# US 10,771,501 B2 · DDoS attack defense method, system, and related device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,501 B2 - Document ID: US10771501B2 - Status: Granted - Kind: B2 - Application number: 16/372,113 - Filed: 2019-04-01 - Published: 2019-07-25 - Granted: 2020-09-08 - Earliest claimed: 2016-12-15 - Assignees: Tencent Technology (Shenzhen) Company Limited - Applicants: Tencent Technology (Shenzhen) Company Limited - Inventors: Hu Chen - Web page: https://patentgrep.com/patent/US10771501B2 ## CPC - H04L 63/1458: {Denial of Service} - H04L 41/06: Management of faults, events, alarms or notifications - H04L 63/0263: {Rule management} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method, blocking device, and a non-transitory computer-readable storage medium are provided. For example, the method is performed by processing circuitry of the blocking device. In the method, alarm data that includes attacking information of attacking packets among packets that enter a service network that provides services to servers is received. The alarm data is generated based on parsing the packets to identify the attacking packets and to determine the attacking information of the attacking packets. A blocking policy for blocking the attacking packets is determined based on the alarm data and blocking rules for determining whether the servers are attacked. A blocking action is initiated to block the attacking packets based on the blocking policy. ## Claims ### Claim 1 A method for defending against a distributed denial of service attack, the method comprising: receiving, by a blocking device, packets that enter a service network providing services to servers that are receiving the services from the service network; parsing the packets to identify attacking packets and generating alarm data based on the attacking packets; determining, by the blocking device, a blocking policy for blocking the attacking packets based on the alarm data and blocking rules; and initiating, by the blocking device, a blocking action to block the attacking packets based on the blocking policy, wherein the blocking rules are used to determine whether the servers are attacked based on types of clients of an internet service provider, which is defined by at least one of payment method by the clients, bandwidth purchased by the clients, and quantity of users of the clients, and the blocking rules are customized according to a request of one of the clients of the internet service provider, the one of the clients being at least one of a border gateway protocol high-defense client or a client with a priority higher than priorities of other clients. ### Claim 2 (depends on 1) The method of claim 1, wherein the packets that enter the service network are mirrored by an optical splitter from the internet service provider in real time. ### Claim 3 (depends on 1) The method of claim 1, wherein the packets to identify the attacking packets are parsed according to a specification of a network protocol stack of the service network. ### Claim 4 (depends on 3) The method of claim 3, wherein the alarm data contains at least one of: an attack time; an attack type; a destination internet protocol; an attack position; a value corresponding to the packets; a transmission control protocol of the network protocol stack; or a user datagram protocol of the network protocol stack. ### Claim 5 (depends on 1) The method of claim 1, wherein the determining the blocking policy for blocking the attacking packets comprises: determining a type of a client of the internet service provider according to a destination internet protocol of the alarm data; obtaining a blocking threshold corresponding to the determined type of the client; comparing packets of the destination internet protocol of the alarm data with the obtained blocking threshold and a security threshold corresponding to the servers; sending a first notification of the blocking action to the servers when the packets of the destination internet protocol of the alarm data are greater than or equal to the obtained blocking threshold and are smaller than the security threshold corresponding to the servers; and sending a second notification of the blocking action to the internet service provider when the packets of the destination internet protocol of the alai data are greater than or equal to the security threshold corresponding to the servers. ### Claim 6 (depends on 5) The method of claim 5, wherein the initiating the blocking action to block the attacking packets based on the blocking policy comprises one of: causing an ingress router or a core switch of the servers to discard the packets of the destination internet protocol of the alarm data; or causing a blocking interface of the internet service provider to discard the packets of the destination internet protocol before the packets reach the servers. ### Claim 7 (depends on 1) The method of claim 1, wherein the determining the blocking policy for blocking the attacking packets comprises: obtaining a plurality of destination internet protocols of the alarm data having a same alarm time; comparing a sum of the packets of the plurality of destination internet protocols of the alarm data with a security threshold corresponding to the servers; determining the destination internet protocols that are to be blocked through the blocking action based on the types of clients of the internet service provider and the packets corresponding to the plurality of destination internet protocols of the alarm data when the sum of the packets of the plurality of destination internet protocols of the alarm data is greater than or equal to the security threshold corresponding to the servers; and sending a notification of the blocking action to the internet service provider. ### Claim 8 (depends on 7) The method of claim 7, wherein the initiating the blocking action to block the attacking packets based on the blocking policy comprises: causing a blocking interface of the internet service provider to discard the packets of the determined destination internet protocol before the packets reach the servers. ### Claim 9 (depends on 1) The method of claim 1, further comprising: sending a result of the blocking action to a client of the internet service provider so that the client adjusts an internet service that is affected by the attacking packets in real time or selects an alternative internet service, wherein the result of the blocking action contains at least one of a blocking time, a service type of the attacking packets, or a value corresponding to the packets. ### Claim 10 A blocking device for defending against a distributed denial of service attack, the blocking device comprising: processing circuitry configured to: receive packets that enter a service network that provides services to servers that receive the services from the service network; parse the packets to identify attacking packets and generate alarm data based on the attacking packets; determine a blocking policy for blocking the attacking packets based on the alarm data and blocking rules; and initiate a blocking action to block the attacking packets based on the blocking policy, wherein the blocking rules are used to determine whether the servers are attacked based on types of clients of an internet service provider, which is defined by at least one of payment method by the clients, bandwidth purchased by the clients, and quantity of users of the clients, and the blocking rules are customized according to a request of one of the clients of the internet service provider, the one of the clients being at least one of a border gateway protocol high-defense client or a client with a priority higher than priorities of other clients. ### Claim 11 (depends on 10) The blocking device of claim 10, wherein the packets that enter the service network are mirrored by an optical splitter from the internet service provider in real time, and the packets to identify the attacking packets are parsed according to a specification of a network protocol stack of the service network. ### Claim 12 (depends on 11) The blocking device of claim 11, wherein the alarm data contains at least one of: an attack time; an attack type; a destination internet protocol; an attack position; a value corresponding to the packets; a transmission control protocol of the network protocol stack; or a user datagram protocol of the network protocol stack. ### Claim 13 (depends on 10) The blocking device of claim 10, wherein the determining the blocking policy for blocking the attacking packets comprises: determining a type of a client of the internet service provider according to a destination internet protocol of the alarm data; obtaining a blocking threshold corresponding to the determined type of the client; comparing packets of the destination internet protocol of the alarm data with the obtained blocking threshold and a security threshold corresponding to the servers; sending a first notification of the blocking action to the servers when the packets of the destination internet protocol of the alarm data are greater than or equal to the obtained blocking threshold and are smaller than the security threshold corresponding to the servers; and sending a notification of the blocking action to the internet service provider when the packets of the destination internet protocol of the alarm data are greater than or equal to the security threshold corresponding to the servers. ### Claim 14 (depends on 13) The blocking device of claim 13, wherein the initiating the blocking action to block the attacking packets based on the blocking policy comprises one of: causing an ingress router or a core switch of the servers to discard the packets of the destination internet protocol of the alarm data; or causing a blocking interface of the internet service provider to discard the packets of the destination internet protocol before the packets reach the servers. ### Claim 15 (depends on 10) The blocking device of claim 10, wherein the determining the blocking policy for blocking the attacking packets comprises: obtaining a plurality of destination internet protocols of the alarm data having a same alarm time; comparing a sum of packets of the plurality of destination internet protocols of the alarm data with a security threshold corresponding to the servers; determining destination internet protocols that are to be blocked through the blocking action based on the types of clients of the internet service provider and packets corresponding to the plurality of destination internet protocols of the alarm data when the sum of the packets of the plurality of destination internet protocols of the alarm data is greater than or equal to the security threshold corresponding to the servers; and sending a notification of the blocking action to the internet service provider. ### Claim 16 (depends on 15) The blocking device of claim 15, wherein the initiating the blocking action to block the attacking packets based on the blocking policy comprises: causing a blocking interface of the internet service provider to discard packets of the determined destination internet protocol before the packets reach the servers. ### Claim 17 (depends on 10) The blocking device of claim 10, wherein the processing circuitry is further configured to: send a result of the blocking action to a client of the internet service provider so that the client adjusts an internet service that is affected by the attacking packets in real time or selects an alternative internet service, wherein the result of the blocking action contains at least one of a blocking time, a service type of the attacking packets, or a value corresponding to the packets. ### Claim 18 A non-transitory computer-readable storage medium storing instructions which when executed by at least one processor cause the at least one processor to perform: receiving packets that enter a service network providing services to servers that are receiving the services from the service network; parsing the packets to identify attacking packets and generating alarm data based on the attacking packets; determining a blocking policy for blocking the attacking packets based on the alarm data and blocking rules; and initiating a blocking action to block the attacking packets based on the blocking policy, wherein the blocking rules are used to determine whether the servers are attacked based on types of clients of an internet service provider, which is defined by at least one of payment method by the clients, bandwidth purchased by the clients, and quantity of users of the clients, and the blocking rules are customized according to a request of one of the clients of the internet service provider, the one of the clients being at least one of a border gateway protocol high-defense client or a client with a priority higher than priorities of other clients.