WO2021082834A1 - 报文处理方法、装置、设备及计算机可读存储介质 - Google Patents

报文处理方法、装置、设备及计算机可读存储介质 Download PDF

Info

Publication number
WO2021082834A1
WO2021082834A1 PCT/CN2020/117875 CN2020117875W WO2021082834A1 WO 2021082834 A1 WO2021082834 A1 WO 2021082834A1 CN 2020117875 W CN2020117875 W CN 2020117875W WO 2021082834 A1 WO2021082834 A1 WO 2021082834A1
Authority
WO
WIPO (PCT)
Prior art keywords
fingerprint feature
request message
fingerprint
access
access request
Prior art date
Application number
PCT/CN2020/117875
Other languages
English (en)
French (fr)
Inventor
李世光
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to JP2022523404A priority Critical patent/JP7388613B2/ja
Priority to EP20883473.9A priority patent/EP4044546A4/en
Priority to CA3159619A priority patent/CA3159619C/en
Publication of WO2021082834A1 publication Critical patent/WO2021082834A1/zh
Priority to US17/731,893 priority patent/US20220263823A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/164—Implementing security features at a particular protocol layer at the network layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/166—Implementing security features at a particular protocol layer at the transport layer

Definitions

  • the present invention relates to the field of computer communication technology, in particular to a message processing method, a message processing device, a protection device and a computer-readable storage medium.
  • a denial of service attack also known as a flood attack, is a network attack method whose purpose is to exhaust the network or system resources of the target computer, temporarily interrupt or stop the service, and make it inaccessible to normal users.
  • a denial-of-Service attack When hackers use two or more compromised computers on the network as “zombies” to launch a "Denial-of-Service” attack against a specific target, it is called a distributed denial-of-service attack (DDoS attack) .
  • DDoS attack distributed denial-of-service attack
  • the services that are attacked by DDoS are generally HyperText Transfer Protocol (HTTP) global wide area network (Web) services.
  • DDoS detection and cleaning vendors will detect the HTTP request message format when protecting against DDoS, such as To check whether it is a request initiated by a normal user (such as a browser), it is generally to look at the User-Agent field information in the HTTP request, which will indicate the browser version. If it is found to be an abnormal user (browser) request , It will block the current communication and achieve the purpose of mitigating DDoS attacks.
  • HTTP attack messages are easy to forge, such as finding normal user request messages, and then completely copying them into the attack messages, hackers can easily evade attack detection.
  • the embodiment of the application discloses a message processing method, a message processing device, and a protective device, which can solve the technical problem that hackers in the prior art can easily avoid attack detection and make the target service vulnerable to DDoS attacks.
  • an embodiment of the present application provides a message processing method, and the method may include:
  • the protection device receives a first access request message, where the first access request message includes a message sent based on the TCP/IP protocol, and the destination of the first access request message is a server protected by the protection device;
  • the protection device extracts a first fingerprint feature from the transport layer and/or network layer header of the first access request message, and the first fingerprint feature corresponds to the terminal device that sent the first access request message
  • the type of operating system
  • the fingerprint feature library includes the operating system type of the terminal device that allows access to the server The corresponding fingerprint feature, or/and the fingerprint feature corresponding to the operating system type of the terminal device that is not allowed to access the server;
  • the first access request message is allowed to access the server, then the first access request message is allowed;
  • the first access request message is blocked.
  • the fingerprint characteristics in the header of the transport layer and/or network layer are strongly related to the operating system type, and ordinary programs cannot be modified.
  • modifying the OS means modifying the protocol stack of the OS, and the OS must be recompiled, and the original code of the OS Basically, the OS provider is private and confidential (especially for the current IoT system, more and more devices are developed by manufacturers themselves), so the difficulty and cost of recompilation are very high.
  • Protection devices such as anti-DDoS (Anti-Distributed Denial of Service, Anti-DDoS) devices, can accurately identify whether they are legitimate and normal users by identifying the fingerprint characteristics in the transport layer and/or network layer header of the attack packet Access, and can block abnormal user access requests, so as to better prevent and mitigate DDoS attacks, and better avoid DDoS attacks.
  • Anti-DDoS Anti-Distributed Denial of Service
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that allows access to the server, and the first fingerprint feature is identified based on the fingerprint feature library to determine whether Allowing the first access request message to access the server includes:
  • the first fingerprint feature is not included, it is determined that the first access request message is not allowed to access the server.
  • the method before the receiving the first access request message, the method further includes:
  • the protection device of the embodiment of the present application can automatically learn or analyze the fingerprint characteristics of the access request message in the normal business model at the transport layer and/or network layer through self-learning, and store it in the fingerprint feature database; or Developers or R&D personnel and other users configure the fingerprint characteristics of the access request message in the normal business model at the transport layer and/or network layer, then the protection device can receive the fingerprint characteristics and store them in the fingerprint characteristics database for The subsequent identification is based on the fingerprint features in the fingerprint feature database to identify whether it is a DDoS attack.
  • the fingerprint characteristics of each different transport layer and/or network layer may correspond to different OS types, such as Window 7/8, Windows 10, Linux 2.4, Linux 4.1, and so on.
  • users such as developers or R&D personnel can also directly configure the client OS type list, or automatically learn the OS type corresponding to the normal business model through self-learning to configure the client OS type list, the OS in the client OS type list
  • the type can be the type of OS that is allowed to be accessed, so that the OS blocking strategy can be configured more flexibly, more quickly and efficiently, which can meet the needs of users for rapid response when facing changeable DDoS attacks, and achieve better prevention and mitigation of DDoS attacks. Better avoid the server from DDoS attacks.
  • the fingerprint feature corresponding to the message that allows access to the server in the fingerprint feature library in advance, to identify whether the first fingerprint feature is included in the fingerprint feature library, and to decide whether to release or block the first access request message, it can be accurately Identify whether it is a legitimate normal user access, and can block abnormal user access requests, so as to achieve better prevention and mitigation of DDoS attacks, and better prevent servers from DDoS attacks.
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that is not allowed to access the server, and the first fingerprint feature is identified based on the fingerprint feature library to determine Whether to allow the first access request message to access the server includes:
  • the first fingerprint feature is not included, it is determined that the first access request message is allowed to access the server.
  • the method before the receiving the first access request message, the method further includes:
  • the third access request message in the attack service model is analyzed to obtain fingerprint characteristics at the transmission layer and/or network layer, and the fingerprint characteristics obtained by the analysis are stored in the fingerprint characteristic library.
  • the protection device of the embodiment of this application can automatically learn or analyze the fingerprint characteristics of the access request message in the attack service model at the transport layer and/or network layer through self-learning, and store it in the fingerprint feature database; or Developers or R&D personnel and other users configure the fingerprint characteristics of the access request message in the attack service model at the transport layer and/or network layer, then the protection device can receive the fingerprint characteristics and store it in the fingerprint signature database for The subsequent identification is based on the fingerprint features in the fingerprint feature database to identify whether it is a DDoS attack.
  • the fingerprint characteristics of each different transport layer and/or network layer may correspond to different OS types, such as Window 7/8, Windows 10, Linux 2.4, Linux 4.1, and so on.
  • users such as developers or R&D personnel can also directly configure the client OS type list, or automatically learn the OS type corresponding to the attack business model through self-learning to configure the client OS type list, the OS in the client OS type list
  • the type can be the type of OS that is forbidden to access, so that the OS blocking strategy can be configured more flexibly and more quickly and efficiently. It can meet the needs of users for rapid response when facing changeable DDoS attacks, and achieve better prevention and mitigation of DDoS attacks. Better avoid the server from DDoS attacks.
  • the fingerprint feature corresponding to the client whose access is forbidden in the fingerprint feature library in advance, to identify whether the fingerprint feature library contains the first fingerprint feature to determine whether to release or block the client's first access request message, which can accurately Identify whether it is a legitimate normal user access, and can block abnormal user access requests, so as to achieve better prevention and mitigation of DDoS attacks, and better prevent servers from DDoS attacks.
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that is allowed to access the server and fingerprint features corresponding to the operating system type of the terminal device that is not allowed to access the server,
  • the identifying the first fingerprint feature based on the fingerprint feature database to determine whether to allow the first access request message to access the server includes:
  • the first operating system type list includes at least one operation that allows access to the server System type
  • the second operating system type list includes at least one operating system type that is forbidden to access the server.
  • the fingerprint feature library may include fingerprint features corresponding to the operating system type of the terminal device that is allowed to access the server and fingerprint features corresponding to the operating system type of the terminal device that is not allowed to access the server.
  • the fingerprint feature library contains the correspondence between the operating system type and the fingerprint feature.
  • the fingerprint characteristics of each different transport layer and/or network layer can correspond to different OS types, such as Window 7/8, Windows 10, Linux 2.4, Linux 4.1, and so on. Then users such as developers or R&D personnel can also directly configure the client OS type list, or automatically learn the OS type corresponding to the attack business model through self-learning to configure the client OS type list.
  • the first OS type list can be At least one OS type that is allowed to access the server is included; the second OS type list may include at least one OS type that is forbidden to access the server. Then, after identifying the operating system type corresponding to the first fingerprint feature based on the fingerprint feature database, it can be determined whether to allow the first access request message to access the server according to the first operating system type list or the second operating system type list.
  • the OS blocking strategy can be configured more flexibly, more quickly and efficiently, and it can meet the needs of users for quick response in the face of changing DDoS attacks, achieve better prevention and mitigation of DDoS attacks, and better prevent servers from DDoS attacks. .
  • the message processing method of the embodiment of the present application may also trigger the execution of the transmission layer from the first access request message when it is detected that the server has suffered a DDoS attack. / Or the step of extracting the first fingerprint feature from the network layer message header.
  • the transmission delay of the access request message will be increased, and the access experience of normal users will be affected.
  • the fingerprint feature extraction and identification are triggered, which can well balance the normal access efficiency and alleviate the problem of DDoS attacks.
  • the first access request message in the embodiment of the present application includes a SYN message.
  • the SYN message is the first request message sent by the client to the server when the TCP connection is established, the fingerprint feature of the SYN message is directly extracted and identified, so that whether the access request is a DDoS attack can be identified as quickly as possible. So as to achieve better prevention and mitigation of DDoS attacks, and better avoid DDoS attacks.
  • an embodiment of the present application provides a message processing method, including:
  • the protection device receives a first access request message, where the first access request message includes a message sent based on the TCP/IP protocol, and the destination of the access request message is a server protected by the protection device;
  • the protection device extracts a first fingerprint feature from the transport layer and/or network layer header of the first access request message, and the first fingerprint feature corresponds to the terminal device that sent the first access request message
  • the type of operating system
  • the first operating system type list includes at least one operation that allows access to the server System type
  • the second operating system type list includes at least one operating system type that is forbidden to access the server
  • the first access request message is allowed to access the server, then the first access request message is allowed;
  • the first access request message is blocked.
  • the fingerprint feature database contains the correspondence between the operating system type and the fingerprint feature.
  • the fingerprint characteristics of each different transport layer and/or network layer can correspond to different OS types, such as Window 7/8, Windows 10, Linux 2.4, Linux 4.1, and so on.
  • users such as developers or R&D personnel can also directly configure the client OS type list, or automatically learn the OS type corresponding to the attack business model through self-learning to configure the client OS type list.
  • the first OS type list can be Including at least one OS type that is allowed to access the server; the second OS type list may include at least one OS type that is forbidden to access the server, then after identifying the operating system type corresponding to the first fingerprint feature based on the fingerprint feature database, you can According to the first operating system type list or the second operating system type list, determine whether to allow the first access request message to access the server; thereby achieving more flexible, faster and more efficient configuration of OS blocking policies, and in the face of changing DDoS attacks can meet the needs of users for rapid response, achieve better prevention and mitigation of DDoS attacks, and better prevent servers from DDoS attacks.
  • an embodiment of the present application provides a protective device, including a processor and a network interface, where:
  • the network interface is configured to receive a first access request message, the first access request message including a message sent based on the TCP/IP protocol, and the destination of the first access request message is the protection device protection Server
  • the processor is used to call a stored computer program to perform the following operations:
  • the fingerprint feature library includes the operating system type of the terminal device that allows access to the server The corresponding fingerprint feature, or/and the fingerprint feature corresponding to the operating system type of the terminal device that is not allowed to access the server;
  • the first access request message is allowed to access the server, then the first access request message is allowed;
  • the first access request message is blocked.
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that allows access to the server, and the processor recognizes the first fingerprint feature based on the fingerprint feature library to The determining whether to allow the first access request message to access the server includes:
  • the first fingerprint feature is not included, it is determined that the first access request message is not allowed to access the server.
  • the protection device further includes an input device; the input device is configured to receive the input transport layer and/or network layer information before the network interface receives the first access request message. Fingerprint feature, save the input fingerprint feature in the fingerprint feature library; or,
  • the processor is further configured to analyze the second access request message in the normal service model before the network interface receives the first access request message, so as to obtain fingerprint characteristics at the transport layer and/or network layer, and The fingerprint features obtained by the analysis are stored in the fingerprint feature library.
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that is not allowed to access the server, and the processor recognizes the first fingerprint feature based on the fingerprint feature library To determine whether to allow the first access request message to access the server includes:
  • the first fingerprint feature is not included, it is determined that the first access request message is allowed to access the server.
  • the protection device further includes an input device; the input device is configured to receive the input transport layer and/or network layer information before the network interface receives the first access request message. Fingerprint feature, save the input fingerprint feature in the fingerprint feature library; or,
  • the processor is further configured to analyze the third access request message in the attack service model before the network interface receives the first access request message, so as to obtain fingerprint characteristics at the transport layer and/or network layer, and The fingerprint features obtained by the analysis are stored in the fingerprint feature library.
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that is allowed to access the server and fingerprint features corresponding to the operating system type of the terminal device that is not allowed to access the server
  • the processor identifying the first fingerprint feature based on the fingerprint feature library to determine whether to allow the first access request message to access the server includes:
  • the first operating system type list includes at least one operation that allows access to the server System type
  • the second operating system type list includes at least one operating system type that is forbidden to access the server.
  • the processor may also trigger the execution of the transport layer and/or network layer message from the first access request message when it is detected that the server has suffered a DDoS attack.
  • the step of extracting the first fingerprint feature from the head may also trigger the execution of the transport layer and/or network layer message from the first access request message when it is detected that the server has suffered a DDoS attack.
  • the first access request message in the embodiment of the present application includes a SYN message.
  • an embodiment of the present application provides a protective device, which is characterized by including a processor and a network interface, wherein:
  • the network interface is used to receive a first access request message; the first access request message includes a message sent based on the TCP/IP protocol; the destination of the first access request message is the protection device protection Server
  • the processor is used to call a stored computer program to perform the following operations:
  • the first operating system type list includes at least one operation that allows access to the server System type
  • the second operating system type list includes at least one operating system type that is forbidden to access the server
  • the first access request message is allowed to access the server, then the first access request message is allowed;
  • the first access request message is blocked.
  • an embodiment of the present application provides a message processing device, including:
  • the message receiving unit is configured to receive a first access request message; the first access request message includes a message sent based on the TCP/IP protocol; the destination of the first access request message is the message The server protected by the processing device;
  • the fingerprint feature extraction unit is configured to extract a first fingerprint feature from the transport layer and/or network layer header of the first access request message, and the first fingerprint feature corresponds to sending the first access request message
  • the operating system type of the terminal equipment
  • a processing unit configured to identify the first fingerprint feature based on a fingerprint feature library to determine whether to allow the first access request message to access the server, wherein the fingerprint feature library includes a terminal that is allowed to access the server The fingerprint feature corresponding to the operating system type of the device, or/and the fingerprint feature corresponding to the operating system type of the terminal device that is not allowed to access the server;
  • the processing unit releases the first access request message
  • the processing unit blocks the first access request message.
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that allows access to the server, and the processing unit is specifically configured to:
  • the first fingerprint feature is not included, it is determined that the first access request message is not allowed to access the server.
  • the device further includes:
  • the first feature receiving unit is configured to receive the input fingerprint feature of the transport layer and/or the network layer before the message receiving unit receives the first access request message, and save the input fingerprint feature in the fingerprint Feature library; or
  • the first feature analysis unit is configured to analyze the second access request message in the normal service model before the message receiving unit receives the first access request message, so as to obtain fingerprint features at the transport layer and/or network layer , Save the fingerprint feature obtained by the analysis in the fingerprint feature library.
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that is not allowed to access the server, and the processing unit is specifically configured to:
  • the first fingerprint feature is not included, it is determined that the first access request message is allowed to access the server.
  • the device further includes:
  • the second feature receiving unit is configured to receive the input fingerprint feature of the transport layer and/or the network layer before the message receiving unit receives the first access request message, and save the input fingerprint feature in the fingerprint Feature library; or
  • the second feature analysis unit is configured to analyze the third access request message in the normal service model before the message receiving unit receives the first access request message, so as to obtain fingerprint features at the transport layer and/or network layer , Save the fingerprint feature obtained by the analysis in the fingerprint feature library.
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that is allowed to access the server and fingerprint features corresponding to the operating system type of the terminal device that is not allowed to access the server,
  • the processing unit is specifically used for:
  • the first operating system type list includes at least one operation that allows access to the server System type
  • the second operating system type list includes at least one operating system type that is forbidden to access the server.
  • the fingerprint feature extraction unit may also trigger execution of the transmission layer and/or network layer from the first access request message when it is detected that the server has suffered a DDoS attack.
  • the first access request message in the embodiment of the present application includes a SYN message.
  • an embodiment of the present application provides a computer-readable storage medium that stores a program, where the program includes some or all of the steps used to execute any method of the first aspect Instructions.
  • an embodiment of the present application provides a chip that includes at least one processor and an interface circuit, the processor is configured to execute a computer program stored in a memory after inputting a first access request message through the interface circuit The following steps:
  • the first access request message includes a message sent based on the TCP/IP protocol, and the destination of the first access request message is the server protected by the chip;
  • the fingerprint feature library includes the operating system type of the terminal device that allows access to the server The corresponding fingerprint feature, or the fingerprint feature corresponding to the operating system type of the terminal device that is not allowed to access the server;
  • the first access request message is allowed to access the server, then the first access request message is allowed;
  • the first access request message is blocked.
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that allows access to the server, and the processor recognizes the first fingerprint feature based on the fingerprint feature library to The determining whether to allow the first access request message to access the server specifically includes:
  • the first fingerprint feature is not included, it is determined that the first access request message is not allowed to access the server.
  • the processor before the input of the first access request message through the interface circuit, the processor is further configured to:
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that is not allowed to access the server, and the processor recognizes the first fingerprint feature based on the fingerprint feature library To determine whether to allow the first access request message to access the server, which specifically includes:
  • the first fingerprint feature is not included, it is determined that the first access request message is allowed to access the server.
  • the processor before the input of the first access request message through the interface circuit, the processor is further configured to:
  • the third access request message in the attack service model is analyzed to obtain fingerprint characteristics at the transmission layer and/or network layer, and the fingerprint characteristics obtained by the analysis are stored in the fingerprint characteristic library.
  • the processor may also trigger the execution of the transport layer and/or network layer message from the first access request message when it is detected that the server has suffered a DDoS attack.
  • the step of extracting the first fingerprint feature from the head may also trigger the execution of the transport layer and/or network layer message from the first access request message when it is detected that the server has suffered a DDoS attack.
  • the first access request message in the embodiment of the present application includes a SYN message.
  • the embodiments of the present application provide a computer program product, which when the computer program product runs on a computer, causes the computer to execute part or all of the steps of any one of the methods in the first aspect.
  • the first fingerprint feature and the fingerprint feature in the fingerprint feature library are transport layer fingerprint features;
  • the transport layer fingerprint feature includes one or more of the following:
  • the first fingerprint feature and the fingerprint features in the fingerprint feature library are network layer fingerprint features
  • the network layer fingerprint features include one or more of the following:
  • the fingerprint characteristics of the transport layer or network layer mentioned above are the inherent system fingerprint characteristics of each operating system when it follows or uses the TCP/IP protocol, and each operating system will be different, such as Windows/Linux/other IoT devices, etc.
  • the general attack traffic will imitate the user's normal access characteristics, such as adding the version of a well-known browser to the User-Agent of the HTTP protocol, but will not modify the protocol stack, so by identifying the above-mentioned transport layer or network layer
  • the fingerprint feature of the DDoS protection device realizes that the protocol stack that identifies the traffic on the DDoS protection device can block the obvious attack traffic, thereby preventing and mitigating DDoS attacks.
  • FIG. 1 is a schematic diagram of an application scenario of a message processing method provided by an embodiment of the present application
  • FIG. 2 is a schematic flowchart of a message processing method provided by an embodiment of the present application
  • FIG. 3 is a schematic flowchart of a message processing method according to another embodiment of the present application.
  • FIG. 4 is a schematic diagram of the principle of a message processing method provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of the principle of a message processing method according to another embodiment of the present application.
  • FIG. 6 is a schematic diagram of one embodiment of the message processing flow provided by the present application.
  • FIG. 7 is a schematic diagram of another embodiment of a message processing flow provided by the present application.
  • FIG. 8 is a schematic diagram of fingerprint features corresponding to an operating system provided by an embodiment of the present application.
  • FIG. 9 is a schematic diagram of fingerprint features corresponding to an operating system according to another embodiment of the present application.
  • FIG. 10 is a schematic diagram of fingerprint features corresponding to an operating system according to another embodiment of the present application.
  • FIG. 11 is a schematic diagram of fingerprint features corresponding to an operating system according to another embodiment of the present application.
  • Figure 12 is a schematic structural diagram of a protective device provided by an embodiment of the present application.
  • FIG. 13 is a schematic structural diagram of a message processing device provided by an embodiment of the present application.
  • FIG. 14 is a schematic diagram of the structure of a chip provided by an embodiment of the present application.
  • FIG. 1 is a schematic diagram of an application scenario of a message processing method provided by an embodiment of the application.
  • the network to which the message processing method of the embodiment of the present application is applied includes at least one hacker.
  • FIG. 1 takes a hacker as an example for illustration.
  • the hacker refers to an attacker or an attacking device that initiates a DDoS attack or DoS attack.
  • hackers can control a zombie host (bot) to launch a DoS attack to the server or control multiple bots to launch a DDoS attack to the server.
  • bot zombie host
  • Anti-DDoS devices or anti-DDoS devices are deployed in front of the server to provide cleaning of DDoS traffic for the server, which means that when a DDoS attack occurs, the received attack traffic is identified and blocked to Mitigating DDoS attacks or DoS attacks, thereby protecting normal users' normal access to the server.
  • the anti-DDoS device or the anti-denial of service device is the protection device in the embodiment of this application, and the anti-DDoS device is taken as an example for illustration in FIG. 1.
  • the bot in the embodiment of the present application may be a personal computer (PC) host of a traditional user, or an IoT network device capable of accessing the Internet, such as a camera, a router, and so on.
  • PC personal computer
  • IoT network device capable of accessing the Internet, such as a camera, a router, and so on.
  • the server in the embodiment of the present application is a computer that provides normal services for a certain business, and the user terminal can establish a connection with the server through the Internet and access the business provided by the server.
  • the server is a game server, which is used to access data of a certain game on the game server to run the game.
  • the message processing method provided by the embodiment of the present application includes the following steps.
  • Step S200 the zombie host or normal user terminal sends a first access request message to the server;
  • the first access request message in the embodiment of the present application includes a message sent based on the TCP/IP protocol, and the first access request message is a message for establishing a TCP/IP connection with the server.
  • a bot controlled by a hacker will send a first access request message to the server to request access to the service provided by the server; a normal user terminal can also send a first access request message to the server to request access to the service provided by the server.
  • Step S202 The Anti-DDoS device receives the first access request message
  • the Anti-DDoS device is a device deployed in front of the server.
  • the Anti-DDoS device is triggered to execute step S204 only when the server detects that it has suffered a DDoS attack.
  • the Anti-DDoS device can directly pass the received first access request message to the server.
  • Step S204 The Anti-DDoS device extracts the first fingerprint feature from the transport layer and/or network layer header of the first access request message.
  • the fingerprint characteristics of the transport layer in the embodiments of this application may include one or more of the following: TCP header or option ordering information in options, maximum segment size (Maximum Segment Size, MSS) information, window size (Windows size value) ) Information, window scale (Windows scale) information, etc.
  • the fingerprint features of the network layer in the embodiments of this application may include one or more of the following: IP message time to live information (Time to live), data segment Payload length information, DF (Don't Fragment) flag and other IP header identification information and many more.
  • the Anti-DDoS device performs fingerprint feature extraction on the transport layer and/or network layer header of the received first access request message, it can extract the transport layer and/or the first access request message.
  • the first fingerprint feature of the network layer is the first fingerprint feature of the network layer.
  • the fingerprint characteristics of the transport layer or the network layer in the embodiments of the present application are inherent system fingerprint characteristics when each operating system follows or uses the TCP/IP protocol, and each operating system has a difference. Therefore, the first fingerprint feature corresponds to the operating system type of the terminal device that sends the first access request message.
  • Step S206 The Anti-DDoS device recognizes the first fingerprint feature based on the fingerprint feature database to determine whether to allow the first access request message to access the server.
  • the fingerprint feature library is used to identify the extracted first fingerprint feature to determine whether to allow the access request of the first access request message.
  • the Anti-DDoS device may generate a fingerprint feature database in advance. For example, it is possible to automatically learn or analyze access request messages in the normal business model through self-learning, so as to obtain fingerprint characteristics at the transport layer and/or network layer, or receive user input fingerprint characteristics at the transport layer and/or network layer , And then create and store it in the fingerprint feature database.
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that allows access to the server.
  • the Anti-DDoS device can also automatically learn or analyze the access request message in the attack service model through self-learning, so as to obtain fingerprint characteristics at the transport layer and/or network layer, or receive user input from the transport layer And/or the fingerprint characteristics of the network layer, and then establish and store in the fingerprint characteristic database.
  • the fingerprint feature library includes the fingerprint feature corresponding to the operating system type of the terminal device that is not allowed to access the server.
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that allows access to the server
  • the fingerprint feature library contains the first fingerprint feature
  • it indicates that the first access request message is permitted To access the server perform step S208; if it is determined that the fingerprint feature database does not contain the first fingerprint feature, it indicates that the first access request message is not allowed to access the server, and step S210 is performed.
  • Step S208 The Anti-DDoS device releases the first access request message to the server
  • Step S210 The Anti-DDoS device blocks the first access request message.
  • the fingerprint feature library may include fingerprint features corresponding to the operating system type of the terminal device that is allowed to access the server and fingerprint features corresponding to the operating system type of the terminal device that is not allowed to access the server;
  • the fingerprint feature database also contains the corresponding relationship between the operating system type and the fingerprint feature; then step S206 may specifically be:
  • the first operating system type list includes at least one operation that allows access to the server System type
  • the second operating system type list includes at least one operating system type that is forbidden to access the server.
  • the fingerprint feature of the transport layer or the network layer in the embodiment of the present application is the inherent system fingerprint feature of each operating system when it follows or uses the TCP/IP protocol, and each operating system will have a difference. Then, the Anti-DDoS device can identify the operating system type corresponding to the first fingerprint feature based on the fingerprint feature database.
  • the Anti-DDoS device can also pre-establish a first operating system type list or a second operating system type list; the first operating system type list includes at least one operating system type that allows access to the server, and the second operating system type list
  • the type list includes at least one operating system type that is forbidden to access the server.
  • the first operating system type list or the second operating system type may be the operating system type entered by the user for configuration as required.
  • the first operating system type list can also be through self-learning, to automatically learn or analyze access request messages in the normal business model, so as to obtain fingerprint characteristics at the transport layer and/or network layer, and then obtain the fingerprint characteristics corresponding The type of operating system.
  • the second operating system type can also be through self-learning to automatically learn or analyze or attack the access request message in the business model to obtain the fingerprint feature at the transport layer and/or network layer, and then obtain the operation corresponding to the fingerprint feature System type.
  • the Anti-DDoS device can determine that the operating system type corresponding to the first fingerprint feature is in the first operating system type list according to the first operating system type list, indicating that the first access request message is allowed to access the server, Step S208 is performed; if it is determined that the operating system type corresponding to the first fingerprint feature is not in the first operating system type list, it indicates that the first access request message is not allowed to access the server, and step S210 is performed.
  • the Anti-DDoS device may determine that the operating system type corresponding to the first fingerprint feature is not in the second operating system type list according to the second operating system type list, indicating that the first access request message is allowed to access the server, Step S208 is performed; if it is determined that the operating system type corresponding to the first fingerprint feature is in the second operating system type list, it indicates that the first access request message is not allowed to access the server, and step S210 is performed.
  • FIG. 3 shows a schematic flowchart of a message processing method according to another embodiment of the present application, illustrating how the Anti-DDoS device completes DDoS protection.
  • the message processing method provided by the embodiment of the present application includes the following steps.
  • Step S300 The zombie host or normal user terminal sends a first access request message to the server.
  • Step S302 The Anti-DDoS device receives the first access request message.
  • Step S304 The Anti-DDoS device extracts the first fingerprint feature from the transport layer and/or network layer header of the first access request message.
  • steps S300-S304 can refer to the description of steps S200-S204 in the above embodiment of FIG. 2, which will not be repeated here.
  • Step S306 The Anti-DDoS device identifies the operating system type corresponding to the first fingerprint feature based on the fingerprint feature database.
  • the Anti-DDoS device may pre-generate a fingerprint feature database, for example, through self-learning, it may automatically learn or analyze access request messages in the normal business model, so as to obtain information at the transport layer and/or network layer.
  • the fingerprint characteristics of the transport layer or the network layer in the embodiments of the present application are inherent system fingerprint characteristics that each operating system has when following or using the TCP/IP protocol, and each operating system will be different.
  • the fingerprint feature database of the embodiment of the present application also includes the correspondence between the operating system type and the fingerprint feature, so the Anti-DDoS device can identify the operating system type corresponding to the first fingerprint feature based on the fingerprint feature database.
  • Step S308 The Anti-DDoS device judges whether to allow the first access request message to access the server according to the first operating system type list or the second operating system type list.
  • the Anti-DDoS device may also pre-establish a first operating system type list or a second operating system type list; the first operating system type list includes at least one operating system type allowed to access the server, and the second operation
  • the system type list includes at least one operating system type that is forbidden to access the server.
  • the first operating system type list or the second operating system type may be the operating system type entered by the user for configuration as required.
  • the first operating system type list can also be through self-learning, to automatically learn or analyze access request messages in the normal business model, so as to obtain fingerprint characteristics at the transport layer and/or network layer, and then obtain the fingerprint characteristics corresponding The type of operating system.
  • the second operating system type can also be through self-learning to automatically learn or analyze or attack the access request message in the business model to obtain the fingerprint feature at the transport layer and/or network layer, and then obtain the operation corresponding to the fingerprint feature System type.
  • the Anti-DDoS device can determine that the operating system type corresponding to the first fingerprint feature is in the first operating system type list according to the first operating system type list, indicating that the first access request message is allowed to access the server, Step S310 is performed; if it is determined that the operating system type corresponding to the first fingerprint feature is not in the first operating system type list, it indicates that the first access request message is not allowed to access the server, and step S312 is performed.
  • the Anti-DDoS device may determine that the operating system type corresponding to the first fingerprint feature is not in the second operating system type list according to the second operating system type list, indicating that the first access request message is allowed to access the server, Step S310 is performed; if it is determined that the operating system type corresponding to the first fingerprint feature is in the second operating system type list, it indicates that the first access request message is not allowed to access the server, and step S312 is performed.
  • Step S310 The Anti-DDoS device releases the first access request message to the server
  • Step S312 The Anti-DDoS device blocks the first access request message.
  • Fig. 4 shows a schematic diagram of the principle of the message processing method provided by the embodiment of the present application. From the perspective of the internal module of the protection device, how to process the received access request message is explained. It can be divided into early configuration management and late message identification. filter:
  • the configuration management module can create a fingerprint feature database by manually inputting fingerprint features by the user, or it can acquire the fingerprint features of the access request message in a self-learning manner through the self-learning module to establish fingerprint features Database, you can also combine the two to build a fingerprint feature database.
  • the fingerprint features stored in the fingerprint feature library can be upgraded or updated.
  • the fingerprint feature can be regularly self-learned to update the fingerprint feature, or the fingerprint feature definition rule of the transmission layer and/or network layer can be updated, and the Re-establish the fingerprint feature database.
  • the definition rules of the fingerprint features of the transport layer and/or the network layer can specifically be which transport layer and network layer fingerprint feature items are selected as the identification basis, and configure or self-learn the fingerprint features according to the selected fingerprint features to construct the fingerprint feature library , And extract the fingerprint feature of the first access request message according to the selected fingerprint feature items to identify whether to pass or block the message.
  • the user can also configure the OS blocking strategy through the configuration management module according to their own needs.
  • the fingerprint characteristics of each different transport layer and/or network layer can correspond to different OS types, such as Window 7/8, Windows 10, Linux 2.4, Linux 4.1, and so on.
  • users such as developers or R&D personnel can also directly configure the client OS type list, or automatically learn the OS type corresponding to the normal business model or the attack business model through self-learning to configure the client OS type list, the client OS type
  • the OS types in the list can be OS types that are allowed to be accessed or OS types that are forbidden to access, so that OS blocking strategies can be configured more flexibly, quickly and efficiently, and can meet the needs of users for rapid response in the face of changing DDoS attacks. Achieve better prevention and mitigation of DDoS attacks, and better prevent servers from DDoS attacks.
  • the message receiving module will receive the access request message, and then the source OS identification module will identify the received access request message based on the fingerprint characteristics in the fingerprint feature library and extract the fingerprint. It can also identify the OS type corresponding to the access request message sent through the self-learning module. Then the OS blocking module analyzes whether to block the access request message based on the configured OS blocking policy. If the access request is allowed, the action processing module can send the access request message to the session management module, and the session management module triggers the message sending module to release the access request message to the server; if the access request is not allowed, then the action is processed The module can directly block the access request message.
  • the fingerprint feature in the transport layer and/or network layer header is strongly related to the operating system type, and ordinary programs cannot be modified.
  • Hackers often need to create a RAW Socket or modify the OS to achieve forgery.
  • Modifying the OS means modifying the protocol stack of the OS, and the OS must be recompiled. And the original code of the OS is basically in the hands of the manufacturers (especially for the current IoT system, more and more devices are developed by the manufacturers themselves).
  • Anti-DDoS equipment can accurately identify whether it is a legitimate normal user access by identifying the fingerprint characteristics of the transport layer and/or the network layer of the attack packet, and can block abnormal user access requests, thereby achieving better Prevent and mitigate DDoS attacks better, and better prevent servers from DDoS attacks.
  • the process of generating the OS feature database you can first analyze the header and Option options of TCP SYN messages sent by popular OS, and then extract key fingerprint features or generate signatures, such as the option ordering information in the TCP options of the SYN message, TTL information, MSS information, Windows size value information, Windows scale information, or other options of IP packets.
  • the extracted fingerprint features are formed into fixed features, and they are placed or updated in the fingerprint feature database.
  • the fingerprint features can be released and updated to the Anti-DDoS device for use by the Anti-DDoS device engine.
  • a schematic diagram of one of the embodiments of the message processing flow provided by the present application may include the following steps:
  • Step S600 The Anti-DDoS device may first establish a legal OS type that is allowed to be accessed.
  • the list of OS system types can be configured by the user. For example, the user manually configures the list of allowed client OS system types: Window 7/8, Windows 10; or it can be used by the Anti-DDoS device in normal operation. Self-learning is performed in the business model to automatically learn the list of legal (that is, allow access) client OS system types, such as Window 7/8, Windows 10.
  • Step S602 After receiving the first handshake request message of the new session, that is, the SYN message, the Anti-DDoS device performs message header analysis, such as extracting Option information.
  • Step S604 The Anti-DDoS device extracts fingerprint features, such as analyzing TCP options, and completes fingerprint feature extraction according to predefined rules.
  • the defined rule is to extract option ordering information in TCP options, and TTL ( Time to live) information and Windows size value, then the fingerprint feature extraction of these three items is completed.
  • Step S606 The Anti-DDoS device compares the extracted fingerprint features with the existing fingerprint feature library, and identifies the specific OS system type of the client (which sends the SYN message), such as Window 7/8 or Linux 2.4.
  • adding the fingerprint feature configured with Window 7 includes the following three items:
  • the sort order of TCP options is MSS (Maximum segment size), NOP (No-Operation), window scale , NOP, NOP, SACK Permitted;
  • the TTL (Time to Live) of the IP header of the message is 128; and the Windows size value is 8192.
  • the specific OS system type of the client is identified as Window 7, and the message is allowed to be accessed and released If the SYN message is not the same as the fingerprint characteristics of the above three items in the fingerprint signature database, it is recognized that the specific OS system type of the client is not Window 7, and after it is recognized that none of the OS types are allowed to be accessed, then That is, the SYN packet is blocked.
  • Step S608 The Anti-DDoS device detects whether the identified client OS system type is in the list of allowed client OS system types according to the OS blocking policy.
  • Step S610 If it is detected that it is in the list of allowed client OS system types, the SYN message is released; if it is detected that it is not in the list of allowed client OS system types, the SYN message is blocked or discarded.
  • a schematic diagram of another embodiment of the message processing flow provided by the present application may include the following steps:
  • Step S700 The anti-DDoS device may first establish an illegal OS type that is forbidden to access;
  • the list of OS system types can be configured by the user. For example, the user manually configures a list of prohibited client OS system types: Window 7/8, Windows 10; or the system can be used in the attack business model Carry out self-learning, and automatically learn the list of OS system types of illegal (that is, access prohibited) clients, such as Window 7/8, Windows 10.
  • Step S702 After receiving the first handshake request message of the new session, that is, the SYN message, the Anti-DDoS device performs message header analysis, such as extracting Option information.
  • Step S704 The Anti-DDoS device extracts fingerprint features, such as analyzing TCP options, and completes fingerprint feature extraction according to predefined rules.
  • the defined rule is to extract the option order information in TCP options and the value of each option, then it is completed Fingerprint feature extraction of these two items.
  • Step S706 The Anti-DDoS device compares the extracted fingerprint features with the existing fingerprint feature library, and identifies the specific OS system type of the client (which sends the SYN message), such as Window 7/8 or Linux 2.4.
  • Step S708 The Anti-DDoS device detects whether the identified client OS system type is in the list of prohibited client OS system types according to the OS blocking policy.
  • Step S710 If it is detected that it is not in the list of prohibited client OS system types, the SYN message is released; if it is detected that it is in the list of prohibited client OS system types, the SYN message is blocked or discarded.
  • the Anti-DDoS device engine can have 8 situations in the following table when processing packets:
  • the Anti-DDoS device When detecting that the server has suffered a DDoS attack, the Anti-DDoS device will be triggered to perform fingerprint feature identification on all client OS types connected to the game server (specifically as described in the above embodiment), if the fingerprint identifies the client
  • the end OS type is non-Windows 7/8, Windows 10 systems. If the Linux 2.4 system is identified, the SYN message is directly blocked, thereby blocking the client's access and mitigating DDoS attacks;
  • the SYN message is released.
  • the Anti-DDoS device When detecting that the application server has suffered a DDoS attack, the Anti-DDoS device will be triggered to perform fingerprint feature identification on all client OSs connected to the game server (specifically as described in the above embodiment), if the fingerprint identifies the client If the OS type is a non-iOS system, such as a Windows7 system, SYN packets will be directly blocked, thereby blocking the client's access and mitigating DDoS attacks;
  • the SYN message is released.
  • the fingerprint features of the transport layer and the fingerprint features of the network layer in the embodiments of this application belong to the inherent system fingerprints of the operating system. Different operating systems generally have the above-mentioned different fingerprint features, such as the fingerprints in the IP header and options/TCP header and options. Features, each operating system will be different.
  • Figure 8 shows a schematic diagram of fingerprint characteristics corresponding to the operating system provided by the embodiment of the present application, taking the Windows 7 operating system as an example. It can be seen in Figure 8 that accesses issued based on Windows 7 in accordance with or following the TCP/IP protocol are extracted.
  • the fingerprint characteristics of the request message have one or more of the following:
  • TCP options MSS (Maximum segment size), NOP (No-Operation), window scale, NOP, NOP, SACK Permitted;
  • the TTL (Time to Live) of the IP header of the message is 128;
  • DF Don’t fragment
  • ID Identity
  • Fig. 9 shows a schematic diagram of fingerprint characteristics corresponding to the operating system in another embodiment of the present application, taking the Linux version 3.1 (CentOS 7.1) operating system as an example. It can be seen in Fig. 9 that the extraction is based on the Linux version 3.1 (CentOS 7.1)
  • the fingerprint characteristics of the access request message sent according to or following the TCP/IP protocol have one or more of the following:
  • TCP options MSS, SACK Permitted, Timestamp, NOP, Windows scale;
  • the TTL (Time to Live) of the IP header of the message is 64;
  • DF Don’t fragment
  • a schematic diagram of fingerprint features corresponding to the operating system of another embodiment provided by this application is based on Linux 4.1 (Kali) operating system as an example.
  • the fingerprint characteristics of the access request message sent according to or following the TCP/IP protocol have one or more of the following:
  • TCP options MSS, SACK Permitted, Timestamp, NOP, Windows scale;
  • the TTL of the IP header of the packet is 64;
  • DF Don’t fragment
  • a schematic diagram of fingerprint characteristics corresponding to the operating system of another embodiment provided by this application is taken as an example of the operating system of the Huawei USG6670 gateway device.
  • the fingerprint characteristics extracted from the access request message sent by the Huawei USG6670 gateway device in accordance with or following the TCP/IP protocol have one or more of the following:
  • the sort order of TCP options is MSS;
  • the TTL of the IP header of the packet is 255;
  • FIG. 12 shows a schematic structural diagram of a protective device provided by an embodiment of the present application.
  • the protective device 120 may include:
  • the processor 1210, the network interface 1220, the memory 1230, the input device 1250, and the display 1260 communicate with each other through the communication bus 1240.
  • the input device 1250 can be a touch screen, a mouse, a keyboard, or other devices or components that can obtain user operations.
  • the display 1260 can display some prompt information so that the user can interact with the protective device 120 according to the prompt information. For example, it can be blocked. The information of the access request message is displayed for the user to view.
  • the memory 1230 includes, but is not limited to, random access memory (RAM) and read-only memory (ROM).
  • the memory 1230 can store an operating system (program) 1232 and an application program 1234.
  • the network interface 1220 is used to communicate with other devices; for example, receiving an access request message sent by a terminal device and sending the access request message to the server, and so on.
  • the processor 1210 may be one or more central processing units (CPU for short). When the processor 1210 is a CPU, the CPU may be a single-core CPU or a multi-core CPU; the processor 1210 runs The operating system 1232 provides a software running environment. In the software running environment, the processor 1210 can call the application program 1234 to perform operations related to message processing; specifically:
  • the network interface 1220 is configured to receive a first access request message; the first access request message includes a message sent based on the TCP/IP protocol; the destination of the first access request message is a server protected by the protective device ;
  • the processor 1210 is used to call a stored computer program (such as an application program 1234) to perform the following operations:
  • the first fingerprint feature corresponds to the operating system type of the terminal device that sends the first access request message Recognizing the first fingerprint feature based on the fingerprint feature library to determine whether to allow the first access request message to access the server, wherein the fingerprint feature library includes the operating system of the terminal device that allows access to the server The fingerprint feature corresponding to the type, or/and the fingerprint feature corresponding to the operating system type of the terminal device that is not allowed to access the server;
  • the first access request message is allowed to access the server, then the first access request message is allowed;
  • the first access request message is blocked.
  • the protective device 120 in the embodiment of FIG. 12 is described by taking the memory 1230 as an example.
  • the protection device 120 of the embodiment of the present application may also not include the memory 1230.
  • the stored computer program may be stored on the cloud server in a cloud storage manner, and the stored computer program may be downloaded and executed to perform message processing related operations.
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that allows access to the server, and the processor 1210 recognizes the first fingerprint feature based on the fingerprint feature library to determine whether to allow
  • the first access request message to access the server may specifically include:
  • the first fingerprint feature is not included, it is determined that the first access request message is not allowed to access the server.
  • the input device 1250 may receive the fingerprint characteristics of the transport layer and/or the network layer input by the user, and save the input fingerprint characteristics in the Fingerprint feature database; or
  • the processor 1210 is further configured to, before the network interface 1220 receives the first access request message, analyze the second access request message in the normal service model, so as to obtain fingerprint characteristics at the transport layer and/or network layer, and analyze and obtain The fingerprint feature of is saved in the fingerprint feature library.
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that is not allowed to access the server, and the processor 1210 recognizes the first fingerprint feature based on the fingerprint feature library to determine whether Allowing the first access request message to access the server may specifically include:
  • the first fingerprint feature is not included, it is determined that the first access request message is allowed to access the server.
  • the input device 1250 may receive the fingerprint characteristics of the transport layer and/or the network layer input by the user, and save the input fingerprint characteristics in the Fingerprint feature database; or
  • the processor 1210 is further configured to, before the network interface 1220 receives the first access request message, analyze the third access request message in the attack service model, so as to obtain fingerprint characteristics at the transport layer and/or network layer, and analyze and obtain The fingerprint feature of is saved in the fingerprint feature library.
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that is allowed to access the server and fingerprint features corresponding to the operating system type of the terminal device that is not allowed to access the server. 1210
  • the identification of the first fingerprint feature based on the fingerprint feature database to determine whether to allow the first access request message to access the server may specifically include:
  • the processor 1210 identifies the operating system type corresponding to the first fingerprint feature based on the fingerprint feature library, and the fingerprint feature library contains the correspondence between the operating system type and the fingerprint feature;
  • the first operating system type list includes at least one operation that allows access to the server System type
  • the second operating system type list includes at least one operating system type that is forbidden to access the server.
  • the processor 1210 may also trigger execution from the transport layer and/or network layer header of the first access request message when it detects that the server has suffered a DDoS attack. The step of extracting the first fingerprint feature.
  • FIG. 13 shows a schematic structural diagram of a message processing apparatus provided by an embodiment of the present application.
  • the message processing apparatus 13 may include: a message receiving unit 130, a fingerprint feature extraction unit 132, and a processing unit. Unit 134; where,
  • the message receiving unit 130 is configured to receive a first access request message; the first access request message includes a message sent based on the TCP/IP protocol; the destination of the first access request message is the message The server protected by the processing device;
  • the fingerprint feature extraction unit 132 is configured to extract a first fingerprint feature from the transport layer and/or network layer header of the first access request message, and the first fingerprint feature corresponds to sending the first access request message
  • the operating system type of the terminal equipment
  • the processing unit 134 is configured to identify the first fingerprint feature based on the fingerprint feature library to determine whether to allow the first access request message to access the server, wherein the fingerprint feature library includes terminals that are allowed to access the server The fingerprint feature corresponding to the operating system type of the device, or/and the fingerprint feature corresponding to the operating system type of the terminal device that is not allowed to access the server;
  • the processing unit releases the first access request message
  • the processing unit blocks the first access request message.
  • the fingerprint feature library may include fingerprint features corresponding to the operating system type of the terminal device that allows access to the server, and the processing unit 134 may be specifically configured to:
  • the first fingerprint feature is not included, it is determined that the first access request message is not allowed to access the server.
  • the message processing device 13 may further include:
  • the first feature receiving unit is configured to receive the input fingerprint feature of the transport layer and/or the network layer before the message receiving unit 130 receives the first access request message, and save the input fingerprint feature in the fingerprint feature In the library; or
  • the first feature analysis unit is configured to analyze the second access request message in the normal service model before the message receiving unit 130 receives the first access request message, so as to obtain fingerprint features at the transport layer and/or network layer,
  • the fingerprint features obtained by the analysis are stored in the fingerprint feature library.
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that is not allowed to access the server, and the processing unit 134 may be specifically configured to:
  • the first fingerprint feature is not included, it is determined that the first access request message is allowed to access the server.
  • the message processing device 13 may further include:
  • the second feature receiving unit is configured to receive the input fingerprint feature of the transport layer and/or the network layer before the message receiving unit 130 receives the first access request message, and save the input fingerprint feature in the fingerprint feature In the library; or
  • the second feature analysis unit is configured to analyze the third access request message in the normal service model before the message receiving unit 130 receives the first access request message, so as to obtain fingerprint features at the transport layer and/or network layer,
  • the fingerprint features obtained by the analysis are stored in the fingerprint feature library.
  • the fingerprint feature library may include fingerprint features corresponding to the operating system type of the terminal device that is allowed to access the server and fingerprint features corresponding to the operating system type of the terminal device that is not allowed to access the server.
  • the processing unit 134 may be specifically used for:
  • the first operating system type list includes at least one operation that allows access to the server System type
  • the second operating system type list includes at least one operating system type that is forbidden to access the server.
  • the fingerprint feature extraction unit 132 may also trigger the execution of the transmission layer and/or network layer report from the first access request message when it is detected that the server has suffered a DDoS attack. The step of extracting the first fingerprint feature in the text header.
  • the chip 14 may include: at least one processor 140 and an interface circuit 142; among them,
  • the processor 140 is configured to, after inputting the first access request message through the interface circuit 142, execute the computer program stored in the memory to perform the following steps:
  • the first access request message includes a message sent based on the TCP/IP protocol, and the destination of the first access request message is the server protected by the chip;
  • the fingerprint feature library includes the operating system type of the terminal device that allows access to the server The corresponding fingerprint feature, or the fingerprint feature corresponding to the operating system type of the terminal device that is not allowed to access the server;
  • the first access request message is allowed to access the server, then the first access request message is allowed;
  • the first access request message is blocked.
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that allows access to the server, and the processor 140 recognizes the first fingerprint feature based on the fingerprint feature library to determine whether to allow
  • the first access request message to access the server may specifically include:
  • the first fingerprint feature is not included, it is determined that the first access request message is not allowed to access the server.
  • the processor 140 may further execute:
  • the fingerprint feature library includes fingerprint features corresponding to the operating system type of the terminal device that is not allowed to access the server, and the processor 140 recognizes the first fingerprint feature based on the fingerprint feature library to determine Whether to allow the first access request message to access the server may specifically include:
  • the first fingerprint feature is not included, it is determined that the first access request message is allowed to access the server.
  • the processor 140 may further execute:
  • the third access request message in the attack service model is analyzed to obtain fingerprint characteristics at the transmission layer and/or network layer, and the fingerprint characteristics obtained by the analysis are stored in the fingerprint characteristic library.
  • the processor 140 may also trigger execution from the transport layer and/or network layer header of the first access request message when it detects that the server has suffered a DDoS attack. In the step of extracting the first fingerprint feature.
  • the first access request message in the embodiment of the present application includes a SYN message.
  • the computer-readable medium may include a computer-readable storage medium, which corresponds to a tangible medium, such as a data storage medium, or a communication medium that includes any medium that facilitates the transfer of a computer program from one place to another (for example, according to a communication protocol) .
  • a computer-readable medium may generally correspond to (1) a non-transitory tangible computer-readable storage medium, or (2) a communication medium, such as a signal or carrier wave.
  • Data storage media may be any available media that can be accessed by one or more computers or one or more processors to retrieve instructions, codes, and/or data structures for implementing the techniques described in this application.
  • the computer program product may include a computer-readable medium.
  • such computer-readable storage media may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage devices, magnetic disk storage devices or other magnetic storage devices, flash memory, or structures that can be used to store instructions or data Any other media that can be accessed by the computer in the form of desired program code. And, any connection is properly termed a computer-readable medium.
  • any connection is properly termed a computer-readable medium.
  • coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave to transmit instructions from a website, server, or other remote source
  • coaxial cable Wire, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of media.
  • the computer-readable storage media and data storage media do not include connections, carrier waves, signals, or other temporary media, but are actually directed to non-transitory tangible storage media.
  • magnetic disks and optical disks include compact disks (CDs), laser disks, optical disks, digital versatile disks (DVD) and Blu-ray disks, where disks usually reproduce data magnetically, while optical disks use lasers to reproduce data optically data. Combinations of the above should also be included in the scope of computer-readable media.
  • DSP digital signal processors
  • ASIC application-specific integrated circuits
  • FPGA field programmable logic arrays
  • the term "processor” as used herein may refer to any of the foregoing structure or any other structure suitable for implementing the techniques described herein.
  • the functions described by the various illustrative logical blocks, modules, and steps described herein may be provided in dedicated hardware and/or software modules configured for encoding and decoding, or combined Into the combined codec.
  • the technology can be fully implemented in one or more circuits or logic elements.
  • the technology of this application can be implemented in a variety of devices or devices, including wireless handsets, integrated circuits (ICs), or a set of ICs (for example, chipsets).
  • ICs integrated circuits
  • Various components, modules, or units are described in this application to emphasize the functional aspects of the device for implementing the disclosed technology, but they do not necessarily need to be implemented by different hardware units.
  • various units can be combined with appropriate software and/or firmware in the codec hardware unit, or by interoperating hardware units (including one or more processors as described above). provide.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Power Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请提供一种报文处理方法，包括：防护设备接收第一访问请求报文，第一访问请求报文包括基于TCP/IP协议发送的报文；从第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征，第一指纹特征对应发送第一访问请求报文的终端设备的操作系统类型；基于指纹特征库对第一指纹特征进行识别以判断是否允许第一访问请求报文访问服务器；指纹特征库包括允许访问服务器的终端设备的操作系统类型对应的指纹特征，或/和不允许访问服务器的终端设备的操作系统类型对应的指纹特征；若允许访问则放行第一访问请求报文；若不允许访问则阻断第一访问请求报文。解决了黑客们较为轻易地躲避攻击检测，让服务器容易遭受DDoS攻击的技术问题。

Description

报文处理方法、装置、设备及计算机可读存储介质
本申请要求于2019年10月31日提交中国国家知识产权局、申请号为201911057490.8、申请名称为“报文处理方法、装置、设备及计算机可读存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及计算机通信技术领域，尤其涉及一种报文处理方法、一种报文处理装置、一种防护设备以及一种计算机可读存储介质。
背景技术
拒绝服务攻击亦称洪水(Flood)攻击，是一种网络攻击手法，其目的在于使目标计算机的网络或系统资源耗尽，使服务暂时中断或停止，导致其正常用户无法访问。当黑客使用网络上两个或以上被攻陷的计算机作为“僵尸”向特定的目标发动“拒绝服务”式攻击时，称为分布式拒绝服务攻击(Distributed Denial-of-Service attack，简称DDoS攻击)。
黑客一般控制传统用户PC主机作为僵尸网络的僵尸主机(bot)来发起DDoS攻击,但现阶段随着越来越多的物联网(Internet of Things，IoT)网络设备接入互联网,如摄像头、路由器等，黑客通过入侵这些IoT设备来发起DDoS越来越频繁。
受DDoS攻击的服务一般以超文本传输协议(HyperText Transfer Protocol，HTTP)全球广域网(Web)服务居多，现有技术中，DDoS检测清洗厂商在防护DDoS的时候，会检测HTTP请求报文格式，例如查看是否是正常的用户(如浏览器)发起的请求，一般就是看HTTP请求中的用户代理(User-Agent)字段信息，里面会标示浏览器版本，如果发现是非正常的用户(浏览器)请求，就阻断当前通信，达到缓解DDoS攻击的目的。然而，由于HTTP攻击报文易于伪造，比如找到正常用户请求报文，然后完全复制到攻击报文中，这样黑客们就可以较为轻易地躲避攻击检测。
如何更好地识别出DDoS攻击，阻断或过滤异常访问，以更好地避免遭受DDoS攻击，是人们一直研究的技术问题。
发明内容
本申请实施例公开了一种报文处理方法、报文处理装置和防护设备，能够解决现有技术中黑客们较为轻易地躲避攻击检测，使目标服务容易遭受DDoS攻击的技术问题。
第一方面，本申请实施例提供一种报文处理方法，该方法可以包括：
防护设备接收第一访问请求报文，所述第一访问请求报文包括基于TCP/IP协议发送的报文，所述第一访问请求报文的目的方是所述防护设备保护的服务器；
所述防护设备从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征，所述第一指纹特征对应发送所述第一访问请求报文的终端设备的操作系统类型；
基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，其中，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，或/和不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征；
若允许所述第一访问请求报文访问所述服务器，则放行所述第一访问请求报文；
若不允许所述第一访问请求报文访问所述服务器，则阻断所述第一访问请求报文。
通过上述技术手段，由于传输层和/或网络层报文头中的信息是依赖于操作系统来实现或生成的，也就是说于传输层和/或网络层报文头中的指纹特征(例如TCP头及选项特征、或IP头特征等)是与操作系统类型强相关的，普通的程序是无法修改的。如果黑客想要通过建立原始套接字(RAW Socket)或者修改操作系统(Operation System，OS)来实现伪造，修改OS也就是修改OS的协议栈，必须重新编译该OS，而该OS的原始代码基本上是OS提供商私有保密的(特别是针对当前的IoT系统，越来越多的设备是厂商们自己研发出各自的OS)，因此重新编译的难度以及代价都很大。因此黑客难以通过修改传输层和/或网络层报文头中的指纹特征来伪造报文，从而解决了现有技术中黑客们较为轻易地躲避攻击检测，使目标服务容易遭受DDoS攻击的技术问题。防护设备，例如抗DDoS(Anti Distributed Denial of Service，Anti-DDoS)设备，通过识别攻击报文的传输层和/或网络层报文头中的指纹特征，可以准确地识别是否是合法的正常用户访问，并可以很好地阻断非正常的用户访问请求，从而实现更好地预防和缓解DDoS攻击，更好地避免遭受DDoS攻击。
在一种可能的实现方式中，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，所述基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，包括：
判断所述指纹特征库中是否包含所述第一指纹特征；
如果包含所述第一指纹特征，则确定允许所述第一访问请求报文访问所述服务器；
如果不包含所述第一指纹特征，则确定不允许所述第一访问请求报文访问所述服务器。
本申请实施例通过直接判断指纹特征库中是否包含该第一指纹特征，可以快速高效地判断出是否允许该第一访问请求报文访问服务器。
在一种可能的实现方式中，所述接收第一访问请求报文之前，还包括：
接收输入的传输层和/或网络层的指纹特征，将所述输入的指纹特征保存在所述指纹特征库中；或者
分析正常业务模型中的第二访问请求报文，从而获得在传输层和/或网络层的指纹特征，将分析得到的指纹特征保存在所述指纹特征库中。
本申请实施例的防护设备可以通过自学习的方式，自动学习或分析正常业务模型中的访问请求报文在传输层和/或网络层的指纹特征，并存储到指纹特征库中；或者可以通过开发人员或研发人员等用户来配置正常业务模型中的访问请求报文在传输层和/或网络层的指纹特征，那么防护设备即可以接收到该指纹特征，并存储到指纹特征库中，以便于后续基于该指纹特征库中的指纹特征来识别是否为DDoS攻击。
在一种可能的实现方式中，每个不同的传输层和/或网络层的指纹特征可以对应不同的OS类型，例如Window 7/8、Windows 10、Linux 2.4、Linux 4.1等等。那么开发人员 或研发人员等用户也可以直接配置客户端OS类型列表，或者通过自学习的方式自动学习正常业务模型对应的OS类型来配置客户端OS类型列表，该客户端OS类型列表中的OS类型可以为允许访问的OS类型，从而更加灵活，更加快速高效地配置OS阻断策略，在面对多变的DDoS攻击时可以满足用户快速响应的需求，实现更好地预防和缓解DDoS攻击，更好地避免服务器遭受DDoS攻击。
通过预先在指纹特征库中配置允许访问服务器的报文对应的指纹特征，以识别指纹特征库中是否包含该第一指纹特征，来决定放行还是阻断该第一访问请求报文，可以准确地识别是否是合法的正常用户访问，并可以很好地阻断非正常的用户访问请求，从而实现更好地预防和缓解DDoS攻击，更好地避免服务器遭受DDoS攻击。
在一种可能的实现方式中，所述指纹特征库包括不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，所述基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，包括：
判断所述指纹特征库中是否包含所述第一指纹特征；
如果包含所述第一指纹特征，则确定不允许所述第一访问请求报文访问所述服务器；
如果不包含所述第一指纹特征，则确定允许所述第一访问请求报文访问所述服务器。
本申请实施例通过直接判断指纹特征库中是否包含该第一指纹特征，可以快速高效地判断出是否允许该第一访问请求报文访问服务器。
在一种可能的实现方式中，所述接收第一访问请求报文之前，还包括：
接收输入的传输层和/或网络层的指纹特征，将所述输入的指纹特征保存在所述指纹特征库中；或者
分析攻击业务模型中的第三访问请求报文，从而获得在传输层和/或网络层的指纹特征，将分析得到的指纹特征保存在所述指纹特征库中。
本申请实施例的防护设备可以通过自学习的方式，自动学习或分析攻击业务模型中的访问请求报文在传输层和/或网络层的指纹特征，并存储到指纹特征库中；或者可以通过开发人员或研发人员等用户来配置攻击业务模型中的访问请求报文在传输层和/或网络层的指纹特征，那么防护设备即可以接收到该指纹特征，并存储到指纹特征库中，以便于后续基于该指纹特征库中的指纹特征来识别是否为DDoS攻击。
在一种可能的实现方式中，每个不同的传输层和/或网络层的指纹特征可以对应不同的OS类型，例如Window 7/8、Windows 10、Linux 2.4、Linux 4.1等等。那么开发人员或研发人员等用户也可以直接配置客户端OS类型列表，或者通过自学习的方式自动学习攻击业务模型对应的OS类型来配置客户端OS类型列表，该客户端OS类型列表中的OS类型可以为禁止访问的OS类型，从而更加灵活，更加快速高效地配置OS阻断策略，在面对多变的DDoS攻击时可以满足用户快速响应的需求，实现更好地预防和缓解DDoS攻击，更好地避免服务器遭受DDoS攻击。
通过预先在指纹特征库中配置禁止访问的客户端对应的指纹特征，以识别指纹特征库中是否包含该第一指纹特征，来决定放行还是阻断客户端的第一访问请求报文，可以准确地识别是否是合法的正常用户访问，并可以很好地阻断非正常的用户访问请求，从而实现更好地预防和缓解DDoS攻击，更好地避免服务器遭受DDoS攻击。
在一种可能的实现方式中，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征和不允许访问所述服务器的终端设备的操作系统类型对应的 指纹特征，所述基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，包括：
基于指纹特征库识别所述第一指纹特征对应的操作系统类型，所述指纹特征库中包含操作系统类型与指纹特征之间的对应关系；
根据第一操作系统类型列表、或者第二操作系统类型列表判断是否允许所述第一访问请求报文访问所述服务器，所述第一操作系统类型列表中包括允许访问所述服务器的至少一个操作系统类型，所述第二操作系统类型列表中包括禁止访问所述服务器的至少一个操作系统类型。
通过本申请实施例，指纹特征库可以包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征和不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征。并且指纹特征库中包含操作系统类型与指纹特征之间的对应关系。每个不同的传输层和/或网络层的指纹特征可以对应不同的OS类型，例如Window 7/8、Windows 10、Linux 2.4、Linux 4.1等等。那么开发人员或研发人员等用户也可以直接配置客户端OS类型列表，或者通过自学习的方式自动学习攻击业务模型对应的OS类型来配置客户端OS类型列表，其中，第一OS类型列表中可以包括允许访问所述服务器的至少一个OS类型；第二OS类型列表中可以包括禁止访问所述服务器的至少一个OS类型。那么基于指纹特征库识别第一指纹特征对应的操作系统类型后，即可根据第一操作系统类型列表、或者第二操作系统类型列表判断是否允许该第一访问请求报文访问该服务器。从而实现更加灵活，更加快速高效地配置OS阻断策略，在面对多变的DDoS攻击时可以满足用户快速响应的需求，实现更好地预防和缓解DDoS攻击，更好地避免服务器遭受DDoS攻击。
在一种可能的实现方式中，本申请实施例的报文处理方法，还可以是在检测到服务器遭受到DDoS攻击的情况下，才触发执行从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征的步骤。
由于若对每个接收到的访问请求报文都提取指纹特征并进行识别将会增加访问请求报文的传输延时，将影响正常用户的访问感受。通过上述技术手段，在检测到服务器遭受到DDoS攻击时，再触发执行提取指纹特征并进行识别，可以很好地平衡正常访问效率和缓解DDoS攻击的问题。
在一种可能的实现方式中，本申请实施例的第一访问请求报文包括SYN报文。
由于SYN报文是建立TCP连接时客户端向服务器发送的第一个请求报文，直接对该SYN报文提取指纹特征并进行识别，可以以最快速度识别出该访问请求是否为DDoS攻击，从而实现更好地预防和缓解DDoS攻击，更好地避免遭受DDoS攻击。
第二方面，本申请实施例提供一种报文处理方法，包括：
防护设备接收第一访问请求报文，所述第一访问请求报文包括基于TCP/IP协议发送的报文，所述访问请求报文的目的方是所述防护设备保护的服务器；
所述防护设备从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征，所述第一指纹特征对应发送所述第一访问请求报文的终端设备的操作系统类型；
基于指纹特征库识别所述第一指纹特征对应的操作系统类型，所述指纹特征库中包含操作系统类型与指纹特征之间的对应关系；
根据第一操作系统类型列表、或者第二操作系统类型列表判断是否允许所述第一访问请求报文访问所述服务器，所述第一操作系统类型列表中包括允许访问所述服务器的至少 一个操作系统类型，所述第二操作系统类型列表中包括禁止访问所述服务器的至少一个操作系统类型；
若允许所述第一访问请求报文访问所述服务器，则放行所述第一访问请求报文；
若不允许所述第一访问请求报文访问所述服务器，则阻断所述第一访问请求报文。
通过本申请实施例，该指纹特征库中包含操作系统类型与指纹特征之间的对应关系。每个不同的传输层和/或网络层的指纹特征可以对应不同的OS类型，例如Window 7/8、Windows 10、Linux 2.4、Linux 4.1等等。那么开发人员或研发人员等用户也可以直接配置客户端OS类型列表，或者通过自学习的方式自动学习攻击业务模型对应的OS类型来配置客户端OS类型列表，其中，第一OS类型列表中可以包括允许访问所述服务器的至少一个OS类型；第二OS类型列表中可以包括禁止访问所述服务器的至少一个OS类型，那么基于指纹特征库识别第一指纹特征对应的操作系统类型后，即可根据第一操作系统类型列表、或者第二操作系统类型列表判断是否允许该第一访问请求报文访问该服务器；从而实现更加灵活，更加快速高效地配置OS阻断策略，在面对多变的DDoS攻击时可以满足用户快速响应的需求，实现更好地预防和缓解DDoS攻击，更好地避免服务器遭受DDoS攻击。
第三方面，本申请实施例提供一种防护设备，包括处理器和网络接口，其中，
所述网络接口用于接收第一访问请求报文，所述第一访问请求报文包括基于TCP/IP协议发送的报文，所述第一访问请求报文的目的方是所述防护设备保护的服务器；
所述处理器用于调用存储的计算机程序执行如下操作：
从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征，所述第一指纹特征对应发送所述第一访问请求报文的终端设备的操作系统类型；
基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，其中，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，或/和不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征；
若允许所述第一访问请求报文访问所述服务器，则放行所述第一访问请求报文；
若不允许所述第一访问请求报文访问所述服务器，则阻断所述第一访问请求报文。
在一种可能的实现方式中，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，所述处理器基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，包括：
所述处理器判断所述指纹特征库中是否包含所述第一指纹特征；
如果包含所述第一指纹特征，则确定允许所述第一访问请求报文访问所述服务器；
如果不包含所述第一指纹特征，则确定不允许所述第一访问请求报文访问所述服务器。
在一种可能的实现方式中，所述防护设备还包括输入设备；所述输入设备，用于在所述网络接口接收第一访问请求报文之前，接收输入的传输层和/或网络层的指纹特征，将所述输入的指纹特征保存在所述指纹特征库中；或者，
所述处理器还用于，在所述网络接口接收第一访问请求报文之前，分析正常业务模型中的第二访问请求报文，从而获得在传输层和/或网络层的指纹特征，将分析得到的指纹特征保存在所述指纹特征库中。
在一种可能的实现方式中，所述指纹特征库包括不允许访问所述服务器的终端设备的 操作系统类型对应的指纹特征，所述处理器基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，包括：
所述处理器判断所述指纹特征库中是否包含所述第一指纹特征；
如果包含所述第一指纹特征，则确定不允许所述第一访问请求报文访问所述服务器；
如果不包含所述第一指纹特征，则确定允许所述第一访问请求报文访问所述服务器。
在一种可能的实现方式中，所述防护设备还包括输入设备；所述输入设备，用于在所述网络接口接收第一访问请求报文之前，接收输入的传输层和/或网络层的指纹特征，将所述输入的指纹特征保存在所述指纹特征库中；或者，
所述处理器还用于，在所述网络接口接收第一访问请求报文之前，分析攻击业务模型中的第三访问请求报文，从而获得在传输层和/或网络层的指纹特征，将分析得到的指纹特征保存在所述指纹特征库中。
在一种可能的实现方式中，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征和不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，所述处理器基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，包括：
所述处理器基于指纹特征库识别所述第一指纹特征对应的操作系统类型，所述指纹特征库中包含操作系统类型与指纹特征之间的对应关系；
根据第一操作系统类型列表、或者第二操作系统类型列表判断是否允许所述第一访问请求报文访问所述服务器，所述第一操作系统类型列表中包括允许访问所述服务器的至少一个操作系统类型，所述第二操作系统类型列表中包括禁止访问所述服务器的至少一个操作系统类型。
在一种可能的实现方式中，所述处理器还可以是在检测到服务器遭受到DDoS攻击的情况下，才触发执行从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征的步骤。
在一种可能的实现方式中，本申请实施例的第一访问请求报文包括SYN报文。
第四方面，本申请实施例提供一种防护设备，其特征在于，包括处理器和网络接口，其中，
所述网络接口用于接收第一访问请求报文；所述第一访问请求报文包括基于TCP/IP协议发送的报文；所述第一访问请求报文的目的方是所述防护设备保护的服务器；
所述处理器用于调用存储的计算机程序执行如下操作：
从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征，所述第一指纹特征对应发送所述第一访问请求报文的终端设备的操作系统类型；
基于指纹特征库识别所述第一指纹特征对应的操作系统类型，所述指纹特征库中包含操作系统类型与指纹特征之间的对应关系；
根据第一操作系统类型列表、或者第二操作系统类型列表判断是否允许所述第一访问请求报文访问所述服务器，所述第一操作系统类型列表中包括允许访问所述服务器的至少一个操作系统类型，所述第二操作系统类型列表中包括禁止访问所述服务器的至少一个操作系统类型；
若允许所述第一访问请求报文访问所述服务器，则放行所述第一访问请求报文；
若不允许所述第一访问请求报文访问所述服务器，则阻断所述第一访问请求报文。
第五方面，本申请实施例提供一种报文处理装置，包括：
报文接收单元，用于接收第一访问请求报文；所述第一访问请求报文包括基于TCP/IP协议发送的报文；所述第一访问请求报文的目的方是所述报文处理装置保护的服务器；
指纹特征提取单元，用于从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征，所述第一指纹特征对应发送所述第一访问请求报文的终端设备的操作系统类型；
处理单元，用于基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，其中，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，或/和不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征；
若允许所述第一访问请求报文访问所述服务器，则所述处理单元放行所述第一访问请求报文；
若不允许所述第一访问请求报文访问所述服务器，则所述处理单元阻断所述第一访问请求报文。
在一种可能的实现方式中，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，所述处理单元，具体用于：
判断所述指纹特征库中是否包含所述第一指纹特征；
如果包含所述第一指纹特征，则确定允许所述第一访问请求报文访问所述服务器；
如果不包含所述第一指纹特征，则确定不允许所述第一访问请求报文访问所述服务器。
在一种可能的实现方式中，所述装置还包括：
第一特征接收单元，用于在所述报文接收单元接收第一访问请求报文之前，接收输入的传输层和/或网络层的指纹特征，将所述输入的指纹特征保存在所述指纹特征库中；或者
第一特征分析单元，用于在所述报文接收单元接收第一访问请求报文之前，分析正常业务模型中的第二访问请求报文，从而获得在传输层和/或网络层的指纹特征，将分析得到的指纹特征保存在所述指纹特征库中。
在一种可能的实现方式中，所述指纹特征库包括不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，所述处理单元，具体用于：
判断所述指纹特征库中是否包含所述第一指纹特征；
如果包含所述第一指纹特征，则确定不允许所述第一访问请求报文访问所述服务器；
如果不包含所述第一指纹特征，则确定允许所述第一访问请求报文访问所述服务器。
在一种可能的实现方式中，所述装置还包括：
第二特征接收单元，用于在所述报文接收单元接收第一访问请求报文之前，接收输入的传输层和/或网络层的指纹特征，将所述输入的指纹特征保存在所述指纹特征库中；或者
第二特征分析单元，用于在所述报文接收单元接收第一访问请求报文之前，分析正常业务模型中的第三访问请求报文，从而获得在传输层和/或网络层的指纹特征，将分析得到的指纹特征保存在所述指纹特征库中。
在一种可能的实现方式中，所述指纹特征库包括允许访问所述服务器的终端设备的操 作系统类型对应的指纹特征和不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，所述处理单元，具体用于：
基于指纹特征库识别所述第一指纹特征对应的操作系统类型，所述指纹特征库中包含操作系统类型与指纹特征之间的对应关系；
根据第一操作系统类型列表、或者第二操作系统类型列表判断是否允许所述第一访问请求报文访问所述服务器，所述第一操作系统类型列表中包括允许访问所述服务器的至少一个操作系统类型，所述第二操作系统类型列表中包括禁止访问所述服务器的至少一个操作系统类型。
在一种可能的实现方式中，所述指纹特征提取单元还可以是在检测到服务器遭受到DDoS攻击的情况下，才触发执行从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征的步骤。
在一种可能的实现方式中，本申请实施例的第一访问请求报文包括SYN报文。
第六方面，本申请实施例提供一种计算机可读存储介质，所述计算机可读存储介质存储了程序，其中，所述程序包括用于执行第一方面的任意一种方法的部分或全部步骤的指令。
第七方面，本申请实施例提供一种芯片，包括至少一个处理器和接口电路，所述处理器用于通过所述接口电路输入第一访问请求报文后，执行存储器中存储的计算机程序以执行以下步骤：
从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征，所述第一指纹特征对应发送所述第一访问请求报文的终端设备的操作系统类型；所述第一访问请求报文包括基于TCP/IP协议发送的报文，所述第一访问请求报文的目的方是所述芯片保护的服务器；
基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，其中，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，或者不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征；
若允许所述第一访问请求报文访问所述服务器，则放行所述第一访问请求报文；
若不允许所述第一访问请求报文访问所述服务器，则阻断所述第一访问请求报文。
在一种可能的实现方式中，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，所述处理器基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，具体包括：
判断所述指纹特征库中是否包含所述第一指纹特征；
如果包含所述第一指纹特征，则确定允许所述第一访问请求报文访问所述服务器；
如果不包含所述第一指纹特征，则确定不允许所述第一访问请求报文访问所述服务器。
在一种可能的实现方式中，所述通过所述接口电路输入第一访问请求报文之前，所述处理器还用于：
将接收输入的传输层和/或网络层的指纹特征保存在所述指纹特征库中；或者
分析正常业务模型中的第二访问请求报文，从而获得在传输层和/或网络层的指纹特征，将分析得到的指纹特征保存在所述指纹特征库中。
在一种可能的实现方式中，所述指纹特征库包括不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，所述处理器基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，具体包括：
判断所述指纹特征库中是否包含所述第一指纹特征；
如果包含所述第一指纹特征，则确定不允许所述第一访问请求报文访问所述服务器；
如果不包含所述第一指纹特征，则确定允许所述第一访问请求报文访问所述服务器。
在一种可能的实现方式中，所述通过所述接口电路输入第一访问请求报文之前，所述处理器还用于：
将接收输入的传输层和/或网络层的指纹特征保存在所述指纹特征库中；或者
分析攻击业务模型中的第三访问请求报文，从而获得在传输层和/或网络层的指纹特征，将分析得到的指纹特征保存在所述指纹特征库中。
在一种可能的实现方式中，所述处理器还可以是在检测到服务器遭受到DDoS攻击的情况下，才触发执行从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征的步骤。
在一种可能的实现方式中，本申请实施例的第一访问请求报文包括SYN报文。
第八方面，本申请实施例提供一种计算机程序产品，当所述计算机程序产品在计算机上运行时，使得所述计算机执行第一方面的任意一种方法的部分或全部步骤。
其中，在上述第一至第八方面的各个技术方案中：
在一种可能的实现方式中，所述第一指纹特征和所述指纹特征库中的指纹特征为传输层指纹特征；所述传输层指纹特征包括以下一个或多个：
TCP选项中的选项排序信息；
最大分段大小信息；
窗口大小信息；
窗口比例信息；
DF标志位信息。
在上述第一至第八方面的各个技术方案中：
在一种可能的实现方式中，所述第一指纹特征和所述指纹特征库中的指纹特征为网络层指纹特征，所述网络层指纹特征包括以下一个或多个：
IP报文存活时间信息；
IP头部标识信息。
上述传输层或网络层的指纹特征是每个操作系统在遵循或使用TCP/IP协议时都有的固有系统指纹特征，并且每个操作系统都会有差别，例如Windows/Linux/其他IoT设备等，黑客控制这些设备的时候,一般攻击流量会仿造用户的正常访问特征,比如在HTTP协议的User-Agent里面添加知名浏览器的版本,但是不会修改协议栈，因此通过识别上述传输层或网络层的指纹特征，即实现通过在DDoS防护设备上识别流量的协议栈,阻断掉明显的攻击流量,从而预防和缓解DDoS攻击。
应当理解的是，本申请的第二至第八方面与本申请的第一方面的技术方案一致，各方面及对应的可行实施方式所取得的有益效果相似，不再赘述。
附图说明
为了更清楚地说明本申请实施例或背景技术中的技术方案，下面将对本申请实施例或背景技术中所需要使用的附图进行说明。
图1是本申请实施例提供的一种报文处理方法的应用场景示意图；
图2是本申请实施例提供的报文处理方法的流程示意图；
图3是本申请提供的另一实施例的报文处理方法的流程示意图；
图4是本申请实施例提供的报文处理方法的原理示意图；
图5是本申请提供的另一实施例的报文处理方法的原理示意图；
图6是本申请提供的报文处理流程的其中一个实施例的示意图；
图7是本申请提供的报文处理流程的另一个实施例的示意图；
图8是本申请实施例提供的操作系统对应的指纹特征的示意图；
图9是本申请提供的另一实施例的操作系统对应的指纹特征的示意图；
图10是本申请提供的另一实施例的操作系统对应的指纹特征的示意图；
图11是本申请提供的另一实施例的操作系统对应的指纹特征的示意图；
图12是本申请实施例提供的防护设备的结构示意图；
图13是本申请实施例提供的报文处理装置的结构示意图；
图14是本申请实施例提供的芯片的结构示意图。
具体实施方式
下面结合本申请实施例中的附图对本申请实施例进行描述。
图1为本申请实施例提供的一种报文处理方法的应用场景示意图。本申请实施例的报文处理方法所应用的网络中包括至少一个黑客，图1中以一个黑客为例进行说明。该黑客指发起DDoS攻击或DoS攻击的攻击者或攻击设备。黑客可以控制一个僵尸主机(bot)向服务器发起DoS攻击或控制多个bot向服务器发起DDoS攻击。抗分布式拒绝服务(Anti-DDoS)设备或抗拒绝服务设备部署在服务器前，为服务器提供DDoS流量的清洗，也就是说在发生DDoS攻击时，对接收的攻击流量进行识别并阻断，以缓解DDoS攻击或DoS攻击，从而保护正常用户对服务器的正常访问。其中，Anti-DDoS设备或抗拒绝服务设备即为本申请实施例中的防护设备，图1中以Anti-DDoS设备为例进行说明。
本申请实施例中的bot可以为传统用户的个人计算机(Personal Computer，PC)主机、或能够接入互联网的IoT网络设备，如摄像头、路由器等等。
本申请实施例的服务器是为某业务提供正常服务的计算机，用户终端通过互联网即可与该服务器建立连接，并对服务器提供的业务进行访问。例如服务器为游戏服务器，用于访问游戏服务器上的某游戏的数据，以运行该游戏。
下面以Anti-DDoS设备执行DDoS防护为例，结合图2示出的本申请实施例提供的报文处理方法的流程示意图，说明Anti-DDoS设备如何完成DDoS防护。如图2所示，本申请实施例提供的报文处理方法包括如下步骤。
步骤S200：僵尸主机或正常的用户终端向服务器发送第一访问请求报文；
具体地，本申请实施例的第一访问请求报文包括基于TCP/IP协议发送的报文，该第一访问请求报文是为了与服务器建立TCP/IP连接的报文。受黑客控制的bot会向服务器 发送第一访问请求报文，以请求访问服务器提供的服务；正常的用户终端也可以向服务器发送第一访问请求报文，以请求访问服务器提供的服务。
步骤S202：Anti-DDoS设备接收该第一访问请求报文；
具体地，Anti-DDoS设备为部署在服务器前的设备。可选地，本申请实施例在服务器检测到遭受DDoS攻击的情况下，才触发Anti-DDoS设备执行步骤S204。在服务器没有检测到遭受DDoS攻击的情况下，Anti-DDoS设备可以将接收到的第一访问请求报文直接放行给该服务器。
步骤S204：Anti-DDoS设备从该第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征。
具体地，本申请实施例中传输层指纹特征可以包括以下一个或多个：TCP头部或者选项中的选项排序信息、最大分段大小(Maximum Segment Size，MSS)信息、窗口大小(Windows size value)信息、窗口比例(Windows scale)信息等等。
本申请实施例中网络层指纹特征可以包括以下一个或多个：IP报文存活时间信息(Time to live)、数据段Payload长度信息、DF(Don’t Fragment)标志位等IP头部标识信息等等。
那么，Anti-DDoS设备针对接收到的第一访问请求报文的传输层和/或网络层报文头进行指纹特征提取后，即可提取出该第一访问请求报文的传输层和/或网络层的第一指纹特征。
由于本申请实施例中传输层或网络层的指纹特征是每个操作系统在遵循或使用TCP/IP协议时都有的固有系统指纹特征，并且每个操作系统都会有差别。因此，该第一指纹特征对应发送所述第一访问请求报文的终端设备的操作系统类型。
步骤S206：Anti-DDoS设备基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器。该指纹特征库是用于对提取出的第一指纹特征进行识别，以判断是否允许该第一访问请求报文的访问请求。
具体地，步骤S206之前，Anti-DDoS设备可以预先生成指纹特征库。例如可以通过自学习的方式，自动学习或分析正常业务模型中访问请求报文，从而获得在传输层和/或网络层的指纹特征，或者接收用户输入的传输层和/或网络层的指纹特征，然后建立并存储到指纹特征库中。在这种情况下，该指纹特征库即包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征。可替换地，Anti-DDoS设备也可以通过自学习的方式，自动学习或分析攻击业务模型中访问请求报文，从而获得在传输层和/或网络层的指纹特征，或者接收用户输入的传输层和/或网络层的指纹特征，然后建立并存储到指纹特征库中。在这种情况下该指纹特征库即包括不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征。
例如，当指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征时，若判断出该指纹特征库中包含该第一指纹特征，则表明允许该第一访问请求报文访问该服务器，执行步骤S208；若判断出该指纹特征库中不包含该第一指纹特征，则表明不允许该第一访问请求报文访问该服务器，执行步骤S210。
步骤S208：Anti-DDoS设备向服务器放行该第一访问请求报文；
步骤S210：Anti-DDoS设备阻断该第一访问请求报文。
在一种可能的实施方式中，该指纹特征库可以包括允许访问所述服务器的终端设备的 操作系统类型对应的指纹特征和不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征；该指纹特征库中还包含操作系统类型与指纹特征之间的对应关系；那么步骤S206可以具体为：
基于指纹特征库识别该第一指纹特征对应的操作系统类型；
根据第一操作系统类型列表、或者第二操作系统类型列表判断是否允许所述第一访问请求报文访问所述服务器，所述第一操作系统类型列表中包括允许访问所述服务器的至少一个操作系统类型，所述第二操作系统类型列表中包括禁止访问所述服务器的至少一个操作系统类型。
具体地，本申请实施例中传输层或网络层的指纹特征是每个操作系统在遵循或使用TCP/IP协议时都有的固有系统指纹特征，并且每个操作系统都会有差别。那么Anti-DDoS设备即可基于指纹特征库识别所述第一指纹特征对应的操作系统类型。
另外，Anti-DDoS设备还可预先建立好第一操作系统类型列表或第二操作系统类型列表；该第一操作系统类型列表中包括允许访问该服务器的至少一个操作系统类型，该第二操作系统类型列表中包括禁止访问该服务器的至少一个操作系统类型。该第一操作系统类型列表或第二操作系统类型可以为用户按照需要进行配置，输入的操作系统类型。或者该第一操作系统类型列表也可以是通过自学习的方式，自动学习或分析正常业务模型中访问请求报文，从而获得在传输层和/或网络层的指纹特征，然后得到该指纹特征对应的操作系统类型。该第二操作系统类型也可以是通过自学习的方式，自动学习或分析或攻击业务模型中访问请求报文从而获得在传输层和/或网络层的指纹特征，然后得到该指纹特征对应的操作系统类型。
那么Anti-DDoS设备可以根据第一操作系统类型列表，若判断该第一指纹特征对应的操作系统类型在该第一操作系统类型列表中，则表明允许该第一访问请求报文访问该服务器，执行步骤S208；若判断该第一指纹特征对应的操作系统类型不在该第一操作系统类型列表中，则表明不允许该第一访问请求报文访问该服务器，执行步骤S210。或者Anti-DDoS设备可以根据第二操作系统类型列表，若判断该第一指纹特征对应的操作系统类型不在该第二操作系统类型列表中，则表明允许该第一访问请求报文访问该服务器，执行步骤S208；若判断该第一指纹特征对应的操作系统类型在该第二操作系统类型列表中，则表明不允许该第一访问请求报文访问该服务器，执行步骤S210。
图3示出的本申请提供的另一实施例的报文处理方法的流程示意图，说明Anti-DDoS设备如何完成DDoS防护。如图3所示，本申请实施例提供的报文处理方法包括如下步骤。
步骤S300：僵尸主机或正常的用户终端向服务器发送第一访问请求报文。
步骤S302：Anti-DDoS设备接收该第一访问请求报文。
步骤S304：Anti-DDoS设备从该第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征。
其中，步骤S300-S304可以参见上述图2实施例中步骤S200-S204的描述，这里不再赘述。
步骤S306：Anti-DDoS设备基于指纹特征库识别所述第一指纹特征对应的操作系统类型。
具体地，步骤S306之前，Anti-DDoS设备可以预先生成指纹特征库，例如可以通过自 学习的方式，自动学习或分析正常业务模型中访问请求报文，从而获得在传输层和/或网络层的指纹特征，或者接收用户输入的传输层和/或网络层的指纹特征，然后建立并存储到指纹特征库中，那么该指纹特征库即包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征；也可以通过自学习的方式，自动学习或分析攻击业务模型中访问请求报文，从而获得在传输层和/或网络层的指纹特征，或者接收用户输入的传输层和/或网络层的指纹特征，然后建立并存储到指纹特征库中，那么该指纹特征库即包括禁止访问所述服务器的终端设备的操作系统类型对应的指纹特征。
本申请实施例中传输层或网络层的指纹特征是每个操作系统在遵循或使用TCP/IP协议时都有的固有系统指纹特征，并且每个操作系统都会有差别。
本申请实施例的指纹特征库中还包含操作系统类型与指纹特征之间的对应关系，那么Anti-DDoS设备即可基于指纹特征库识别所述第一指纹特征对应的操作系统类型。
步骤S308：Anti-DDoS设备根据第一操作系统类型列表、或者第二操作系统类型列表判断是否允许所述第一访问请求报文访问所述服务器。
具体地，Anti-DDoS设备还可预先建立好第一操作系统类型列表或第二操作系统类型列表；该第一操作系统类型列表中包括允许访问该服务器的至少一个操作系统类型，该第二操作系统类型列表中包括禁止访问该服务器的至少一个操作系统类型。该第一操作系统类型列表或第二操作系统类型可以为用户按照需要进行配置，输入的操作系统类型。或者该第一操作系统类型列表也可以是通过自学习的方式，自动学习或分析正常业务模型中访问请求报文，从而获得在传输层和/或网络层的指纹特征，然后得到该指纹特征对应的操作系统类型。该第二操作系统类型也可以是通过自学习的方式，自动学习或分析或攻击业务模型中访问请求报文从而获得在传输层和/或网络层的指纹特征，然后得到该指纹特征对应的操作系统类型。
那么Anti-DDoS设备可以根据第一操作系统类型列表，若判断该第一指纹特征对应的操作系统类型在该第一操作系统类型列表中，则表明允许该第一访问请求报文访问该服务器，执行步骤S310；若判断该第一指纹特征对应的操作系统类型不在该第一操作系统类型列表中，则表明不允许该第一访问请求报文访问该服务器，执行步骤S312。或者Anti-DDoS设备可以根据第二操作系统类型列表，若判断该第一指纹特征对应的操作系统类型不在该第二操作系统类型列表中，则表明允许该第一访问请求报文访问该服务器，执行步骤S310；若判断该第一指纹特征对应的操作系统类型在该第二操作系统类型列表中，则表明不允许该第一访问请求报文访问该服务器，执行步骤S312。
步骤S310：Anti-DDoS设备向服务器放行该第一访问请求报文；
步骤S312：Anti-DDoS设备阻断该第一访问请求报文。
如图4示出的本申请实施例提供的报文处理方法的原理示意图，以防护设备内部模块的角度来说明如何处理接收到的访问请求报文，可以分为前期配置管理和后期报文识别过滤：
在配置管理的过程中，配置管理模块可以通过用户手工输入指纹特征的形式来建立指纹特征库，也可以通过自学习模块以自学习的方式来获取访问请求报文的指纹特征，以建立指纹特征库，也可以两者结合一起来建立指纹特征库。
进一步地，通过升级模块，可以对指纹特征库中存储的指纹特征进行升级或更新，例 如可以定期自学习更新指纹特征，或者更新传输层和/或网络层的指纹特征的定义规则，并按照更新的定义规则重新建立指纹特征库。传输层和/或网络层的指纹特征的定义规则具体可以为选取哪些传输层和网络层的指纹特征项来作为识别依据，按照选取的这些指纹特征来配置或自学习指纹特征以构建指纹特征库，以及按照选取的这些指纹特征项提取第一访问请求报文的指纹特征，以识别放行还是阻断该报文。
在一种可能的实现方式中，用户也可以根据自身需求通过配置管理模块来配置OS阻断策略。比如每个不同的传输层和/或网络层的指纹特征可以对应不同的OS类型，例如Window 7/8、Windows 10、Linux 2.4、Linux 4.1等等。那么开发人员或研发人员等用户也可以直接配置客户端OS类型列表，或者通过自学习的方式自动学习正常业务模型或攻击业务模型对应的OS类型来配置客户端OS类型列表，该客户端OS类型列表中的OS类型可以为允许访问的OS类型或禁止访问的OS类型，从而更加灵活，更加快速高效地配置OS阻断策略，在面对多变的DDoS攻击时可以满足用户快速响应的需求，实现更好地预防和缓解DDoS攻击，更好地避免服务器遭受DDoS攻击。
在后期报文识别过滤的过程中，报文接收模块会接收访问请求报文，然后通过源OS识别模块基于指纹特征库中的指纹特征，对接收到的访问请求报文进行识别，提取出指纹特征，并还可以通过自学习模块识别出发送该访问请求报文对应的OS类型。然后由OS阻断模块基于配置的OS阻断策略分析是否阻断该访问请求报文。若允许访问请求，由动作处理模块可以将访问请求报文给到会话管理模块，在由会话管理模块触发报文发送模块将该访问请求报文放行给服务器；若不允许访问请求，那么动作处理模块即可以直接阻断掉该访问请求报文。
通过本申请实施例，由于传输层和/或网络层报文头中的信息是依赖于操作系统来实现或生成的，也就是说于传输层和/或网络层报文头中的指纹特征(例如TCP头及选项特征、或IP头特征等)是与操作系统类型强相关的，普通的程序是无法修改的。黑客往往需要通过建立RAW Socket或者修改OS来实现伪造，修改OS也就是修改OS的协议栈，必须重新编译该OS。而该OS的原始代码基本上都在厂商手里(特别是针对当前的IoT系统，越来越多的设备是厂商们自己研发出各自的OS)。因此重新编译的难度以及代价都很大，从而解决了现有技术中黑客们较为轻易地躲避攻击检测，使目标服务容易遭受DDoS攻击的技术问题。Anti-DDoS设备通过识别攻击报文的传输层和/或网络层的指纹特征，可以准确地识别是否是合法的正常用户访问，并可以很好地阻断非正常的用户访问请求，从而实现更好地预防和缓解DDoS攻击，更好地避免服务器遭受DDoS攻击。
为了更好地理解本申请实施例的报文处理方法的原理，再结合图5示出的本申请提供的另一实施例的报文处理方法的原理示意图，具体以OS特征库生成以及Anti-DDoS设备引擎如何处理报文，两块进行说明：
在生成OS特征库的过程中，可以先分析流行OS发出的TCP SYN报文的头部以及Option选项，然后提取关键的指纹特征或生成签名，例如SYN报文的TCP选项中的选项排序信息、IP报文的TTL信息、MSS信息、Windows size value信息、Windows scale信息、或其它选项等。将提取的指纹特征形成固定特征，放入或更新到指纹特征库中，该指纹特征可以发布更新到Anti-DDoS设备上，供Anti-DDoS设备引擎使用。
在Anti-DDoS设备引擎处理报文的过程中，可以通过如下两个实施例来说明：(画流程附图)
实施例一
如图6示出的本申请提供的报文处理流程的其中一个实施例的示意图，可以包括如下步骤：
步骤S600：Anti-DDoS设备可以先建立合法的允许访问的OS类型。
例如可以为OS系统类型列表，该OS系统类型列表可以由用户配置，比如用户手动配置了允许的客户端OS系统类型列表:Window 7/8、Windows 10；或者也可以由Anti-DDoS设备在正常业务模型中进行自学习,自动学习合法(即允许访问)客户端的OS系统类型列表，如Window 7/8、Windows 10。
步骤S602：Anti-DDoS设备在接收到新建会话的第一个握手请求报文，即SYN报文后，进行报文头部解析，比如提取Option信息。
步骤S604：Anti-DDoS设备提取指纹特征，比如分析TCP选项，具体根据预先定义的规则来完成指纹特征提取，比如定义的规则是提取TCP选项中的选项排序信息、报文IP头部的TTL(Time to live)信息以及Windows size value值，那么即完成这三项的指纹特征提取。
步骤S606：Anti-DDoS设备将提取的指纹特征与已有的指纹特征库进行比对，识别出客户端(发出该SYN报文)的具体OS系统类型，如Window 7/8或Linux 2.4。
以建立合法的允许访问的OS类型包括Window 7为例，加入配置了Window 7的指纹特征包括如下三项：TCP选项的排序顺序为MSS(Maximum segment size)、NOP(No-Operation)、window scale、NOP、NOP、SACK Permitted；报文IP头部的TTL(Time to live)为128；以及Windows size value值为8192。那么提取SYN报文中的上述三项的指纹特征，若与指纹特征库中上述三项的指纹特征都相同，则识别出客户端的具体OS系统类型为Window 7，允许该报文的访问，放行该SYN报文；若与指纹特征库中上述三项的指纹特征不都相同，则识别出客户端的具体OS系统类型不为Window 7，并在识别出都不为允许访问的OS类型后，那么即阻断该SYN报文。
步骤S608：Anti-DDoS设备根据OS阻断策略，检测该识别出的客户端OS系统类型是否在允许的客户端OS系统类型列表中。
步骤S610：若检测到在允许的客户端OS系统类型列表中，则放行该SYN报文；若检测到不在允许的客户端OS系统类型列表中，则阻断或丢弃该SYN报文。
实施例二
如图7示出的本申请提供的报文处理流程的另一个实施例的示意图，可以包括如下步骤：
步骤S700：Anti-DDoS设备可以先建立非法的禁止访问的OS类型；
例如可以为OS系统类型列表，该OS系统类型列表可以由用户配置，比如用户手动配置了禁止的客户端OS系统类型列表:Window 7/8、Windows 10；或者也可以由系统在攻击业务模型中进行自学习,自动学习非法(即禁止访问)客户端的OS系统类型列表，如Window 7/8、Windows 10。
步骤S702：Anti-DDoS设备在接收到新建会话的第一个握手请求报文，即SYN报文后，进行报文头部解析，比如提取Option信息。
步骤S704：Anti-DDoS设备提取指纹特征，比如分析TCP选项，具体根据预先定义的规则来完成指纹特征提取，比如定义的规则是提取TCP选项中的选项排序信息以及各选项的值，那么即完成这两项的指纹特征提取。
步骤S706：Anti-DDoS设备将提取的指纹特征与已有的指纹特征库进行比对，识别出客户端(发出该SYN报文)的具体OS系统类型，如Window 7/8或Linux 2.4。
步骤S708：Anti-DDoS设备根据OS阻断策略，检测该识别出的客户端OS系统类型是否在禁止的客户端OS系统类型列表中。
步骤S710：若检测到不在禁止的客户端OS系统类型列表中，则放行该SYN报文；若检测到在禁止的客户端OS系统类型列表中，则阻断或丢弃该SYN报文。
也就是说，Anti-DDoS设备引擎在处理报文的过程中可以有下表的8种情形：
Figure PCTCN2020117875-appb-000001
下面结合两个业务实例进行说明：
业务实例一
以Anti-DDoS设备保护一款Windows下运行的游戏的服务器为例；该游戏只能在Windows上运行，则根据客户端类型设置允许的客户端OS系统类型列表为Windows 7/8、Windows 10；
当检测到该服务器遭受到DDoS攻击时，Anti-DDoS设备将被触发对所有连接到游戏的服务器的客户端OS类型进行指纹特征识别(具体如上述实施例所述)，如果指纹识别出该客户端OS类型为非Windows 7/8、Windows 10系统，如识别出是Linux 2.4系统，则直接阻断SYN报文,从而阻断该客户端的访问，缓解DDoS攻击；
反之，如果识别出客户端OS类型为Windows 10系统，则放行该SYN报文。
业务实例二
以Anti-DDoS设备保护一款App应用服务器为例，该App只能在苹果iPhone设备上运行，则根据客户端类型设置允许的客户端OS系统类型列表为iOS；
当检测到该应用服务器遭受到DDoS攻击时，Anti-DDoS设备将被触发对所有连接到游戏服务器的客户端OS进行指纹特征识别(具体如上述实施例所述)，如果指纹识别出该客户端OS类型为非iOS系统，如Windows7系统，则直接阻断SYN报文,从而阻断该客户端的访问，缓解DDoS攻击；
反之，如果识别出客户端OS类型为iOS(iPhone)设备，则放行该SYN报文。
由于若对每个接收到的访问请求报文都提取指纹特征并进行识别，将影响正常用户的访问效率。通过上述技术手段，在检测到服务器遭受到DDoS攻击时，再触发执行提取指纹特征并进行识别，可以很好地平衡正常访问效率和缓解DDoS攻击的问题。
本申请实施例中的传输层指纹特征和网络层指纹特征，属于操作系统固有的系统指纹，不同的操作系统一般有着上述不同的指纹特征，具体如在IP头及选项/TCP头及选项的指纹特征，每个操作系统都会有差别。
下面结合图8至图11，分别举例说明不同操作系统上的传输层指纹特征和网络层指纹特征：
如图8示出的本申请实施例提供的操作系统对应的指纹特征的示意图，是以Windows7操作系统为例，图8中可以看到，提取到基于Windows7按照或遵循TCP/IP协议发出的访问请求报文的指纹特征有以下一个或多个：
TCP选项的排序顺序为MSS(Maximum segment size)、NOP(No-Operation)、window scale、NOP、NOP、SACK Permitted；
报文IP头部的TTL(Time to live)为128；
Windows size value值为8192；
Windows scale值为2；
DF(Don’t fragment)置1，并且IP头部的ID(Identification)字段非0。
如图9示出的本申请提供的另一实施例的操作系统对应的指纹特征的示意图，是以Linux version 3.1(CentOS 7.1)操作系统为例，图9中可以看到，提取到基于Linux version 3.1(CentOS 7.1)按照或遵循TCP/IP协议发出的访问请求报文的指纹特征有以下一个或多个：
TCP选项的排序顺序为MSS、SACK Permitted、Timestamp、NOP、Windows scale；
报文IP头的TTL(Time to live)为64；
Windows size value值为14600(MSS*10)；
Windows scale值为7；
DF(Don’t fragment)置1，并且ID字段非0。
如图10示出的本申请提供的另一实施例的操作系统对应的指纹特征的示意图，是以Linux 4.1(Kali)操作系统为例，图10中可以看到，提取到基于Linux 4.1(Kali)按照或遵循TCP/IP协议发出的访问请求报文的指纹特征有以下一个或多个：
TCP选项的排序顺序为MSS、SACK Permitted、Timestamp、NOP、Windows scale；
报文IP头部的TTL为64；
Windows size value值为29200(MSS*20)；
Windows scale值为7；
DF(Don’t fragment)置1，并且ID字段非0。
如图11示出的本申请提供的另一实施例的操作系统对应的指纹特征的示意图，是以Huawei USG6670网关设备的操作系统为例，针对当前的IoT系统，越来越多的设备是厂商们自己研发出各自的OS。图11中可以看到，提取到基于Huawei USG6670网关设备按照或遵循TCP/IP协议发出的访问请求报文的指纹特征有以下一个或多个：
TCP选项的排序顺序为MSS；
报文IP头部的TTL为255；
Windows size value值为32768；
无字段Windows scale；
DF未设置。
下面请参见图12，图12示出了本申请实施例提供的防护设备的结构示意图，该防护设备120可以包括：
处理器1210、网络接口1220、存储器1230、通信总线1240、输入设备1250、显示器1260。其中处理器1210，网络接口1220，存储器1230，输入设备1250，显示器1260通过通信总线1240相互通信。输入设备1250可以为触摸屏、鼠标、键盘等可以获取用户操作的设备或元器件，该显示器1260可以显示一些提示信息以便于用户根据该提示信息与该防护设备120交互，例如，可以将阻断掉的访问请求报文的信息显示出来以供用户查看。存储器1230包括但不限于随机存取存储器(RAM)、只读存储器(ROM)，该存储器1230中可以存储操作系统(程序)1232和应用程序1234。网络接口1220用于与其他设备通信；例如接收终端设备发送的访问请求报文和向服务器发送该访问请求报文，等等。处理器1210可以是一个或多个中央处理器(Central Processing Unit，简称CPU)，在处理器1210是一个CPU的情况下，该CPU可以是单核CPU，也可以是多核CPU；处理器1210运行操作系统1232以提供一种软件运行环境，在该软件运行环境下，该处理器1210可以调用该应用程序1234来执行报文处理的相关操作；具体地：
网络接口1220用于接收第一访问请求报文；所述第一访问请求报文包括基于TCP/IP协议发送的报文；该第一访问请求报文的目的方是所述防护设备保护的服务器；
处理器1210用于调用存储的计算机程序(如应用程序1234)执行如下操作：
从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征，所述第一指纹特征对应发送所述第一访问请求报文的终端设备的操作系统类型；基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，其中，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，或/和不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征；
若允许所述第一访问请求报文访问所述服务器，则放行所述第一访问请求报文；
若不允许所述第一访问请求报文访问所述服务器，则阻断所述第一访问请求报文。
需要说明的是，图12实施例中的防护设备120以包括存储器1230为例进行的说明。而本申请实施例的防护设备120也可以不包括存储器1230，该存储的计算机程序可以通过云存储的方式存储在云服务器端，可通过下载执行该存储的计算机程序来执行报文处理相关操作。
在一种可能实现方式中，该指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，处理器1210基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，具体可以包括：
判断所述指纹特征库中是否包含所述第一指纹特征；
如果包含所述第一指纹特征，则确定允许所述第一访问请求报文访问所述服务器；
如果不包含所述第一指纹特征，则确定不允许所述第一访问请求报文访问所述服务器。
在一种可能实现方式中，在网络接口1220接收第一访问请求报文之前，输入设备1250可以接收用户输入的传输层和/或网络层的指纹特征，将所述输入的指纹特征保存在该指纹特征库中；或者
处理器1210还用于，在网络接口1220接收第一访问请求报文之前，分析正常业务模型中的第二访问请求报文，从而获得在传输层和/或网络层的指纹特征，将分析得到的指纹特征保存在该指纹特征库中。
在一种可能实现方式中，该指纹特征库包括不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，处理器1210基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，可以具体包括：
所述处理器判断所述指纹特征库中是否包含所述第一指纹特征；
如果包含所述第一指纹特征，则确定不允许所述第一访问请求报文访问所述服务器；
如果不包含所述第一指纹特征，则确定允许所述第一访问请求报文访问所述服务器。
在一种可能实现方式中，在网络接口1220接收第一访问请求报文之前，输入设备1250可以接收用户输入的传输层和/或网络层的指纹特征，将所述输入的指纹特征保存在该指纹特征库中；或者
处理器1210还用于，在网络接口1220接收第一访问请求报文之前，分析攻击业务模型中的第三访问请求报文，从而获得在传输层和/或网络层的指纹特征，将分析得到的指纹特征保存在该指纹特征库中。
在一种可能实现方式中，该指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征和不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，处理器1210基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，可以具体包括：
处理器1210基于指纹特征库识别该第一指纹特征对应的操作系统类型，该指纹特征库中包含操作系统类型与指纹特征之间的对应关系；
根据第一操作系统类型列表、或者第二操作系统类型列表判断是否允许所述第一访问请求报文访问所述服务器，所述第一操作系统类型列表中包括允许访问所述服务器的至少一个操作系统类型，所述第二操作系统类型列表中包括禁止访问所述服务器的至少一个操作系统类型。
在一种可能实现方式中，处理器1210还可以是在检测到服务器遭受到DDoS攻击的情况下，才触发执行从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征的步骤。
具体来说，防护设备120对报文的处理过程以及所取得的有益效果，可以参考图1-图11实施例的详细描述，这里不再赘述。
下面对应的，可以参见图13，图13示出了本申请实施例提供的报文处理装置的结构示意图，该报文处理装置13可以包括：报文接收单元130、指纹特征提取单元132和处理单元134；其中，
报文接收单元130用于接收第一访问请求报文；所述第一访问请求报文包括基于TCP/IP协议发送的报文；所述第一访问请求报文的目的方是所述报文处理装置保护的服务器；
指纹特征提取单元132用于从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征，所述第一指纹特征对应发送所述第一访问请求报文的终端设备的操作系统类型；
处理单元134用于基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，其中，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，或/和不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征；
若允许所述第一访问请求报文访问所述服务器，则所述处理单元放行所述第一访问请求报文；
若不允许所述第一访问请求报文访问所述服务器，则所述处理单元阻断所述第一访问请求报文。
在一种可能的实现方式中，该指纹特征库可以包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，处理单元134，可以具体用于：
判断所述指纹特征库中是否包含所述第一指纹特征；
如果包含所述第一指纹特征，则确定允许所述第一访问请求报文访问所述服务器；
如果不包含所述第一指纹特征，则确定不允许所述第一访问请求报文访问所述服务器。
在一种可能的实现方式中，报文处理装置13还可以包括：
第一特征接收单元，用于在报文接收单元130接收第一访问请求报文之前，接收输入的传输层和/或网络层的指纹特征，将所述输入的指纹特征保存在所述指纹特征库中；或者
第一特征分析单元，用于在报文接收单元130接收第一访问请求报文之前，分析正常业务模型中的第二访问请求报文，从而获得在传输层和/或网络层的指纹特征，将分析得到的指纹特征保存在所述指纹特征库中。
在一种可能的实现方式中，该指纹特征库包括不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，处理单元134，可以具体用于：
判断所述指纹特征库中是否包含所述第一指纹特征；
如果包含所述第一指纹特征，则确定不允许所述第一访问请求报文访问所述服务器；
如果不包含所述第一指纹特征，则确定允许所述第一访问请求报文访问所述服务器。
在一种可能的实现方式中，报文处理装置13还可以包括：
第二特征接收单元，用于在报文接收单元130接收第一访问请求报文之前，接收输入的传输层和/或网络层的指纹特征，将所述输入的指纹特征保存在所述指纹特征库中；或者
第二特征分析单元，用于在报文接收单元130接收第一访问请求报文之前，分析正常业务模型中的第三访问请求报文，从而获得在传输层和/或网络层的指纹特征，将分析得到的指纹特征保存在所述指纹特征库中。
在一种可能的实现方式中，所述指纹特征库可以包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征和不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，处理单元134，可以具体用于：
基于指纹特征库识别所述第一指纹特征对应的操作系统类型，所述指纹特征库中包含 操作系统类型与指纹特征之间的对应关系；
根据第一操作系统类型列表、或者第二操作系统类型列表判断是否允许所述第一访问请求报文访问所述服务器，所述第一操作系统类型列表中包括允许访问所述服务器的至少一个操作系统类型，所述第二操作系统类型列表中包括禁止访问所述服务器的至少一个操作系统类型。
在一种可能的实现方式中，指纹特征提取单元132还可以是在检测到服务器遭受到DDoS攻击的情况下，才触发执行从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征的步骤。
具体来说，报文处理装置13对报文的处理过程以及所取得的有益效果，可以参考图1-图11实施例的详细描述，这里不再赘述。
下面可以参见图14，图14示出了本申请实施例提供的芯片的结构示意图，该芯片14可以包括：至少一个处理器140和接口电路142；其中，
处理器140用于通过接口电路142输入第一访问请求报文后，可以执行存储器中存储的计算机程序以执行以下步骤：
从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征，所述第一指纹特征对应发送所述第一访问请求报文的终端设备的操作系统类型；所述第一访问请求报文包括基于TCP/IP协议发送的报文，所述第一访问请求报文的目的方是所述芯片保护的服务器；
基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，其中，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，或者不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征；
若允许所述第一访问请求报文访问所述服务器，则放行所述第一访问请求报文；
若不允许所述第一访问请求报文访问所述服务器，则阻断所述第一访问请求报文。
在一种可能的实现方式中，指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，处理器140基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，可以具体包括：
判断所述指纹特征库中是否包含所述第一指纹特征；
如果包含所述第一指纹特征，则确定允许所述第一访问请求报文访问所述服务器；
如果不包含所述第一指纹特征，则确定不允许所述第一访问请求报文访问所述服务器。
在一种可能的实现方式中，通过所述接口电路142输入第一访问请求报文之前，处理器140还可以执行：
将接收输入的传输层和/或网络层的指纹特征保存在所述指纹特征库中；或者
分析正常业务模型中的第二访问请求报文，从而获得在传输层和/或网络层的指纹特征，将分析得到的指纹特征保存在所述指纹特征库中。
在一种可能的实现方式中，该指纹特征库包括不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，处理器140基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，可以具体包括：
判断所述指纹特征库中是否包含所述第一指纹特征；
如果包含所述第一指纹特征，则确定不允许所述第一访问请求报文访问所述服务器；
如果不包含所述第一指纹特征，则确定允许所述第一访问请求报文访问所述服务器。
在一种可能的实现方式中，通过所述接口电路142输入第一访问请求报文之前，处理器140还可以执行：
将接收输入的传输层和/或网络层的指纹特征保存在所述指纹特征库中；或者
分析攻击业务模型中的第三访问请求报文，从而获得在传输层和/或网络层的指纹特征，将分析得到的指纹特征保存在所述指纹特征库中。
在一种可能的实现方式中，处理器140还可以是在检测到服务器遭受到DDoS攻击的情况下，才触发执行从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征的步骤。
在一种可能的实现方式中，本申请实施例的第一访问请求报文包括SYN报文。
具体来说，芯片14对报文的处理过程以及所取得的有益效果，可以参考图1-图11实施例的详细描述，这里不再赘述。
本领域技术人员能够领会，结合本文公开描述的各种说明性逻辑框、模块和算法步骤所描述的功能可以硬件、软件、固件或其任何组合来实施。如果以软件来实施，那么各种说明性逻辑框、模块、和步骤描述的功能可作为一或多个指令或代码在计算机可读媒体上存储或传输，且由基于硬件的处理单元执行。计算机可读媒体可包含计算机可读存储媒体，其对应于有形媒体，例如数据存储媒体，或包括任何促进将计算机程序从一处传送到另一处的媒体(例如，根据通信协议)的通信媒体。以此方式，计算机可读媒体大体上可对应于(1)非暂时性的有形计算机可读存储媒体，或(2)通信媒体，例如信号或载波。数据存储媒体可为可由一或多个计算机或一或多个处理器存取以检索用于实施本申请中描述的技术的指令、代码和/或数据结构的任何可用媒体。计算机程序产品可包含计算机可读媒体。
作为实例而非限制，此类计算机可读存储媒体可包括RAM、ROM、EEPROM、CD-ROM或其它光盘存储装置、磁盘存储装置或其它磁性存储装置、快闪存储器或可用来存储指令或数据结构的形式的所要程序代码并且可由计算机存取的任何其它媒体。并且，任何连接被恰当地称作计算机可读媒体。举例来说，如果使用同轴缆线、光纤缆线、双绞线、数字订户线(DSL)或例如红外线、无线电和微波等无线技术从网站、服务器或其它远程源传输指令，那么同轴缆线、光纤缆线、双绞线、DSL或例如红外线、无线电和微波等无线技术包含在媒体的定义中。但是，应理解，所述计算机可读存储媒体和数据存储媒体并不包括连接、载波、信号或其它暂时媒体，而是实际上针对于非暂时性有形存储媒体。如本文中所使用，磁盘和光盘包含压缩光盘(CD)、激光光盘、光学光盘、数字多功能光盘(DVD)和蓝光光盘，其中磁盘通常以磁性方式再现数据，而光盘利用激光以光学方式再现数据。以上各项的组合也应包含在计算机可读媒体的范围内。
可通过例如一或多个数字信号处理器(DSP)、通用微处理器、专用集成电路(ASIC)、现场可编程逻辑阵列(FPGA)或其它等效集成或离散逻辑电路等一或多个处理器来执行指令。因此，如本文中所使用的术语“处理器”可指前述结构或适合于实施本文中所描述的技术的任一其它结构中的任一者。另外，在一些方面中，本文中所描述的各种说明性逻辑 框、模块、和步骤所描述的功能可以提供于经配置以用于编码和解码的专用硬件和/或软件模块内，或者并入在组合编解码器中。而且，所述技术可完全实施于一或多个电路或逻辑元件中。
本申请的技术可在各种各样的装置或设备中实施，包含无线手持机、集成电路(IC)或一组IC(例如，芯片组)。本申请中描述各种组件、模块或单元是为了强调用于执行所揭示的技术的装置的功能方面，但未必需要由不同硬件单元实现。实际上，如上文所描述，各种单元可结合合适的软件和/或固件组合在编码解码器硬件单元中，或者通过互操作硬件单元(包含如上文所描述的一或多个处理器)来提供。
以上所述，仅为本申请示例性的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到的变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应该以权利要求的保护范围为准。

Claims (18)

  1. 一种报文处理方法，其特征在于，包括：
    防护设备接收第一访问请求报文，所述第一访问请求报文包括基于TCP/IP协议发送的报文，所述第一访问请求报文的目的方是所述防护设备保护的服务器；
    所述防护设备从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征，所述第一指纹特征对应发送所述第一访问请求报文的终端设备的操作系统类型；
    基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，其中，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，或/和不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征；
    若允许所述第一访问请求报文访问所述服务器，则放行所述第一访问请求报文；
    若不允许所述第一访问请求报文访问所述服务器，则阻断所述第一访问请求报文。
  2. 如权利要求1所述的方法，其特征在于，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，所述基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，包括：
    判断所述指纹特征库中是否包含所述第一指纹特征；
    如果包含所述第一指纹特征，则确定允许所述第一访问请求报文访问所述服务器；
    如果不包含所述第一指纹特征，则确定不允许所述第一访问请求报文访问所述服务器。
  3. 如权利要求2所述的方法，其特征在于，所述接收第一访问请求报文之前，还包括：
    接收输入的传输层和/或网络层的指纹特征，将所述输入的指纹特征保存在所述指纹特征库中；或者
    分析正常业务模型中的第二访问请求报文，从而获得在传输层和/或网络层的指纹特征，将分析得到的指纹特征保存在所述指纹特征库中。
  4. 如权利要求1所述的方法，其特征在于，所述指纹特征库包括不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，所述基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，包括：
    判断所述指纹特征库中是否包含所述第一指纹特征；
    如果包含所述第一指纹特征，则确定不允许所述第一访问请求报文访问所述服务器；
    如果不包含所述第一指纹特征，则确定允许所述第一访问请求报文访问所述服务器。
  5. 如权利要求4所述的方法，其特征在于，所述接收第一访问请求报文之前，还包括：
    接收输入的传输层和/或网络层的指纹特征，将所述输入的指纹特征保存在所述指纹特征库中；或者
    分析攻击业务模型中的第三访问请求报文，从而获得在传输层和/或网络层的指纹特征，将分析得到的指纹特征保存在所述指纹特征库中。
  6. 如权利要求1所述的方法，其特征在于，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征和不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，所述基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，包括：
    基于指纹特征库识别所述第一指纹特征对应的操作系统类型，所述指纹特征库中包含操作系统类型与指纹特征之间的对应关系；
    根据第一操作系统类型列表、或者第二操作系统类型列表判断是否允许所述第一访问请求报文访问所述服务器，所述第一操作系统类型列表中包括允许访问所述服务器的至少一个操作系统类型，所述第二操作系统类型列表中包括禁止访问所述服务器的至少一个操作系统类型。
  7. 如权利要求1-6任一项所述的方法，其特征在于，所述第一指纹特征和所述指纹特征库中的指纹特征为传输层指纹特征；
    所述传输层指纹特征包括以下一个或多个：
    TCP选项中的选项排序信息；
    最大分段大小信息；窗口大小信息；
    窗口比例信息；
    DF标志位信息。
  8. 如权利要求1-6任一项所述的方法，其特征在于，所述第一指纹特征和所述指纹特征库中的指纹特征为网络层指纹特征，所述网络层指纹特征包括以下一个或多个：
    IP报文存活时间信息；
    IP头部标识信息。
  9. 一种防护设备，其特征在于，包括处理器和网络接口，其中，
    所述网络接口用于接收第一访问请求报文，所述第一访问请求报文包括基于TCP/IP协议发送的报文，所述第一访问请求报文的目的方是所述防护设备保护的服务器；
    所述处理器用于调用存储的计算机程序执行如下操作：
    从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征，所述第一指纹特征对应发送所述第一访问请求报文的终端设备的操作系统类型；
    基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，其中，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，或/和不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征；
    若允许所述第一访问请求报文访问所述服务器，则放行所述第一访问请求报文；
    若不允许所述第一访问请求报文访问所述服务器，则阻断所述第一访问请求报文。
  10. 如权利要求9所述的设备，其特征在于，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，所述处理器基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，包括：
    所述处理器判断所述指纹特征库中是否包含所述第一指纹特征；
    如果包含所述第一指纹特征，则确定允许所述第一访问请求报文访问所述服务器；
    如果不包含所述第一指纹特征，则确定不允许所述第一访问请求报文访问所述服务器。
  11. 如权利要求10所述的设备，其特征在于，所述防护设备还包括输入设备；所述输入设备，用于在所述网络接口接收第一访问请求报文之前，接收输入的传输层和/或网络层的指纹特征，将所述输入的指纹特征保存在所述指纹特征库中；或者，
    所述处理器还用于，在所述网络接口接收第一访问请求报文之前，分析正常业务模型中的第二访问请求报文，从而获得在传输层和/或网络层的指纹特征，将分析得到的指纹特征保存在所述指纹特征库中。
  12. 如权利要求9所述的设备，其特征在于，所述指纹特征库包括不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，所述处理器基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，包括：
    所述处理器判断所述指纹特征库中是否包含所述第一指纹特征；
    如果包含所述第一指纹特征，则确定不允许所述第一访问请求报文访问所述服务器；
    如果不包含所述第一指纹特征，则确定允许所述第一访问请求报文访问所述服务器。
  13. 如权利要求12所述的设备，其特征在于，所述防护设备还包括输入设备；所述输入设备，用于在所述网络接口接收第一访问请求报文之前，接收输入的传输层和/或网络层的指纹特征，将所述输入的指纹特征保存在所述指纹特征库中；或者，
    所述处理器还用于，在所述网络接口接收第一访问请求报文之前，分析攻击业务模型中的第三访问请求报文，从而获得在传输层和/或网络层的指纹特征，将分析得到的指纹特征保存在所述指纹特征库中。
  14. 如权利要求9所述的设备，其特征在于，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征和不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，所述处理器基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，包括：
    所述处理器基于指纹特征库识别所述第一指纹特征对应的操作系统类型，所述指纹特征库中包含操作系统类型与指纹特征之间的对应关系；
    根据第一操作系统类型列表、或者第二操作系统类型列表判断是否允许所述第一访问请求报文访问所述服务器，所述第一操作系统类型列表中包括允许访问所述服务器的至少一个操作系统类型，所述第二操作系统类型列表中包括禁止访问所述服务器的至少一个操作系统类型。
  15. 如权利要求9-14任一项所述的设备，其特征在于，所述第一指纹特征和所述指纹特征库中的指纹特征为传输层指纹特征；
    所述传输层指纹特征包括以下一个或多个：
    TCP选项中的选项排序信息；
    最大分段大小信息；
    窗口大小信息；
    窗口比例信息；
    DF标志位信息。
  16. 如权利要求9-14任一项所述的设备，其特征在于，所述第一指纹特征和所述指纹特征库中的指纹特征为网络层指纹特征，所述网络层指纹特征包括以下一个或多个：
    IP报文存活时间信息；
    IP头部标识信息。
  17. 一种报文处理装置，其特征在于，包括：
    报文接收单元，用于接收第一访问请求报文；所述第一访问请求报文包括基于TCP/IP协议发送的报文；所述第一访问请求报文的目的方是所述报文处理装置保护的服务器；
    指纹特征提取单元，用于从所述第一访问请求报文的传输层和/或网络层报文头中提取第一指纹特征，所述第一指纹特征对应发送所述第一访问请求报文的终端设备的操作系统类型；
    处理单元，用于基于指纹特征库对所述第一指纹特征进行识别以判断是否允许所述第一访问请求报文访问所述服务器，其中，所述指纹特征库包括允许访问所述服务器的终端设备的操作系统类型对应的指纹特征，或/和不允许访问所述服务器的终端设备的操作系统类型对应的指纹特征；
    若允许所述第一访问请求报文访问所述服务器，则所述处理单元放行所述第一访问请求报文；
    若不允许所述第一访问请求报文访问所述服务器，则所述处理单元阻断所述第一访问请求报文。
  18. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有程序，所述程序当被处理器执行时使所述处理器执行如权利要求1-8任一项所述的方法。
PCT/CN2020/117875 2019-10-31 2020-09-25 报文处理方法、装置、设备及计算机可读存储介质 WO2021082834A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
JP2022523404A JP7388613B2 (ja) 2019-10-31 2020-09-25 パケット処理方法及び装置、デバイス、並びに、コンピュータ可読ストレージ媒体
EP20883473.9A EP4044546A4 (en) 2019-10-31 2020-09-25 METHOD, DEVICE AND DEVICE FOR MESSAGE PROCESSING, AND COMPUTER-READABLE STORAGE MEDIUM
CA3159619A CA3159619C (en) 2019-10-31 2020-09-25 Packet processing method and apparatus, device, and computer-readable storage medium
US17/731,893 US20220263823A1 (en) 2019-10-31 2022-04-28 Packet Processing Method and Apparatus, Device, and Computer-Readable Storage Medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911057490.8 2019-10-31
CN201911057490.8A CN112751815B (zh) 2019-10-31 2019-10-31 报文处理方法、装置、设备及计算机可读存储介质

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/731,893 Continuation US20220263823A1 (en) 2019-10-31 2022-04-28 Packet Processing Method and Apparatus, Device, and Computer-Readable Storage Medium

Publications (1)

Publication Number Publication Date
WO2021082834A1 true WO2021082834A1 (zh) 2021-05-06

Family

ID=75645700

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/117875 WO2021082834A1 (zh) 2019-10-31 2020-09-25 报文处理方法、装置、设备及计算机可读存储介质

Country Status (6)

Country Link
US (1) US20220263823A1 (zh)
EP (1) EP4044546A4 (zh)
JP (1) JP7388613B2 (zh)
CN (1) CN112751815B (zh)
CA (1) CA3159619C (zh)
WO (1) WO2021082834A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115242675A (zh) * 2022-07-25 2022-10-25 北京天融信网络安全技术有限公司 一种物联网终端的类型识别方法及系统

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114710781A (zh) * 2020-12-16 2022-07-05 华为技术有限公司 一种终端识别方法及装置
CN113505007A (zh) * 2021-07-12 2021-10-15 北京鲸鲮信息系统技术有限公司 基于Linux系统的协议栈数据传输方法、计算机设备和存储介质
CN114465795B (zh) * 2022-01-27 2024-03-29 杭州默安科技有限公司 一种干扰网络扫描器的方法及系统
CN115051977B (zh) * 2022-06-24 2023-09-19 绿盟科技集团股份有限公司 一种Web机器人的识别方法、装置、设备和介质
CN116232767B (zh) * 2023-05-06 2023-08-15 杭州美创科技股份有限公司 DDoS防御方法、装置、计算机设备及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160241576A1 (en) * 2015-02-13 2016-08-18 Canon Kabushiki Kaisha Detection of anomalous network activity
CN106534068A (zh) * 2016-09-29 2017-03-22 广州华多网络科技有限公司 一种ddos防御系统中清洗伪造源ip的方法和装置
CN106789934A (zh) * 2016-11-29 2017-05-31 北京神州绿盟信息安全科技股份有限公司 一种网络设备识别方法及系统
CN107800668A (zh) * 2016-09-05 2018-03-13 华为技术有限公司 一种分布式拒绝服务攻击防御方法、装置及系统
CN110113290A (zh) * 2018-02-01 2019-08-09 华为技术有限公司 网络攻击的检测方法、装置、主机及存储介质
CN111565203A (zh) * 2020-07-16 2020-08-21 腾讯科技（深圳）有限公司 业务请求的防护方法、装置、系统和计算机设备

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7949732B1 (en) * 2003-05-12 2011-05-24 Sourcefire, Inc. Systems and methods for determining characteristics of a network and enforcing policy
JP5011234B2 (ja) 2008-08-25 2012-08-29 株式会社日立情報システムズ 攻撃ノード群判定装置およびその方法、ならびに情報処理装置および攻撃対処方法、およびプログラム
CN106549925A (zh) * 2015-09-23 2017-03-29 阿里巴巴集团控股有限公司 防止跨站点请求伪造的方法、装置及系统
WO2017058966A1 (en) 2015-09-28 2017-04-06 Department 13, LLC Unmanned aerial vehicle intrusion detection and countermeasures
KR101859562B1 (ko) 2016-11-11 2018-05-21 한국인터넷진흥원 취약점 정보 분석 방법 및 장치
JP2019022066A (ja) 2017-07-14 2019-02-07 日本電信電話株式会社 検出システム、検出方法及び検出プログラム
JP6866258B2 (ja) 2017-08-14 2021-04-28 日本電信電話株式会社 端末識別装置、端末識別方法及びプログラム
CN108600145B (zh) * 2017-12-25 2020-12-25 北京神州绿盟信息安全科技股份有限公司 一种确定DDoS攻击设备的方法及装置
CN108521408B (zh) * 2018-03-22 2021-03-12 平安科技（深圳）有限公司 抵抗网络攻击方法、装置、计算机设备及存储介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160241576A1 (en) * 2015-02-13 2016-08-18 Canon Kabushiki Kaisha Detection of anomalous network activity
CN107800668A (zh) * 2016-09-05 2018-03-13 华为技术有限公司 一种分布式拒绝服务攻击防御方法、装置及系统
CN106534068A (zh) * 2016-09-29 2017-03-22 广州华多网络科技有限公司 一种ddos防御系统中清洗伪造源ip的方法和装置
CN106789934A (zh) * 2016-11-29 2017-05-31 北京神州绿盟信息安全科技股份有限公司 一种网络设备识别方法及系统
CN110113290A (zh) * 2018-02-01 2019-08-09 华为技术有限公司 网络攻击的检测方法、装置、主机及存储介质
CN111565203A (zh) * 2020-07-16 2020-08-21 腾讯科技（深圳）有限公司 业务请求的防护方法、装置、系统和计算机设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4044546A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115242675A (zh) * 2022-07-25 2022-10-25 北京天融信网络安全技术有限公司 一种物联网终端的类型识别方法及系统

Also Published As

Publication number Publication date
CA3159619A1 (en) 2021-05-06
EP4044546A1 (en) 2022-08-17
CN112751815B (zh) 2021-11-19
EP4044546A4 (en) 2022-11-02
JP7388613B2 (ja) 2023-11-29
CA3159619C (en) 2024-05-21
CN112751815A (zh) 2021-05-04
US20220263823A1 (en) 2022-08-18
JP2022554101A (ja) 2022-12-28

Similar Documents

Publication Publication Date Title
WO2021082834A1 (zh) 报文处理方法、装置、设备及计算机可读存储介质
US10454953B1 (en) System and method for separated packet processing and static analysis
US10855700B1 (en) Post-intrusion detection of cyber-attacks during lateral movement within networks
KR101054705B1 (ko) 위조 발생지 어드레스를 가진 포트 스캔을 탐지하기 위한 방법 및 장치
US11831420B2 (en) Network application firewall
US9800608B2 (en) Processing data flows with a data flow processor
US9912678B2 (en) Techniques for automatically mitigating denial of service attacks via attack pattern matching
CN111193719A (zh) 一种网络入侵防护系统
US20110213869A1 (en) Processing data flows with a data flow processor
US20110231564A1 (en) Processing data flows with a data flow processor
US20110238855A1 (en) Processing data flows with a data flow processor
US10757135B2 (en) Bot characteristic detection method and apparatus
JP2019021294A (ja) ＤＤｏＳ攻撃判定システムおよび方法
JP2010520566A (ja) 外部デバイスとホスト・デバイスの間でデータおよびデバイスのセキュリティを提供するためのシステムおよび方法
Kumar et al. DDOS prevention in IoT
CN111565203B (zh) 业务请求的防护方法、装置、系统和计算机设备
Huang et al. An authentication scheme to defend against UDP DrDoS attacks in 5G networks
JP6592196B2 (ja) 悪性イベント検出装置、悪性イベント検出方法および悪性イベント検出プログラム
CN114726579B (zh) 防御网络攻击的方法、装置、设备、存储介质及程序产品
Patel et al. A Snort-based secure edge router for smart home
US10182071B2 (en) Probabilistic tracking of host characteristics
CN114553452B (zh) 攻击防御方法及防护设备
KR20180102884A (ko) 방화벽 및 이의 패킷 처리 방법
WO2022156197A1 (zh) 攻击成功识别方法及防护设备
Williams Risk Access Spots (RAS) Common to Communication Networks

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20883473

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2022523404

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 3159619

Country of ref document: CA

ENP Entry into the national phase

Ref document number: 2020883473

Country of ref document: EP

Effective date: 20220428

NENP Non-entry into the national phase

Ref country code: DE