WO2018130137A1 - Method and apparatus for defending against network attacks, medium and device - Google Patents

Abstract

Disclosed are a method and an apparatus for defending against network attacks, a medium and a device. The method comprises: acquiring a service access request message; determining whether the service access request message is an attack message; if so, discarding, at a kernel layer, the service access request message. In the embodiments of the present invention, the attack message is discarded at the kernel layer, without the need for a complete protocol parsing, i.e. without the need to consume a lot of large CPU resources, effectively reducing CPU resources consumption.

Description

Method, device, medium and device for defending against network attacks

The present application claims priority to Chinese Patent Application No. JP-A No. No. No. No. No. No. No. No. No. No. No. No. No. No. No. No. In the application.

Technical field

The embodiments of the present invention relate to the field of Internet technologies, and in particular, to a method, an apparatus, a medium, and a device for defending against network attacks.

Background technique

Current network attacks are mainly classified into traffic attacks and application layer attacks. Traffic attacks generally refer to Layer 3 (network layer) or Layer 4 (transport layer) attacks. The main purpose is to use IP/TCP (English name: Transmission Control Protocol/ Internet Protocol) Some flaws in the protocol itself, forging source IP to create attack packets to combat traffic to make traffic smash. For example, the most common denial of service attack (SYN-flood) is a typical traffic attack. The attacker fakes TCP handshake. The signal (English full name: SYNCHRONOUS, abbreviation: SYN) package to combat the ingress traffic of the equipment room, so that the normal business package can not be processed, so that the normal business is paralyzed. Other traffic attacks include domain name system (DNS) reflection attacks, user datagram protocol attacks (UDP-flood) attacks, and network time protocol (NTP) reflection attacks. The 7-layer (application layer) attack generally refers to the CC (Challenge Collapsar) attack, which is mainly for specific attacks against actual services. It can also be regarded as a hypertext transfer protocol (abbreviation: HTTP) attack. For example, the most common one is high. Frequent access to an interface, making the application server anomaly and affecting the business, such as by constructing a request to brush tickets or swipe verification codes, etc., are all within the scope of CC attacks.

However, the current security defenses are mainly concentrated on distributed denial of service (DDoS) traffic cleaning attacks. However, there are not many effective methods for CC attacks on the application layer based on HTTP requests. The existing defense methods are based on Hardware defense techniques, such as RST (Reset the connection), bounce for defense. RST bounce is a common defense attack. The main principle is that when a user initiates a TCP connection request, the connection request is first rejected by returning the RST packet, and the real user will retry at this time, that is, initiate a second connection request. Then the firewall is released again, but the attacker (such as the program) will not retry, so the interception purpose is achieved. However, RST rebound has many drawbacks. One of them is that the RST bounce is implemented in the traditional load balancing layer 7 layer interception (that is, directly intercepted in the load balancing program or device), and needs to perform complete HTTP protocol parsing, which requires more consumption. CPU resources.

Summary of the invention

The embodiment of the invention provides a method and a device for defending against network attacks. The interception of attack packets at the kernel layer does not require complete HTTP protocol parsing, and can effectively reduce CPU resources consumed.

The method for defending against network attacks provided by the embodiments of the present invention includes:

Obtain a service access request message;

Determine whether the service access request packet is an attack packet;

If yes, the service access request message is discarded at the kernel layer.

The service access request packet is discarded at the kernel layer, including:

The service access request message is discarded at the kernel layer by operating Iptables.

After the service access request packet is discarded at the kernel layer by the operation of the Iptables, the method further includes:

Release the TCP connection corresponding to the service access request packet.

The TCP connection corresponding to the service access request packet is released, including:

The Iptables is used to change the packet type of the TCP packet corresponding to the TCP connection to the connection reset RST packet to release the TCP connection corresponding to the service access request message.

The determining whether the service access request packet is an attack packet includes:

Collect business access request logs;

Whether the service access request packet is an attack packet is determined according to the feature information of the service access request log.

And determining, according to the feature information of the service access request log, whether the service access request packet is an attack packet, including:

The service access request packet is an attack packet according to the feature information of the service access request log and the currently accessed domain name.

And determining, according to the feature information of the service access request log and the currently accessed domain name, whether the service access request packet is an attack packet, including:

Determining the historical access frequency of the service access request packet according to the request time of the service access request log;

Determine the domain name currently accessed by the service access request log;

When the historical access frequency of the service access request packet is greater than the preset value and the current access domain name is the preset domain name, the service access request packet is determined to be an attack packet.

After determining that the service access request packet is an attack packet, the method further includes:

Determine the risk level of the service access request message;

The step of discarding the service access request message at the kernel layer when the risk level of the service access request message is the first degree of danger level;

When the risk level of the service access request message is the second degree of danger level, a warning indication is displayed, and the warning indication is used to indicate that there is currently a network attack, and the first degree of danger level is higher than the second level of danger level.

The device for defending against network attacks provided by the embodiment of the invention includes:

An obtaining module, configured to obtain a service access request message;

a first determining module, configured to determine whether the service access request packet obtained by the acquiring module is an attack packet;

The discarding module is configured to discard the service access request packet at the kernel layer if the first determining module determines that the service access request packet is an attack packet.

The discarding module is specifically used to:

The service access request message is discarded at the kernel layer by operating Iptables.

Wherein, the device further comprises:

The release module is configured to release the TCP connection corresponding to the service access request message after the service layer discards the service access request message by operating the Iptables.

The release module is specifically used to:

The Iptables is used to change the packet type of the TCP packet corresponding to the TCP connection to the connection reset RST packet to release the TCP connection corresponding to the service access request packet.

The first determining module includes:

a collection unit, configured to collect a service access request log;

The determining unit is configured to determine, according to the feature information of the service access request log collected by the collecting unit, whether the service access request packet is an attack packet.

Wherein, the determining unit is further configured to:

The service access request packet is an attack packet according to the feature information of the service access request log and the currently accessed domain name.

Wherein, the determining unit is specifically used for:

Determining the historical access frequency of the service access request packet according to the request time of the service access request log;

Determine the domain name currently accessed by the service access request log;

When the historical access frequency of the service access request packet is greater than the preset value and the current access domain name is the preset domain name, the service access request packet is determined to be an attack packet.

Wherein, the device further comprises:

a second determining module, configured to determine a risk level of the service access request message after the first determining module determines that the service access request message is an attack message;

a triggering module, configured to: when the second determining module determines that the risk level of the service access request message is the first risk level, triggering the discarding module to discard the service access request message at the kernel layer;

a display module, configured to: when the second determining module determines that the risk level of the service access request message is a second degree of danger level, displaying a warning indication, where the warning indication is used to indicate that a current network attack exists, and the first risk level is higher than the first Two levels of danger.

In the computer readable storage medium provided by the embodiment of the present invention, a computer program is stored on the storage medium, and when the program is executed by the processor, the steps of the foregoing method are implemented.

A computer device provided by an embodiment of the present invention includes a memory, a processor, and a computer program stored on the memory and operable on the processor, and the processor implements the steps of the foregoing method when the program is executed.

Therefore, compared with the traditional load balancing layer 7 layer interception attack packet, in the embodiment of the present invention, the attack packet is discarded at the kernel layer, and complete protocol parsing is not required, that is, no large CPU resources are consumed. Can effectively reduce the consumption of CPU resources.

DRAWINGS

The accompanying drawings are intended to provide a further understanding of the embodiments of the embodiments of the invention Improper limitations. In the drawing:

FIG. 1 is a schematic flowchart diagram of a method for defending against network attacks according to an embodiment of the present invention;

2 is another schematic flowchart of a method for defending against network attacks according to an embodiment of the present invention;

3 is a schematic structural diagram of a system for implementing a defense against a network attack according to an embodiment of the present invention;

4 is a schematic structural diagram of a Storm big data computing platform according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an apparatus for defending against network attacks according to an embodiment of the present invention;

FIG. 6 is another schematic structural diagram of an apparatus for defending against network attacks according to an embodiment of the present invention;

FIG. 7 is another schematic structural diagram of an apparatus for defending against network attacks according to an embodiment of the present invention;

FIG. 8 is another schematic structural diagram of an apparatus for defending against network attacks according to an embodiment of the present invention.

detailed description

The embodiments of the present invention will be further described with reference to the drawings and specific embodiments.

The following is a description of a method for defending against a network attack according to an embodiment of the present invention. Referring to FIG. 1 , FIG. 1 is a schematic flowchart of an embodiment of a method for defending against a network attack according to an embodiment of the present invention, including:

Step 101: Obtain a service access request message.

Step 102: Determine whether the service access request packet is an attack packet, and if yes, perform step 103.

Step 103: Discard the service access request message at the kernel layer.

At this point, the basic process of the embodiment of the present invention has been completed. In the embodiment of the present invention, the service access request packet is obtained, and the service access request packet is determined to be an attack packet, and the service access request packet is determined to be an attack packet. The service access request message is discarded at the kernel layer. It can be seen that, in the embodiment of the present invention, the attack packet is discarded at the kernel layer, and the complete protocol parsing is not required, so that it is not necessary to consume a large amount of CPU resources. Can effectively reduce the consumption of CPU resources.

For ease of understanding, a detailed description of the embodiments of the present invention is provided below. Referring to FIG. 2, FIG. 2 is a schematic flowchart of another embodiment of a method for defending against network attacks according to an embodiment of the present invention, including:

Step 201: Collect a service access request log.

The Kafka (Apache Kafka) queue is a high-throughput distributed message queue that records all the action flow data in a website. For example, user web browsing, search, and other user behavior. A data processing framework specifically for handling massive business access request logs, user behavior, and website operations statistics. Collecting business access request logs using Kafka queues has the following characteristics:

(1) The disk data structure with time complexity at O(1) to provide message persistence, even for messages exceeding the terabyte (Terabyte) level, can maintain storage stability for a long time.

(2) High throughput. In practical applications, even ordinary hardware Kafka can support collecting millions of messages per second.

(3) Support for partitioning messages, that is, support for assigning messages to different topic partitions, and supporting Hadoop parallel data loading.

That is, when combined with data mining, behavior analysis, operational monitoring and other requirements, Kafka queues can meet a variety of real-time online and offline processing, as well as low latency and batch throughput performance requirements. In the embodiment of the present invention, the HTTP request is used as an example, and the HTTP access request log can be collected through the Kafka queue.

Step 202: Obtain a service access request message.

Step 203: Determine, according to the feature information of the service access request log, whether the service access request packet is an attack packet. When the service access request packet is determined as the attack packet according to the feature information of the service access request log, step 204 is performed.

The service access request log is a file for recording information related to the access process, such as the access time and the source IP address of the service access request, for a certain period of time. For example, in the embodiment of the present invention, the HTTP access request packet is an attack message according to the feature information of the HTTP access request log, wherein the HTTP access request log is characterized. Information includes, but is not limited to:

HTTP request header;

HTTP response status code;

HTTP response status header;

HTTP response status body;

HTTP request time;

HTTP request length.

It should be understood that the HTTP access record of the request log record can be used to determine the access status of the currently acquired HTTP access request message within a certain period of time. For example, information such as the historical access frequency and the total number of accesses of the HTTP access request message in the preset time period is determined. The preset time period may be set according to the actual application, for example, the preset time period may be within one month, and the like, which is not limited herein.

In some examples of the present invention, determining whether the service access request packet is an attack packet according to the feature information of the service access request log, specifically:

Determining the historical access frequency of the service access request packet according to the request time of the service access request log;

The request time of the service access request log determines the historical access frequency of the service access request message. When the historical access frequency of the service access request message is greater than the preset value, the service access request message is determined to be an attack message. The preset value can be set according to actual needs, which is not limited herein. It should be noted that whether the foregoing service access request packet is an attack packet is only one of the implementation manners. According to the feature information of the service access request log, it can be determined whether the currently obtained service access request packet is an attack. The message is not limited here.

It should be understood that, in a practical application, the load balancing server is a control server, and all user service access requests are first sent to the load balancing server, and then the load balancing server specifically allocates the service access request to a certain one according to the actual processing server status. Actually processed in the server. The load balancing server generally only performs load balancing task allocation, but is not a server that actually processes the service access request. Behind the same load balancing server, generally corresponds to multiple domain names. E.g. Sohu corresponding server load balancing, for example, behind a load balancing domain name server is http: //www.sohu.com, i.e. Sohu master, there is a http://m.sohu.com, i.e. Sohu's mobile host station has different behaviors for different domain names for the same message, that is, only the same message is allowed to access certain domain names. In some embodiments of the present invention, the feature information of the service access request log and the currently accessed domain name are used to determine whether the service access request message is an attack message.

For example, the historical access frequency of the service access request packet is determined, and the domain name currently accessed by the service access request log is determined. When the historical access frequency of the service access request packet is greater than a preset value and the current access domain name is a preset domain name, The service access request packet is determined to be an attack packet.

For example, when the historical access frequency of an IP packet is higher than the preset value, the IP packet is identified as the IP packet of the mobile terminal ( http://m.sohu.com ) that attacks Sohu. The generated service access request cannot pass through the firewall, but the normal access to the Sohu's primary station ( http://m.sohu.com ) is not affected. Therefore, in the embodiment of the present invention, the same IP packet can be used. The behavior of different domain names of the load balancing server is different, that is, the domain name can be used to restrict the behavior of the IP packet. For example, the IP packet is not allowed to access certain domain names behind the same balanced load, instead of being completely disabled. It enhances the diversity of the solution and can effectively reduce the situation that the business corresponding to some domain names cannot be performed normally.

Step 204: Discard the service access request message at the kernel layer by operating the Ip table (Iptables).

Iptables is a packet processing module inside the core layer of the Linux operating system. It has a network address translation function, specifically a firewall function for modifying packet content and packet filtering.

In the embodiment of the present invention, after determining that the service access request packet is an attack packet, the service access request packet is discarded at the kernel layer by operating the Iptables.

Optionally, in some embodiments of the present invention, after determining that the service access request message is an attack message, the method further includes:

Determine the risk level of the service access request message;

The step of discarding the service access request message at the kernel layer is triggered when the risk level of the service access request message is the first degree of danger level;

When the risk level of the service access request message is the second degree of danger level, a warning indication is displayed, where the warning indication is used to indicate that there is currently a network attack, wherein the first risk level is higher than the second risk level.

That is, in the embodiment of the present invention, the risk level of the attack message may be classified into a first risk level and a second risk level, wherein the risk level of the attack message may be based on some access conditions of the attack message. For example, the historical access frequency, the access path ring repetition degree, and the like are determined, and are not limited herein. After determining that the service access request packet is an attack packet, the service access request packet is determined by the degree of danger level, and the service access request packet is processed differently according to the risk level of the service access request packet.

For example, each attack packet is scored, and the scoring criteria may include historical access frequency, access request time difference, access path loop repeatability, access path dispersion, access status code difference, etc., and then combined according to these scoring standards. Into a score, the range of the score is [0,99], 0 is harmless, 99 is the most dangerous, the user can set the danger range, such as 60 no treatment, 60 to 80 is the second danger level, When it is 60 minutes to 80 minutes, only the alarm system is notified to display the alarm, which is used to indicate that there is a current network attack, and 80 points or more is the first dangerous degree level, and when it is 80 points or more, the actual interception is performed.

Step 205: Release the TCP connection corresponding to the service access request message.

In the embodiment of the present invention, after the service access request message is discarded at the kernel layer by the operation of the Iptables, the TCP connection corresponding to the service access request message is released. It should be understood that for an HTTP request, a TCP connection is first performed, and an HTTP protocol layer session is performed after the TCP connection is established. When it is determined that the HTTP access request packet corresponding to the HTTP request matches the attack packet, the The HTTP access request packet is discarded, and the TCP connection corresponding to the HTTP access request packet is released, which can effectively reduce the number of TCP connections on the server.

Preferably, in the embodiment of the present invention, the TCP connection corresponding to the service access request message is released, specifically by the following manner:

By operating Iptables, the packet type of the TCP packet corresponding to the TCP connection is changed to the connection reset RST packet, and the purpose of releasing the TCP connection corresponding to the service access request message is achieved.

For ease of understanding, taking an HTTP access request as an example, an application example of the above method is described by the Storm big data computing platform:

As shown in FIG. 3, FIG. 3 is a schematic structural diagram of a system for implementing a method for defending against a network attack according to an embodiment of the present invention. Among them, the interceptor mainly plays the role of intercepting the attack message at the kernel layer, and intercepts the kernel in the iptabl es. The interceptor sets the matching rule in the kernel by operating the iptables. When the packet matching rule occurs, the interception action is triggered.

Figure 4 shows a schematic diagram of the Storm big data computing platform, including log input module (loginput), filtering module (filter), IP module (IP), configuration module (Conf), and alarm module (alert). . Obtain an HTTP access request log from the kafka queue through the log input module, and enter the filtering module. The filtering module filters the HTTP access request log and eliminates the invalid HTTP access request log. For example, a data error or missing log occurs in the HTTP access request log. For example, the date of the HTTP access request log record exceeds the log of the current time, and for example, a log with missing data such as the HTTP request header appears. In the embodiment of the present invention, the configuration may be performed according to the actual application, and the log of the case is configured as an invalid HTTP access request log, which is not limited herein.

The filtering module then extracts the feature information of the valid HTTP access request log, such as the request time of the HTTP access request log, and sends the feature information to the IP module after extracting the feature information. The matching parameters are configured in the configuration file of the Storm big data computing platform. The configuration module calculates the matching rules of the configuration files in the platform according to the Storm big data, and the matching rules are applied to the IP module. The IP module sends the filtering module through the filtering module. The feature information is used to classify the HTTP access request message for each received HTTP access request message, for example, to query the historical access frequency of the HTTP access request message by using the feature information, according to the KMP algorithm. Determine the domain name accessed by the HTTP access request packet. Once the behavior of the HTTP access request message matches the rule, for example, the number of accesses of the HTTP access request message in the last 2 days is higher than the set number of times, and the domain name accessed by the HTTP access request message is a preset domain name, it will be determined. The HTTP access request packet is an attack packet, and the HTTP access request packet is sent to the alert module. The alert module performs different actions according to the severity level of the HTTP access request packet, and the risk of the service access request packet is When the degree of severity is the first level of danger, the step of discarding the service access request message at the kernel layer is triggered. When the degree of danger of the service access request message is the second degree of danger level, a warning indication is displayed, and the warning indication is used for Indicates that there is currently a cyber attack, wherein the first level of danger is higher than the second level of risk.

As can be seen from the foregoing technical solutions, the embodiment of the present invention provides a method and device for defending a network attack, by obtaining a service access request packet, determining whether the service access request packet is an attack packet, and determining a service access request packet. When the packet is an attack packet, the service access request packet is discarded at the kernel layer. Therefore, compared with the traditional load balancing layer 7 layer, the attack packet is discarded. In the embodiment of the present invention, the attack packet is discarded at the kernel layer, and complete protocol parsing is not required, so that no large consumption is required. CPU resources can effectively reduce the CPU resources consumed.

The method for defending against network attacks is described in the foregoing embodiment of the present invention. Based on the method, the embodiment of the present invention provides a device for defending against network attacks, and the following provides a defense against network attacks according to an embodiment of the present invention. The device is described.

Referring to FIG. 5, FIG. 5 is a schematic structural diagram of an apparatus for defending against network attacks according to an embodiment of the present invention. The apparatus includes an obtaining module 501, a first determining module 502, and a discarding module 503. Function description:

The obtaining module 501 is configured to obtain a service access request packet.

The first determining module 502 is configured to determine whether the service access request packet obtained by the obtaining module 501 is an attack packet.

The discarding module 503 is configured to discard the service access request message at the kernel layer if the first determining module 502 determines that the service access request message is an attack message.

In a possible implementation, the discarding module 503 is specifically configured to:

The service access request message is discarded at the kernel layer by operating Iptables.

Referring to FIG. 5, referring to FIG. 6, in a possible implementation, the apparatus further includes:

The release module 504 is configured to release the TCP connection corresponding to the service access request message after the service layer discards the service access request message by operating the Iptables.

In one possible implementation, the release module 504 is specifically configured to:

The Iptables is used to change the packet type of the TCP packet corresponding to the TCP connection to the connection reset RST packet to release the TCP connection corresponding to the service access request message.

Referring to FIG. 6, referring to FIG. 7, in a possible implementation, the first determining module 502 includes:

The collecting unit 5021 is configured to collect a service access request log.

The determining unit 5022 is configured to determine, according to the feature information of the service access request log collected by the collecting unit 5021, whether the service access request message is an attack message.

In one possible implementation, the determining unit 5022 is further configured to:

The service access request packet is an attack packet according to the feature information of the service access request log and the currently accessed domain name.

In a possible implementation, the determining unit 5022 is specifically configured to:

Determining the historical access frequency of the service access request packet and the accessed domain name according to the request time of the service access request log;

When it is determined that the historical access frequency of the service access request packet is greater than the preset value and the access domain name is the preset domain name, the service access request packet is determined to be an attack packet.

In a possible implementation, the determining unit 5022 is specifically configured to:

Determining the historical access frequency of the service access request packet according to the request time of the service access request log;

Determine the domain name currently accessed by the service access request log;

When the historical access frequency of the service access request packet is greater than the preset value and the current access domain name is the preset domain name, the service access request packet is determined to be an attack packet.

Referring to FIG. 7, referring to FIG. 8, in a possible implementation, the device further includes:

The second determining module 505 is configured to determine a risk level of the service access request message after the first determining module 502 determines that the service access request message is an attack message;

The triggering module 506 is configured to: when the second determining module 505 determines that the risk level of the service access request message is the first risk level, triggering the discarding module to discard the service access request message at the kernel layer;

The display module 507 is configured to: when the second determining module 505 determines that the risk level of the service access request message is the second degree of danger level, display a warning indication, where the warning indication is used to indicate that the network attack currently exists, and the first risk level is high. At the second level of danger.

As can be seen from the foregoing technical solutions, the embodiment of the present invention provides a method and device for defending a network attack, by obtaining a service access request packet, determining whether the service access request packet is an attack packet, and determining a service access request packet. When the packet is an attack packet, the service access request packet is discarded at the kernel layer. Therefore, in the embodiment of the present invention, the attack packet is discarded at the kernel layer, and complete protocol parsing is not required, that is, the CPU resources are not consumed, and the consumed CPU resources can be effectively reduced.

A person skilled in the art should understand that the technical solutions of the present invention may be modified or equivalent, without departing from the spirit and scope of the present invention, and should be included in the scope of the claims.

Those of ordinary skill in the art will appreciate that all or some of the steps, systems, and functional blocks/units of the methods disclosed above may be implemented as software, firmware, hardware, and suitable combinations thereof. In a hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of several physical The components work together. Some or all of the components may be implemented as software executed by a processor, such as a digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer readable medium, which may include computer storage media (or non-transitory media) and communication media (or transitory media). As is well known to those of ordinary skill in the art, the term computer storage medium includes volatile and nonvolatile, implemented in any method or technology for storing information, such as computer readable instructions, data structures, program modules or other data. Sex, removable and non-removable media. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridge, magnetic tape, magnetic disk storage or other magnetic storage device, or may Any other medium used to store the desired information and that can be accessed by the computer. Moreover, it is well known to those skilled in the art that communication media typically includes computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and can include any information delivery media. .

Industrial applicability

In the embodiment of the present invention, the attack packet is discarded at the kernel layer, and complete protocol parsing is not required, that is, the CPU resources are not consumed, and the consumed CPU resources can be effectively reduced.

Claims (18)

A method of defending against network attacks, including: Obtain a service access request message; Determining whether the service access request packet is an attack packet; If yes, the service access request message is discarded at the kernel layer. The method of claim 1, wherein the discarding the service access request message at the kernel layer comprises: The service access request message is discarded at the kernel layer by operating the Ip table. The method of claim 2, wherein the method further comprises: after the core layer discards the service access request message by operating the Ip table, the method further comprising: The TCP connection corresponding to the service access request message is released. The method of claim 3, wherein the releasing the TCP connection corresponding to the service access request message comprises: The packet type of the TCP packet corresponding to the TCP connection is changed to the connection reset RST packet by the operation of the Ip table to release the TCP connection corresponding to the service access request message. The method of claim 1, wherein the determining whether the service access request message is an attack message comprises: Collecting the service access request log; And determining, according to the feature information of the service access request log, whether the service access request packet is an attack packet. The method according to claim 5, wherein the determining, according to the feature information of the service access request log, whether the service access request message is an attack message, includes: And determining, according to the feature information of the service access request log and the currently accessed domain name, whether the service access request message is an attack message. The method of claim 6, wherein determining whether the service access request message is an attack message according to the feature information of the service access request log and the currently accessed domain name includes: Determining, according to the request time of the service access request log, a historical access frequency of the service access request message; Determining a domain name currently accessed by the service access request log; When the historical access frequency of the service access request packet is greater than a preset value, and the current access domain name is a preset domain name, the service access request packet is determined to be an attack packet. The method according to any one of claims 1 to 7, wherein, after the determining that the service access request message is an attack message, the method further comprises: Determining a risk level of the service access request message; And the step of discarding the service access request message at the kernel layer when the risk level of the service access request message is a first degree of danger level; When the risk level of the service access request message is a second degree of danger level, displaying a warning indication, the warning indication is used to indicate that a network attack currently exists, and the first risk level is higher than the second risk Degree level. A device for defending against network attacks, including: An obtaining module, configured to obtain a service access request message; a first determining module, configured to determine whether the service access request packet obtained by the acquiring module is an attack packet; And a discarding module, configured to discard the service access request message at the kernel layer, if the first determining module determines that the service access request packet is an attack packet. The apparatus of claim 9, wherein the discarding module is specifically configured to: The service access request message is discarded at the kernel layer by operating the Ip table. The device of claim 10, wherein the device further comprises: The release module is configured to release the TCP connection corresponding to the service access request message after the kernel layer discards the service access request message by operating the Ip table. The apparatus according to claim 11, wherein the release module is specifically configured to: The packet type of the TCP packet corresponding to the TCP connection is changed to the connection reset RST packet by the operation of the Ip table to release the TCP connection corresponding to the service access request message. The apparatus of claim 9, wherein the first determining module comprises: a collecting unit, configured to collect the service access request log; And a determining unit, configured to determine, according to the feature information of the service access request log collected by the collecting unit, whether the service access request message is an attack message. The apparatus according to claim 13, wherein the determining unit is further configured to: And determining, according to the feature information of the service access request log and the currently accessed domain name, whether the service access request message is an attack message. The apparatus according to claim 14, wherein the determining unit is specifically configured to: Determining, according to the request time of the service access request log, a historical access frequency of the service access request message; Determining a domain name currently accessed by the service access request log; When the historical access frequency of the service access request packet is greater than a preset value, and the current access domain name is a preset domain name, the service access request packet is determined to be an attack packet. The device according to any one of claims 9 to 15, wherein the device further comprises: a second determining module, configured to determine a risk level of the service access request message after the first determining module determines that the service access request message is an attack message; a triggering module, configured to trigger, when the second determining module determines that the risk level of the service access request message is a first degree of danger level, triggering the discarding module to discard the service access request message at the kernel layer ; a display module, configured to: when the second determining module determines that the risk level of the service access request message is a second degree of danger level, displaying a warning indication, where the warning indication is used to indicate that a network attack currently exists, The first degree of danger level is higher than the second level of danger level. A computer readable storage medium having stored thereon a computer program, the program being executed by a processor to perform the steps of the method of any one of claims 1-8. A computer device comprising a memory, a processor, and a computer program stored on the memory and operable on the processor, the processor executing the program to implement any one of claims 1 to The steps of the method.

Images