Method, programmable switch, and computer program product for detecting network attack

Abstract

A method in an illustrative embodiment includes registering a storage system of a server with a programmable switch for transmitting and compressing data. The method further includes transmitting read data and write data associated with the storage system between the server and a client by the programmable switch. The method further includes determining a compression ratio of the read data and a compression ratio of the write data for a connection between the client and the programmable switch. The method further includes detecting a network attack based on the compression ratio of the read data and the compression ratio of the write data. In this way, abnormal data can be quickly and effectively identified without consuming a large quantity of resources, and whether a network attack exists can be determined, thereby maintaining the performance of a storage server while reducing the consumption of resources.