Method and Apparatus for Tracing Attack Source of Abnormal Network Traffic

摘要

The present invention provides a method and an apparatus for tracing an attack source in the case of an abnormal network traffic, where said method comprises: from the network node(s) of an attack link, any or multiple said network nodes are selected as a tracing start point(s) and there into, said attack link is a communication link between an attacked target and an attack source. According to said tracing start point(s), a higher-level network node of said attack link is identified stepwise until a final attack source is confirmed. By adopting said technical solution provided by the present invention, the problems that the network security mechanisms in related technologies can only alleviate a network attack rather than position an attack source are solved, thus an effect can be achieved to trace and position the attack source in a reverse direction.

主权项

1. A method for tracing an attack source in the case of abnormal network traffic, which is characterized in comprising steps of:
from one or more network nodes of an attack link, selecting any or multiple said network nodes as one or more tracing start points, where said attack link is a communication link between an attacked target and an attack source; and