WO2023160693A1 - 一种攻击阻断方法及相关装置 - Google Patents

一种攻击阻断方法及相关装置 Download PDF

Info

Publication number
WO2023160693A1
WO2023160693A1 PCT/CN2023/078368 CN2023078368W WO2023160693A1 WO 2023160693 A1 WO2023160693 A1 WO 2023160693A1 CN 2023078368 W CN2023078368 W CN 2023078368W WO 2023160693 A1 WO2023160693 A1 WO 2023160693A1
Authority
WO
WIPO (PCT)
Prior art keywords
attack
blocking
target
blocking group
paths
Prior art date
Application number
PCT/CN2023/078368
Other languages
English (en)
French (fr)
Inventor
吴朱亮
王仲宇
谢于明
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023160693A1 publication Critical patent/WO2023160693A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the technical field of network security, in particular to an attack blocking method and a related device.
  • firewalls At the network egress to prevent external attacks.
  • the firewall detects network packets, matches the characteristics of attack behaviors, and directly discards the packets after discovering that the internal network has been attacked, thereby blocking the communication between external attackers and internal devices and achieving the purpose of protecting the internal network.
  • the firewall Since the firewall is deployed at the egress of the network, the firewall can usually only block the network packets between the internal network and the external network, but cannot block the horizontal attack packets launched by the successfully invaded device inside the network to other devices. Therefore, in the related art, an access blacklist is sent on a switch close to the terminal device in the internal network, so as to block attack packets sent to the terminal device by attack sources of the external network and the internal network.
  • the internal network usually includes multiple switches close to the terminal equipment, in the related art, it is necessary to deploy the same access blacklist on each switch close to the terminal equipment to block attack packets, thus causing the storage resources and processing resources of the switch to be limited.
  • the overhead is high.
  • This application provides an attack blocking method. Under the condition of ensuring that multiple attack paths are blocked, the attack packet is blocked by a target blocking group including the least network equipment, which can maximize the protection effect At the same time, the overhead of storage resources and processing resources in the network device is saved as much as possible.
  • the first aspect of the present application provides an attack blocking method, which can be applied to a control device or a cloud device in a cloud protection system.
  • the cloud device obtains multiple attack paths, determines the first target blocking group according to the multiple attack paths, and sends a packet blocking policy to the network devices in the first target blocking group, so that the first target blocking group
  • Each network device can block the attack packets related to the attack source according to the packet blocking strategy sent.
  • the multiple attack paths are forwarding paths of attack packets, and the multiple attack paths have the same attack source. That is, the starting points of the multiple attack paths obtained by the cloud device are the same, and the network devices or end points on different attack paths are different.
  • the first target blocking group is a blocking group including a minimum number of network devices among the plurality of blocking groups.
  • Each of the multiple blocking groups includes at least one network device, and the network devices in each blocking group are used to block attack packets on multiple attack paths.
  • each attack path in the multiple attack paths must include the network devices in the blocking group, so blocking can be achieved based on all network devices in the blocking group Attack packets on multiple attack paths.
  • the cloud device determines a target blocking group including one or more network devices by obtaining multiple attack paths with the same attack source.
  • the target blocking group is all blocking groups that can block multiple attack paths includes at least Number of blocking groups for network devices.
  • the cloud device blocks attack packets on multiple attack paths by sending a packet blocking policy to the network devices in the target blocking group.
  • the blocking of attack packets is realized by the target blocking group including the least network devices, which can maximize the protection effect at the cost of occupying the least resources, thereby saving as much as possible The overhead of storage resources and processing resources in network devices.
  • the first target blocking group includes a network device
  • the multiple attack paths acquired by the cloud device include the network device in the first target blocking group.
  • the first target blocking group includes multiple network devices, each of the multiple network devices is located on a part of the multiple attack paths, and each of the multiple attack paths above all include at least one network device in the first target blocking group. That is to say, the multiple attack paths do not include the same network device, and the multiple network devices in the first target blocking group work together to block attack packets on all attack paths.
  • the process for the cloud device to determine the first target blocking group according to multiple attack paths specifically includes: the cloud device determines multiple candidate blocking groups according to the multiple attack paths, and according to preset policies among multiple candidate blocking groups
  • the first target blocking group is identified in the group.
  • the plurality of candidate blocking groups are all blocking groups including the least number of network devices among the plurality of blocking groups.
  • the preset strategy includes one or more of the following strategies: a strategy close to an attack source, a strategy close to an attack target, a resource comparison strategy, and a random strategy.
  • the near attack source strategy is used to select the blocking group closest to the attack source among multiple candidate blocking groups
  • the near attack target strategy is used to select the blocking group closest to the attack target among the multiple candidate blocking groups
  • the resource comparison strategy is used to select a blocking group with the most blocking resources among multiple candidate blocking groups.
  • the blocking resource is free storage space used to store packet blocking policies in the network device.
  • the cloud device when there are multiple candidate blocking groups that meet the requirements, the cloud device further selects the final target candidate blocking group from among the multiple candidate blocking groups based on the preset strategy, thereby saving the storage capacity of the network device. In the case of resources, other demands of the network shall be met as much as possible.
  • the cloud device after the cloud device sends a packet blocking policy to the network devices in the first target blocking group, the cloud device obtains the newly added attack path, and determines the second target according to the newly added attack path and multiple attack paths block group, and send a packet blocking policy to the first target network device, where the first target network device is included in the second target block group but not included in the first target block group.
  • the newly added attack path has the same attack source as the multiple attack paths previously acquired by the cloud device.
  • the second target blocking group is a blocking group including the minimum number of network devices among multiple new blocking groups, and each blocking group in the multiple new blocking groups is used to block newly added attack paths and attack packets on multiple attack paths. That is to say, the second target blocking group is a blocking group re-determined by the cloud device based on multiple old attack paths and newly added attack paths.
  • the network devices in the second target blocking group can simultaneously block the old Multiple attack paths and attack packets on newly added attack paths.
  • the cloud device determines a new blocking group for the new attack path and the old attack path in real time, and can make adaptive adjustments to the network device that blocks the attack message according to the change of the attack event during the network operation. , to ensure the protection effect of the network.
  • the cloud device sends the second target network device the an instruction.
  • the first instruction is used to instruct the second target network device to delete the packet blocking policy.
  • the second target network device is included in the first target blocking group and not included in the second target blocking group.
  • the cloud device instructs the second target network device to delete the packet blocking policy to save the second target network device storage resources.
  • the cloud device in response to the obtained multiple attack paths corresponding to the attack state being attacking, sends an access control list (access control lists, ACL) to the network device in the first target blocking group, and the ACL uses to block packets from attack sources.
  • ACL access control lists
  • the network devices in the first target blocking group can intercept the packets from the attack source, thereby restricting the access of the attack source to the terminal devices in the internal network and ensuring that the terminal devices in the internal network Protected from attack sources.
  • the cloud device in response to the acquired attack status corresponding to the multiple attack paths being successful attack, sends a black hole route to the network device in the first target blocking group, the black hole route is used to block the destination address as attack source message.
  • the attack source successfully attacks the terminal device of the internal network, by sending a black hole route to the network device in the first target blocking group, the message sent from the internal network to the attack source can be effectively intercepted, thereby avoiding Leakage of private information such as keys and user passwords caused by attacks.
  • the process for the cloud device to acquire multiple attack paths specifically includes: the cloud device acquires multiple threat events, and the multiple threat events include the same attack source address. Then, the cloud device determines multiple attack paths according to the source address and destination address of each threat event in the multiple threat events.
  • the multiple threat events are determined by the cloud device from multiple alarm events according to preset rules, and the multiple alarm events are, for example, events indicated in alarm logs reported by the firewall.
  • the second aspect of the present application provides an attack blocking device.
  • the device includes an acquisition module, a processing module and a sending module.
  • the acquisition module is used to acquire multiple attack paths.
  • the multiple attack paths are the forwarding paths of the attack packets, and the multiple attack paths have the same attack source.
  • the processing module is used to determine the first target blocking group according to multiple attack paths.
  • the first target blocking group is a blocking group including a minimum number of network devices among the plurality of blocking groups.
  • Each of the multiple blocking groups includes at least one network device, and the network devices in each blocking group are used to block attack packets on multiple attack paths.
  • a sending module configured to send a packet blocking strategy to network devices in the first target blocking group, where the packet blocking strategy is used to block attack packets related to the attack source.
  • the first target blocking group includes a network device, and multiple attack paths include network devices in the first target blocking group.
  • the first target blocking group includes multiple network devices, each of the multiple network devices is located on a part of the multiple attack paths, and each of the multiple attack paths Each includes at least one network device in the first target blocking group.
  • the processing module is specifically configured to: determine multiple candidate blocking groups according to multiple attack paths, and determine a first target blocking group among the multiple candidate blocking groups according to a preset strategy.
  • the plurality of candidate blocking groups are all blocking groups including the minimum number of network devices among the plurality of blocking groups.
  • the preset strategy includes one or more of the following strategies: a strategy close to an attack source, a strategy close to an attack target, a resource comparison strategy, and a random strategy.
  • the near attack source strategy is used to select the blocking group closest to the attack source among multiple candidate blocking groups
  • the near attack target strategy is used to select the blocking group closest to the attack target among the multiple candidate blocking groups
  • the resource comparison strategy is used to select a blocking group with the most blocking resources among multiple candidate blocking groups, and the blocking resource is an idle storage space in the network device for storing the message blocking strategy.
  • the obtaining module is also used to obtain a newly added attack path, and the newly added attack path has the same attack source as the multiple attack paths.
  • the processing module is further configured to determine a second target blocking group according to the newly added attack path and multiple attack paths.
  • the second target blocking group is a blocking group including a minimum number of network devices among the multiple new blocking groups, and each blocking group in the multiple new blocking groups is used to block newly added attack paths and Attack packets on multiple attack paths.
  • the sending module is further configured to send the packet blocking policy to the first target network device, where the first target network device is included in the second target blocking group and not included in the first target blocking group.
  • the sending module is further configured to send the first instruction to the second target network device.
  • the first instruction is used to instruct the second target network device to delete the packet blocking policy.
  • the second target network device is included in the first target blocking group and is not included in the second target blocking group.
  • the sending module is specifically configured to send the ACL to the network devices in the first target blocking group in response to the attack status corresponding to the multiple attack paths being attacking.
  • ACLs are used to block packets from attack sources.
  • the sending module is specifically configured to send the blackhole route to the network devices in the first target blocking group in response to the attack status corresponding to the multiple attack paths being the attack success.
  • Blackhole routing is used to block packets whose destination addresses are attack sources.
  • a third aspect of the present application provides a network device, including a processor and a memory.
  • the memory is used to store program codes
  • the processor is used to call the program codes in the memory so that the network device executes the method according to any implementation manner of the first aspect.
  • a fourth aspect of the present application provides a computer-readable storage medium storing instructions, and when the instructions are run on a computer, the computer is made to execute the method according to any one of the implementation manners of the first aspect.
  • the fifth aspect of the present application provides a computer program product, which, when run on a computer, causes the computer to execute the method according to any one of the implementation manners of the first aspect.
  • a sixth aspect of the present application provides a chip, including one or more processors. Part or all of the processor is used to read and execute computer instructions stored in the memory, so as to execute the method in any possible implementation manner of any aspect above.
  • the chip further includes a memory.
  • the chip further includes a communication interface, and the processor is connected to the communication interface.
  • the communication interface is used to receive data and/or information to be processed, and the processor obtains the data and/or information from the communication interface, processes the data and/or information, and outputs the processing result through the communication interface.
  • the communication interface is an input-output interface or a bus interface.
  • the method provided in this application is implemented by one chip, or is implemented cooperatively by multiple chips.
  • FIG. 1 is a schematic diagram of a network deployment scenario provided by an embodiment of the present application
  • FIG. 2 is a schematic flow diagram of an attack blocking method provided in an embodiment of the present application.
  • FIG. 3 is a schematic diagram of an attack source attacking a terminal device provided in an embodiment of the present application.
  • FIG. 4 is a schematic diagram of another attack source attacking a terminal device according to an embodiment of the present application.
  • FIG. 5 is a schematic diagram of another attack source attacking a terminal device according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of multiple candidate blocking groups in an internal network provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a comparison before and after a newly added attack path provided by the embodiment of the present application.
  • FIG. 8 is a schematic flowchart of a method for applying attack blocking in a network provided by an embodiment of the present application.
  • FIG. 9 is a schematic flowchart of a cloud device executing an attack blocking method provided in an embodiment of the present application.
  • FIG. 10 is a schematic diagram of the direction of the attack path provided by the embodiment of the present application.
  • FIG. 11 is a schematic diagram of a search attack path provided by an embodiment of the present application.
  • FIG. 12 is a schematic diagram of another search attack path provided by the embodiment of the present application.
  • FIG. 13 is a schematic structural diagram of an attack blocking device provided in an embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of a network device provided by an embodiment of the present application.
  • the embodiment of the present application provides an attack blocking method, which is used to save the overhead of storage resources and processing resources in a network device.
  • the embodiment of the present application also provides a corresponding attack blocking device, a server, a computer-readable storage medium, and the like.
  • FIG. 1 is a schematic diagram of a network deployment scenario provided by an embodiment of the present application.
  • the network architecture includes internal network, external network and cloud protection system.
  • the internal network includes a firewall, a plurality of network devices (namely, network device 1 - network device 6 ) for forwarding packets, and a plurality of terminal devices (ie, terminal device 1 - terminal device 4 ).
  • the external network includes attack sources that attack terminal devices on the internal network.
  • the cloud protection system includes one or more cloud devices. For ease of understanding, each device in the network architecture will be introduced in detail below.
  • the terminal device is the direct target of the attack initiated by the attack source, that is, the terminal device is the destination device of the attack packet sent by the attack source.
  • the terminal device includes physical devices such as a server, a personal computer, a notebook computer, a smart phone, a tablet computer, and an Internet of Things device.
  • the terminal device includes a virtualization device deployed on a physical device, for example, the terminal device includes a virtual machine (virtual machine, VM) deployed on a server and used to provide business services.
  • VM virtual machine
  • a firewall is a network security device deployed between the internal network and the external network to detect attack behavior and take corresponding defense measures against the attack behavior. For example, during network operation, the firewall can perform tasks such as virus detection, intrusion detection, uniform resource locator (uniform resource locator, URL) filtering, domain name system (domain name system, DNS) filtering, and email filtering. In some cases, the firewall generates an alarm log according to the attack behavior initiated by the external network, and reports the alarm log to the cloud protection system.
  • uniform resource locator uniform resource locator
  • URL uniform resource locator
  • domain name system domain name system
  • the network device deployed between the firewall and the terminal device is a packet forwarding device, which is used to forward the traffic between the external network and the terminal device in the internal network and the traffic between different terminal devices in the internal network.
  • the network devices include packet forwarding devices such as switches, gateways, and routers.
  • the network device is implemented as a virtualized device deployed on a hardware device.
  • network devices include VMs running programs for sending packets, virtual routers or virtual switches.
  • the cloud device in the cloud protection system is the execution body of the attack blocking method provided by the embodiment of the present application.
  • the cloud device is used to determine the network devices used to block attack packets in the internal network according to the alarm logs reported by the firewall, and send packet blocking policies to these network devices used to block attack packets, so as to Block packets related to attack sources.
  • the cloud device includes a server or a VM deployed on the server.
  • the server can be deployed in public cloud, private cloud or hybrid cloud.
  • the execution subject of the attack blocking method provided in the embodiment of the present application may also be other devices, for example, a controller or a network management device.
  • the execution subject of the method is a cloud device as an example for illustration.
  • the attack sources in the external network send attack packets to the terminal devices in the internal network.
  • the attack message from the attack source can reach the terminal device only after being forwarded by a firewall and a network device between the firewall and the terminal device.
  • the firewall recognizes the attack behavior initiated by the attack source through the attack message
  • the firewall reports an alarm log to the cloud protection system to notify the cloud protection system of the attack behavior initiated by the attack source.
  • the cloud protection system obtains multiple attack paths related to the same attack source based on the alarm log, and determines the target blocking group based on the multiple attack paths, and the target blocking group is all blocking paths that can block multiple attack paths.
  • the blocking group includes the least number of network devices in the blocking group.
  • the cloud protection system sends a packet blocking policy to the network devices in the target blocking group, so that the network devices in the target blocking group can block the attack packets related to the attack source by executing the packet blocking policy.
  • FIG. 2 is a schematic flowchart of an attack blocking method provided in an embodiment of the present application. As shown in Figure 2, the attack blocking method includes the following steps 201-203.
  • Step 201 obtaining multiple attack paths, the multiple attack paths are forwarding paths of attack packets, and the multiple attack paths have the same attack source.
  • the cloud device when the attack source launches an attack on the terminal device in the internal network by sending an attack message, the cloud device obtains multiple attack paths aimed at the terminal device by the attack source. Since the attack packet sent by the attack source to the terminal device is forwarded to the terminal device through the network device between the attack source and the terminal device, the multiple attack paths are actually composed of the attack source, the terminal device, and the attack source and the terminal device. The forwarding path of the attack packets formed by the network devices between them.
  • different attack paths include different network devices or different terminal devices, but the multiple attack paths have the same attack source. That is to say, the starting points of the multiple attack paths obtained by the cloud device are the same, and the network devices or end points on different attack paths are different.
  • Step 202 Determine a first target blocking group according to multiple attack paths, where the first target blocking group is a blocking group including a minimum number of network devices among the multiple blocking groups.
  • each of the multiple blocking groups includes at least one network device, and the network devices in each blocking group are used to block attack packets on multiple attack paths. That is to say, for any one of the multiple blocking groups, each of the multiple attack paths must include the network devices in the blocking group. In this way, since each attack path includes network devices in the blocking group, attack packets on multiple attack paths can be blocked based on all network devices in the blocking group.
  • different blocking groups include different network devices, and the numbers of network devices included in different blocking groups may also be different.
  • the first target blocking group is a blocking group among the multiple blocking groups, and the first target blocking group is a blocking group including the least number of network devices among the multiple blocking groups.
  • the cloud device determines multiple blocking groups capable of blocking attack packets on the multiple attack paths. Then, the cloud device determines the first target blocking group including the least number of network devices according to the number of network devices included in each blocking group among the plurality of blocking groups.
  • the network devices in the blocking group include, for example, packet forwarding devices such as switches, gateways, and routers. Since the firewall is actually also responsible for packet forwarding, in some scenarios, the network devices in the blocking group also include the firewall. For example, if the blocking resources of the firewall are sufficient, the network devices in the blocking group include firewalls, switches, gateways, and routers between the attack source and the terminal device; if the blocking resources of the firewall are insufficient , the network devices in the blocking group include switches, gateways and routers between the firewall and the terminal devices. Wherein, the blocking resources of the firewall refer to free storage space in the firewall for storing packet blocking policies.
  • Step 203 sending a packet blocking policy to the network devices in the first target blocking group, where the packet blocking policy is used to block attack packets related to the attack source.
  • the cloud device After the cloud device determines the first target blocking group, the cloud device sends a packet blocking policy to each network device in the first target blocking group, so that each network device in the first target blocking group can The sent packet blocking policy blocks attack packets related to the attack source.
  • the cloud device when the cloud device is directly connected to the network device in the first target blocking group, the cloud device directly sends the packet blocking policy to the network device in the first target blocking group; If the network devices in the first target blocking group do not have a direct connection, the cloud device sends a packet blocking policy to other devices in the internal network to block the first target through other devices in the internal network. Packet forwarding blocking policy for network devices in the group.
  • the cloud device determines a target blocking group including one or more network devices by obtaining multiple attack paths with the same attack source.
  • the target blocking group is all blocking groups that can block multiple attack paths Include the blocking group with the fewest number of network devices.
  • the cloud device blocks attack packets on multiple attack paths by sending a packet blocking policy to the network devices in the target blocking group.
  • the most Blocking attack packets by using fewer target blocking groups of network devices can maximize the protection effect at the cost of occupying the least resources, thereby saving storage and processing resources in network devices as much as possible.
  • the packet blocking strategies sent by the cloud device are different.
  • Attack scenario 1 The attack status corresponding to multiple attack paths is attacking, that is, the attack source has not yet successfully attacked the terminal device of the internal network.
  • the cloud device When the attack source is attacking the terminal device of the internal network through multiple attack paths, in response to the attack status corresponding to the multiple attack paths being attacking, the cloud device sends an access control list to the network devices in the first target blocking group (access control lists, ACL).
  • ACL is used to block packets from attack sources. To put it simply, ACL is similar to a blacklist.
  • IP Internet Protocol
  • the network devices in the first target blocking group can intercept the packets from the attack source, thereby restricting the access of the attack source to the terminal devices in the internal network and ensuring that the terminal devices in the internal network Protected from attack sources.
  • Attack Scenario 2 The attack status corresponding to multiple attack paths is attack success, that is, the attack source has successfully invaded the terminal device of the internal network.
  • the attack source may instruct the terminal device on the internal network to feed back private information such as keys and user passwords through attack packets. Therefore, in order to avoid the leakage of private information, in response to the attack status corresponding to the multiple attack paths being the attack success, the cloud device sends a black hole route to the network devices in the first target blocking group. Among them, the black hole route is used to block the packets whose destination address is the attack source.
  • the blackhole route is a static route
  • the outbound interface of the blackhole route is NULL0. If the outbound interface of a network segment in a static route is specified as NULL0, all data packets destined for the network segment in the static route will be directly discarded without forwarding. Therefore, by configuring the network segment in the black hole route as the IP address of the attack source, the network devices in the first target blocking group can discard packets destined for the attack source based on the black hole route.
  • the attack source successfully attacks the terminal device of the internal network, by sending a black hole route to the network device in the first target blocking group, the message sent from the internal network to the attack source can be effectively intercepted, thereby avoiding Leakage of private information such as keys and user passwords.
  • the cloud device can determine the first target blocking group according to multiple attack paths of the new attack source, and send an ACL to the network devices in the first target blocking group, the ACL includes the IP address of the new attack source to indicate that the target
  • the network devices in the blocking group discard the attack packets from the new attack source, thereby restricting the attacks launched by the new attack source.
  • the network topology in the internal network may be different The same, and the attack path of the attack source targeting the internal network may also be different. Therefore, in different scenarios, the first target blocking group determined by the cloud device is often different.
  • Scenario 1 The same network device exists on all attack paths, that is, the multiple attack paths obtained by the cloud device include the same network device.
  • FIG. 3 is a schematic diagram of an attack source attacking a terminal device according to an embodiment of the present application.
  • the attack source, the firewall, and the switch 1 are connected in sequence, and the switch 1 is connected to the switch 2 and the switch 3 respectively.
  • the switch 2 is connected to the terminal device 1 and the terminal device 2 respectively, and the switch 3 is connected to the terminal device 3 and the terminal device 4 respectively.
  • the attack path of the attack source against the terminal device includes attack path 1 and attack path 2.
  • the attack path 1 is specifically: attack source ⁇ firewall ⁇ switch 1 ⁇ switch 2 ⁇ terminal device 1.
  • Attack path 2 is specifically: attack source ⁇ firewall ⁇ switch 1 ⁇ switch 3 ⁇ terminal device 4 .
  • firewall and switch 1 are located on attack path 1 and attack path 2
  • switch 2 and switch 3 are located on attack path 1 and attack path 2 respectively.
  • the first blocking group includes switch 1;
  • the second blocking group includes switches 2 and 3. Since the number of network devices included in the first blocking group is the smallest, the cloud device determines that the first blocking group is the first target blocking group, that is, the first target blocking group includes the switch 1 .
  • Scenario 2 The same network device does not exist on all attack paths.
  • each of the multiple network devices in the first target blocking group is located on a part of the multiple attack paths, and each of the multiple attack paths includes the first target blocking At least one network device in the group.
  • FIG. 4 is a schematic diagram of another attack source attacking a terminal device according to an embodiment of the present application.
  • each attack path includes a network device in the first target blocking group (hereinafter referred to as blocking equipment).
  • the attack path of the attack source against the terminal device includes attack path 1 and attack path 2 .
  • the attack path 1 is specifically: attack source ⁇ firewall ⁇ switch 1 ⁇ switch 3 ⁇ terminal device 1.
  • Attack path 2 is specifically: attack source ⁇ firewall ⁇ switch 2 ⁇ switch 6 ⁇ terminal device 4 .
  • the first blocking group includes switch 1 and switch 2; the second blocking group includes switch 3 and switch 6.
  • the cloud device selects the first blocking group as the first target blocking group, that is, the first target blocking group includes switch 1 and switch 2 .
  • switch 1 and switch 2 work together to block attack packets on attack path 1 and attack path 2 .
  • attack path 1 only includes switch 1 in the first target blocking group
  • attack path 2 includes only switch 2 in the first target blocking group, that is, each attack path includes a first target blocking Network devices in the group.
  • FIG. 5 is a schematic diagram of another attack source attacking a terminal device according to an embodiment of the present application.
  • the same network device does not exist on all attack paths in the internal network, and some attack paths include multiple blocking devices.
  • the attack path of the attack source for the terminal device includes attack path 1, attack path 2, and attack path 3.
  • the attack path 1 is specifically: attack source ⁇ firewall ⁇ switch 1 ⁇ switch 3 ⁇ terminal device 1.
  • Attack path 2 is specifically: attack source ⁇ firewall ⁇ switch 1 ⁇ switch 4 ⁇ terminal device 2.
  • Attack path 3 is specifically: attack source ⁇ firewall ⁇ switch 2 ⁇ switch 4 ⁇ terminal device 2 .
  • the blocking groups in FIG. 5 that can block attack packets include at least three.
  • the first blocking group includes switch 1 and switch 2;
  • the second blocking group includes switch 3 and switch 4;
  • the third blocking group includes switch 1 and switch 4.
  • the cloud device selects the third blocking group as the first target blocking group, that is, the first target blocking group includes switch 1 and switch 4 .
  • switch 1 and switch 4 work together to block attack packets on attack path 1 , attack path 2 , and attack path 3 .
  • attack path 1 only includes switch 1 in the first target blocking group
  • attack path 3 includes only switch 4 in the first target blocking group
  • attack path 2 includes switch 4 in the first target blocking group.
  • multiple blocking groups may simultaneously exist in the internal network and all meet the requirement for the number of network devices, that is, the multiple blocking groups are the blocking groups that include the least number of network devices among all the blocking groups.
  • the cloud device needs to select one of the multiple blocking groups as the first target blocking group.
  • the cloud device determines multiple candidate blocking groups according to the multiple attack paths, wherein the multiple candidate blocking groups are capable of blocking attack packets on multiple attack paths
  • the plurality of blocking groups includes a blocking group with the least number of network devices. For example, assume that there are three blocking groups capable of blocking attack packets on multiple attack paths in the internal network, namely blocking group 1, blocking group 2, and blocking group 3. Wherein, blocking group 1 includes 2 network devices, blocking group 2 includes 2 network devices, and blocking group 3 includes 3 network devices. Then, both the blocking group 1 and the blocking group 2 are blocking groups including the least number of network devices among the three blocking groups, so the cloud device determines the blocking group 1 and the blocking group 2 as candidate blocking groups.
  • the cloud device determines the first target blocking group among the multiple candidate blocking groups according to a preset strategy.
  • the preset policies include one or more of the following policies: a policy close to an attack source, a policy close to an attack target, a resource comparison policy, and a random policy.
  • the near attack source strategy is used to select the blocking group closest to the attack source among multiple candidate blocking groups
  • the near attack target strategy is used to select the blocking group closest to the attack target among the multiple candidate blocking groups
  • the resource comparison strategy is used to select the blocking group with the most blocking resources among multiple candidate blocking groups
  • the blocking resource is free storage space used to store the blocking policy in the network device.
  • the preset policies configured on the cloud device can be adjusted according to different scenarios to meet different requirements.
  • the preset policy configured on the cloud device is the close attack source policy, that is, select the nearest attack source as much as possible.
  • Network devices block attack packets, thereby shortening the flow distance of attack packets in the internal network and saving forwarding resources of network devices.
  • the preset strategy configured on the cloud device is the resource comparison strategy, that is, select the network device with more blocking resources as much as possible to block attack reports. file, so as to avoid frequent occurrence of insufficient blocking resources on network devices.
  • FIG. 6 is a schematic diagram of multiple candidate blocking groups in an internal network provided by an embodiment of the present application.
  • the attack path of the attack source against the terminal device includes attack path 1 and attack path 2 .
  • the attack path 1 is specifically: attack source ⁇ firewall ⁇ switch 1 ⁇ switch 3 ⁇ terminal device 1.
  • the attack path 2 is specifically: attack source ⁇ firewall ⁇ switch 2 ⁇ switch 4 ⁇ terminal device 4 .
  • the first blocking group includes switch 1 and switch 2; the second blocking group includes switch 3 and switch 4.
  • both the first blocking group and the second blocking group include two network devices, so both the first blocking group and the second blocking group are candidate blocking groups.
  • the cloud device selects the second blocking group from the two candidate blocking groups as the first target blocking group according to a random strategy, that is, the first target blocking group includes switches 3 and 4 .
  • the attack source since the attack source attacks the terminal devices of the internal network is a dynamic process, the attack source may continuously launch attacks against new attack targets, so the attack path corresponding to the same attack source may also continuously change. Increase.
  • the cloud device has sent a packet blocking policy for the old attack path, if the cloud device obtains a new attack path, the cloud device will re-determine the target blocking group based on the old attack path and the new attack path, so as to Ensure that the newly determined target blocking group can block the attack packets on the old attack path and the new attack path.
  • the cloud device after the cloud device executes step 203 to send a packet blocking policy to the network devices in the first target blocking group, the cloud device obtains a newly added attack path.
  • the newly added attack path has the same attack source as the multiple attack paths acquired by the cloud device in step 201 above.
  • the newly added attack path is not the same as the multiple attack paths obtained by the cloud device in step 201 above.
  • the cloud device determines the second target blocking group according to the newly added attack path and the multiple attack paths acquired in step 201 .
  • the second target blocking group is a blocking group including the minimum number of network devices among the multiple new blocking groups, and each blocking group in the multiple new blocking groups is used to block newly added attacks Paths and attack packets on multiple attack paths acquired in step 201. That is to say, the second target blocking group is a blocking group re-determined by the cloud device based on multiple old attack paths and newly added attack paths. The network devices in the second target blocking group can simultaneously block the old Multiple attack paths and attack packets on newly added attack paths.
  • the cloud device sends the packet blocking policy to the first target network device, and the first target network device is included in the second target blocking group and not included in the first target blocking group. Since the first target blocks network devices in the group and the second The network devices in the target blocking group are all used to block the packets related to the same attack source, so for the network devices included in both the first target blocking group and the second target blocking group, the cloud The device has already sent the packet blocking policy once, so it does not need to send the packet blocking policy again.
  • the cloud device determines a new blocking group for the new attack path and the old attack path in real time, and can make adaptive adjustments to the network device that blocks the attack message according to the change of the attack event during the network operation. , to ensure the protection effect of the network.
  • the cloud device sends a first instruction to the second target network device, where the first instruction is used to instruct the second target network device to delete the packet blocking policy, and the second The target network device is included in the first target blocking group and is not included in the second target blocking group.
  • the second target network device is a network device for blocking attack packets determined by the cloud device based on multiple old attack paths. Moreover, after the cloud device obtains the new attack path, the cloud device determines based on the new attack path and the old attack path that the second target network device is no longer used as the network device for blocking attack packets. That is, the second target network device does not need to block packets related to the attack source. Therefore, the cloud device instructs the second target network device to delete the packet blocking policy, so as to save storage resources on the second target network device.
  • FIG. 7 is a schematic diagram of a before and after comparison of a newly added attack path provided by an embodiment of the present application.
  • the attack path of the attack source against the terminal device includes attack path 1 and attack path 2 .
  • the attack path 1 is specifically: attack source ⁇ firewall ⁇ switch 1 ⁇ switch 3 ⁇ terminal device 1.
  • Attack path 2 is specifically: attack source ⁇ firewall ⁇ switch 1 ⁇ switch 3 ⁇ terminal device 2.
  • the cloud device determines to use the switch 3 to block the attack packets on the attack path 1 and the attack path 2, that is, the above-mentioned first target blocking group includes the switch 3 .
  • the attack path 3 is added by the attack source to the terminal device.
  • the attack path 3 is specifically: attack source ⁇ firewall ⁇ switch 2 ⁇ switch 5 ⁇ terminal device 6.
  • the cloud device determines to use switch 1 and switch 2 to block attack packets on attack path 1, attack path 2, and newly added attack path 3, that is, the above
  • the second target blocking group includes Switch1 and Switch2.
  • Switch 1 and Switch 2 are both included in the second target blocking group and not included in the first target blocking group, that is, Switch 1 and Switch 2 are newly determined to block attack messages. Therefore, the cloud device sends a packet blocking policy to Switch 1 and Switch 2 after adding an attack path. And, because the switch 3 is included in the first target blocking group and not included in the second target blocking group, that is, the switch 3 is a network device that no longer needs to block attack packets, so the cloud device sends an instruction to the switch 3 , to instruct switch 3 to delete the packet blocking policy.
  • FIG. 8 is a schematic flowchart of a method for applying attack blocking in a network according to an embodiment of the present application. As shown in Fig. 8, the process of applying the attack blocking method in the network includes the following steps 801-805.
  • Step 801 the attack source of the external network sends an attack message to the firewall.
  • the source address of the attack message sent by the attack source is the IP address of the attack source
  • the destination address of the attack message is the IP address of the terminal device in the internal network.
  • the attack packet sent by the attack source needs to be forwarded by the firewall and the switch before reaching the terminal device in the internal network.
  • Step 802 the firewall detects the attack behavior initiated by the attack source based on the attack message sent by the attack source, and uploads an alarm log to the cloud device.
  • the firewall can detect the attack behavior initiated by the attack source based on the information of the attack packets. Moreover, the firewall generates an alarm log according to the detected attack behavior and uploads the generated alarm log to the cloud device. Wherein, the alarm log records the attack behavior detected by the firewall.
  • the alarm log uploaded by the firewall includes: alarm identifier, firewall identifier, time when the attack behavior occurred, the area where the attack source is located, the area where the attack target is located, the number or name of the attack behavior, the source IP address corresponding to the attack message, Source port, destination IP address, destination port, transport layer protocol, and the original attack packet that triggers the generation of this alarm log.
  • the content in the alarm log is shown in Table 1.
  • Step 803 the cloud device obtains the attack path based on the alarm log, and determines a switch for blocking the attack message on the attack path.
  • the cloud device After obtaining the alarm log, the cloud device obtains the attack path related to the attack behavior based on the attack behavior information indicated by the alarm log. Then, the cloud device determines a switch for blocking attack packets on the attack path based on the obtained attack path.
  • the manner in which the cloud device determines the switch used to block the attack message on the attack path can refer to the above-mentioned step 202, which will not be repeated here.
  • Step 804 the cloud device sends a packet blocking policy to the switch for blocking the attack packets on the attack path.
  • step 804 is similar to the above-mentioned step 203, please refer to the above-mentioned step 203 for details, and details are not repeated here.
  • Step 805 the switch blocks the attack packets according to the packet blocking strategy.
  • the switch After obtaining the packet blocking policy sent by the cloud device, the switch implements the packet blocking policy in the process of forwarding packets to block the attack packets related to the attack source.
  • FIG. 9 is a schematic flowchart of an attack blocking method performed by a cloud device according to an embodiment of the present application.
  • the process for the cloud device to execute the attack blocking method includes the following steps 901-907.
  • cloud devices can provide protection services and network digital map services.
  • the protection service and the network digital map service may be provided by the same cloud device, or provided by different cloud devices.
  • Step 901 the firewall uploads the alarm log to the cloud device.
  • step 901 is similar to the above-mentioned step 802, please refer to the above-mentioned step 802 for details, and details are not repeated here.
  • Step 902 the threat determination module in the cloud device for providing the protection service determines the threat event based on the alarm log.
  • the firewall may have false positives, that is, the firewall recognizes the normal packet sending behavior as an attack behavior, so the threat determination module is used to determine whether the alarm event indicated in the alarm log uploaded by the firewall is a threat event.
  • the threat judging module determines that the alarm event reported by the firewall is a threat event, the cloud device performs subsequent anti-attack processing on the threat event.
  • the threat judging module determines whether the alarm event indicated in the alarm log is a threat event.
  • Method 1 Identify whether an alarm event is a threat event based on a preset rule.
  • the threat judgment module can analyze the alarm events indicated in the alarm log based on the preset rules, and mark the alarm events matching the rules as threat events.
  • the preset rules are generally related to the number or name of the attack behavior, that is, the threat determination module determines whether the alarm event is a threat event according to the number or name of the attack behavior indicated in the alarm log. For example, assuming that the name of the attack behavior indicated in the alarm log is Medusa http form password brute force cracking, then confirm that the alarm event indicated in the alarm log is a threat event, and Medusa is an attack tool. For another example, assuming that the name of the attack behavior indicated in the alarm log is password parameter buffer overflow vulnerability, it is confirmed that the alarm event indicated in the alarm log is a threat event. For another example, assuming that the name of the attack behavior indicated in the alarm log is a hypertext preprocessor (Hypertext Preprocessor, PHP) file upload global variable rewriting vulnerability, then confirm that the alarm event indicated in the alarm log is a threat event.
  • Hypertext Preprocessor PHP
  • Method 2 Identify whether an alarm event is a threat event based on machine learning.
  • the second method is to identify whether an alarm event is a threat event through a pre-trained machine learning model.
  • the cloud device inputs the features associated with the alarm log into the machine learning model to determine the threat of the alarm log.
  • Method 3 Identify whether an alarm event is a threat event based on manual handling.
  • the alarm log cannot be identified based on the above method 1 and method 2, it is manually handled to identify whether the alarm event in the alarm log is a threat event. That is, network experts comprehensively determine whether an alarm event in the alarm log is a threat event based on experience and in combination with other security information in the network.
  • the cloud device may also identify the threat event based on other methods, which will not Be specific.
  • Step 903 the threat determination module sends the source address and destination address of the threat event to the path search module in the cloud device for providing the network digital map service, and requests the attack path corresponding to the threat event.
  • Step 904 the path search module searches for an attack path based on the source address and destination address of the threat event.
  • the cloud device for providing the network digital map service constructs the network digital map in advance according to the network device configuration and link status in the internal network, so as to provide the network topology visualization service.
  • the network digital map indicates the topology of the entire internal network, that is, the network digital map indicates the connection relationship between various network devices in the internal network.
  • the path search module can search the attack path in the network digital map based on the source address and destination address of the threat event.
  • the cloud device first constructs the topology of network devices such as switches and firewalls according to the neighbor information of the Link Layer Discovery Protocol (LLDP). Then, the cloud device constructs a topology between terminal devices and network devices such as switches based on Address Resolution Protocol (ARP) information, thereby obtaining a complete topology of the internal network. Finally, based on the complete topology of the internal network, the cloud device searches for the attack path under the specific source address and destination address according to the routing table entries.
  • LLDP Link Layer Discovery Protocol
  • ARP Address Resolution Protocol
  • Step 905 the path search module returns attack path information to the cloud device for providing protection services.
  • the information of the attack path includes the information of the network device on the attack path and/or the port information of the packet forwarded by the network device on the attack path.
  • the attack path information is as follows.
  • the above attack path information indicates that the attack path is specifically: port 3 on switch 2 ⁇ port 2 on switch 1 ⁇ port 1 on switch 3 .
  • Step 906 the blocking device selection module in the cloud device for providing the protection service determines the switch device for blocking the attack message based on the attack path.
  • Step 907 the cloud device for providing the protection service sends a blocking policy to the switch device for blocking attack packets.
  • step 906 is similar to the above-mentioned step 202
  • step 907 is similar to the above-mentioned step 203.
  • Attack direction 1 Attack from the external network to the internal network.
  • the attack source located in the external network sends attack packets to the terminal devices in the internal network to realize The external network attacks the internal network.
  • FIG. 10 is a schematic diagram of the direction of the attack path provided by the embodiment of the present application.
  • the attack source of the external network attacks the terminal device 1 of the internal network through the attack path 1 .
  • Attack path 1 is specifically: attack source ⁇ port 1 on the firewall ⁇ port 2 on switch 1 ⁇ port 3 on switch 2 ⁇ terminal device 1. Therefore, the information of the attack path searched by the path search module in the cloud device is as follows.
  • Attack direction 2 Attack from the internal network to the internal network.
  • the terminal device in the internal network may send attack packets to other terminal devices in the internal network under the control of the attack source, so as to realize the transmission from the internal network to the internal network attack.
  • Attack path 2 is specifically: port 4 on terminal device 1 ⁇ port 5 on switch 2 ⁇ port 6 on switch 1 ⁇ port 7 on switch 3 ⁇ terminal device 3 . Therefore, the information of the attack path searched by the path search module in the cloud device is as follows.
  • Case 1 There is no load balancing between the network devices between the attack source and the attack target.
  • the network device When there is no load sharing between the network device between the attack source and the attack target, the network device will have a uniquely determined outgoing interface when forwarding packets, so the cloud device can usually search for a unique interface based on a pair of source and destination addresses. an attack path.
  • FIG. 11 is a schematic diagram of a search attack path provided by an embodiment of the present application.
  • the attack path obtained by searching the cloud device is attack path 1, that is, attack source ⁇ firewall ⁇ switch 1 ⁇ switch 2 ⁇ terminal device 1.
  • the attack path obtained by searching the cloud device is the attack path 2, that is, the attack source ⁇ firewall ⁇ switch 1 ⁇ switch 3 ⁇ terminal device 4. That is to say, in the internal network shown in FIG. 11 where there is no load sharing between network devices, the cloud device can only search for a unique corresponding attack path based on a pair of source address and destination address.
  • Case 2 There is load sharing between the network devices between the attack source and the attack target.
  • the network device may have multiple outbound interfaces for load balancing when forwarding packets. Simply put, network devices receive source addresses at different times When packets with the same destination address are sent, the network device may forward these packets to different network devices to implement load sharing. Therefore, based on a pair of source address and destination address, cloud devices can usually search for multiple attack paths.
  • FIG. 12 is a schematic diagram of another search attack path provided by the embodiment of the present application.
  • switch 3 and switch 4 in the internal network have load sharing, and switch 5 and switch 6 have load sharing.
  • the attack paths obtained by searching the cloud device include attack paths 3 and 4 .
  • the attack path 3 is specifically: attack source ⁇ firewall ⁇ switch 1 ⁇ switch 3 ⁇ terminal device 1.
  • the attack path 4 is specifically: attack source ⁇ firewall ⁇ switch 1 ⁇ switch 4 ⁇ terminal device 1. That is to say, in the internal network with load sharing between network devices shown in FIG. 12 , the cloud device can search for two corresponding attack paths based on a pair of source address and destination address.
  • FIG. 13 is a schematic structural diagram of an attack blocking device provided in an embodiment of the present application.
  • the attack blocking device includes an acquisition module 1301 , a processing module 1302 and a sending module 1303 .
  • the obtaining module 1301 is used to obtain multiple attack paths.
  • the multiple attack paths are the forwarding paths of the attack packets, and the multiple attack paths have the same attack source.
  • a processing module 1302, configured to determine a first target blocking group according to multiple attack paths.
  • the first target blocking group is a blocking group including a minimum number of network devices among the plurality of blocking groups.
  • Each of the multiple blocking groups includes at least one network device, and the network devices in each blocking group are used to block attack packets on multiple attack paths.
  • a sending module 1303, configured to send a packet blocking policy to network devices in the first target blocking group, where the packet blocking policy is used to block attack packets related to the attack source.
  • the first target blocking group includes a network device, and multiple attack paths include network devices in the first target blocking group.
  • the first target blocking group includes multiple network devices, each of the multiple network devices is located on a part of the multiple attack paths, and each of the multiple attack paths Each includes at least one network device in the first target blocking group.
  • the processing module 1302 is specifically configured to: determine multiple candidate blocking groups according to multiple attack paths, and determine a first target blocking group among the multiple candidate blocking groups according to a preset policy.
  • the plurality of candidate blocking groups are all blocking groups including the minimum number of network devices among the plurality of blocking groups.
  • the preset strategy includes one or more of the following strategies: a strategy close to an attack source, a strategy close to an attack target, a resource comparison strategy, and a random strategy.
  • the near attack source strategy is used to select the blocking group closest to the attack source among multiple candidate blocking groups
  • the near attack target strategy is used to select the blocking group closest to the attack target among the multiple candidate blocking groups
  • the resource comparison strategy is used to select a blocking group with the most blocking resources among multiple candidate blocking groups, and the blocking resource is an idle storage space in the network device for storing the message blocking strategy.
  • the obtaining module 1301 is also used to obtain newly added attack paths.
  • the newly added attack path has the same attack source as multiple attack paths.
  • the processing module 1302 is further configured to determine a second target blocking group according to the newly added attack path and multiple attack paths.
  • the second target blocking group is a blocking group including the minimum number of network devices among the multiple new blocking groups, and each blocking group in the multiple new blocking groups is used to block newly added attack paths and Attack packets on multiple attack paths.
  • the sending module 1303 is further configured to send the packet blocking policy to the first target network device, where the first target network device is included in the second target blocking group and not included in the first target blocking group.
  • the sending module 1303 is further configured to send the first instruction to the second target network device.
  • the first instruction is used to instruct the second target network device to delete the packet blocking policy.
  • the second target network device is included in the first target blocking group and is not included in the second target blocking group.
  • the sending module 1303 is specifically configured to send an ACL to the network device in the first target blocking group in response to the attack status corresponding to the multiple attack paths, and the ACL is used to block the report from the attack source. arts.
  • the sending module 1303 is specifically configured to send a blackhole route to the network device in the first target blocking group in response to the attack status corresponding to the multiple attack paths being an attack success, and the blackhole route is used to block the destination address as an attack source message.
  • FIG. 14 is a schematic structural diagram of a network device 1400 provided by an embodiment of the present application.
  • the network device 1400 is equipped with the above-mentioned attack blocking device.
  • Network device 1400 is implemented by a generic bus architecture.
  • the network device 1400 includes at least one processor 1401 , a communication bus 1402 , a memory 1403 and at least one communication interface 1404 .
  • the processor 1401 is a general-purpose CPU, NP, microprocessor, or one or more integrated circuits used to implement the solution of the present application, for example, an application-specific integrated circuit (application-specific integrated circuit, ASIC), which can be Programmable logic device (programmable logic device, PLD) or its combination.
  • ASIC application-specific integrated circuit
  • PLD Programmable logic device
  • the aforementioned PLD is a complex programmable logic device (complex programmable logic device, CPLD), a field-programmable gate array (field-programmable gate array, FPGA), a general array logic (generic array logic, GAL) or any combination thereof.
  • Communication bus 1402 is used to transfer information between the above-described components.
  • the communication bus 1402 is divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.
  • the memory 1403 is a read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions.
  • the memory 1403 is random access memory (random access memory, RAM) or other types of dynamic storage devices that can store information and instructions.
  • the memory 1403 is an electrically erasable programmable read-only memory (electrically erasable programmable read-only memory, EEPROM), a read-only optical disc (compact disc read-only memory, CD-ROM) or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or are capable of carrying or storing desired program code in the form of instructions or data structures and can be programmed by a computer Any other medium accessed, but not limited to.
  • the memory 1403 exists independently and is connected to the processor 1401 through the communication bus 1402 .
  • the memory 1403 and the processor 1401 are integrated together.
  • the Communication interface 1404 uses any transceiver-like device for communicating with other devices or a communication network.
  • the communication interface 1404 includes a wired communication interface.
  • the communication interface 1404 also includes a wireless communication interface.
  • the wired communication interface is, for example, an Ethernet interface.
  • the Ethernet interface is an optical interface, an electrical interface or a combination thereof.
  • the wireless communication interface is a wireless local area network (wireless local area networks, WLAN) interface, a cellular network communication interface or a combination thereof.
  • the processor 1401 includes one or more CPUs, as shown in FIG. 14 CPU0 and CPU1.
  • the network device 1400 includes multiple processors, such as the processor 1401 and the processor 1405 shown in FIG. 14 .
  • processors are a single-core processor (single-CPU), or a multi-core processor (multi-CPU).
  • a processor herein refers to one or more devices, circuits, and/or processing cores for processing data such as computer program instructions.
  • the memory 1403 is used to store program code 1414 for implementing the solution of the present application, and the processor 1401 executes the program code 1414 stored in the memory 1403 . That is to say, the network device 1400 implements the foregoing method embodiments through the processor 1401 and the program code 1414 in the memory 1403 .
  • a reference to B means that A is the same as B or A is a simple variation of B.
  • first and second in the description and claims of the embodiments of the present application are used to distinguish different objects, not to describe a specific order of objects, nor can they be interpreted as indicating or implying relative importance sex.
  • first speed-limiting channel and the second speed-limiting channel are used to distinguish different speed-limiting channels, but not to describe the specific order of the speed-limiting channels, nor can it be understood that the first speed-limiting channel is faster than the second speed-limiting channel. important.
  • the above-mentioned embodiments may be fully or partially implemented by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, all or part of the processes or functions described in accordance with the embodiments of the present application will be generated.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server or data center via wired (such as coaxial cable, optical fiber, Digital Subscriber Line (DSL)) or wireless (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium (such as a floppy disk, a hard disk, or a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk (Solid State Disk, SSD)), etc.
  • a magnetic medium such as a floppy disk, a hard disk, or a magnetic tape
  • an optical medium such as a DVD
  • a semiconductor medium such as a solid state disk (Solid State Disk, SSD)

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种攻击阻断方法，应用于云端防护系统中的云端设备。云端设备通过获取多条具有相同攻击源的攻击路径，确定包括一个或多个网络设备的目标阻断组，该目标阻断组是所有能够阻断多条攻击路径的阻断组中包括最少数量网络设备的阻断组。并且，云端设备通过向目标阻断组中的网络设备发送报文阻断策略，实现阻断多条攻击路径上的攻击报文。在保证阻断多条攻击路径的情况下，由包括最少网络设备的目标阻断组来实现攻击报文的阻断，能够以占用最少资源的代价来实现防护效果最大化，从而尽可能地节省网络设备中存储资源和处理资源的开销。

Description

一种攻击阻断方法及相关装置
本申请要求于2022年2月28日提交中国专利局、申请号为202210190619.8、发明名称为“一种攻击阻断方法及相关装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络安全技术领域，尤其涉及一种攻击阻断方法及相关装置。
背景技术
近年来，网络安全问题日益突出，攻击者使用各种手段进行网络攻击，致使网络安全事件层出不穷。为了保证网络的安全性，企业单位一般都会选择在网络出口部署防火墙来阻止外部攻击。防火墙通过对网络报文进行检测，匹配攻击行为特征，并在发现内部网络遭到攻击后直接丢弃报文，从而阻断外部攻击者和内部设备之间的通信，达到保护内部网络的目的。
由于防火墙部署于网络出口处，因此防火墙通常只能阻断内部网络与外部网络之间的网络报文，而无法阻断网络内部被成功入侵的设备向其他设备发起的横向攻击报文。因此，相关技术中在内部网络中靠近终端设备的交换机上发送访问黑名单，以阻断外部网络和内部网络的攻击源向终端设备发送的攻击报文。
然而，由于内部网络中通常包括多个靠近终端设备的交换机，相关技术中需要在靠近终端设备的各个交换机上部署相同的访问黑名单来阻断攻击报文，从而导致交换机的存储资源和处理资源开销较大。
发明内容
本申请提供了一种攻击阻断方法，在保证阻断多条攻击路径的情况下，由包括最少网络设备的目标阻断组来实现攻击报文的阻断，能够在实现防护效果最大化的同时，尽可能地节省网络设备中存储资源和处理资源的开销。
本申请第一方面提供一种攻击阻断方法，可以应用于控制设备或云端防护系统中的云端设备。云端设备获取多条攻击路径，根据多条攻击路径确定第一目标阻断组，并向第一目标阻断组中的网络设备发送报文阻断策略，以使得第一目标阻断组中的各个网络设备能够根据所发送的报文阻断策略阻断与攻击源相关的攻击报文。该多条攻击路径为攻击报文的转发路径，且多条攻击路径具有相同的攻击源。即，云端设备所获取到的多条攻击路径的起点是相同的，且不同攻击路径上的网络设备或终点是不相同的。第一目标阻断组为多个阻断组中包括最少数量的网络设备的阻断组。该多个阻断组中的每个阻断组均包括至少一个网络设备，且每个阻断组中的网络设备用于阻断多条攻击路径上的攻击报文。对于多个阻断组中的任意一个阻断组，多条攻击路径中的每条攻击路径必然包括该阻断组中的网络设备，因此基于阻断组中的所有网络设备则能够实现阻断多条攻击路径上的攻击报文。
本方案中，云端设备通过获取多条具有相同攻击源的攻击路径，确定包括一个或多个网络设备的目标阻断组，该目标阻断组是所有能够阻断多条攻击路径的阻断组中包括最少 数量网络设备的阻断组。并且，云端设备通过向目标阻断组中的网络设备发送报文阻断策略，实现阻断多条攻击路径上的攻击报文。在保证阻断多条攻击路径的情况下，由包括最少网络设备的目标阻断组来实现攻击报文的阻断，能够以占用最少资源的代价来实现防护效果最大化，从而尽可能地节省网络设备中存储资源和处理资源的开销。
可选的，第一目标阻断组中包括一个网络设备，云端设备所获取到的多条攻击路径上均包括第一目标阻断组中的网络设备。在这种情况下，网络中存在同一个网络设备位于所有的攻击路径上，因此，基于多条攻击路径上的同一个网络设备即能够实现阻断所有攻击路径上的攻击报文，可以更多地节省网络设备中存储资源和处理资源的开销。
可选的，第一目标阻断组中包括多个网络设备，该多个网络设备中的每个网络设备位于多条攻击路径的部分攻击路径上，且多条攻击路径中的每条攻击路径上均包括第一目标阻断组中的至少一个网络设备。也就是说，多条攻击路径上没有包括同一个网络设备，第一目标阻断组中的多个网络设备共同配合，以实现阻断所有攻击路径上的攻击报文。
可选的，云端设备根据多条攻击路径确定第一目标阻断组的过程，具体包括：云端设备根据多条攻击路径确定多个候选阻断组，并根据预置策略在多个候选阻断组中确定第一目标阻断组。该多个候选阻断组均为多个阻断组中包括最少数量的网络设备的阻断组。
可选的，预置策略包括以下策略中的一种或多种：近攻击源策略、近攻击目标策略、资源对比策略和随机策略。其中，近攻击源策略用于在多个候选阻断组中选择距离攻击源最近的阻断组，近攻击目标策略用于在多个候选阻断组中选择距离攻击目标最近的阻断组，资源对比策略用于在多个候选阻断组中选择拥有最多阻断资源的阻断组。阻断资源为网络设备中用于存储报文阻断策略的空闲存储空间。
本方案中，在出现多个满足要求的候选阻断组的情况下，云端设备基于预置策略在多个候选阻断组进一步选择最终的目标候选阻断组，从而能够在节省网络设备的存储资源的情况下，尽可能满足网络的其他需求。
可选的，在云端设备向第一目标阻断组中的网络设备发送报文阻断策略之后，云端设备获取新增的攻击路径，根据新增的攻击路径和多条攻击路径确定第二目标阻断组，并向第一目标网络设备发送报文阻断策略，该第一目标网络设备包括在第二目标阻断组中且未包括在第一目标阻断组中。
新增的攻击路径与云端设备之前所获取的多条攻击路径具有相同的攻击源。第二目标阻断组为多个新的阻断组中包括最少数量的网络设备的阻断组，该多个新的阻断组中的每个阻断组用于阻断新增的攻击路径和多条攻击路径上的攻击报文。也就是说，第二目标阻断组是云端设备根据旧的多条攻击路径和新增的攻击路径重新确定得到的阻断组，第二目标阻断组中的网络设备能够实现同时阻断旧的多条攻击路径和新增的攻击路径上的攻击报文。
本方案中，云端设备通过实时针对新增的攻击路径和旧的攻击路径确定新的阻断组，能够在网络运行过程中根据攻击事件的变化对阻断攻击报文的网络设备进行适应性调整，保证网络的防护效果。
可选的，在云端设备确定第二目标阻断组之后，云端设备向第二目标网络设备发送第 一指令。第一指令用于指示第二目标网络设备删除报文阻断策略。该第二目标网络设备包括在第一目标阻断组中且未包括在第二目标阻断组中。
本方案中，由于第二目标网络设备不需要再对与攻击源相关的报文进行阻断，因此云端设备向第二目标网络设备指示删除报文阻断策略，以节省第二目标网络设备上的存储资源。
可选的，响应于所获取到的多条攻击路径对应的攻击状态为正在攻击，云端设备向第一目标阻断组中的网络设备发送访问控制列表(access control lists，ACL)，该ACL用于阻断来自于攻击源的报文。
本方案中，基于ACL，第一目标阻断组中的网络设备能够对来自于攻击源的报文进行拦截，从而限制攻击源对内部网络中的终端设备的访问，保证内部网络中的终端设备免受攻击源的攻击。
可选的，响应于所获取到的多条攻击路径对应的攻击状态为攻击成功，云端设备向第一目标阻断组中的网络设备发送黑洞路由，该黑洞路由用于阻断目的地址为攻击源的报文。
本方案中，在攻击源成功攻击内部网络的终端设备的情况下，通过向第一目标阻断组中的网络设备发送黑洞路由，能够有效拦截从内部网络发往攻击源的报文，从而避免攻击造成的密钥、用户密码等隐私信息的泄漏。
可选的，云端设备获取多条攻击路径的过程，具体包括：云端设备获取多个威胁事件，该多个威胁事件包括相同的攻击源地址。然后，云端设备根据多个威胁事件中每个威胁事件的源地址和目的地址，确定多条攻击路径。
可选的，该多个威胁事件是云端设备根据预置规则从多个告警事件中确定的，该多个告警事件例如为防火墙所上报的告警日志中所指示的事件。
本申请第二方面提供一种攻击阻断装置。该装置包括获取模块、处理模块和发送模块。获取模块用于获取多条攻击路径。多条攻击路径为攻击报文的转发路径，多条攻击路径具有相同的攻击源。处理模块用于根据多条攻击路径确定第一目标阻断组。第一目标阻断组为多个阻断组中包括最少数量的网络设备的阻断组。多个阻断组中的每个阻断组均包括至少一个网络设备，且每个阻断组中的网络设备用于阻断多条攻击路径上的攻击报文。发送模块，用于向第一目标阻断组中的网络设备发送报文阻断策略，报文阻断策略用于阻断与攻击源相关的攻击报文。
可选的，第一目标阻断组中包括一个网络设备，多条攻击路径上均包括第一目标阻断组中的网络设备。
可选的，第一目标阻断组中包括多个网络设备，多个网络设备中的每个网络设备位于多条攻击路径的部分攻击路径上，且多条攻击路径中的每条攻击路径上均包括第一目标阻断组中的至少一个网络设备。
可选的，处理模块，具体用于：根据多条攻击路径确定多个候选阻断组，并根据预置策略在多个候选阻断组中确定第一目标阻断组。多个候选阻断组均为多个阻断组中包括最少数量的网络设备的阻断组。
可选的，预置策略包括以下策略中的一种或多种：近攻击源策略、近攻击目标策略、资源对比策略和随机策略。其中，近攻击源策略用于在多个候选阻断组中选择距离攻击源最近的阻断组，近攻击目标策略用于在多个候选阻断组中选择距离攻击目标最近的阻断组，资源对比策略用于在多个候选阻断组中选择拥有最多阻断资源的阻断组，阻断资源为网络设备中用于存储报文阻断策略的空闲存储空间。
可选的，获取模块还用于获取新增的攻击路径，新增的攻击路径与多条攻击路径具有相同的攻击源。处理模块，还用于根据新增的攻击路径和多条攻击路径，确定第二目标阻断组。第二目标阻断组为多个新的阻断组中包括最少数量的网络设备的阻断组，多个新的阻断组中的每个阻断组用于阻断新增的攻击路径和多条攻击路径上的攻击报文。发送模块，还用于向第一目标网络设备发送报文阻断策略，第一目标网络设备包括在第二目标阻断组中且未包括在第一目标阻断组中。
可选的，发送模块还用于向第二目标网络设备发送第一指令。第一指令用于指示第二目标网络设备删除报文阻断策略。第二目标网络设备包括在第一目标阻断组中且未包括在第二目标阻断组中。
可选的，发送模块，具体用于响应于多条攻击路径对应的攻击状态为正在攻击，向第一目标阻断组中的网络设备发送ACL。ACL用于阻断来自于攻击源的报文。
可选的，发送模块，具体用于响应于多条攻击路径对应的攻击状态为攻击成功，向第一目标阻断组中的网络设备发送黑洞路由。黑洞路由用于阻断目的地址为攻击源的报文。
本申请第三方面提供一种网络设备，包括处理器和存储器。存储器用于存储程序代码，处理器用于调用存储器中的程序代码以使得网络设备执行如第一方面的任意一种实施方式的方法。
本申请第四方面提供一种计算机可读存储介质，存储有指令，当指令在计算机上运行时，使得计算机执行如第一方面的任意一种实施方式的方法。
本申请第五方面提供一种计算机程序产品，当其在计算机上运行时，使得计算机执行如第一方面的任意一种实施方式的方法。
本申请第六方面提供一种芯片，包括一个或多个处理器。处理器中的部分或全部用于读取并执行存储器中存储的计算机指令，以执行上述任一方面任意可能的实施方式中的方法。可选地，芯片还包括存储器。可选地，芯片还包括通信接口，处理器与通信接口连接。通信接口用于接收需要处理的数据和/或信息，处理器从通信接口获取数据和/或信息，并对数据和/或信息进行处理，并通过通信接口输出处理结果。可选地，通信接口是输入输出接口或者总线接口。本申请提供的方法由一个芯片实现，或者由多个芯片协同实现。
上述第二方面至第六方面提供的方案，用于实现或配合实现上述第一方面提供的方法，因此能够与第一方面达到相同或相应的有益效果，此处不再进行赘述。
附图说明
图1为本申请实施例提供的一种网络部署场景的示意图；
图2为本申请实施例提供的一种攻击阻断方法的流程示意图；
图3为本申请实施例提供的一种攻击源攻击终端设备的示意图；
图4为本申请实施例提供的另一种攻击源攻击终端设备的示意图；
图5为本申请实施例提供的另一种攻击源攻击终端设备的示意图；
图6为本申请实施例提供的一种内部网络中存在多个候选阻断组的示意图；
图7为本申请实施例提供的一种新增攻击路径的前后对比示意图；
图8为本申请实施例提供的一种在网络中应用攻击阻断方法的流程示意图；
图9为本申请实施例提供的一种云端设备执行攻击阻断方法的流程示意图；
图10为本申请实施例提供的攻击路径的方向示意图；
图11为本申请实施例提供的一种搜索攻击路径的示意图；
图12为本申请实施例提供的另一种搜索攻击路径的示意图；
图13为本申请实施例提供的一种攻击阻断装置的结构示意图；
图14为本申请实施例提供的一种网络设备的结构示意图。
具体实施方式
下面结合附图，对本申请的实施例进行描述，显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。本领域普通技术人员可知，随着技术发展和新场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
在这里专用的词“示例性”意为“用作例子、实施例或说明性”。这里作为“示例性”所说明的任何实施例不必解释为优于或好于其它实施例。
本申请实施例提供了一种攻击阻断方法，用于节省网络设备中存储资源和处理资源的开销。本申请实施例还提供了相应的攻击阻断装置、服务器和计算机可读存储介质等。为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
请参阅图1，图1为本申请实施例提供的一种网络部署场景的示意图。如图1所示，网络架构中包括内部网络、外部网络和云端防护系统。其中，内部网络中包括防火墙、多个用于转发报文的网络设备(即网络设备1-网络设备6)以及多个终端设备(即终端设备1-终端设备4)。外部网络中包括向内部网络中的终端设备发起攻击的攻击源。云端防护系统中包括一个或多个云端设备。为便于理解，以下将详细介绍网络架构中的各个设备。
在内部网络中，终端设备是攻击源所发起的攻击的直接目标，即终端设备是攻击源所发送的攻击报文的目的设备。示例性地，终端设备包括服务器、个人电脑、笔记本电脑、智能手机、平板电脑以及物联网设备等物理设备。可选的，终端设备包括部署于物理设备上的虚拟化设备，例如终端设备包括部署于服务器上且用于提供业务服务的虚拟机(virtual machine，VM)。
防火墙是部署于内部网络与外部网络之间的网络安全设备，用于检测来自于外部网络 的攻击行为并对攻击行为采取相应的防御措施。例如，在网络运行过程中，防火墙能够执行病毒检测、入侵检测、统一资源定位器(uniform resource locator,URL)过滤、域名系统(domain name system，DNS)过滤以及邮件过滤等任务。在一些情况下，防火墙根据外部网络所发起的攻击行为生成告警日志，并向云端防护系统上报告警日志。
部署于防火墙和终端设备之间的网络设备为报文转发设备，用于转发外部网络与内部网络中的终端设备之间的流量以及内部网络中不同终端设备之间的流量。示例性地，网络设备包括交换机、网关以及路由器等报文转发设备。可选的，网络设备的实现为部署在硬件设备上的虚拟化设备。例如，网络设备包括运行有用于发送报文的程序的VM，虚拟路由器或虚拟交换机。
云端防护系统中的云端设备是本申请实施例提供的攻击阻断方法的执行主体。具体地，云端设备用于根据防火墙所上报的告警日志确定内部网络中用于阻断攻击报文的网络设备，并向这些用于阻断攻击报文的网络设备发送报文阻断策略，以实现阻断与攻击源相关的报文。示例性地，云端设备包括服务器或者部署在服务器上的VM。该服务器可以部署于公有云、私有云或混合云中。
可以理解的是，本申请实施例提供的攻击阻断方法的执行主体还可以是其他设备，例如，控制器或网管设备。下文以该方法的执行主体为云端设备为例进行说明。
总的来说，在网络架构的运行过程中，外部网络中的攻击源向内部网络中的终端设备发送攻击报文。其中，来自于攻击源的攻击报文需要经过防火墙以及防火墙与终端设备之间的网络设备转发后才能够到达终端设备。当防火墙识别到攻击源通过攻击报文所发起的攻击行为时，防火墙向云端防护系统上报告警日志，以向云端防护系统通知由攻击源所发起的攻击行为。然后，云端防护系统基于告警日志获取与同一个攻击源相关的多条攻击路径，并基于多条攻击路径确定目标阻断组，且该目标阻断组是所有能够阻断多条攻击路径的阻断组中包括最少数量网络设备的阻断组。最后，云端防护系统向目标阻断组中的网络设备发送报文阻断策略，以使得目标阻断组中的网络设备能够通过执行报文阻断策略来阻断与攻击源的攻击报文。
以上介绍了本申请实施例提供的攻击阻断方法所应用的场景，以下将详细介绍本申请实施例提供的攻击阻断方法的具体实现过程。
请参阅图2，图2为本申请实施例提供的一种攻击阻断方法的流程示意图。如图2所示，攻击阻断方法包括以下的步骤201-203。
步骤201，获取多条攻击路径，该多条攻击路径为攻击报文的转发路径，且多条攻击路径具有相同的攻击源。
本实施例中，在攻击源通过发送攻击报文的方式向内部网络中的终端设备发起攻击时，云端设备获取攻击源针对于终端设备的多条攻击路径。由于攻击源向终端设备所发送的攻击报文是通过攻击源与终端设备之间的网络设备转发给终端设备的，因此多条攻击路径实际上是由攻击源、终端设备以及攻击源与终端设备之间的网络设备所构成的攻击报文的转发路径。
在多条攻击路径中，不同的攻击路径上包括有不同的网络设备或不同的终端设备，但这多条攻击路径具有相同的攻击源。也就是说，云端设备所获取到的多条攻击路径的起点是相同的，且不同攻击路径上的网络设备或终点是不相同的。
步骤202，根据多条攻击路径，确定第一目标阻断组，第一目标阻断组为多个阻断组中包括最少数量的网络设备的阻断组。
其中，多个阻断组中的每个阻断组均包括至少一个网络设备，且每个阻断组中的网络设备用于阻断多条攻击路径上的攻击报文。也就是说，对于多个阻断组中的任意一个阻断组，多条攻击路径中的每条攻击路径必然包括该阻断组中的网络设备。这样一来，由于每条攻击路径上都包括阻断组中的网络设备，因此基于阻断组中的所有网络设备则能够实现阻断多条攻击路径上的攻击报文。
此外，在多个阻断组中，不同的阻断组包括不同的网络设备，且不同的阻断组所包括的网络设备的数量也可能是不相同的。第一目标阻断组为多个阻断组中的一个阻断组，且第一目标阻断是多个阻断组中包括最少数量的网络设备的阻断组。
示例性地，在获取到多条攻击路径后，云端设备确定能够阻断多条攻击路径上的攻击报文的多个阻断组。然后，云端设备根据多个阻断组中每个阻断组所包括的网络设备的数量，确定包括最少数量的网络设备的第一目标阻断组。
可选的，对于多个阻断组中的任意一个阻断组，阻断组中的网络设备例如包括交换机、网关和路由器等报文转发设备。由于防火墙实际上也负责报文的转发，因此在一些场景下，阻断组中的网络设备还包括防火墙。例如，在防火墙的阻断资源充足的情况下，阻断组中的网络设备包括位于攻击源和终端设备之间的防火墙、交换机、网关和路由器等设备；在防火墙的阻断资源不足的情况下，阻断组中的网络设备则包括位于防火墙和终端设备之间的交换机、网关和路由器等设备。其中，防火墙的阻断资源是指防火墙中用于存储报文阻断策略的空闲存储空间。
步骤203，向第一目标阻断组中的网络设备发送报文阻断策略，该报文阻断策略用于阻断与攻击源相关的攻击报文。
在云端设备确定第一目标阻断组之后，云端设备则向第一目标阻断组中的各个网络设备发送报文阻断策略，以使得第一目标阻断组中的各个网络设备能够根据所发送的报文阻断策略阻断与攻击源相关的攻击报文。
可选的，在云端设备与第一目标阻断组中的网络设备具有直接连接的情况下，云端设备直接向第一目标阻断组中的网络设备发送报文阻断策略；在云端设备与第一目标阻断组中的网络设备并不具有直接连接的情况下，云端设备则向内部网络中的其他设备发送报文阻断策略，以通过内部网络中的其他设备向第一目标阻断组中的网络设备转发报文阻断策略。
本方案中，云端设备通过获取多条具有相同攻击源的攻击路径，确定包括一个或多个网络设备的目标阻断组，该目标阻断组是所有能够阻断多条攻击路径的阻断组中包括最少数量网络设备的阻断组。并且，云端设备通过向目标阻断组中的网络设备发送报文阻断策略，实现阻断多条攻击路径上的攻击报文。在保证阻断多条攻击路径的情况下，由包括最 少网络设备的目标阻断组来实现攻击报文的阻断，能够以占用最少资源的代价来实现防护效果最大化，从而尽可能地节省网络设备中存储资源和处理资源的开销。
可选的，在不同的攻击场景下，云端设备所发送的报文阻断策略是不同的。
攻击场景一：多条攻击路径对应的攻击状态为正在攻击，即攻击源仍未成功攻击内部网络的终端设备。
在攻击源正在通过多条攻击路径攻击内部网络的终端设备的情况下，响应于多条攻击路径对应的攻击状态为正在攻击，云端设备向第一目标阻断组中的网络设备发送访问控制列表(access control lists，ACL)。其中，ACL用于阻断来自于攻击源的报文。简单来说，ACL与黑名单类似，通过在ACL中指定攻击源的互联网(Internet Protocol，IP)地址，第一目标阻断组中的网络设备则能够根据ACL对接收到的报文进行过滤，从而丢弃源地址为ACL中所指定的IP地址的报文。
也就是说，基于ACL，第一目标阻断组中的网络设备能够对来自于攻击源的报文进行拦截，从而限制攻击源对内部网络中的终端设备的访问，保证内部网络中的终端设备免受攻击源的攻击。
攻击场景二：多条攻击路径对应的攻击状态为攻击成功，即攻击源已成功入侵内部网络的终端设备。
在攻击源已经通过多条攻击路径成功攻击了内部网络的终端设备的情况下，攻击源可能会通过攻击报文指示内部网络的终端设备反馈密钥、用户密码等隐私信息。因此，为避免隐私信息的泄漏，响应于多条攻击路径对应的攻击状态为攻击成功，云端设备向第一目标阻断组中的网络设备发送黑洞路由。其中，黑洞路由用于阻断目的地址为攻击源的报文。
具体来说，黑洞路由是一条静态路由，且黑洞路由的出接口为NULL0。如果一条静态路由中的网段的出接口被指定为NULL0时，那么，前往该静态路由中的网段的所有数据报文将被直接丢弃，不进行转发。因此，通过配置黑洞路由中的网段为攻击源的IP地址，第一目标阻断组中的网络设备则能够基于黑洞路由丢弃前往攻击源的报文，
本方案中，在攻击源成功攻击内部网络的终端设备的情况下，通过向第一目标阻断组中的网络设备发送黑洞路由，能够有效拦截从内部网络发往攻击源的报文，从而避免密钥、用户密码等隐私信息的泄漏。
可以理解的是，当攻击源成功攻击了内部网络的终端，且导致内部网络的终端成为新的攻击源时，该场景类似于场景一。云端设备可以根据该新攻击源的多条攻击路径确定第一目标阻断组，并向第一目标阻断组中的网络设备发送ACL，该ACL中包括新攻击源的IP地址，以指示目标阻断组中的网络设备丢弃来自于该新攻击源的攻击报文，从而限制该新攻击源发起的攻击。
以上介绍了本申请实施例提供的攻击阻断方法的执行过程，为便于理解，以下将详细介绍云端设备确定第一目标阻断组的过程。
对于不同的内部网络或不同时期下的内部网络而言，内部网络中的网络拓扑可能是不 一样的，且攻击源针对于内部网络的攻击路径也可能是不一样的。因此，在不同的场景下，云端设备所确定的第一目标阻断组往往也是不同的。
场景1：存在同一个网络设备位于所有的攻击路径上，即云端设备所获取到的多条攻击路径上均包括同一个网络设备。
在场景1中，由于多条攻击路径上均包括同一个网络设备，因此基于多条攻击路径上的同一个网络设备即能够实现阻断所有攻击路径上的攻击报文。也就是说，在云端设备所确定的第一目标阻断组中包括一个网络设备，且云端设备获取到的多条攻击路径上均包括第一目标阻断组中的网络设备。
示例性地，请参阅图3，图3为本申请实施例提供的一种攻击源攻击终端设备的示意图。如图3所示，攻击源、防火墙以及交换机1依次连接，且交换机1分别与交换机2以及交换机3连接。交换机2分别与终端设备1和终端设备2连接，交换机3分别与终端设备3和终端设备4连接。攻击源针对终端设备的攻击路径包括攻击路径1和攻击路径2。其中，攻击路径1具体为：攻击源→防火墙→交换机1→交换机2→终端设备1。攻击路径2具体为：攻击源→防火墙→交换机1→交换机3→终端设备4。
由图3中的攻击路径1和攻击路径2可知，防火墙和交换机1均位于攻击路径1和攻击路径2上，且交换机2和交换机3分别位于攻击路径1和攻击路径2上。在不采用防火墙来实现阻断攻击报文的情况下，图3中能够实现阻断攻击报文的阻断组一共有2个。其中，第一个阻断组包括交换机1；第二个阻断组包括交换机2和交换机3。由于第一个阻断组中包括的网络设备的数量最少，因此云端设备确定第一个阻断组为第一目标阻断组，即第一目标阻断组中包括交换机1。
场景2：不存在同一个网络设备位于所有的攻击路径上。
在场景2中，由于多条攻击路径上没有包括同一个网络设备，因此无法基于一个网络设备来实现阻断所有攻击路径上的攻击报文。也就是说，在云端设备所确定的第一目标阻断组中包括多个网络设备。第一目标阻断组中的多个网络设备共同配合，才能够实现阻断所有攻击路径上的攻击报文。
此外，第一目标阻断组中的多个网络设备中的每个网络设备位于多条攻击路径的部分攻击路径上，且多条攻击路径中的每条攻击路径上均包括第一目标阻断组中的至少一个网络设备。
示例性地，请参阅图4，图4为本申请实施例提供的另一种攻击源攻击终端设备的示意图。在图4所示的场景2.1中，内部网络中不存在有同一个网络设备位于所有攻击路径上，且每条攻击路径上均包括一个第一目标阻断组中的网络设备(以下简称阻断设备)。如图4所示，攻击源针对终端设备的攻击路径包括攻击路径1和攻击路径2。其中，攻击路径1具体为：攻击源→防火墙→交换机1→交换机3→终端设备1。攻击路径2具体为：攻击源→防火墙→交换机2→交换机6→终端设备4。在不采用防火墙来实现阻断攻击报文的情况下，图4中能够实现阻断攻击报文的阻断组一共有2个。其中，第一个阻断组包括交换机1和交换机2；第二个阻断组包括交换机3和交换机6。在图4中，云端设备选择第一个阻断组作为第一目标阻断组，即第一目标阻断组中包括交换机1和交换机2。
这样，在图4所示的场景2.1中，交换机1和交换机2共同配合，以阻断攻击路径1和攻击路径2上的攻击报文。并且，攻击路径1上仅包括第一目标阻断组中的交换机1，攻击路径2上仅包括第一目标阻断组中的交换机2，即每条攻击路径上均包括一个第一目标阻断组中的网络设备。
示例性地，请参阅图5，图5为本申请实施例提供的另一种攻击源攻击终端设备的示意图。在图5所示的场景2.2中，内部网络中不存在有同一个网络设备位于所有攻击路径上，且部分攻击路径上包括多个阻断设备。如图5所示，攻击源针对终端设备的攻击路径包括攻击路径1、攻击路径2和攻击路径3。其中，攻击路径1具体为：攻击源→防火墙→交换机1→交换机3→终端设备1。攻击路径2具体为：攻击源→防火墙→交换机1→交换机4→终端设备2。攻击路径3具体为：攻击源→防火墙→交换机2→交换机4→终端设备2。
在不采用防火墙来实现阻断攻击报文的情况下，图5中能够实现阻断攻击报文的阻断组至少包括3个。其中，第一个阻断组包括交换机1和交换机2；第二个阻断组包括交换机3和交换机4；第三个阻断组包括交换机1和交换机4。在图5中，云端设备选择第三个阻断组作为第一目标阻断组，即第一目标阻断组中包括交换机1和交换机4。
这样，在图5所示的场景2.2中，交换机1和交换机4共同配合，以阻断攻击路径1、攻击路径2和攻击路径3上的攻击报文。此外，攻击路径1上仅包括第一目标阻断组中的交换机1，攻击路径3上仅包括第一目标阻断组中的交换机4，而攻击路径2上包括第一目标阻断组中的交换机1和交换机4。即，在图5所示的场景2.2中，部分攻击路径上包括第一目标阻断组中的多个网络设备。
以上介绍了在不同的网络场景下第一目标阻断组中所包括的网络设备的情况。在一些场景中，内部网络中可能会同时存在多个阻断组均满足网络设备数量要求，即该多个阻断组均是所有阻断组中包括最少数量网络设备的阻断组。在这种场景下，云端设备则需要在多个阻断组选择其中的一个阻断组作为第一目标阻断组。
可选的，在获取到多条攻击路径之后，云端设备根据多条攻击路径，确定多个候选阻断组，其中多个候选阻断组均为能够阻断多条攻击路径上攻击报文的多个阻断组中包括最少数量网络设备的阻断组。例如，假设在内部网络中能够阻断多条攻击路径上攻击报文的阻断组一共有3个，分别为阻断组1、阻断组2和阻断组3。其中，阻断组1包括2个网络设备，阻断组2包括2个网络设备，阻断组3包括3个网络设备。那么，阻断组1和阻断组2均为3个阻断组中包括最少数量网络设备的阻断组，因此云端设备将阻断组1和阻断组2确定为候选阻断组。
在得到多个候选阻断组的情况下，云端设备则根据预置策略在多个候选阻断组中确定第一目标阻断组。示例性地，预置策略包括以下策略中的一种或多种：近攻击源策略、近攻击目标策略、资源对比策略和随机策略。其中，近攻击源策略用于在多个候选阻断组中选择距离攻击源最近的阻断组，近攻击目标策略用于在多个候选阻断组中选择距离攻击目标最近的阻断组，资源对比策略用于在多个候选阻断组中选择拥有最多阻断资源的阻断组， 阻断资源为网络设备中用于存储阻断策略的空闲存储空间。
其中，云端设备上所配置的预置策略能够根据不同的场景来进行调整，以满足不同的需求。例如，在内部网络中的大部分攻击事件都是从外部网络向内部网络进行攻击的事件的情况下，云端设备上配置的预置策略为近攻击源策略，即尽可能选择距离攻击源最近的网络设备来阻断攻击报文，从而缩短攻击报文在内部网络中的流动距离，节约网络设备的转发资源。又例如，在内部网络中的网络设备经常出现阻断资源不足的情况下，云端设备上配置的预置策略为资源对比策略，即尽可能选择阻断资源较多的网络设备来阻断攻击报文，从而避免网络设备频繁出现阻断资源不足的现象。
请参阅图6，图6为本申请实施例提供的一种内部网络中存在多个候选阻断组的示意图。如图6所示，攻击源针对终端设备的攻击路径包括攻击路径1和攻击路径2。其中，攻击路径1具体为：攻击源→防火墙→交换机1→交换机3→终端设备1。攻击路径2具体为：攻击源→防火墙→交换机2→交换机4→终端设备4。
在不采用防火墙来实现阻断攻击报文的情况下，图6中能够实现阻断攻击报文的阻断组至少包括2个。其中，第一个阻断组包括交换机1和交换机2；第二个阻断组包括交换机3和交换机4。显然，第一个阻断组和第二个阻断组中所包括的网络设备的数量均为2个，因此第一个阻断组和第二个阻断组均为候选阻断组。在图6中，云端设备根据随机策略从两个候选阻断组中选择了第二个阻断组作为第一目标阻断组，即第一目标阻断组中包括交换机3和交换机4。
可以理解的是，由于攻击源对内部网络的终端设备进行攻击是一个动态过程，攻击源可能会不断地针对新的攻击目标发起攻击，因此同一个攻击源所对应的攻击路径也可能会不断地增加。在云端设备已经针对旧的攻击路径发送报文阻断策略的情况下，如果云端设备获取到新的攻击路径，则云端设备基于旧的攻击路径和新的攻击路径重新确定目标阻断组，以保证新确定的目标阻断组能够实现阻断旧的攻击路径和新的攻击路径上的攻击报文。
可选的，在图2对应的实施例中，在云端设备通过执行步骤203向第一目标阻断组中的网络设备发送报文阻断策略后，云端设备获取新增的攻击路径。其中，新增的攻击路径与云端设备在上述步骤201中所获取的多条攻击路径具有相同的攻击源。并且，新增的攻击路径与云端设备在上述步骤201中所获取的多条攻击路径并不相同。此外，新增的攻击路径可以为一条或多条，本实施例并不限定新增的攻击路径的数量。
然后，云端设备根据新增的攻击路径和步骤201中所获取的多条攻击路径，确定第二目标阻断组。其中，第二目标阻断组为多个新的阻断组中包括最少数量的网络设备的阻断组，多个新的阻断组中的每个阻断组用于阻断新增的攻击路径和步骤201中所获取的多条攻击路径上的攻击报文。也就是说，第二目标阻断组是云端设备根据旧的多条攻击路径和新增的攻击路径重新确定得到的阻断组，第二目标阻断组中的网络设备能够实现同时阻断旧的多条攻击路径和新增的攻击路径上的攻击报文。
最后，云端设备向第一目标网络设备发送报文阻断策略，第一目标网络设备包括在第二目标阻断组中且未包括在第一目标阻断组中。由于第一目标阻断组中的网络设备和第二 目标阻断组中的网络设备均用于阻断与同一个攻击源相关的报文，因此对于既包括在第一目标阻断组中又包括在第二目标阻断组中的网络设备，云端设备已经发送过一次报文阻断策略，从而不需要再发送报文阻断策略。
本方案中，云端设备通过实时针对新增的攻击路径和旧的攻击路径确定新的阻断组，能够在网络运行过程中根据攻击事件的变化对阻断攻击报文的网络设备进行适应性调整，保证网络的防护效果。
可选的，在云端设备确定第二目标阻断组之后，云端设备向第二目标网络设备发送第一指令，其中第一指令用于指示第二目标网络设备删除报文阻断策略，第二目标网络设备包括在第一目标阻断组中且未包括在第二目标阻断组中。
也就是说，第二目标网络设备是根据云端设备根据旧的多条攻击路径所确定的用于阻断攻击报文的网络设备。并且，在云端设备获取到新的攻击路径后，云端设备基于新的攻击路径和旧的攻击路径确定不再采用第二目标网络设备作为阻断攻击报文的网络设备。即，第二目标网络设备不需要再对与攻击源相关的报文进行阻断。因此，云端设备指示第二目标网络设备删除报文阻断策略，以节省第二目标网络设备上的存储资源。
示例性地，请参阅图7，图7为本申请实施例提供的一种新增攻击路径的前后对比示意图。如图7所示，在新增攻击路径之前，攻击源针对终端设备的攻击路径包括攻击路径1和攻击路径2。其中，攻击路径1具体为：攻击源→防火墙→交换机1→交换机3→终端设备1。攻击路径2具体为：攻击源→防火墙→交换机1→交换机3→终端设备2。基于攻击路径1和攻击路径2，云端设备确定采用交换机3来阻断攻击路径1和攻击路径2上的攻击报文，即上述的第一目标阻断组中包括交换机3。
在新增攻击路径之后，攻击源针对终端设备新增的攻击路径为攻击路径3。其中，攻击路径3具体为：攻击源→防火墙→交换机2→交换机5→终端设备6。基于攻击路径1、攻击路径2以及新增的攻击路径3，云端设备确定采用交换机1和交换机2来阻断攻击路径1、攻击路径2以及新增的攻击路径3上的攻击报文，即上述的第二目标阻断组中包括交换机1和交换机2。
由上述的分析可知，交换机1和交换机2均是包括在第二目标阻断组中且未包括在第一目标阻断组中，即交换机1和交换机2是新确定的用于阻断攻击报文的网络设备，因此云端设备在新增攻击路径后向交换机1和交换机2发送报文阻断策略。并且，由于交换机3包括在第一目标阻断组中且未包括在第二目标阻断组中，即交换机3是不再需要阻断攻击报文的网络设备，因此云端设备向交换机3发送指令，以指示交换机3删除报文阻断策略。
为了便于理解，以下将结合具体例子详细介绍在网络中应用本申请实施例提供的攻击阻断方法的过程。
请参阅图8，图8为本申请实施例提供的一种在网络中应用攻击阻断方法的流程示意图。如图8所示，在网络中应用攻击阻断方法的过程包括以下的步骤801-805。
步骤801，外部网络的攻击源向防火墙发送攻击报文。
其中，攻击源所发送的攻击报文的源地址为攻击源的IP地址，攻击报文的目的地址为内部网络中的终端设备的IP地址。攻击源所发送的攻击报文需要经过防火墙和交换机的转发，才能够到达内部网络中的终端设备。
步骤802，防火墙基于攻击源发送的攻击报文检测到攻击源所发起的攻击行为，并向云端设备上传告警日志。
在攻击源向防火墙发送攻击报文的过程中，防火墙能够基于攻击报文的信息检测到攻击源所发起的攻击行为。并且，防火墙根据所检测到的攻击行为，生成告警日志并向云端设备上传所生成的告警日志。其中，告警日志中记录了防火墙所检测到的攻击行为。
可选的，防火墙所上传的告警日志中包括：告警标识，防火墙标识，攻击行为发生时间，攻击源所在区域，攻击目标所在区域，攻击行为的编号或名称，攻击报文对应的源IP地址、源端口、目的IP地址、目的端口和传输层协议，以及触发生成该告警日志的原始攻击报文。
在一个可能的示例中，告警日志中的内容如表1所示。
表1
步骤803，云端设备基于告警日志获取攻击路径，并确定用于阻断攻击路径上攻击报文的交换机。
在获取到告警日志后，云端设备基于告警日志所指示的攻击行为信息，获取与攻击行为相关的攻击路径。然后，云端设备基于获取到的攻击路径确定用于阻断攻击路径上攻击报文的交换机。其中，云端设备确定用于阻断攻击路径上攻击报文的交换机的方式可以参阅上述的步骤202，在此不再赘述。
步骤804，云端设备向用于阻断攻击路径上攻击报文的交换机发送报文阻断策略。
本实施例中，步骤804与上述的步骤203类似，具体请参考上述的步骤203，在此不再赘述。
步骤805，交换机根据报文阻断策略阻断攻击报文。
在获得云端设备所发送的报文阻断策略后，交换机通过在转发报文的过程中执行报文阻断策略来实现阻断与攻击源相关的攻击报文。
请参阅图9，图9为本申请实施例提供的一种云端设备执行攻击阻断方法的流程示意图。如图9所示，云端设备执行攻击阻断方法的过程包括以下的步骤901-907。其中，云端设备能够提供防护服务和网络数字地图服务。并且，防护服务和网络数字地图服务可以是由同一个云端设备来提供，或者是由不同的云端设备来提供。
步骤901，防火墙向云端设备上传告警日志。
本实施例中，步骤901与上述的步骤802类似，具体请参考上述的步骤802，在此不再赘述。
步骤902，用于提供防护服务的云端设备中的威胁判定模块基于告警日志确定威胁事件。
由于防火墙可能会出现误报的情况，即防火墙将正常的报文发送行为识别为攻击行为，因此威胁判定模块用于确定防火墙上传的告警日志中所指示的告警事件是否为威胁事件。在威胁判定模块确定防火墙所上报的告警事件是威胁事件时，云端设备再针对威胁事件进行后续的防攻击处理。
可选的，威胁判定模块确定告警日志中所指示的告警事件是否为威胁事件的方式有多种。
方式一：基于预置的规则识别告警事件是否为威胁事件。
具体来说，通过将专家经验抽象成预置的规则，威胁判定模块则能够通过基于预置的规则对告警日志中指示的告警事件进行分析，并将匹配上规则的告警事件标记为威胁事件。
一般来说，预置的规则通常是与攻击行为的编号或名称相关，即威胁判定模块根据告警日志中所指示的攻击行为的编号或名称来判定告警事件是否为威胁事件。例如，假设告警日志中所指示的攻击行为的名称为Medusa http表单密码暴力破解，则确认告警日志所指示的告警事件为威胁事件，其中Medusa是一种攻击工具。又例如，假设告警日志中所指示的攻击行为的名称为密码参数缓冲区溢出漏洞，则确认告警日志所指示的告警事件为威胁事件。又例如，假设告警日志中所指示的攻击行为的名称为超文本预处理器(Hypertext Preprocessor，PHP)文件上传全局变量重写漏洞，则确认告警日志所指示的告警事件为威胁事件。
方式二：基于机器学习的方式识别告警事件是否为威胁事件。
一般来说，方式二是通过预先训练得到的机器学习模型来识别告警事件是否为威胁事件。云端设备将与告警日志关联的特征输入机器学习模型以对告警日志进行威胁判定。
方式三：基于人工处置的方式识别告警事件是否为威胁事件。
在一些情况下，如果基于上述的方式一和方式二均无法对告警日志进行识别，则通过人工处置的方式来识别告警日志中的告警事件是否为威胁事件。即，由网络专家根据经验，结合网络中的其他安全信息，综合判定告警日志中的告警事件是否为威胁事件。
需要说明的是，以上介绍了云端设备确定告警日志中所指示的告警事件是否为威胁事件的多个示例，在实际应用中，云端设备也可以是基于其他的方式来识别威胁事件，在此不做具体限定。
步骤903，威胁判定模块向用于提供网络数字地图服务的云端设备中的路径搜索模块发送威胁事件的源地址和目的地址，请求威胁事件对应的攻击路径。
步骤904，路径搜索模块基于威胁事件的源地址和目的地址搜索攻击路径。
本实施例中，用于提供网络数字地图服务的云端设备预先根据内部网络中的网络设备配置和链路状态构建了网络数字地图，从而能够提供网络拓扑可视化服务。其中，网络数字地图指示了整个内部网络的拓扑，即网络数字地图指示了内部网络中各个网络设备之间的连接关系。这样一样，路径搜索模块基于威胁事件的源地址和目的地址，则能够在网络数字地图中搜索攻击路径。
示例性地，云端设备首先根据链路层发现协议(Link Layer Discovery Protocol，LLDP)的邻居信息构建交换机和防火墙等网络设备的拓扑。然后，云端设备再根据地址解析协议(Address Resolution Protocol，ARP)信息构建终端设备和交换机等网络设备之间的拓扑，从而得到内部网络的完整拓扑。最后，云端设备基于内部网络的完整拓扑，根据路由表项搜索特定源地址和目的地址下的攻击路径。
步骤905，路径搜索模块向用于提供防护服务的云端设备返回攻击路径的信息。
其中，攻击路径的信息包括攻击路径上的网络设备的信息和/或攻击路径上的网络设备转发报文的端口信息。
示例性地，攻击路径的信息如下所示。
[{"网络设备":"交换机2","出接口":"端口3"},
{"网络设备":"交换机1","出接口":"端口2"},
{"网络设备":"交换机3","出接口":"端口1"}]
上述的攻击路径的信息指示了攻击路径具体为：交换机2上的端口3→交换机1上的端口2→交换机3上的端口1。
步骤906，用于提供防护服务的云端设备中的阻断设备选择模块基于攻击路径确定用于阻断攻击报文的交换机设备。
步骤907，用于提供防护服务的云端设备向用于阻断攻击报文的交换机设备发送阻断策略。
本实施例中，步骤906与上述的步骤202类似，步骤907与上述的步骤203类似，具体请参考上述的步骤202和步骤203，在此不再赘述。
为便于理解，以下将详细介绍上述步骤904中云端设备基于威胁事件的源地址和目的地址搜索攻击路径的多种情况。
一般来说，云端设备搜索得到的攻击路径的方向通常有两种。
攻击方向1：从外部网络向内部网络攻击。
具体地，位于外部网络的攻击源向内部网络中的终端设备发送攻击报文，以实现从外 部网络向内部网络攻击。
请参阅图10，图10为本申请实施例提供的攻击路径的方向示意图。如图10中的(a)所示，外部网络的攻击源通过攻击路径1向内部网络的终端设备1进行攻击。攻击路径1具体为：攻击源→防火墙上的端口1→交换机1上的端口2→交换机2上的端口3→终端设备1。因此，云端设备中的路径搜索模块搜索得到的攻击路径的信息如下所示。
[{"网络设备":"防火墙","出接口":"端口1"},
{"网络设备":"交换机1","出接口":"端口2"},
{"网络设备":"交换机2","出接口":"端口3"}]
攻击方向2：从内部网络向内部网络攻击。
在外部网络的攻击源成功入侵内部网络中的终端设备之后，内部网络中的终端设备可能在攻击源的控制下向内部网络中的其他终端设备发送攻击报文，以实现从内部网络向内部网络攻击。
如图10中的(b)所示，内部网络的终端设备1被入侵后，终端设备1通过攻击路径2向内部网络的终端设备3进行攻击。攻击路径2具体为：终端设备1上的端口4→交换机2上的端口5→交换机1上的端口6→交换机3上的端口7→终端设备3。因此，云端设备中的路径搜索模块搜索得到的攻击路径的信息如下所示。
[{"网络设备":"终端设备1","出接口":"端口4"},
{"网络设备":"交换机2","出接口":"端口5"},
{"网络设备":"交换机1","出接口":"端口6"}，
{"网络设备":"交换机3","出接口":"端口7"}]
此外，攻击源与攻击目标之间的网络设备是否存在负载分担也会影响云端设备搜索得到的攻击路径。
情况1：攻击源与攻击目标之间的网络设备不存在负载分担。
在攻击源与攻击目标之间的网络设备不存在负载分担的情况下，网络设备在转发报文时会有唯一确定的出接口，因此云端设备基于一对源地址和目的地址通常能够搜索得到唯一的一条攻击路径。
请参阅图11，图11为本申请实施例提供的一种搜索攻击路径的示意图。如图11所示，内部网络中的交换机之间均不存在负载分担。在源地址为攻击源的IP地址以及目的地址1为终端设备1的情况下，云端设备搜索得到的攻击路径为攻击路径1，即攻击源→防火墙→交换机1→交换机2→终端设备1。在源地址为攻击源的IP地址以及目的地址2为终端设备4的情况下，云端设备搜索得到的攻击路径为攻击路径2，即攻击源→防火墙→交换机1→交换机3→终端设备4。也就是说，在图11所示的网络设备之间不存在负载分担的内部网络中，云端设备基于一对源地址和目的地址只能够搜索得到一条唯一对应的攻击路径。
情况2：攻击源与攻击目标之间的网络设备存在负载分担。
在攻击源与攻击目标之间的网络设备存在负载分担的情况下，网络设备在转发报文时可能会有多个用于实现负载分担的出接口。简单来说，网络设备在不同时刻接收到源地址 和目的地址相同的报文时，网络设备可能将这些报文分别转发到不同的网络设备上，以实现负载分担。因此，云端设备基于一对源地址和目的地址通常能够搜索得到多条攻击路径。
请参阅图12，图12为本申请实施例提供的另一种搜索攻击路径的示意图。如图12所示，内部网络中的交换机3和交换机4存在负载分担，交换机5和交换机6存在负载分担。在源地址为攻击源的IP地址以及目的地址为终端设备1的情况下，云端设备搜索得到的攻击路径包括攻击路径3和攻击路径4。其中，攻击路径3具体为：攻击源→防火墙→交换机1→交换机3→终端设备1。攻击路径4具体为：攻击源→防火墙→交换机1→交换机4→终端设备1。也就是说，在图12所示的网络设备之间存在负载分担的内部网络中，云端设备基于一对源地址和目的地址能够搜索得到两条对应的攻击路径。
请参阅图13，图13为本申请实施例提供的一种攻击阻断装置的结构示意图。如图13所示，攻击阻断装置包括获取模块1301、处理模块1302和发送模块1303。获取模块1301用于获取多条攻击路径。多条攻击路径为攻击报文的转发路径，多条攻击路径具有相同的攻击源。处理模块1302，用于根据多条攻击路径确定第一目标阻断组。第一目标阻断组为多个阻断组中包括最少数量的网络设备的阻断组。多个阻断组中的每个阻断组均包括至少一个网络设备，且每个阻断组中的网络设备用于阻断多条攻击路径上的攻击报文。发送模块1303，用于向第一目标阻断组中的网络设备发送报文阻断策略，报文阻断策略用于阻断与攻击源相关的攻击报文。
可选的，第一目标阻断组中包括一个网络设备，多条攻击路径上均包括第一目标阻断组中的网络设备。
可选的，第一目标阻断组中包括多个网络设备，多个网络设备中的每个网络设备位于多条攻击路径的部分攻击路径上，且多条攻击路径中的每条攻击路径上均包括第一目标阻断组中的至少一个网络设备。
可选的，处理模块1302，具体用于：根据多条攻击路径确定多个候选阻断组，并根据预置策略在多个候选阻断组中确定第一目标阻断组。多个候选阻断组均为多个阻断组中包括最少数量的网络设备的阻断组。
可选的，预置策略包括以下策略中的一种或多种：近攻击源策略、近攻击目标策略、资源对比策略和随机策略。其中，近攻击源策略用于在多个候选阻断组中选择距离攻击源最近的阻断组，近攻击目标策略用于在多个候选阻断组中选择距离攻击目标最近的阻断组，资源对比策略用于在多个候选阻断组中选择拥有最多阻断资源的阻断组，阻断资源为网络设备中用于存储报文阻断策略的空闲存储空间。
可选的，获取模块1301，还用于获取新增的攻击路径。新增的攻击路径与多条攻击路径具有相同的攻击源。处理模块1302，还用于根据新增的攻击路径和多条攻击路径，确定第二目标阻断组。第二目标阻断组为多个新的阻断组中包括最少数量的网络设备的阻断组，多个新的阻断组中的每个阻断组用于阻断新增的攻击路径和多条攻击路径上的攻击报文。发送模块1303，还用于向第一目标网络设备发送报文阻断策略，第一目标网络设备包括在第二目标阻断组中且未包括在第一目标阻断组中。
可选的，发送模块1303，还用于向第二目标网络设备发送第一指令。第一指令用于指示第二目标网络设备删除报文阻断策略。第二目标网络设备包括在第一目标阻断组中且未包括在第二目标阻断组中。
可选的，发送模块1303，具体用于响应于多条攻击路径对应的攻击状态为正在攻击，向第一目标阻断组中的网络设备发送ACL，ACL用于阻断来自于攻击源的报文。
可选的，发送模块1303，具体用于响应于多条攻击路径对应的攻击状态为攻击成功，向第一目标阻断组中的网络设备发送黑洞路由，黑洞路由用于阻断目的地址为攻击源的报文。
图14为本申请实施例提供的一种网络设备1400的结构示意图。网络设备1400搭载有上述的攻击阻断装置。网络设备1400由一般性的总线体系结构来实现。
网络设备1400包括至少一个处理器1401、通信总线1402、存储器1403以及至少一个通信接口1404。
可选地，处理器1401是一个通用CPU、NP、微处理器、或者是一个或多个用于实现本申请方案的集成电路，例如，专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic，GAL)或其任意组合。
通信总线1402用于在上述组件之间传送信息。通信总线1402分为地址总线、数据总线、控制总线等。为便于表示，图中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
可选地，存储器1403是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其它类型的静态存储设备。可替换的，存储器1403是随机存取存储器(random access memory，RAM)或者可存储信息和指令的其它类型的动态存储设备。可替换的，存储器1403是电可擦可编程只读存储器(electrically erasable programmable read-only Memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其它光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其它磁存储设备，或者是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其它介质，但不限于此。可选地，存储器1403是独立存在的，并通过通信总线1402与处理器1401相连接。可选地，存储器1403和处理器1401集成在一起。
通信接口1404使用任何收发器一类的装置，用于与其它设备或通信网络通信。通信接口1404包括有线通信接口。可选地，通信接口1404还包括无线通信接口。其中，有线通信接口例如为以太网接口。以太网接口是光接口，电接口或其组合。无线通信接口为无线局域网(wireless local area networks，WLAN)接口，蜂窝网络通信接口或其组合等。
在具体实现中，作为一种实施例，处理器1401包括一个或多个CPU，如图14中所示 的CPU0和CPU1。
在具体实现中，作为一种实施例，网络设备1400包括多个处理器，如图14中所示的处理器1401和处理器1405。这些处理器中的每一个是一个单核处理器(single-CPU)，或者是一个多核处理器(multi-CPU)。这里的处理器指一个或多个设备、电路、和/或用于处理数据(如计算机程序指令)的处理核。
在一些实施例中，存储器1403用于存储执行本申请方案的程序代码1414，处理器1401执行存储器1403中存储的程序代码1414。也就是说，网络设备1400通过处理器1401以及存储器1403中的程序代码1414，来实现上述的方法实施例。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分可互相参考，每个实施例重点说明的都是与其他实施例的不同之处。
A参考B，指的是A与B相同或者A为B的简单变形。
本申请实施例的说明书和权利要求书中的术语“第一”和“第二”等是用于区别不同的对象，而不是用于描述对象的特定顺序，也不能理解为指示或暗示相对重要性。例如，第一限速通道和第二限速通道用于区别不同的限速通道，而不是用于描述限速通道的特定顺序，也不能理解为第一限速通道比第二限速通道更重要。
本申请实施例，除非另有说明，“至少一个”的含义是指一个或多个，“多个”的含义是指两个或两个以上。
上述实施例可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例描述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(Digital Subscriber Line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。
以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (21)

  1. 一种攻击阻断方法，其特征在于，包括：
    获取多条攻击路径，所述多条攻击路径为攻击报文的转发路径，所述多条攻击路径具有相同的攻击源；
    根据所述多条攻击路径，确定第一目标阻断组，所述第一目标阻断组为多个阻断组中包括最少数量的网络设备的阻断组，所述多个阻断组中的每个阻断组均包括至少一个网络设备，且所述每个阻断组中的网络设备用于阻断所述多条攻击路径上的攻击报文；
    向所述第一目标阻断组中的网络设备发送报文阻断策略，所述报文阻断策略用于阻断与所述攻击源相关的攻击报文。
  2. 根据权利要求1所述的方法，其特征在于，所述第一目标阻断组中包括一个网络设备，所述多条攻击路径上均包括所述第一目标阻断组中的网络设备。
  3. 根据权利要求1所述的方法，其特征在于，所述第一目标阻断组中包括多个网络设备，所述多个网络设备中的每个网络设备位于所述多条攻击路径的部分攻击路径上，且所述多条攻击路径中的每条攻击路径上均包括所述第一目标阻断组中的至少一个网络设备。
  4. 根据权利要求1-3任意一项所述的方法，其特征在于，所述根据所述多条攻击路径，确定第一目标阻断组，包括：
    根据所述多条攻击路径，确定多个候选阻断组，所述多个候选阻断组均为所述多个阻断组中包括最少数量的网络设备的阻断组；
    根据预置策略在所述多个候选阻断组中确定所述第一目标阻断组。
  5. 根据权利要求4所述的方法，其特征在于，所述预置策略包括以下策略中的一种或多种：近攻击源策略、近攻击目标策略、资源对比策略和随机策略；
    其中，所述近攻击源策略用于在所述多个候选阻断组中选择距离攻击源最近的阻断组，所述近攻击目标策略用于在所述多个候选阻断组中选择距离攻击目标最近的阻断组，所述资源对比策略用于在所述多个候选阻断组中选择拥有最多阻断资源的阻断组，所述阻断资源为网络设备中用于存储报文阻断策略的空闲存储空间。
  6. 根据权利要求1-5任意一项所述的方法，其特征在于，所述向所述第一目标阻断组中的网络设备发送报文阻断策略之后，所述方法还包括：
    获取新增的攻击路径，所述新增的攻击路径与所述多条攻击路径具有相同的攻击源；
    根据所述新增的攻击路径和所述多条攻击路径，确定第二目标阻断组，所述第二目标阻断组为多个新的阻断组中包括最少数量的网络设备的阻断组，所述多个新的阻断组中的每个阻断组用于阻断所述新增的攻击路径和所述多条攻击路径上的攻击报文；
    向第一目标网络设备发送所述报文阻断策略，所述第一目标网络设备包括在所述第二 目标阻断组中且未包括在所述第一目标阻断组中。
  7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    向第二目标网络设备发送第一指令，所述第一指令用于指示所述第二目标网络设备删除所述报文阻断策略，所述第二目标网络设备包括在所述第一目标阻断组中且未包括在所述第二目标阻断组中。
  8. 根据权利要求1-7任意一项所述的方法，其特征在于，所述向所述第一目标阻断组中的网络设备发送报文阻断策略，包括：
    响应于所述多条攻击路径对应的攻击状态为正在攻击，向所述第一目标阻断组中的网络设备发送访问控制列表ACL，所述ACL用于阻断来自于所述攻击源的报文。
  9. 根据权利要求1-7任意一项所述的方法，其特征在于，所述向所述第一目标阻断组中的网络设备发送报文阻断策略，包括：
    响应于所述多条攻击路径对应的攻击状态为攻击成功，向所述第一目标阻断组中的网络设备发送黑洞路由，所述黑洞路由用于阻断目的地址为所述攻击源的报文。
  10. 一种攻击阻断装置，其特征在于，包括：
    获取模块，用于获取多条攻击路径，所述多条攻击路径为攻击报文的转发路径，所述多条攻击路径具有相同的攻击源；
    处理模块，用于根据所述多条攻击路径，确定第一目标阻断组，所述第一目标阻断组为多个阻断组中包括最少数量的网络设备的阻断组，所述多个阻断组中的每个阻断组均包括至少一个网络设备，且所述每个阻断组中的网络设备用于阻断所述多条攻击路径上的攻击报文；
    发送模块，用于向所述第一目标阻断组中的网络设备发送报文阻断策略，所述报文阻断策略用于阻断与所述攻击源相关的攻击报文。
  11. 根据权利要求10所述的装置，其特征在于，所述第一目标阻断组中包括一个网络设备，所述多条攻击路径上均包括所述第一目标阻断组中的网络设备。
  12. 根据权利要求10所述的装置，其特征在于，所述第一目标阻断组中包括多个网络设备，所述多个网络设备中的每个网络设备位于所述多条攻击路径的部分攻击路径上，且所述多条攻击路径中的每条攻击路径上均包括所述第一目标阻断组中的至少一个网络设备。
  13. 根据权利要求10-12任意一项所述的装置，其特征在于，所述处理模块，具体用于：
    根据所述多条攻击路径，确定多个候选阻断组，所述多个候选阻断组均为所述多个阻断组中包括最少数量的网络设备的阻断组；
    根据预置策略在所述多个候选阻断组中确定所述第一目标阻断组。
  14. 根据权利要求13所述的装置，其特征在于，所述预置策略包括以下策略中的一种或多种：近攻击源策略、近攻击目标策略、资源对比策略和随机策略；
    其中，所述近攻击源策略用于在所述多个候选阻断组中选择距离攻击源最近的阻断组，所述近攻击目标策略用于在所述多个候选阻断组中选择距离攻击目标最近的阻断组，所述资源对比策略用于在所述多个候选阻断组中选择拥有最多阻断资源的阻断组，所述阻断资源为网络设备中用于存储报文阻断策略的空闲存储空间。
  15. 根据权利要求10-14任意一项所述的装置，其特征在于，
    所述获取模块，还用于获取新增的攻击路径，所述新增的攻击路径与所述多条攻击路径具有相同的攻击源；
    所述处理模块，还用于根据所述新增的攻击路径和所述多条攻击路径，确定第二目标阻断组，所述第二目标阻断组为多个新的阻断组中包括最少数量的网络设备的阻断组，所述多个新的阻断组中的每个阻断组用于阻断所述新增的攻击路径和所述多条攻击路径上的攻击报文；
    所述发送模块，还用于向第一目标网络设备发送所述报文阻断策略，所述第一目标网络设备包括在所述第二目标阻断组中且未包括在所述第一目标阻断组中。
  16. 根据权利要求15所述的装置，其特征在于，
    所述发送模块，还用于向第二目标网络设备发送第一指令，所述第一指令用于指示所述第二目标网络设备删除所述报文阻断策略，所述第二目标网络设备包括在所述第一目标阻断组中且未包括在所述第二目标阻断组中。
  17. 根据权利要求10-16任意一项所述的装置，其特征在于，
    所述发送模块，具体用于响应于所述多条攻击路径对应的攻击状态为正在攻击，向所述第一目标阻断组中的网络设备发送访问控制列表ACL，所述ACL用于阻断来自于所述攻击源的报文。
  18. 根据权利要求10-16任意一项所述的装置，其特征在于，
    所述发送模块，具体用于响应于所述多条攻击路径对应的攻击状态为攻击成功，向所述第一目标阻断组中的网络设备发送黑洞路由，所述黑洞路由用于阻断目的地址为所述攻击源的报文。
  19. 一种网络设备，包括处理器和存储器，所述存储器用于存储程序代码，所述处理器用于调用所述存储器中的程序代码以使得所述网络设备执行如权利要求1-9任一项所述的方法。
  20. 一种计算机可读存储介质，存储有指令，当所述指令在计算机上运行时，使得计算机执行如权利要求1-9任一项所述的方法。
  21. 一种计算机程序产品，其特征在于，包括程序代码，当计算机运行所述计算机程序产品时，使得所述计算机执行如权利要求1-9任一项所述的方法。
PCT/CN2023/078368 2022-02-28 2023-02-27 一种攻击阻断方法及相关装置 WO2023160693A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210190619.8A CN116707848A (zh) 2022-02-28 2022-02-28 一种攻击阻断方法及相关装置
CN202210190619.8 2022-02-28

Publications (1)

Publication Number Publication Date
WO2023160693A1 true WO2023160693A1 (zh) 2023-08-31

Family

ID=87764870

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/078368 WO2023160693A1 (zh) 2022-02-28 2023-02-27 一种攻击阻断方法及相关装置

Country Status (2)

Country Link
CN (1) CN116707848A (zh)
WO (1) WO2023160693A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101345755A (zh) * 2008-08-29 2009-01-14 中兴通讯股份有限公司 一种防止地址解析协议报文攻击的方法和系统
CN104954335A (zh) * 2014-03-27 2015-09-30 中国移动通信集团安徽有限公司 一种阻断高风险网络入侵的方法及系统
US20170302691A1 (en) * 2016-04-18 2017-10-19 Acalvio Technologies, Inc. Systems and Methods for Detecting and Tracking Adversary Trajectory
CN111049859A (zh) * 2019-12-27 2020-04-21 东南大学 一种基于拓扑分析的攻击流量分流和阻断方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101345755A (zh) * 2008-08-29 2009-01-14 中兴通讯股份有限公司 一种防止地址解析协议报文攻击的方法和系统
CN104954335A (zh) * 2014-03-27 2015-09-30 中国移动通信集团安徽有限公司 一种阻断高风险网络入侵的方法及系统
US20170302691A1 (en) * 2016-04-18 2017-10-19 Acalvio Technologies, Inc. Systems and Methods for Detecting and Tracking Adversary Trajectory
CN111049859A (zh) * 2019-12-27 2020-04-21 东南大学 一种基于拓扑分析的攻击流量分流和阻断方法

Also Published As

Publication number Publication date
CN116707848A (zh) 2023-09-05

Similar Documents

Publication Publication Date Title
US11057349B2 (en) Cloud-based multi-function firewall and zero trust private virtual network
US11824875B2 (en) Efficient threat context-aware packet filtering for network protection
US9276907B1 (en) Load balancing in a network with session information
WO2021032207A1 (zh) 网络威胁的诱捕方法、系统和转发设备
US20210112091A1 (en) Denial-of-service detection and mitigation solution
US10516694B1 (en) Hierarchical mitigation of denial of service attacks on communication networks
US11539722B2 (en) Security threat detection based on process information
WO2023040303A1 (zh) 网络流量控制方法以及相关系统
US11874845B2 (en) Centralized state database storing state information
US20220123989A1 (en) Management and resolution of alarms based on historical alarms
US11750564B2 (en) Systems and methods for monitoring and securing networks using a shared buffer
Cho et al. A sophisticated packet forwarding scheme with deep packet inspection in an openflow switch
WO2023160693A1 (zh) 一种攻击阻断方法及相关装置
US10848465B2 (en) Dynamic firewalls and forensic gateways
US20240031334A1 (en) Identity firewall with context information tracking
WO2023060881A1 (zh) 报文源地址识别方法及装置
CN113660199B (zh) 流量攻击的防护方法、装置、设备及可读存储介质
EP4080822B1 (en) Methods and systems for efficient threat context-aware packet filtering for network protection
US11539740B1 (en) Methods for protecting CPU during DDoS attack and devices thereof
US20230198944A1 (en) Networking and security split architecture
Ubale et al. Survey on DDoS Attack Techniques and Solutions in Software-Defined
CN113225314A (zh) 一种基于端口跳变MTD的SDN网络抗Dos方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23759314

Country of ref document: EP

Kind code of ref document: A1