WO2024156236A1

WO2024156236A1 - Slow attack identification method and apparatus, electronic device and storage medium

Info

Publication number: WO2024156236A1
Application number: PCT/CN2023/139654
Authority: WO
Inventors: 李竞佳; 林顺东; 陈晓裕; 林漳坤; 李可惟
Original assignee: 天翼云科技有限公司
Priority date: 2023-01-28
Filing date: 2023-12-18
Publication date: 2024-08-02
Also published as: CN116074083A; CN116074083B

Abstract

The present application relates to the technical field of network communications and provides a slow attack identification method and apparatus, an electronic device and a storage medium. The method comprises: receiving a data packet corresponding to a request; and, when the data packet satisfies a preset slow attack condition, a transport layer of a network system determining the data packet as a slow attack data packet and, when the data packet corresponding to the request comprises the slow attack data packet, determining the request as a slow attack request. Identifying the slow attack data packet and the slow attack request at the transport layer of the network system avoids identifying the slow attack request at the application layer and avoids occupying application layer resources, such that the application layer has higher application processing performance. The transport layer is more ahead of the application layer, such that early identification aids in early protection, ensures resource utilization of back-end application services, and avoids operations in which applications individually identify the slow attacks, thus reducing the operation and maintenance workload.

Description

Slow attack identification method, device, electronic device and storage medium

This application claims priority to a Chinese patent application filed with the China Patent Office on January 28, 2023, with application number 202310042925.1 and application name “Slow Attack Identification Method, Device, Electronic Device and Storage Medium”, the entire contents of which are incorporated by reference in this application.

Technical Field

The present application belongs to the field of network communication technology, and in particular, relates to a slow attack identification method, device, electronic device and storage medium.

Background technique

With the rapid development of the Internet, network security issues are becoming increasingly serious. Among them, slow attacks are a type of attack that is more difficult to defend. Slow attacks mainly refer to maintaining a connection with the network system through a small amount of data and a low rate, thereby consuming the resources of the network system.

Chinese patent CN109040140A discloses a slow attack detection method and device. The defense against slow attacks in this patent is mainly to identify and intercept them at the application layer of the network system.

However, identifying slow attacks at the application layer occupies more resources of the application layer, resulting in poor application processing performance at the application layer.

Summary of the invention

The present application provides a slow attack identification method, device, electronic device and storage medium, aiming to solve the problem of identifying slow attacks at the application layer, etc., which occupies more resources of the application layer.

In a first aspect, the present application provides a slow attack identification method, which is applied to a network system, comprising:

Receive the data packet corresponding to the request;

The transport layer of the network system determines the data packet as a slow attack data packet when the data packet meets the preset slow attack condition, and determines the request as a slow attack request when the data packet corresponding to the request includes the slow attack data packet.

In a second aspect, the present application provides a slow attack identification device, which is applied to a network system, comprising:

A receiving module, used for receiving a data packet corresponding to a request;

The identification module is used in the transport layer of the network system. When the data packet meets the preset slow attack condition, the data packet is determined as a slow attack data packet, and when the data packet corresponding to the request includes the slow attack data packet, the request is determined as a slow attack request.

In a third aspect, the present application provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned slow attack identification method when executing the program.

In a fourth aspect, the present application provides a readable storage medium, when the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the above-mentioned slow attack identification method.

In the embodiment of the present application, the data packets that meet the preset slow attack conditions are determined as slow attack data packets at the transport layer of the network system, and the requests including slow attack data packets are determined as slow attack requests at the transport layer of the network system. That is to say, the identification of slow attack data packets and slow attack requests is completed at the transport layer of the network system, and there is no need to identify slow attack requests at the application layer, and the application layer does not need to parse protocols, etc., and thus the identification of slow attacks does not occupy the resources of the application layer, so that the application layer has higher processing performance for applications. Moreover, the transport layer is closer to the application layer, and the slow attack is recognized at the transport layer. On the one hand, early identification helps to protect against slow attacks as early as possible, ensuring the resource utilization of back-end application services. On the other hand, it eliminates the need for each back-end application service to identify slow attacks one by one, greatly reducing the workload of operation and maintenance.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

FIG1 is a flowchart of a method for identifying a slow attack provided by an embodiment of the present application;

FIG2 is a flowchart of another method for identifying a slow attack provided by an embodiment of the present application;

FIG3 is a structural diagram of a slow attack identification device provided in an embodiment of the present application;

FIG4 shows a schematic diagram of a partial architecture of a network system provided in an embodiment of the present application;

FIG5 shows a schematic diagram of an initialization process of a network system provided in an embodiment of the present application;

FIG6 shows a schematic diagram of a process flow of a slow attack on a network system provided in an embodiment of the present application;

FIG. 7 is a structural diagram of an electronic device provided in an embodiment of the present application.

Detailed ways

The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

FIG1 is a flowchart of a method for identifying a slow attack provided by an embodiment of the present application. The method is applied to a network system. The network model of the network system can be a seven-layer model (Open System Interconnection, OSI) or a four-layer model. The seven-layer model is from bottom to top: physical layer, data link layer, network layer, transport layer, session layer, presentation layer, and application layer. The four-layer model is from bottom to top: link layer, network layer, transport layer, and application layer.

The slow attacks mentioned in this application are mainly divided into three types: Slow read attack, Slow headers attack, and Slow body attack. Slow read attack means that the attacker sends a complete request to the network system after establishing a link, and then keeps the link, reading the response at a very low speed or making the network system mistakenly believe that the client is busy, so as to consume the link and memory resources of the network system. Slow headers attack means that the attacker initiates an HTTP (Hyper Text Transfer Protocol) request to the network system, continuously sending HTTP headers, and the network system needs to receive all HTTP headers before processing, thus consuming the link and memory resources of the network system. Slow body attack means that the attacker sends an HTTP POST request, indicating that a large amount of data is to be sent. At this time, the network system will maintain the link and prepare to receive data, but the attacking client only sends a small amount of data each time, thereby consuming the link and memory resources of the network system.

As shown in FIG. 1 , the method may include the following steps.

Step 101: Receive a data packet corresponding to a request.

The network system can provide network data services, and each client can send a data packet corresponding to the request to the network system. The data packet corresponding to the request is used to request the network system for network data services. The number of data packets corresponding to the request is not specifically limited.

Step 102: The transport layer of the network system determines the data packet as a slow attack data packet when the data packet meets the preset slow attack condition, and determines the request as a slow attack request when the data packet corresponding to the request includes the slow attack data packet.

The transport layer of the network system determines the request as a slow attack request when the data packets corresponding to the request include at least one slow attack data packet. That is, the transport layer of the network system determines the request as a slow attack request when the data packets corresponding to the request include at least one slow attack data packet.

The inventor found that the prior art only identifies slow attacks at the application layer of the network system, so different application services need to identify slow attacks separately, and if the slow attacks change, each different application service also needs to be upgraded and changed in accordance with the above-mentioned changed slow attacks, which makes the workload of operation and maintenance very large. For example, if the network system includes a thread-based application service Apache, and an application service Httpd. The network system also includes an event-based application service Nginx, and an application service lighttpd. The network system also includes other application services, such as application service falsk, application service gin, etc. If the prior art is used to identify slow attacks at the application layer of the network system, each application service such as application service Apache, application service Httpd, application service Nginx, application service lighttpd, application service falsk, application service gin, etc. needs to identify slow attacks separately, and each of the above application services also needs to be upgraded and changed in accordance with the changed slow attacks, which makes the workload of operation and maintenance very large.

Compared with the prior art that identifies slow attacks only at the application layer of the network system, in the present application, at the transport layer of the network system, when a data packet meets the preset slow attack conditions, the data packet is determined as slow attack data, and at the transport layer of the network system, a request including a slow attack data packet is determined as a slow attack request. That is to say, the present application realizes the identification of slow attack data packets and slow attack requests at the transport layer of the network system, that is, the identification of slow attacks is realized at the transport layer of the network system, and there is no need to identify slow attacks at the application layer, and the application layer does not need to parse protocols, etc., and then the identification of slow attacks does not need to occupy the resources of the application layer, so that the application layer has higher processing performance for the application. Moreover, the transport layer is closer to the application layer, and the identification of slow attacks is realized at the transport layer. On the one hand, early identification helps to protect as early as possible, ensuring the resource utilization of the back-end application services. On the other hand, it eliminates the need for each application at the back end to identify slow attacks one by one, greatly reducing the workload of operation and maintenance.

The transport layer here may be the transport layer in a seven-layer model of a network system, or may be the transport layer in a four-layer model, etc., and there is no specific limitation on this.

Optionally, determining the slow attack data packet in the aforementioned step 102 may include at least one of the following sub-steps.

Sub-step 1021, the transport layer of the network system determines each consecutive data packet as a slow attack data packet when each consecutive data packet is a small data packet and a first total number of each consecutive data packet is greater than or equal to a first preset number; and the length of the small data packet is less than or equal to a preset length.

A small data packet is a data packet whose length is less than or equal to a preset length. The preset length here can be determined according to actual needs. For example, the preset length here can be 50 bytes, or the preset length here can be 60 bytes, etc.

That is to say, the transport layer of the network system determines the continuous data packets or continuous small data packets as slow attack data packets, regardless of whether the continuous data packets are from the same request or not, as long as the continuous data packets received are all small data packets, and the first total number of the continuous data packets or continuous small data packets is greater than or equal to the first preset number. This is equivalent to the client sending only a small amount of data each time, thereby consuming the link and memory resources of the network system, and the continuous data packets or continuous small data packets are all slow attack data packets.

The size of the first preset number is determined according to actual needs. Optionally, the first preset number is greater than or equal to 3, and the size of the first preset number is set appropriately, so that slow attack data packets can be more accurately identified. For example, the transport layer of the network system does not care whether the consecutive data packets are from the same request, as long as the consecutive data packets received are all small data packets, and the first total number of consecutive data packets or consecutive small data packets is greater than or equal to 3, then the consecutive data packets or consecutive small data packets are all slow attack data packets.

For example, the first preset number is 3. If the network system receives 4 small data packets consecutively, then the first total number of consecutive data packets or consecutive small data packets is 4. If 4 is greater than 3, the transport layer of the network system will determine the 4 consecutive data packets or 4 consecutive small data packets as slow attack data packets.

Sub-step 1022, the transport layer of the network system determines both adjacent data packets as slow attack data packets when the interval between the reception times of two adjacent data packets corresponding to the same request is greater than or equal to a preset time.

If the interval between the reception times of two adjacent data packets corresponding to the same request is greater than or equal to the preset interval, the network system needs to maintain a longer connection for the request to receive each data packet of the request, which will make the network system mistakenly believe that the client is very busy and consume the connection and memory resources of the network system. In this case, the transport layer of the network system will determine the two adjacent data packets as slow attack data packets.

The preset time length can be set according to actual needs. Optionally, the preset time length is greater than or equal to 120 seconds, which is more appropriate and can more accurately identify slow attack data packets.

For example, the preset duration is 120 seconds. For request A, the network system receives a data packet at 13:20:20 on December 20, 2022, and then receives the next data packet at 13:22:40 on December 20, 2022. Then, for request A, the interval between the reception times of the two adjacent data packets is 140 seconds, which is greater than or equal to the preset duration of 120 seconds. The transport layer of the network system will determine request A and the two adjacent data packets as slow attack data packets.

Sub-step 1023: The transport layer of the network system determines the SYN packet as a slow attack packet when the window value in the SYN packet corresponding to the request is less than or equal to the preset window value.

The SYN packet is the first packet or header of the Transmission Control Protocol (TCP) connection. It is the handshake signal used when TCP/IP (Transmission Control Protocol/Internet Protocol) establishes a connection. When a normal TCP network connection is established between the client and the network system, the client first sends a SYN message or SYN packet. The network system uses a SYN+ACK response to indicate that it has received the message. Finally, the client responds with an ACK message. In this way, a reliable TCP connection can be established between the client and the network system, and data can be transmitted. To be passed between the client and the network system.

The window value in the SYN packet can be obtained from the header of the SYN packet. When the window value in the SYN packet corresponding to the request is less than or equal to the preset window value, the network system can only transmit data to the client at a very low bit rate, which will make the network system mistakenly believe that the client is very busy, consuming the link and memory resources of the network system. Therefore, the transport layer of the network system determines the SYN packet as a slow attack packet.

The preset window value here is determined according to actual needs, and is not specifically limited in the embodiments of the present application. For example, the preset window value may be 512 bytes.

For example, the preset window value is 512 bytes, and the window value in the SYN data packet corresponding to the request is 400 bytes, which is smaller than the preset window value of 512 bytes. Then, the transport layer of the network system determines the SYN data packet as a slow attack data packet.

Sub-step 1024, the transport layer of the network system determines each consecutive data packet as a slow attack data packet when each consecutive data packet is a zero window data packet and the second total number of the consecutive data packets is greater than or equal to a second preset number; the window value in the zero window data packet is 0.

The window value in the zero window data packet is 0, and the data packet received by the network system is a zero window data packet. In this case, the network system can only transmit data to the client at a very low bit rate, or the network system needs to wait for a period of time before transmitting data to the client.

When the network system receives consecutive data packets that are all zero window data packets, and the second total number of the consecutive data packets is greater than or equal to the second preset number, the network system will mistakenly believe that the client is very busy in order to consume the link and memory resources of the network system. Therefore, the transport layer of the network system determines that the consecutive data packets are all slow attack data packets.

The second preset number here can be determined according to actual needs. Optionally, the second preset number is greater than or equal to 4, and the size of the second preset number is set appropriately, so that slow attack data packets can be more accurately identified. For example, the transport layer of the network system does not care whether the consecutive data packets are from the same request, as long as the consecutive data packets received are all zero window data packets, and the second total number of consecutive data packets or consecutive zero window data packets is greater than or equal to 4, then the consecutive data packets or consecutive zero window data packets are all slow attack data packets.

For example, the second preset number is 4. If the network system receives 4 consecutive zero-window data packets, the second total number of consecutive data packets or consecutive zero-window data packets is 4, and 4 is equal to the second preset number. Then, the transport layer of the network system will determine the 4 consecutive data packets or 4 consecutive zero-window data packets as slow attack data packets.

Optionally, a load balancer is provided at the transport layer of the network system, and the above step 102 is implemented by the load balancer. A load balancer is provided at the transport layer of the network system, which can improve the performance of the network system. It should be noted that the type of the load balancer is not specifically limited. For example, the load balancer can be a DPVS load balancer developed based on DPDK.

Optionally, after the aforementioned step 102, the method may further include: the transport layer of the network system, when the request is not a slow attack request, releases the data packet corresponding to the request. That is, when the request is not a slow attack request, the data packet corresponding to the request is forwarded or processed normally to ensure normal Forwarding and processing of data packets.

FIG2 is a flowchart of the steps of another slow attack identification method provided in an embodiment of the present application. The method is also applied to the aforementioned network system. Referring to FIG2 , the method includes the following steps.

Step 201: Receive a data packet corresponding to a request.

Step 202: The transport layer of the network system determines the data packet as a slow attack data packet when the data packet meets the preset slow attack condition, and determines the request as a slow attack request when the data packet corresponding to the request includes the slow attack data packet.

The steps 201 and 202 may refer to the aforementioned steps 101 and 102 respectively, and can achieve the same or similar beneficial effects. To avoid repetition, they will not be described again here.

Step 203: When the request is a slow attack request, a protection operation is performed on the request.

In the case that the request is a slow attack request, performing a protection operation on the request can reduce the adverse effects caused by the slow attack request as much as possible.

Optionally, step 203 may include: in the case where the request is a slow attack request, the transport layer of the network system performs a protection operation on the request, that is, the protection operation on the slow attack request is completed at the transport layer of the network system, and there is no need to perform the protection operation on the slow attack request at the application layer, and the application layer does not need to parse the protocol, etc., and thus the protection operation on the slow attack request does not need to occupy the resources of the application layer, so that the application layer has higher processing performance for the application. Moreover, the transport layer is closer to the application layer than the application layer, and the protection operation on the slow attack request is implemented at the transport layer. On the one hand, the protection operation on the slow attack request is implemented as early as possible, ensuring the resource utilization of the back-end application service. On the other hand, it eliminates the need for each back-end application service to perform protection operations on the slow attack request one by one, greatly reducing the operation and maintenance workload.

Optionally, when the request is a slow attack request, the transport layer of the network system performs protection operations on the request, which may include at least one of the following steps.

Step S1: When the request is a slow attack request, the transport layer of the network system discards the data packet corresponding to the request.

In the case that the request is a slow attack request, the transport layer of the network system discards the data packet corresponding to the request, that is, does not respond to the data packet corresponding to the request, which can reduce the adverse effects of the slow attack request.

Step S2: When the request is a slow attack request, the transport layer of the network system disconnects the link corresponding to the request.

In the case that the request is a slow attack request, the transport layer of the network system disconnects the link corresponding to the request. After disconnecting the link corresponding to the request, the network system will no longer receive the data packet corresponding to the request, thereby reducing the adverse effects of the slow attack request.

Step S3: When the request is a slow attack request, the transport layer of the network system adds the source IP address corresponding to the request to a blacklist.

In the case that the request is a slow attack request, the transport layer of the network system adds the source IP address corresponding to the request to the blacklist, and then performs protection operations on the request according to the protection operations in the blacklist, which can reduce the adverse effects of the slow attack request and reduce the subsequent adverse effects brought by the source IP address.

Step S4: When the request is a slow attack request, the transport layer of the network system adds a log record indicating that the request is a slow attack request.

In the case where the request is a slow attack request, the transport layer of the network system adds a log record indicating that the request is a slow attack request, so as to facilitate subsequent search for the slow attack request. For example, in the testing phase of the network system, by adding a log record of the slow attack request, it is possible to grasp as much as possible which slow attack requests the network system is susceptible to.

It should be noted that, in the case where the request is a slow attack request, the transport layer of the network system specifically performs one or more of the above steps to perform the protection operation, which is not specifically limited. For example, in the case where the request is a slow attack request, the transport layer of the network system can disconnect the link corresponding to the request and add the source IP address corresponding to the request to the blacklist.

Optionally, step 203 may include: when the request is a slow attack request and the third total number of slow attack data packets in the data packets corresponding to the request is greater than or equal to a third preset number, performing a protection operation on the request, thereby avoiding misoperation. The third preset number can be set according to actual needs and is not specifically limited in the embodiment of the present application.

Optionally, the third preset number is greater than or equal to 2, that is, when the request is a slow attack request and the third total number of slow attack data packets in the data packets corresponding to the request is greater than or equal to 2, a protection operation is performed on the request, thereby avoiding misoperation and minimizing the adverse effects of slow attacks.

For example, the third preset number is 2, the network system receives a total of 5 data packets corresponding to request B, and the transport layer of the network system identifies that 3 of the 5 data packets are slow attack data packets, then the third total number of slow attack data packets in the data packets corresponding to request B is 3, which is greater than the third preset number 2, and thus, a protection operation is performed for request B. For another example, the third preset number is 2, the network system receives a total of 6 data packets corresponding to request C, and the transport layer of the network system identifies that 1 of the 6 data packets is a slow attack data packet, then the third total number of slow attack data packets in the data packets corresponding to request C is 1, which is less than the third preset number 2, and thus, no protection operation is performed for request C.

Optionally, the aforementioned protection operation for the request when the request is a slow attack request and the third total number of slow attack data packets in the data packets corresponding to the request is greater than or equal to the third preset number may include: when the request is a slow attack request and the third total number of slow attack data packets in the data packets corresponding to the request within the preset period is greater than or equal to the third preset number, the transport layer of the network system performs a protection operation for the request, which can further reduce misoperation. Moreover, the protection operation for the slow attack request is completed at the transport layer of the network system, and there is no need to perform the protection operation for the slow attack request at the application layer. The application layer does not need to parse the protocol, etc., and thus the protection operation for the slow attack request does not need to occupy the resources of the application layer, so that the application layer has higher processing performance for the application. Moreover, the transport layer is closer to the application layer, and the protection operation for the slow attack request is implemented at the transport layer. On the one hand, the protection operation for the slow attack request is implemented as early as possible, ensuring the resource utilization of the back-end application service. On the other hand, it is unnecessary for each back-end application service to perform protection operations for the slow attack request one by one, greatly reducing the operation and maintenance workload.

It should be noted that the preset period can be set according to actual needs. In the embodiment of the present application, There is no specific limitation on the size of the preset period. For example, the preset period may be 900 seconds.

Optionally, in the aforementioned case where the request is a slow attack request and the third total number of slow attack data packets in the data packets corresponding to the request within a preset period is greater than or equal to a third preset number, the transport layer of the network system performs a protection operation on the request, including at least one of the following steps.

Step X1: When the request is a slow attack request and the third total number of slow attack data packets in the data packets corresponding to the request within a preset period is greater than or equal to a third preset number, the transport layer of the network system discards the data packets corresponding to the request.

Step X2: When the request is a slow attack request and a third total number of slow attack data packets in the data packets corresponding to the request within a preset period is greater than or equal to a third preset number, the transport layer of the network system disconnects the link corresponding to the request.

Step X3: When the request is a slow attack request and the third total number of slow attack data packets in the data packets corresponding to the request within the preset period is greater than or equal to the third preset number, the transport layer of the network system adds the source IP address corresponding to the request to the blacklist.

Step X4: When the request is a slow attack request and the third total number of slow attack data packets in the data packets corresponding to the request within the preset period is greater than or equal to the third preset number, the transport layer of the network system adds a log record that the request is a slow attack request.

The above steps X1 to X4 can refer to the above steps S1 to S4 and the above related contents, and will not be described again here to avoid repetition. The above steps X1 to X4 can further reduce misoperation, and the protection operation of the slow attack request is completed at the transport layer of the network system, and there is no need to perform the protection operation of the slow attack request at the application layer. The application layer does not need to parse the protocol, etc., and the protection operation of the slow attack request does not need to occupy the resources of the application layer, so that the application layer has higher processing performance for the application. Moreover, the transport layer is closer to the application layer than the application layer, and the protection operation of the slow attack request is implemented at the transport layer. On the one hand, the protection operation of the slow attack request is implemented as early as possible, ensuring the resource utilization of the back-end application service. On the other hand, it eliminates the need for each application service at the back end to perform protection operations on the slow attack request one by one, greatly reducing the operation and maintenance workload.

It should be noted that the execution order of certain steps of the slow attack identification method of this application is not specifically limited.

FIG3 is a structural diagram of a slow attack identification device provided in an embodiment of the present application. The device is applied to a network system. The device may include: a receiving module 301, which is used to receive a data packet corresponding to a request.

And an identification module 302, which is used in the transport layer of the network system, determines the aforementioned data packet as a slow attack data packet when the aforementioned data packet meets the preset slow attack condition, and determines the request as a slow attack request when the data packet corresponding to the request includes a slow attack data packet.

Optionally, the identification module 302 may include at least one of the following sub-modules.

The first identification submodule is used in the transport layer of the network system. When each consecutive data packet is a small data packet and the first total number of each consecutive data packet is greater than or equal to a first preset number, each consecutive data packet is determined as a slow attack data packet; the length of the small data packet is less than or equal to the preset length.

The second identification submodule is used in the transport layer of the network system to identify two adjacent data corresponding to the same request. When the interval between the receiving times of the packets is greater than or equal to the preset time, the two adjacent data packets are determined as slow attack data packets;

The third identification submodule is used for the transport layer of the network system, and determines the SYN data packet as a slow attack data packet when the window value in the SYN data packet corresponding to the request is less than or equal to the preset window value.

The fourth identification submodule is used for the transport layer of the network system. When each consecutive data packet is a zero window data packet and the second total number of the consecutive data packets is greater than or equal to the second preset number, each consecutive data packet is determined as a slow attack data packet; the window value in the zero window data packet is 0.

Optionally, the slow attack identification device may further include: a protection module, configured to perform a protection operation on the request when the request is a slow attack request.

Optionally, the protection module may include: a first protection submodule, which is used for performing a protection operation on the request at the transport layer of the network system when the request is a slow attack request.

Optionally, the first protection submodule may include at least one of the following units.

The first protection unit is used for discarding a data packet corresponding to a request at a transport layer of a network system when the request is a slow attack request.

The second protection unit is used for disconnecting the link corresponding to the request at the transport layer of the network system when the request is a slow attack request.

The third protection unit is used for, when the request is a slow attack request, the transport layer of the network system to add the source IP address corresponding to the request into a blacklist.

The fourth protection unit is used to add a log record of the request being a slow attack request to the transport layer of the network system when the request is a slow attack request.

Optionally, the protection module may include: a second protection sub-module, used to perform a protection operation on the request when the request is a slow attack request and the third total number of slow attack data packets in the data packets corresponding to the request is greater than or equal to a third preset number.

Optionally, the second protection submodule may include: a fifth protection unit, used for the transport layer of the network system to perform protection operations on the request when the request is a slow attack request and the third total number of slow attack data packets in the data packets corresponding to the request within a preset period is greater than or equal to a third preset number.

Optionally, the fifth protection unit may include at least one of the following sub-units.

The first subunit is used for, when the request is a slow attack request and the third total number of slow attack data packets in the data packets corresponding to the request within a preset period is greater than or equal to a third preset number, the transport layer of the network system discards the data packets corresponding to the request.

The second subunit is used to disconnect the link corresponding to the request at the transport layer of the network system when the request is a slow attack request and the third total number of slow attack data packets in the data packets corresponding to the request within a preset period is greater than or equal to a third preset number.

The third subunit is used for, when the request is a slow attack request and the third total number of slow attack data packets in the data packets corresponding to the request within a preset period is greater than or equal to a third preset number, the transport layer of the network system will add the source IP address corresponding to the request to the blacklist.

The fourth subunit is used for, when the request is a slow attack request and a third total number of slow attack data packets in the data packets corresponding to the request within a preset period is greater than or equal to a third preset number, the network system The transport layer of the system adds logging of slow attack requests.

Optionally, a load balancer is deployed at the transport layer.

Optionally, the slow attack identification device may further include: a release module, which is used in the transport layer of the network system and releases the data packet corresponding to the request when the request is not a slow attack request.

Optionally, the first preset number is greater than or equal to 3; the preset duration is greater than or equal to 120 seconds; and the second preset number is greater than or equal to 4.

Optionally, the third preset number is greater than or equal to 2.

The slow attack identification device has the same or similar beneficial effects as any of the aforementioned slow attack identification methods, which will not be described again to avoid repetition.

The present application is further explained below in conjunction with specific embodiments.

Example

Figure 4 shows a schematic diagram of a partial architecture of a network system provided in an embodiment of the present application. Figure 5 shows a schematic diagram of an initialization process of a network system provided in an embodiment of the present application. Figure 6 shows a schematic diagram of a slow attack process of a network system provided in an embodiment of the present application.

As shown in FIG4 , in the network system, a load balancer is arranged at the transport layer of the network system, and the load balancer realizes the identification of slow attack requests and performs protection operations for the slow attack requests. When the request is not a slow attack request, the load balancer releases the data packet corresponding to the request, and the data packet can be forwarded to the corresponding application service. The application services included in the network system include: application service Nginx, application service Apache, and other application services.

As shown in Figure 5, in this embodiment, after the program of the network system is started, the identification module and the protection module will be loaded, and then the aforementioned first preset number, second preset number, third preset number, preset length, preset duration, preset window value and other configurations will be read. After the configuration is read, the initialization process is completed.

The above configuration in this embodiment can be shown in the following program segment.

Specifically, as shown in FIG6 , 1. the data packet passes through the aforementioned slowhttp_process processing logic.

2. First get dst_port from req->l4hdr, if no match is found, release it.

3. If a match is found, slow attack identification is performed.

(1) If the number of consecutively received http data packets whose size is less than or equal to http_request_size_limit is greater than or equal to http_request_count_limit, it is considered an attack. http_request_size_limit specifies a preset length, and http_request_count_limit specifies a first preset number.

(2) For the same request, if the interval between the receiving times of two consecutive data packets is greater than or equal to http_package_interval_limit, and the number of data packets exceeds http_package_interval_count_limit, it is considered an attack. http_package_interval_limit limits the preset time, while http_package_interval_count_limit limits two consecutive data packets.

(3) If the window value in the TCP SYN packet is smaller than tcp_syn_win_size_limit, it is considered an attack. tcp_syn_win_size_limit defines the preset window value.

(4) If the number of consecutive zero windows received is greater than tcp_zero_win_count_limit, it is considered an attack. tcp_zero_win_count_limit is limited to the second preset number.

4.Slowhttp protection operation process.

(1) When the identification module detects any of the above attacks, the counter of the slow attack data packet is incremented.

(2) When the number of slow attack packets for the same request within the statistical period is greater than exception_count_limit, the action_sip protection operation is performed on the request. The period defines the preset period, and the exception_count_limit defines the third preset number.

The present application also provides an electronic device, see FIG. 7 , comprising: a processor 901 , a memory 902 , and a computer program 9021 stored in the memory and executable on the processor, and the processor implements the slow attack identification method of the aforementioned embodiment when executing the program.

The present application also provides a readable storage medium. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the slow attack identification method of the aforementioned embodiment.

As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

It should be noted that the various information and data obtained in the embodiments of the present application are obtained with the authorization of the information/data holder.

The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the application is not directed to any specific programming language either. It should be understood that various programming languages can be utilized to realize the content of the application described herein, and the description of the above specific languages is to disclose the best mode of implementation of the application.

In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

Similarly, it should be understood that in order to streamline the present application and help understand one or more of the various inventive aspects, in the above description of the exemplary embodiments of the present application, the various features of the present application are sometimes grouped together into a single embodiment, figure, or description thereof. However, the disclosed method should not be interpreted as reflecting the following intention: the claimed application requires more features than the features clearly stated in each claim. More specifically, as reflected in the following claims, the inventive aspects are less than all the features of the single embodiment disclosed above. Therefore, the claims following the specific embodiment are hereby expressly incorporated into the specific embodiment, wherein each claim itself serves as a separate embodiment of the present application.

Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination, except that at least some of such features and/or processes or units are mutually exclusive. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

The various component embodiments of the present application can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all functions of some or all components of the sorting device according to the present application. The present application can also be implemented as a device or apparatus program for executing part or all of the methods described herein. Such an implementation of the present application The program may be stored on a computer readable medium, or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, or provided on a carrier signal, or in any other form.

It should be noted that the above embodiments illustrate the present application rather than limit the present application, and that those skilled in the art may design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets should not be constructed as a limitation to the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of multiple such elements. The present application may be implemented by means of hardware including several different elements and by means of a suitably programmed computer. In a unit claim that lists several devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words may be interpreted as names.

The user information (including but not limited to the user's device information, user personal information, etc.) and related data involved in this application are all information authorized by the user or by all parties.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

The above are only preferred embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the protection scope of the present application.

The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

A slow attack identification method, characterized in that it is applied to a network system, and the method comprises:

Receive the data packet corresponding to the request;

The transport layer of the network system determines the data packet as a slow attack data packet when the data packet meets a preset slow attack condition, and determines the request as a slow attack request when the data packet corresponding to the request includes a slow attack data packet.
The slow attack identification method according to claim 1 is characterized in that the transport layer of the network system, when the data packet meets a preset slow attack condition, determines the data packet as a slow attack data packet, comprising at least one of the following steps:

The transport layer of the network system determines each of the consecutive data packets as a slow attack data packet when each of the consecutive data packets is a small data packet and a first total number of the consecutive data packets is greater than or equal to a first preset number; and the length of the small data packet is less than or equal to a preset length;

The transport layer of the network system determines both of the two adjacent data packets corresponding to the same request as slow attack data packets when the interval between the reception times of the two adjacent data packets is greater than or equal to a preset time.

The transport layer of the network system, when the window value in the SYN data packet corresponding to the request is less than or equal to the preset window value, determines the SYN data packet as a slow attack data packet;

The transport layer of the network system determines each of the consecutive data packets as a slow attack data packet when each of the consecutive data packets is a zero window data packet and the second total number of the consecutive data packets is greater than or equal to a second preset number; the window value in the zero window data packet is 0.
The slow attack identification method according to claim 1, characterized in that the method further comprises:

In the case that the request is a slow attack request, a protection operation is performed on the request.
The slow attack identification method according to claim 3 is characterized in that, when the request is a slow attack request, performing a protection operation on the request comprises:

In the case that the request is a slow attack request, the transport layer of the network system performs a protection operation on the request.
The slow attack identification method according to claim 4 is characterized in that, when the request is a slow attack request, the transport layer of the network system performs a protection operation on the request, comprising at least one of the following steps:

In the case where the request is a slow attack request, the transport layer of the network system discards a data packet corresponding to the request;

In the case where the request is a slow attack request, the transport layer of the network system disconnects the link corresponding to the request;

In the case where the request is a slow attack request, the transport layer of the network system adds the source IP address corresponding to the request to a blacklist;

In the case that the request is a slow attack request, the transport layer of the network system adds a log record indicating that the request is a slow attack request.
The slow attack identification method according to claim 3 is characterized in that, when the request is a slow attack request, performing a protection operation on the request comprises:

When the request is a slow attack request and a third total number of slow attack data packets in the data packets corresponding to the request is greater than or equal to a third preset number, a protection operation is performed on the request.
The slow attack identification method according to claim 6 is characterized in that, when the request is a slow attack request and a third total number of slow attack data packets in the data packets corresponding to the request is greater than or equal to a third preset number, performing a protection operation on the request comprises:

When the request is a slow attack request and the third total number of slow attack data packets in the data packets corresponding to the request within a preset period is greater than or equal to the third preset number, the transport layer of the network system performs a protection operation on the request.
The slow attack identification method according to claim 7 is characterized in that, when the request is a slow attack request and the third total number of slow attack data packets in the data packets corresponding to the request within a preset period is greater than or equal to the third preset number, the transport layer of the network system performs a protection operation on the request, comprising at least one of the following steps:

When the request is a slow attack request and the third total number of slow attack data packets in the data packets corresponding to the request within the preset period is greater than or equal to the third preset number, the transport layer of the network system discards the data packet corresponding to the request;

When the request is a slow attack request and a third total number of slow attack data packets in the data packets corresponding to the request within the preset period is greater than or equal to the third preset number, the transport layer of the network system disconnects the link corresponding to the request;

When the request is a slow attack request and the third total number of slow attack data packets in the data packets corresponding to the request within the preset period is greater than or equal to the third preset number, the transport layer of the network system adds the source IP address corresponding to the request to a blacklist;

When the request is a slow attack request and the third total number of slow attack data packets in the data packets corresponding to the request within the preset period is greater than or equal to the third preset number, the transport layer of the network system adds a log record that the request is a slow attack request.
The slow attack identification method according to any one of claims 1 to 8 is characterized in that a load balancer is deployed at the transport layer.
The slow attack identification method according to any one of claims 1 to 8, characterized in that the method further comprises:

The transport layer of the network system releases the data packet corresponding to the request when the request is not a slow attack request.
The slow attack identification method according to claim 2, characterized in that the first preset number is greater than or equal to 3;

The preset duration is greater than or equal to 120 seconds;

The second preset number is greater than or equal to 4.
The slow attack identification method according to claim 6, characterized in that the third preset number is greater than or equal to 2.
A slow attack identification device, characterized in that it is applied to a network system and comprises:

A receiving module, used for receiving a data packet corresponding to a request;

An identification module is used for the transport layer of the network system. When the data packet meets a preset slow attack condition, the data packet is determined as a slow attack data packet, and when the data packet corresponding to the request includes a slow attack data packet, the request is determined as a slow attack request.
An electronic device, comprising:

A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 12 when executing the program.
A readable storage medium, characterized in that when the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any one of the methods described in claims 1 to 12.