Suppressing virus propagation in a local area network

A method for suppressing virus propagation in a local area network (LAN), being applicable to a forwarding device, comprising:

• in response to receiving an address resolution protocol (ARP) packet initiated by a target terminal, determining whether a number of interacting terminals in the LAN that have performed ARP interaction with the target terminal reaches a first preset threshold;
• in response to that the number of interacting terminals reaches the first preset threshold, determining whether a difference between a current time and an abnormal packet reception time maintained by the forwarding device is less than a preset time threshold, wherein the current time corresponds to a time when the number of interacting terminals reaches the first preset threshold, the abnormal packet reception time corresponds to the most recent time when an abnormal packet initiated by the target terminal is received by the forwarding device, and the abnormal packet is a first service message with a preset risky port as a destination port;
• in response to that the difference between the current time and the abnormal packet reception time is less than the preset time threshold, providing protection to the target terminal to suppress virus propagation in the LAN,
• wherein providing protection to the target terminal to suppress virus propagation in the LAN comprises:
• determining whether a number of abnormal terminal relationships corresponding to the target terminal reaches a second preset threshold, wherein for one of the number of abnormal terminal relationships, the target terminal performs interaction with other terminal in the LAN by sending a first service packet of which a destination port belongs to preset risky ports, and
• in response to that the number of abnormal terminal relationships reaches the second preset threshold, providing protection to the target terminal so to suppress virus propagation in the LAN,
• wherein providing protection to the target terminal to suppress virus propagation in the LAN further comprises:
• determining whether a number of first terminals reaches a third preset threshold, wherein the number of first terminals are terminals in the number of interacting terminals of which Internet protocol (IP) addresses are consecutive;
• and
• in response to that the number of first terminals reaches the third preset threshold, providing protection to the target terminal to suppress virus propagation in the LAN.

A forwarding device in a LAN, comprising:

• a processor;
• a memory for storing program instructions that are executable by the processor to perform operations comprising:
• in response to receiving a first service packet, determining whether a destination port carried in the first service packet indicates one of the preset risky ports;
• wherein the first service packet corresponds to a first one of service packets sent to other terminal by the target terminal immediately after acquiring a media access control (MAC) address of the other terminal by performing an address resolution protocol (ARP) interaction with the other terminal;
• in response to that the destination port indicates one of the preset risky ports, determining whether a number of interacting terminals in the LAN that have performed ARP interaction with the target terminal reaches a first preset threshold;
• in response to that the number of interacting terminals reaches the first preset threshold, providing protection to the target terminal so to suppress virus propagation in the LAN,
• the operations further comprising:
• in response to that the destination port indicates one of the preset risky ports, updating an abnormal packet reception time maintained by the forwarding device;
• in response to receiving the ARP packet sent by the target terminal, determining whether the number of interacting terminals reaches the first preset threshold;
• in response to that the number of interacting terminals reaches the first preset threshold, determining whether a difference between a current time and the abnormal packet reception time is less than a preset time threshold, wherein the current time corresponds to a time when the number of interacting terminals reaches the first preset threshold, the abnormal packet reception time corresponds to the most recent time when an abnormal packet initiated by the target terminal is received by the forwarding device, and the abnormal packet is a first service message with a preset risky port as a destination port;
• in response to that the difference between the current time and the abnormal packet reception time is less than the preset time threshold, providing protection to the target terminal to suppress virus propagation in the LAN,
• wherein providing protection to the target terminal to suppress virus propagation in the LAN comprises:
• determining whether a number of abnormal terminal relationships corresponding to the target terminal reaches a second preset threshold, wherein for one of the number of abnormal terminal relationships, the target terminal performs interaction with other terminal in the LAN by sending a first service packet of which a destination port belongs to preset risky ports, and
• in response to that the number of abnormal terminal relationships reaches the second preset threshold, providing protection to the target terminal so to suppress virus propagation in the LAN,
• wherein providing protection to the target terminal to suppress virus propagation in the LAN further comprises:
• determining whether a number of first terminals reaches a third preset threshold, wherein the number of first terminals are terminals in the number of interacting terminals of which Internet protocol (IP) addresses are consecutive;
• and
• in response to that the number of first terminals reaches the third preset threshold, providing protection to the target terminal to suppress virus propagation in the LAN.