Method and apparatus for defending against network attack

A network security device, wherein the network security device is deployed between a protected network and an external network in which an external device is located, the network security device comprises:

• a memory unit comprising instructions and configuration information of a fake network, the configuration information comprises an internet protocol IP address of each node in the fake network;
• a communications interface;
• and
• one or more processors coupled to the processing unit,
• wherein the communications interface is configured to
• receive a first packet sent by the external device;
• the one or more processors execute the instructions to:
• match a destination IP address of the first packet received by the communications interface receiving unit with the configuration information of the fake network;
• process the first packet based on a fake network policy, when an IP address of a node in the configuration information of the fake network has a same subnet prefix as the destination IP address, wherein each fake network policy comprises a matching condition and an action corresponding to the matching condition, and the action comprises constructing and sending a response packet, or prohibiting answering the first packet, or redirecting the first packet to a honeypot device;
• and
• process the first packet based on a firewall policy, when no IP address of a node in the configuration information of the fake network has a same subnet prefix as the destination IP address.

A computer-readable storage medium, wherein the computer-readable storage medium stores a computer executable instruction, and the computer executable instruction is used to enable a computer to

• receive a first packet sent by an external device, wherein the network security device is deployed between a protected network and an external network in which the external device is located, the network security device stores configuration information of a fake network, and the configuration information comprises an internet protocol IP address of each node in the fake network;
• match a destination IP address of the first packet with the configuration information of the fake network;
• and
• process the first packet based on a fake network policy if an IP address of a node in the configuration information of the fake network has a same subnet prefix as the destination IP address, wherein each fake network policy comprises a matching condition and an action corresponding to the matching condition, and the action comprises constructing and sending a response packet, or prohibiting answering the first packet, or redirecting the first packet to a honeypot device;
• or
• process the first packet based on a firewall policy if no IP address of a node in the configuration information of the fake network has a same subnet prefix as the destination IP address.