Attack protection method and device, equipment and readable storage medium

Abstract

The invention discloses an attack protection method and device, equipment and a readable storage medium. The method comprises the steps that when it is monitored that a target IP suffers from an ICMPFLOOD attack, an ICMP message sent to the target IP is intercepted, whether the ICMP message is a retransmission message or not is determined, when the ICMP message is the retransmission message, theICMP message is forwarded to a server, and when the ICMP message is not the retransmission message, the ICMP message is discarded. A sending end of an attack destination IP is considered to send an ICMP message irregularly. A retransmission message does not exist; therefore, whether the ICMP message sent to the target IP is a retransmission message or not is verified; whether the sending end is the attack end or the normal end can be effectively determined, so that the non-retransmission message sent by the attack end can be discarded, the ICMP message sent by the normal end can be forwarded,the ICMP FLOOD attack is protected, meanwhile, the normal message is prevented from being mistakenly killed, and the false alarm of service abnormity is avoided.

Description

technical field [0001] The present invention relates to the technical field of network communication security, in particular to an attack protection method and device, equipment and a readable storage medium. Background technique [0002] Internet Control Message Protocol Flood (Internet Control Message Protocol FLOOD, ICMPFLOOD) attack is a common distributed denial of service (Distributed Denial of Service, DDOS) attack, and ICMP FLOOD is a typical bandwidth-blocking DDOS attack method. A large number of ICMP spam messages are sent to the attacked server through the botnet, so that the bandwidth of the attacked server is blocked, normal requests cannot be responded, and the purpose of denial of service is achieved. [0003] In the prior art, adopt the mode (speed-limiting mode) of the quantity of the ICMP message of limiting transmission to defend against ICMPFLOOD attack, yet this mode has following shortcoming: (1) limit the transmission of normal ICMP message, there is ...

AI Technical Summary

Problems solved by technology

[0004] The main purpose of the present invention is to provide an attack protection method, device, equipment, and readable storage medium, aiming at solving the problem of manslaughter in the attack protection method in the prior art, which will cause false positives of business abnormalities; affect the business of the detection server, Lead to the unavailability of detection services; technical problems that lead to business unavailability when the attack end is too dispersed

Images