Traffic attack protection method and device, protection server and storage medium

Abstract

Embodiments of the invention provide a traffic attack protection method and device, a protection server and a storage medium. The method comprises the following steps of acquiring a message to be sentto a target server under a condition that a traffic attack possibility exists in the target server; at least extracting a load of a message whose source port is not a preset source port from the message to be sent to the target server in order to obtain the load of a message to be matched; matching the load of the message to be matched with fingerprint features of a pre-defined attack message, and determining the attack message from the message to be matched, wherein the determined load of the attack message is provided with a character string corresponding to each key field defined by the fingerprint features; and filtering the attack message. According to the embodiments of the invention, the accuracy of traffic attack protection can be improved, a protection effect of the traffic attack is improved, and the normal service provision of the target server is guaranteed.

Description

technical field [0001] The present invention relates to the technical field of network security, in particular to a traffic attack protection method, device, protection server and storage medium. Background technique [0002] Traffic attack refers to an attack method that sends a large number of attack packets to the target server, causing the target server to fail to respond to normal business requests and affecting the service provided by the target server. Among traffic attacks, DDoS (Distributed Denial of Service, Distributed Denial of Service) attacks are the most typical. [0003] The current traffic attack protection method is mainly based on the packet rate limiting strategy, that is, to limit the rate of packets sent from the same source IP to the target IP (the target IP is the IP of the target server to be protected), so that the source IP and target IP latitude The rate limit of the message is carried out, and the messages sent from the same source IP to the tar...

AI Technical Summary

Problems solved by technology

This traffic attack protection method can only limit the rate of packets without distinction, and there is a possibility of killing normal packets by mistake (for example, if the packet traffic of normal business is too large and hits the packet rate limit policy, the packets of normal business will be was killed by mistake), the accuracy of the protection is not high; at the same time, the traffic attack protection based on the packet rate limit policy cannot filter all the attack traffic, the comprehensiveness of the protection is low, and the protection effect is limited

Images