DDoS attack defense method, system, and related device

A blocking device for defending against a distributed denial of service attack, the blocking device comprising:

• processing circuitry configured to:
• receive packets that enter a service network that provides services to servers that receive the services from the service network;
• parse the packets to identify attacking packets and generate alarm data based on the attacking packets;
• determine a blocking policy for blocking the attacking packets based on the alarm data and blocking rules;
• and
• initiate a blocking action to block the attacking packets based on the blocking policy,
• wherein the blocking rules are used to determine whether the servers are attacked based on types of clients of an internet service provider, which is defined by at least one of payment method by the clients, bandwidth purchased by the clients, and quantity of users of the clients, and the blocking rules are customized according to a request of one of the clients of the internet service provider, the one of the clients being at least one of a border gateway protocol high-defense client or a client with a priority higher than priorities of other clients.

A non-transitory computer-readable storage medium storing instructions which when executed by at least one processor cause the at least one processor to perform:

• receiving packets that enter a service network providing services to servers that are receiving the services from the service network;
• parsing the packets to identify attacking packets and generating alarm data based on the attacking packets;
• determining a blocking policy for blocking the attacking packets based on the alarm data and blocking rules;
• and
• initiating a blocking action to block the attacking packets based on the blocking policy,
• wherein the blocking rules are used to determine whether the servers are attacked based on types of clients of an internet service provider, which is defined by at least one of payment method by the clients, bandwidth purchased by the clients, and quantity of users of the clients, and the blocking rules are customized according to a request of one of the clients of the internet service provider, the one of the clients being at least one of a border gateway protocol high-defense client or a client with a priority higher than priorities of other clients.