Method for defending against attack, defense device, and computer readable storage medium

A defense device, comprising a memory and a processor;

• the memory being configured to store a computer program;
• and the processor being configured to execute the computer program in the memory, to specifically perform:
• detecting whether a target host is attacked by a User Datagram Protocol (UDP) attack from an attack device;
• obtaining an Internet Control Message Protocol (ICMP) data packet sent back by the target host to the attack device, when detecting that the target host is attacked by the UDP attack from the attack device;
• extracting information about target ports in the ICMP data packet;
• determining whether distribution of attacks on the target ports is a centralized distribution or a dispersed distribution according to a quantity of the target ports being attacked;
• and
• performing, according to the information about the target ports, interception processing on UDP data packets sent by the attack device to the target ports, comprising:
• in response to determining that the distribution of the attacks on the target ports is the dispersed distribution:
• limiting, by the defense device, traffic of the UDP data packets allowed to pass through the target ports within a first threshold, or randomly discarding, by the defense device, at least one of the UDP data packets sent to the target ports;
• and
• in response to determining that the distribution of the attacks on the target ports is the centralized distribution, discarding, by the defense device, the UDP data packets sent to the target ports.

A non-transitory computer readable storage medium, storing a program instruction which, when being executed by a processor, causes the processor to perform:

• detecting whether a target host is attacked by a User Datagram Protocol (UDP) attack from an attack device;
• obtaining an Internet Control Message Protocol (ICMP) data packet sent back by the target host to the attack device, when detecting that the target host is attacked by the UDP attack from the attack device;
• extracting information about target ports in the ICMP data packet;
• determining whether distribution of attacks on the target ports is a centralized distribution or a dispersed distribution according to a quantity of the target ports being attacked;
• and
• performing, according to the information about the target ports, interception processing on UDP data packets sent by the attack device to the target ports, comprising:
• in response to determining that the distribution of the attacks on the target ports is the dispersed distribution:
• limiting, by the defense device, traffic of the UDP data packets allowed to pass through the target ports within a first threshold, or randomly discarding, by the defense device, at least one of the UDP data packets sent to the target ports;
• and
• in response to determining that the distribution of the attacks on the target ports is the centralized distribution, discarding, by the defense device, the UDP data packets sent to the target ports.