DDoS attack detection methods, packet forwarding methods, electronic devices and storage media

Abstract

This invention provides a method for detecting DDoS attacks, a packet forwarding method, an electronic device, and a storage medium, belonging to the field of computer communication technology. The DDoS attack detection method includes: acquiring any packet group in a DDoS attack; calculating a first packet entropy to characterize the local disorder level of the packet group based on the individual bit probabilities of each packet in the packet group, where the individual bit probabilities of each packet refer to the probability of each packet's individual bit appearing relative to its total number of bits; calculating a second packet entropy to characterize the overall disorder level of the packet group based on the cumulative bit probabilities of all packets in the packet group; and determining the legitimacy of the DDoS attack based on the first and second packet entropies. This invention eliminates the need for packet-by-packet parsing in DDoS attack detection, effectively improving the timeliness and accuracy of DDoS attack detection and enhancing DDoS attack defense performance.

Description

Technical Field

[0001] This invention relates to the field of computer communication technology, and more specifically to a method for detecting DDoS attacks, a message forwarding method, an electronic device, and a storage medium. Background Technology

[0002] Distributed Denial of Service (DDoS) attacks refer to attacks launched simultaneously by multiple attackers located in different locations against one or more targets. It is a distributed, coordinated, large-scale network attack pattern. DDoS attacks can render multiple computers unusable at the same time. Currently, traditional DDoS attack defense and detection methods involve parsing and filtering attack packets packet by packet, especially for granular filtering schemes which require detailed packet analysis to calculate the probability of an attack. However, DDoS attack packets are characterized by their massive size, small byte size, diverse source IP addresses, and fixed target IP addresses. Therefore, traditional defense and detection methods require significant performance resources for parsing attack packets, which is not conducive to timely and accurate determination of the attack's malicious nature. Summary of the Invention

[0003] The purpose of this invention is to provide a method, apparatus, electronic device, and storage medium for detecting DDoS attacks, which at least partially solves the aforementioned technical problems.

[0004] To achieve the above objectives, in a first aspect, embodiments of the present invention provide a method for detecting DDoS attacks. The detection method includes: acquiring any packet group in the DDoS attack; calculating a first packet entropy to characterize the local disorder level of the packet group based on the set bit probabilities of each packet in the packet group, wherein the set bit probabilities of each packet refer to the probability of each packet's set bit appearing relative to its total number of bits; calculating a second packet entropy to characterize the overall disorder level of the packet group based on the cumulative set bit probabilities of all packets in the packet group; and determining the legitimacy of the DDoS attack based on the first packet entropy and the second packet entropy.

[0005] Optionally, obtaining any packet group in the DDoS attack includes: using a sliding window to extract any packet group in the DDoS attack, wherein the number of packets in the extracted packet group is adapted to the value of the sliding window.

[0006] Optionally, the first message entropy is calculated using the following formula:

[0007]

[0008] Where H(X) is the entropy of the first message, and P(x) is the entropy of the first message. i ) represents the probability of the set bit of the i-th message in the message group appearing relative to its total number of bits, and n is the number of messages in the message group.

[0009] Optionally, the second message entropy is calculated using the following formula:

[0010] Tp(X) = P(sum_set, sum_totbit)

[0011] Where Tp(X) is the second message entropy, sum_set is the number of accumulated set bits in the message group, sum_totbit is the total number of accumulated bits in the message group, and P(sum_set,sum_totbit) is the probability of the number of accumulated set bits in the message group relative to the total number of accumulated bits.

[0012] Optionally, determining the legality of the DDoS attack based on the first message entropy and the second message entropy includes: calculating the message entropy difference of the message group based on the first message entropy and the second message entropy; comparing the message entropy difference of the message group with a preset entropy difference threshold; if the message entropy difference is greater than or equal to the preset entropy difference threshold, then determining that the messages in the message group are legitimate messages; otherwise, determining that the messages in the message group are illegitimate messages.

[0013] Secondly, embodiments of the present invention provide a message forwarding method, the message forwarding method comprising: performing DDoS attack detection on a received message based on the detection method described in any one of the first aspects to determine whether the message is a legitimate message; and forwarding the message if the message is determined to be a legitimate message.

[0014] Optionally, the message forwarding method further includes performing any one or more of the following operations when the message is determined to be an illegal message: parsing the message; discarding the message; adding the message to a blacklist or whitelist; and limiting the number of incoming messages.

[0015] Thirdly, embodiments of the present invention provide a DDoS attack detection device, the detection device comprising: an acquisition unit for acquiring any packet group in the DDoS attack; a first calculation unit for calculating a first packet entropy characterizing the local disorder level of the packet group based on the set bit probabilities of each packet in the packet group, wherein the set bit probabilities of each packet refer to the probability of each set bit of each packet appearing relative to its total number of bits; a second calculation unit for calculating a second packet entropy characterizing the overall disorder level of the packet group based on the accumulated set bit probabilities of all packets in the packet group; and a determination unit for determining the legality of the DDoS attack based on the first packet entropy and the second packet entropy.

[0016] Fourthly, embodiments of the present invention provide a message forwarding system, wherein the message forwarding device includes: a DDoS attack detection device as described in the third aspect, used to perform DDoS attack detection on received messages to determine whether the messages are legitimate messages; and a forwarding device, used to forward the messages if the messages are determined to be legitimate messages.

[0017] Fifthly, embodiments of the present invention provide an electronic device, the electronic device comprising: one or more processors; a memory for storing one or more programs; and when the one or more programs are executed by the one or more processors, the one or more processors implement the detection method described in any of the first aspects or the message forwarding method described in any of the second aspects.

[0018] In a sixth aspect, embodiments of the present invention provide a machine-readable storage medium storing instructions that cause a machine to execute the detection method described in any of the first aspects of the present application or the message forwarding method described in any of the second aspects.

[0019] Through the above technical solution, the embodiments of the present invention do not require packet-by-packet parsing and filtering of DDoS attack packets, effectively improving the timeliness and accuracy of DDoS attack detection and enhancing the defense performance against DDoS attacks.

[0020] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0021] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings:

[0022] Figure 1This is a flowchart illustrating a method for detecting DDoS attacks according to an exemplary embodiment;

[0023] Figure 2 This is a schematic diagram of a sliding window according to an exemplary embodiment;

[0024] Figure 3 This is a schematic diagram illustrating a process for determining the legitimacy of a DDoS attack according to an exemplary embodiment;

[0025] Figure 4 This is a schematic diagram illustrating a message forwarding process according to an exemplary embodiment;

[0026] Figure 5 This is a schematic diagram illustrating a packet forwarding process based on a VPP framework according to an exemplary embodiment;

[0027] Figure 6 This is a schematic block diagram illustrating a DDoS attack detection device according to an exemplary embodiment; and

[0028] Figure 7 This is a schematic block diagram illustrating a message forwarding system according to an exemplary embodiment. Detailed Implementation

[0029] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0030] Figure 1 This is a schematic diagram illustrating a DDoS attack detection method according to an exemplary embodiment. Figure 1 As shown, the detection method includes steps S110 to S140:

[0031] Step S110: Obtain any packet group from the DDoS attack.

[0032] For example, a message refers to a data unit exchanged and transmitted in a network, containing complete data information to be sent. A message group refers to dividing a message into several segments to facilitate fast and efficient transmission in the network. A DDoS attack refers to an external attacker launching a large number of messages at a target server, aiming to deplete the target server's performance or network bandwidth, thereby causing the target server to be unable to provide normal services. This embodiment of the invention detects DDoS attacks by studying the message groups within the attack, determining whether the attack messages are legitimate, and thus confirming the legitimacy of the DDoS attack.

[0033] In a preferred embodiment, for step S110 above, obtaining the packet group in the DDoS attack includes: using a sliding window to extract any packet group in the DDoS attack, wherein the number of packets in the extracted packet group is adapted to the value of the sliding window used.

[0034] For example, a sliding window can be viewed as a dynamic window, whose length can be fixed or variable. In this embodiment of the invention, the value of the sliding window is its length, which can characterize the number of packets in the extracted packet group. Figure 2 As shown, the length of the sliding window, i.e., the value of the sliding window, is 3, and the number of packets extracted by this sliding window is 3. After the requirement parameters of packets 1, 2, and 3 in the sliding window are extracted, the sliding window continues to extract the requirement parameters of the next 3 incoming packets, and so on. Therefore, the sliding window in this embodiment of the invention can extract only the requirement parameters of the packets within the sliding window each time, effectively controlling the flow of calculated packets, avoiding packet loss, and increasing the reliability of packet acquisition.

[0035] Step S120: Calculate the first message entropy, which characterizes the degree of local disorder of the message group, based on the respective set bit probabilities of each message in the message group. The respective set bit probabilities of each message refer to the probability of each message's respective set bit appearing relative to its total number of bits.

[0036] For example, messages are represented in binary form during computation, using 0s and 1s. A set bit is a bit in the message that is 1, and the total number of bits includes both 1s and 0s. Let the value of the sliding window be n, meaning the number of messages to be computed within the sliding window is n. Let the sequence numbers of the messages within the sliding window be 1, 2, 3…n. Therefore, the probability of the set bit appearing relative to the total number of bits in the message with sequence number 1 in the sliding window is denoted as P(x1), and the corresponding probability of the set bit appearing relative to the total number of bits in the last message with sequence number n is denoted as P(x2). n ).

[0037] Message entropy is a measure of information uncertainty. The greater the information content, the more regular the architecture, and the more complete the functionality of a message, the lower the message entropy. However, in typical DDoS attacks, a group of attack packets containing relatively small amounts of information (creating large-scale packets would require significantly more computing resources from the attacker's perspective, so attack packets typically don't use large-byte packets) and with scattered and non-unique source IPs will have higher message entropy. Therefore, the message entropy value can characterize the degree of message disorder and, consequently, help determine the legitimacy of the attack packets.

[0038] Based on this, embodiments of the present invention introduce the concept of message entropy and apply it to the detection of DDoS attacks. The first message entropy of the message group in the sliding window is calculated based on the probability of the set bit in each message relative to the total number of bits, and is used for further judgment of the message's legitimacy.

[0039] In a preferred embodiment, the first message entropy is calculated using the following formula:

[0040]

[0041] Where H(X) is the entropy of the first message, and P(x) is the entropy of the first message. i ) represents the probability of the set bit of the i-th message in the message group appearing relative to its total number of bits, and n is the number of messages in the message group.

[0042] By employing the above formula, the first message entropy of the message group is obtained based on the probability of the set bit of each message appearing relative to the total number of bits. This first message entropy is used to characterize the local disorder level of the message group. Detecting the legitimacy of a DDoS attack from the perspective of message entropy, which characterizes the disorder level of the messages, can improve the speed of attack detection compared to existing attack detection methods. It is especially suitable for situations involving a large number of attack messages. The embodiments of this invention do not require a significant investment of performance in packet disassembly, facilitating timely and effective accurate judgment of the legitimacy of the messages.

[0043] Step S130: Calculate the second message entropy, which characterizes the overall disorder level of the messages in the message group, based on the cumulative set bit probabilities of all messages in the message group.

[0044] For example, the cumulative set bit probability refers to the probability of the cumulative set bit count across all messages relative to the total number of bits in all messages. The cumulative set bit count is obtained by summing the set bit counts of each message in the message group. The total number of bits is obtained by summing the total number of bits of each message in the message group. Figure 2 As shown, the number of set bits refers to the number of bits that are 1 in the message, and the total number of bits refers to the sum of the number of bits that are 1 and the number of bits that are 0 in the message. For example, the number of set bits for message 1 is 3, and the total number of bits is 8. Similarly, the sum of the number of set bits for messages 1, 2, and 3 is the cumulative number of set bits for the message group acquired by the sliding window. The sum of the total number of bits for each of messages 1, 2, and 3 is the cumulative total number of bits for the message group acquired by the sliding window.

[0045] In a preferred embodiment, the second message entropy is calculated using the following formula:

[0046] Tp(X) = P(sum_set, sum_totbit)

[0047] Where Tp(X) is the second message entropy, sum_set is the number of accumulated set bits in the message group, sum_totbit is the total number of accumulated bits in the message group, and P(sum_set,sum_totbit) is the probability of the number of accumulated set bits in the message group relative to the total number of accumulated bits.

[0048] Step S140: Determine the legitimacy of the DDoS attack based on the first message entropy and the second message entropy.

[0049] In a preferred embodiment, such as Figure 3 As shown, determining the legitimacy of the DDoS attack based on the first message entropy and the second message entropy includes steps S310 to S320:

[0050] Step S310: Calculate the message entropy difference of the message group based on the first message entropy and the second message entropy.

[0051] For example, based on the first and second message entropies calculated in the above embodiments, let the first message entropy be H(X), the second message entropy be TP(X), and the message entropy difference of the message group be DE, then the message entropy difference DE = H(X) - TP(X).

[0052] Step S320: Compare the message entropy difference of the message group with a preset entropy difference threshold. If the message entropy difference is greater than or equal to the preset entropy difference threshold, the message group is determined to be a legitimate message; otherwise, the message group is determined to be an illegal message.

[0053] For example, the preset entropy difference threshold can be flexibly set according to the actual detection scenario. The entropy difference of the packet group is compared with the preset entropy difference threshold to determine the legitimacy of the packet group in the DDoS attack, including: if the entropy difference is greater than or equal to the preset entropy difference threshold, the packet group is determined to be a legitimate packet; otherwise, the packet group is determined to be an illegitimate packet.

[0054] It should be noted that the above embodiment is only an example. The present invention can also set multiple entropy difference thresholds according to actual detection needs, so as to more accurately determine the legality of the message, so that different processing methods can be adopted for different situations in the future.

[0055] In this embodiment of the invention, considering the uncertainty of message entropy, message entropy difference is introduced, which can make an accurate judgment on the legality of the message.

[0056] As can be seen from the above embodiments regarding DDoS attack detection, the present invention does not require disassembling and parsing each packet, which is beneficial for real-time, fast and accurate processing of the legitimacy of DDoS attacks. In particular, the present invention is applicable to situations where DDoS attacks contain a large number of attack packets.

[0057] Based on the DDoS attack detection method described above, this embodiment of the invention also provides a packet forwarding method, such as... Figure 4 As shown, the message forwarding method includes steps S410 to S420:

[0058] Step S410: Perform DDoS attack detection on the received message to determine whether the message is a legitimate message.

[0059] For example, different network architectures typically obtain or receive packets transmitted from the network via the network interface. For instance... Figure 5 As shown, Figure 5 This is a packet forwarding process using the Vector Packet Processing (VPP) framework as an example, where packets enter through the Network Interface Controller (NIC) port in the VPP framework.

[0060] This step employs the DDoS attack detection method described in the above embodiments for DDoS attack detection. For example, as... Figure 5 As shown, for the VPP framework, after a packet enters through the NIC port, it passes through the Ethernet and IP layers within the VPP network framework. A detection node is set up at the IP layer output to perform attack detection on the packet. Furthermore, DDoS attack detection can be flexibly set up at any interface within the network framework or at any point during transmission. For example... Figure 5 As shown, for the VPP framework, attack detection for packets can also be set at locations such as between the lookup layer and the forwarding layer.

[0061] Step S420: If the message is a valid message, then forward the message.

[0062] For example, such as Figure 5 As shown, once it is determined that the received message is a legitimate message, the message is allowed to pass through the lookup layer and the forwarding layer, and then be forwarded and output through the NIC port.

[0063] In a preferred embodiment, if the message is an illegal message, at least one of the following operations is performed: parsing the message; discarding the message; adding the message to a blacklist or whitelist; and limiting the number of incoming messages.

[0064] For example, once a message is determined to be an illegal message, it needs to be intercepted accordingly. Those skilled in the art can flexibly choose the appropriate processing method according to actual needs to ensure that the local device is not affected by DDoS attacks from external networks.

[0065] As can be seen from the above message forwarding process, since the DDoS attack detection in this invention does not require parsing each message individually, detection nodes can be set up at any interface in the network architecture or at any position in the transmission process. Furthermore, the message forwarding method of this embodiment can achieve the purpose of detection in any process that satisfies the sending and receiving of messages, which facilitates the development of DDoS defense and effectively improves the flexibility of development.

[0066] Correspondingly, based on the same technical concept as the detection method for the aforementioned DDoS attacks, such as... Figure 6 As shown, this invention also provides a DDoS attack detection device 600, which includes: an acquisition unit 610 for acquiring any packet group in the DDoS attack; a first calculation unit 620 for calculating a first packet entropy of the packet group based on the probability that the set bit of each packet in the packet group appears in the total number of bits of each packet; a second calculation unit 630 for calculating a second packet entropy of the packet group based on the number of set bits of each packet in the packet group and the total number of bits; and a determination unit 640 for determining the legitimacy of the DDoS attack based on the first packet entropy and the second packet entropy. Other implementation details and effects of this detection device 600 can be found in the above embodiments regarding the detection method, and will not be repeated here.

[0067] Accordingly, based on the same technical concept as the above-mentioned message forwarding method, this invention also provides a message forwarding system, such as... Figure 7 As shown, the packet forwarding system 70 includes: a detection device 600, used to perform DDoS attack detection on received packets to determine whether the packets are legitimate; and a forwarding device 500, used to forward the packets if they are legitimate, otherwise process the packets. Similarly, other implementation details and effects of the packet forwarding system 70 can be found in the above embodiments regarding the packet forwarding method, and will not be repeated here.

[0068] Accordingly, the present invention also provides an electronic device, characterized in that the electronic device includes: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the detection method described in the above embodiments.

[0069] This invention also provides a machine-readable storage medium storing instructions that cause a machine to perform the detection method described in any of the above embodiments of this application.

[0070] In summary, the DDoS attack detection method provided by this invention has the following advantages:

[0071] 1) Compared with existing detection methods, it does not require parsing each packet individually, thus improving the real-time performance and accuracy of DDoS attack detection;

[0072] 2) Applicable to situations where DDoS attacks contain a large number of packets, it can make timely and accurate judgments on the legitimacy of packets, thus improving the overall performance of DDoS attack detection;

[0073] 3) This attack detection can be set at any interface in the network architecture or at any location in the transmission process, which improves the flexibility of DDoS attack defense and facilitates the development of DDoS attack defense.

[0074] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0075] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0076] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0077] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0078] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0079] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0080] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0081] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0082] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for detecting a DDoS attack, characterized in that, The detection method comprises: acquiring any packet group in the DDos attack; calculating a first packet entropy for representing a local disorder degree of the packets in the packet group according to the respective set bit probability of each packet in the packet group, wherein the respective set bit probability of each packet refers to the probability of the respective set bit of each packet appearing relative to the total bit thereof; calculating a second packet entropy for representing an overall disorder degree of the packets in the packet group according to the cumulative set bit probability of all the packets in the packet group; and determining the legitimacy of the DDos attack according to the first packet entropy and the second packet entropy, The determination of the legitimacy of the DDos attack according to the first packet entropy and the second packet entropy comprises: calculating a packet entropy difference of the packet group according to the first packet entropy and the second packet entropy; comparing the packet entropy difference of the packet group with a preset entropy difference threshold, and if the packet entropy difference is greater than or equal to the preset entropy difference threshold, determining that the packets of the packet group belong to legal packets, otherwise, determining that the packets of the packet group belong to illegal packets.

2. The detection method according to claim 1, characterized in that, The acquisition of any packet group in the DDos attack comprises: extracting any packet group in the DDos attack by using a sliding window, wherein the number of packets in the extracted packet group is adapted to the value of the sliding window.

3. The method of claim 1, wherein The first packet entropy is calculated by using the following formula: in, The entropy of the first message, For the message group of the first The probability of a set bit in a message relative to its total number of bits. The number of messages in the message group.

4. A packet forwarding method, characterized by, The packet forwarding method comprises: performing DDos attack detection on the received packets to determine whether the packets belong to legal packets based on the detection method according to any one of claims 1-3; and forwarding the packets in the case of determining that the packets belong to legal packets.

5. The packet forwarding method of claim 4, wherein, The packet forwarding method further comprises performing any one or more of the following operations in the case of determining that the packets belong to illegal packets: analyzing the packets; discarding the packets; adding the packets to a blacklist or a whitelist; and limiting the number of incoming packets.

6. A device for detecting a DDoS attack, characterized in that, The detection device comprises: an acquisition unit configured to acquire any packet group in the DDos attack; a first calculation unit configured to calculate a first packet entropy for representing a local disorder degree of the packets in the packet group according to the respective set bit probability of each packet in the packet group, wherein the respective set bit probability of each packet refers to the probability of the respective set bit of each packet appearing relative to the total bit thereof; a second calculation unit configured to calculate a second packet entropy for representing an overall disorder degree of the packets in the packet group according to the cumulative set bit probability of all the packets in the packet group; and a determination unit configured to determine the legitimacy of the DDos attack according to the first packet entropy and the second packet entropy, wherein the determination unit is further configured to calculate a packet entropy difference of the packet group according to the first packet entropy and the second packet entropy; compare the packet entropy difference of the packet group with a preset entropy difference threshold, and if the packet entropy difference is greater than or equal to the preset entropy difference threshold, determine that the packets of the packet group belong to legal packets, otherwise, determine that the packets of the packet group belong to illegal packets.

7. A packet forwarding system, characterized by The message forwarding system comprises: The DDos attack detection device of claim 6 is used for detecting a received message for DDos attack to determine whether the message is a legal message; A forwarding device is used for forwarding the message if it is determined that the message is a legal message.

8. An electronic device, comprising: The electronic device comprises: One or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the detection method of any one of claims 1-3 or the message forwarding method of claim 4 or 5. 9.A machine readable storage medium having stored thereon instructions for causing a machine to perform the detection method of any one of claims 1-3 or the message forwarding method of claim 4 or 5.

Images