decision packet
US20220103582A1 (en) System and method for cybersecurity
Djalaliev et al. Sentinel: hardware-accelerated mitigation of bot-based DDoS attacks
Bharti et al. A Review on Detection of Session Hijacking and Ip Spoofing.
Jansky et al. Hunting sip authentication attacks efficiently

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18911162

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205N DATED 15.01.2021)

122 Ep: pct application non-entry in european phase

Ref document number: 18911162

Country of ref document: EP

Kind code of ref document: A1