Method and device for determining data flow to be cleaned

Abstract

The embodiment of the present invention discloses a method and device for determining a data flow to be cleaned. In the embodiment of the invention, the data flow to be processed is obtained; the data flow with the same port in the data flow to be processed is determined to be a subdata flow, and the label of each subdata flow is determined according to the object port of each subdata flow; after the label of the abnormal data flow is obtained, the subdata flow is determined to be the data flow to be cleaned in the condition of the label of the subdata flow being the same as the label of the abnormal data flow; and the abnormal data flow is obtained according to each subdata flow and the historical data flow of the object port corresponding to the subdata flow. The data flow to be processed may be accurately cleaned, the performance pressure of a cleaning device is mitigated, and the processing efficiency of the cleaning device is effectively improved.

Description

technical field [0001] The present invention relates to the field of communication technologies, and in particular, to a method and device for determining a data stream to be cleaned. Background technique [0002] With the rapid development of Internet services and the rapid popularization of broadband networks, more and more people begin to use Internet services and enjoy the convenience and changes brought about by the Internet era. But at the same time, due to the weak security awareness of users, the intelligent embedded devices (routers, etc.) used are not properly protected, and there are weak passwords or security loopholes, creating opportunities for hackers. At present, there are more malware with backdoors, and attackers can remotely control the infected machine. Machines infected by this kind of malware are usually called "bots", and the controlled network composed of infected machines is often called "bot". For a "botnet", or botnet, the attacker who controls th...

AI Technical Summary

Problems solved by technology

The main disadvantages of this method are: (1) The drainage data flow is not fine enough. The traditional cleaning technology based on abnormal source IP will cause some normal traffic to be diverted to the cleaning equipment; (2) The cleaning is not accurate enough. The processing is not accurate enough, which will cause part of the normal traffic to be thrown into the traffic black hole; (3) Clean the performance bottleneck of the device. At this stage, 10 Gigabit data streams are relatively common. The defense device is responsible for receiving data, analyzing the data and cleaning the data. The consumption is relatively large. Once the DDOS traffic is too large, the performance of the cleaning equipment will not meet the requirements, and data loss will occur.

Images