Method, device, and system for network attack protection

1. A method implemented by a network device for providing network attack protection against distributed denial of service attacks, comprising:

receiving, by the network device, information about an attack source, wherein the information about the attack source carries address information about an attacker, wherein the attacker is controlled by a malicious controller to launch a denial-of-service attack, and the attacker and the malicious controller are separate network entities;

obtaining, by the network device, address information about a gateway corresponding to the attacker according to the address information about the attacker and a preset mapping relationship between the attacker and the gateway corresponding to the attacker;

sending, by the network device, a first control message to the gateway corresponding to the attacker, wherein the first control message instructs the gateway corresponding to the attacker to control traffic of the attacker for preventing upstream network traffic of a victim host of the denial of service attack from being blocked;

obtaining, by the network device, address information about the malicious controller according to the address information about the attacker;

obtaining, by the network device, address information about a gateway corresponding to the malicious controller according to the address information about the malicious controller and a preset mapping relationship between the malicious controller and the gateway corresponding to the malicious controller; and

sending, by the network device, a second control message to the gateway corresponding to the malicious controller, wherein the second control message instructs the gateway corresponding to the malicious controller to control traffic of the malicious controller for preventing upstream network traffic of the victim host from being blocked.

2. The method for providing network attack protection against distributed denial of service attacks according to claim 1 , wherein:

the information about the attack source carries an attack protocol type or an attacked port number, the first control message and/or the second control message carries control policy information, and the control policy information comprises the attacked port number and/or a protocol type corresponding to the attack protocol type.

3. The method for providing network attack protection against distributed denial of service attacks according to claim 1 , wherein in the step of sending the first control message to the gateway corresponding to the attacker, the gateway corresponding to the attacker has a shortest network path from the attacker.

4. The method for providing network attack protection against distributed denial of service attacks according to claim 1 , wherein in the step of sending the second control message to the gateway corresponding to the malicious controller, the gateway corresponding to the malicious controller has a shortest network path from the malicious controller.

5. The method for providing network attack protection against distributed denial of service attacks according to claim 1 , wherein the step of obtaining address information about the malicious controller on the attacker network to which the attacker belongs comprises:

sending a query request to a device for monitoring the attacker network, wherein the query request carries the address information about the attacker; and

receiving a query result returned by the device for monitoring the attacker network, wherein the query result carries the address information about the malicious controller on the attacker network to which the attacker belongs.

6. A device for providing network attack protection against distribution denial of service attacks, comprising:

a processor; and

a memory coupled to the processor, wherein the processor is configured to:

receive information about an attack source, wherein the information about the attack source carries address information about an attacker, wherein the attacker is controlled by a malicious controller to launch denial-of-service attacks, and the attacker and the malicious controller are separate network entities;

obtain address information about a gateway corresponding to the attacker according to the address information about the attacker and a preset mapping relationship between the attacker and the gateway corresponding to the attacker;

send a first control message to the gateway corresponding to the attacker according to the address information about the gateway corresponding to the attacker, wherein the first control message instructs the gateway corresponding to the attacker to control traffic of the attacker for preventing upstream network traffic of a victim host of the denial of service attack from being blocked;

obtain address information about the malicious controller according to the address information about the attacker received by the first receiving unit;

obtain address information about a gateway corresponding to the malicious controller according to the address information about the malicious controller and a preset mapping relationship between the malicious controller and the gateway corresponding to the malicious controller; and

send a second control message to the gateway corresponding to the malicious controller, wherein the second control message instructs the gateway corresponding to the malicious controller to control traffic of the malicious controller for preventing upstream network traffic of the victim host from being blocked.

7. The device for providing network attack protection against distributed denial of service attacks according to claim 6 , wherein:

the information about the attack source carries an attack protocol type or an attacked port number, the first control message and/or the second control message carries control policy information, and the control policy information comprises the attacked port number and/or a protocol type corresponding to the attack protocol type.

8. The device for providing network attack protection against distributed denial of service attacks according to claim 6 , wherein:

the gateway corresponding to the malicious controller has a shortest network path from the attacker.

9. The device for providing network attack protection against distributed denial of service attacks according to claim 6 , wherein the processor is configured to:

send a query request to a device for monitoring the attacker network, wherein the query request carries the address information about the attacker; and

receive a query result returned by the device for monitoring the attacker network, wherein the query result carries the address information about the malicious controller on the attacker network to which the attacker belongs.

10. The device for providing network attack protection against distributed denial of service attacks according to claim 6 , wherein:

the gateway corresponding to the malicious controller has a shortest network path from the malicious controller.

11. A system for providing network attack protection against distributed denial of service attacks, comprising:

a first device comprising a non-transitory storage medium with executable instructions for detecting a network attack;

a second device comprising a non-transitory storage medium with executable instructions for network attack protection;

a third device comprising a non-transitory storage medium with executable instructions for monitoring an attacker network; and

a gateway, wherein:

the first device for detecting a network attack is configured to detect an attack source on a network and send information about the attack source to the second device for network attack protection, wherein the information about the attack source carries address information about an attacker;

the second device for network attack protection is configured to receive the information about the attack source sent by the first device for detecting a network attack, query the third device for monitoring an attacker network attack for address information about a malicious controller on an attacker network to which the attacker belongs according to the information about the attack source, wherein the attacker is controlled by the malicious controller to launch denial-of-service attacks; obtain address information about the gateway, which corresponds to the malicious controller, according to the address information about the malicious controller and a preset mapping relationship between the malicious controller and the gateway, and send a control message to the gateway corresponding to the malicious controller, the control message instructs the gateway corresponding to the malicious controller to control traffic of the malicious controller;

the third device for monitoring an attacker network is configured to receive a query request sent by the second device for network attack protection, wherein the query request carries the address information about the attacker, and return the address information about the malicious controller on the attacker network to which the attacker belongs to the second device for network attack protection; and

the gateway is configured to receive the control message sent by the second device for network attack protection and control the traffic of the malicious controller according to the control message for preventing upstream network traffic of a victim host from being blocked.

12. The system for providing network attack protection against distributed denial of service attacks according to claim 11 , wherein:

the information about the attack source carries an attack protocol type or an attacked port number, the control message carries control policy information, and the control policy information comprises the attacked port number and/or a protocol type corresponding to the attack protocol type.

13. The system for providing network attack protection against distributed denial of service attacks according to claim 11 , wherein:

the second device for network attack protection is configured to select a gateway having a shortest network path from the malicious controller as the gateway corresponding to the malicious controller.