A method, blocking device, and a non-transitory computer-readable storage medium are provided. For example, the method is performed by processing circuitry of the blocking device. In the method, alarm data that includes attacking information of attacking packets among packets that enter a service network that provides services to servers is received. The alarm data is generated based on parsing the packets to identify the attacking packets and to determine the attacking information of the attacking packets. A blocking policy for blocking the attacking packets is determined based on the alarm data and blocking rules for determining whether the servers are attacked. A blocking action is initiated to block the attacking packets based on the blocking policy.