An adaptive heavy hitter detection method for programmable switches

Abstract

The present invention discloses an adaptive heavy hitter detection method for programmable switches, which combines network measurement methods based on state measurement and flow measurement to achieve adaptive heavy hitter detection. Based on the state information regularly obtained from the state measurement module, the present invention can provide the most appropriate measurement tasks for different time slices, and call the flow measurement module to dynamically select the corresponding processing logic to detect specific heavy hitters. In addition, the present invention can increase the measurement accuracy to the limit with less memory usage by adding a method of accurate statistical flow table, and further effectively distinguish the types of heavy hitters obtained by measurement. The present invention verifies the feasibility of the invention by building a real network topology and using a real network traffic data set containing multiple heavy hitter traffic.

Description

Technical Field

[0001] The present invention belongs to the intersection field of network security and network measurement, and in particular relates to an adaptive heavy hitter detection method for programmable switches. Background Art

[0002] With the rapid development of computer science, the Internet is becoming increasingly characterized by high speed, large scale, and flexibility. In this environment, various network applications are placing higher demands on network service quality. Heavy hitter refers to a network entity where the cumulative number of packets, bytes, or connections exceeds a certain level within a certain period of time. It is one of the most important causes of network service quality issues. Currently, the industry's heavy hitter measurement methods are mainly divided into two categories: state-based measurement and flow-based measurement.

[0003] State-based measurement methods analyze network behavior by detecting changes in network device characteristics caused by network influences. The measured parameters are typically packet rate, packet latency, packet count, device bandwidth, and so on. By collecting device behavior information, network operating status and related heavy hitter types are inferred. Representative methods include Flowsense, In-situ OAM, and INT (Inband Network Telemetry). However, these methods often require devices to deploy information push mechanisms, including real-time packaging of measurement information or transmitting it to servers by carrying it in service packets. This places significant pressure on bandwidth and packet load. Furthermore, these behavioral information-collecting methods cannot directly locate specific heavy hitters and are primarily focused on discovering abnormal nodes rather than analyzing abnormal content.

[0004] Traffic measurement-based methods measure the characteristics of some or all traffic in the network. They can often pinpoint the measurement results to specific traffic with heavy hitter properties, helping network administrators gain a deeper and more granular understanding of network characteristics. Representative methods include Count-Min sketch, BeauCoup, and elastic sketch. However, these methods have high logical complexity and are prone to affecting device throughput, especially under heavy traffic loads. Furthermore, most current methods suffer from a conflict between accuracy and task coverage. High-accuracy methods often only target a single heavy hitter task and are unable to adapt to current network environments where various attacks and large-scale traffic are intertwined. Methods with wide coverage often have low accuracy and consume a large amount of resources. Summary of the Invention

[0005] To address the above problems, the present invention proposes an adaptive heavy hitter detection method for programmable switches. This method combines a state measurement-based method with a flow measurement-based method. While obtaining a complete network status view, it can adaptively select a processing mode based on the current network status, thereby reducing resource overhead, ensuring node throughput, and increasing the system's measurement accuracy for heavy hitters.

[0006] After a packet enters the switch's network interface, it first passes through the state detection module deployed in the programmable switch to obtain status characteristics and determine the current measurement status. If the measurement status is normal, the packet is forwarded directly. If the measurement status is abnormal, the measurement status is stored in metadata (used to store intermediate information required by the module) before being processed by the flow-level measurement module. After entering the flow-level measurement module, the packet is first matched against the precise statistical flow table. Based on the match result, the packet is selected to enter the sketch processing pipeline to complete the detection of suspicious heavy hitters and update the precise statistical flow table.

[0007] To achieve the purpose of the present invention, the detailed technical solution of the present invention is as follows: an adaptive heavy hitter detection method for a programmable switch, the method comprising the following steps:

[0008] (1) In each state statistics period E state The state detection module in the programmable switch collects statistics on multi-dimensional state features based on the received messages, and determines the current switch measurement state based on the statistical results (the measurement state includes three state types: normal state, large flow detection state, and attack detection state).

[0009] (2) During the duration T of each measurement state, according to the current switch measurement state type, the reconfigurable sketch belonging to the flow-level measurement module in the programmable switch will adaptively select the corresponding processing logic to complete the corresponding measurement task.

[0010] (3) In each attack detection state duration T a In the flow level measurement module, the reconfigurable sketch will be based on each flow detection cycle E flow The measurement resource allocation is adaptively adjusted based on the results, thereby improving the measurement accuracy of attack traffic during the entire measurement state.

[0011] (4) In each flow detection cycle E flowThe reconfigurable sketch in the flow-level measurement module will mark the measured suspicious heavy hitter traffic and store it in the precise statistical flow table in the flow-level measurement module for further refined detection. Finally, the iterative update of the precise statistical flow table in each measurement state is completed to obtain the measurement results.

[0012] As an improvement of the present invention, the specific method of step (1) is as follows:

[0013] (1.1) Four registers are deployed in the programmable switch with a time length E state Periodically record basic data related to the message, including each E state The number of packets, total packet length, number of TCP packets, and number of UDP packets.

[0014] (1.2) Using the four basic data of register statistics, the time length E state Periodically calculate multi-dimensional status features. Based on the high traffic volume of heavy hitters, which often triggers a large number of IP connection pairs and short packets, we select four status features for statistical analysis: bandwidth utilization, TCP packet ratio, UDP packet ratio, and average packet length.

[0015] (1.3) Set the threshold conditions for the transition between the three measurement modes in the measurement mode state machine. After calculating the multi-dimensional state characteristics, the switch will calculate the state machine according to the measurement mode and the previous time period E. state The four status features obtained by calculation complete the transition of the measurement state and store the measurement state type ID (0: normal state, 1: high flow detection state, 2: attack detection state) in metadata.

[0016] It should be noted that there is a priority relationship between measurement states. Considering that network attacks often affect network quality faster and more severely, and short-term attack detection will hardly affect the long-lasting large flow, we default to the attack detection state with the highest priority. If the duration of the large flow detection is T h In a certain E state If an attack detection is found, the system will state Jump immediately to the attack detection state.

[0017] Through this step, the measurement process of the programmable switch is given different measurement targets and tasks according to the network status characteristics at different time nodes.

[0018] As an improvement of the present invention, the specific method of step (2) is as follows:

[0019] (2.1) After the message passes the status statistics action in step (1), the current switch measurement status type is determined based on the measurement status type ID inserted in the metadata.

[0020] (2.2) If the measurement status is normal, the flow-level measurement module in the switch is bypassed and the message is forwarded directly.

[0021] (2.3) If the measurement status is abnormal, according to the sketch processing process, the sketch processing pipeline deployed in the flow-level measurement module consists of three modules, representing the three major stages of sketch processing: hash feature extraction, message attribute calculation, and hash conflict reduction. Each stage contains multiple parallel sub-modules to choose from to form a complete sketch processing pipeline. Different measurement states correspond to different sets of processing sub-modules.

[0022] A table lookup is performed based on the measurement state ID in the metadata (the table entry is the state ID-sketch processing submodule ID correspondence table). The table lookup result (the ID sequence number of the subsequent processing submodule set) is carried in the metadata. The flow-level measurement module in the switch selects the corresponding submodule based on the table lookup result in the metadata to form a specific sketch processing pipeline to complete the detection of large flows / attack target flows.

[0023] Through this step, the subsequent action processing of the message (bypass flow level measurement module, sketch large flow detection, sketch attack detection) is determined according to the current measurement status of the switch.

[0024] As an improvement of the present invention, the specific method of the path planning algorithm in step (3) is as follows:

[0025] (3.1) According to the measurement status type ID in the metadata, determine whether the current switch measurement status is the attack detection status. According to the method in step (2), select the submodules serving the attack detection task to form the sketch processing pipeline.

[0026] (3.2) In the first flow detection cycle E flow In order to simultaneously detect different types of attackers with heavy hitter attributes, for the two heavy hitter types of DDoS and superspreader attacks, the sketch measurement resources in the flow-level measurement module are divided into two sub-tables S1 and S2, which are responsible for DDoS attack detection and superspreader detection respectively.

[0027] (3.3) Each subsequent flow detection cycle E flow According to the previous E flowThe detection result of the flow-level measurement module selects the main task in the current detection cycle from the two detection tasks of DDoS and superspreader, and the subtable to which the task belongs is in the next E flow The number of rows in the sub-table is increased by 1, and the number of rows in the other sub-table is reduced by 1. In order to ensure that a You can always capture multiple heavy hitter attacks. During the iterative process of the above operation, any E flow It is necessary to ensure that the number of rows in the sub-table responsible for non-main tasks is not less than 1.

[0028] Through this step, the measurement in the attack detection state can simultaneously take into account attacks with multiple heavy hitter attributes, adaptively distinguish attack types, and allocate appropriate measurement resources to improve measurement efficiency.

[0029] As an improvement of the present invention, the specific method of step (4) is as follows:

[0030] (4.1) In each flow detection cycle E flow In the flow-level measurement module, the sketch identifies the detected suspicious heavy hitters (including large flows / DDoS / superspreader) (large flows are identified by IP pairs, DDoS attacks are identified by DstIP, and superspreader attacks are identified by SrcIP) and stores them in the precise statistical flow table.

[0031] (4.2) In each flow detection cycle E flow In the switch, the packets entering the flow level measurement module first need to be matched in the precise statistical flow table. The packets that fail to match are sent to the sketch processing pipeline. The packets that successfully match only need to complete the precise statistics in the flow table before being forwarded. The flow identifiers that do not meet the heavy hitter condition obtained by the precise statistics will be deleted from the flow table. flow The traffic identifiers that meet the heavy hitter condition and are accurately counted will be retained in the flow table until the end of the entire measurement state period T.

[0032] (4.3) Accurate Statistics Flow Table While accurately counting, it also records auxiliary items for each flow identifier in the table entry, which is used to further analyze the persistent characteristics of the heavy hitter captured in the table. The auxiliary items are mainly used to record the number of times E the identifier item in the accurate statistics flow table that has met the retention conditions exists in the entire measurement period T. flow The statistics during this period still meet the heavy hitter standard.

[0033] This step combines precise statistical flow tables with the multi-level heavy hitter detection and verification mechanism designed using Sketch to obtain more accurate and intuitive heavy hitter measurement results. It also provides additional statistical data for subsequent defense decision analysis.

[0034] Beneficial effects: Compared with the prior art, the technical solution of the present invention has the following beneficial technical effects:

[0035] (1) This invention addresses the current inability of programmable switches to adaptively detect multiple heavy hitters by designing a heavy hitter detection method with adaptive measurement capabilities. By combining state-level and flow-level measurement methods, this invention provides a universal measurement framework for heavy hitter detection, overcoming the measurement limitations of previous programmable switches and possessing significant practical significance.

[0036] (2) This paper proposes a dynamically reconfigurable sketch design method for flexible flow-level measurement. By combining multiple flexibly selectable sketch fine-grained basic processing units, the dynamic reconfiguration capability of the sketch in a programmable switch is realized. Sketch resources can be rationally allocated based on the system's adaptability, achieving higher measurement accuracy with fewer measurement resources.

[0037] (3) The present invention proposes a measurement result optimization method based on an accurate statistical flow table. By deploying an accurate statistical flow table to store and verify suspicious heavy hitters detected from the sketch and analyzing the characteristics of heavy hitters, the flow-level measurement module can eliminate misclassification results caused by hash collisions and bypass a large amount of traffic that would otherwise be detected by the sketch, achieving higher throughput and reducing the impact on normal packet forwarding during deployment. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 This is the flow chart of adaptive heavy hitter detection;

[0039] Figure 2 This is a schematic diagram of the measurement mode state machine;

[0040] Figure 3 This is a schematic diagram of the working method of the reconfigurable sketch processing pipeline;

[0041] Figure 4 This is a schematic diagram of the sketch attack detection and processing method;

[0042] Figure 5 Schematic diagram of adaptive allocation of sketch resources;

[0043] Figure 6 To express intent for accurate statistical flow;

[0044] Figure 7 Schematic diagram of the experimental topology. DETAILED DESCRIPTION

[0045] In order to deepen the knowledge and understanding of the present invention, the technical solution is described in detail below with reference to the accompanying drawings.

[0046] Example: Figure 1 The following is a schematic flow diagram of the present invention. After a message enters the switch network interface, it first passes through the state detection module deployed in the programmable switch to obtain status characteristics and determine the current measurement status. If the measurement status is normal, the message is forwarded directly; if the measurement status is abnormal, the measurement status is stored in metadata and then processed by the flow-level measurement module. After entering the flow-level measurement module, the message is first matched against the precise statistical flow table. Based on the match result, the message is selected to enter the sketch processing pipeline to complete the detection of suspicious heavy hitters and update the precise statistical flow table.

[0047] To achieve the purpose of the present invention, the detailed technical solution of the present invention is as follows: an adaptive heavy hitter detection method for a programmable switch, the method comprising the following steps:

[0048] (1) In each state statistics period E state The state detection module in the programmable switch collects statistics on multi-dimensional state features based on the received messages, and determines the current switch measurement state based on the statistical results (the measurement state includes three state types: normal state, large flow detection state, and attack detection state).

[0049] (2) During the duration T of each measurement state, according to the current switch measurement state type, the reconfigurable sketch belonging to the flow-level measurement module in the programmable switch will adaptively select the corresponding processing logic to complete the corresponding measurement task.

[0050] (3) In each attack detection state duration T a In the flow level measurement module, the reconfigurable sketch will be based on each flow detection cycle E flow The measurement resource allocation is adaptively adjusted based on the results, thereby improving the measurement accuracy of attack traffic during the entire measurement state.

[0051] (4) In each flow detection cycle E flowThe reconfigurable sketch in the flow-level measurement module will mark the measured suspicious heavy hitter traffic and store it in the precise statistical flow table in the flow-level measurement module for further refined detection. Finally, the iterative update of the precise statistical flow table in each measurement state is completed to obtain the measurement results.

[0052] The specific method of step (1) is as follows:

[0053] (1.1) Four registers are deployed in the programmable switch with a time length E state Periodically record basic data related to the message, including each E state The number of packets, total packet length, number of TCP packets, and number of UDP packets.

[0054] (1.2) Using the four basic data of register statistics, the time length E state Periodically calculate multi-dimensional state features. Due to the high traffic volume of heavy hitters, which often triggers a large number of IP connection pairs and short messages, four state features are selected for calculation: bandwidth utilization, TCP message ratio, UDP message ratio, and average message length. The calculation method is shown in the formula:

[0055] -Bandwidth utilization f1: Considering that the traffic caused by heavy hitters is very large compared to normal traffic, the packet arrival rate of the node is very high in this case, causing a surge in bandwidth usage.

[0056]

[0057] TCP packet ratio f2: TCP flood or superspreader scanning, which are DDoS attacks, trigger a large number of IP connections, causing service loss and generating a large number of TCP packets.

[0058]

[0059] UDP packet proportion f3: UDP flood attacks, a type of DDoS attack, exhaust network bandwidth resources by sending a large number of short UDP packets in a short period of time.

[0060]

[0061] - Average message length f4: A network attack with heavy hitter properties constructs a large number of short messages with no payload in a short period of time, triggering a large number of connections or exhausting network bandwidth resources, resulting in service loss.

[0062]

[0063] (1.3) Set the threshold conditions for the transition between the three measurement modes in the measurement mode state machine. After calculating the multi-dimensional state characteristics, the switch will calculate the state machine according to the measurement mode and the previous time period E. state The four status features obtained by calculation complete the jump of the measurement state and store the type ID of the measurement state (0: normal state, 1: high flow detection state, 2: attack detection state) in metadata. Figure 2 As shown, θ1, θ2, and θ3 are the three transition thresholds of the measurement mode state machine that need to be set in this step. θ1 represents the abnormal threshold for bandwidth utilization, θ2 represents the abnormal threshold for the proportion of UDP and TCP packets, and θ3 represents the abnormal threshold for the average packet length. θ1 and θ2 are preset based on the specific experimental environment. Considering that network attacks generally use short 64-byte packets, the average packet length in a normal network environment is RegLen. The preset θ3 can be obtained according to the formula:

[0064] θ3=RegLen*(1-θ2)+64*θ2

[0065] It should be noted that if Figure 2 As shown in the figure, there is a priority relationship between the measurement states. Considering that network attacks often affect network quality faster and more severely, and short-term attack detection will hardly affect the long-lasting large flow, we default to the attack detection state with the highest priority. If the duration of the large flow detection is T h In a certain E state If an attack detection is found, the system will state Jump immediately to the attack detection state.

[0066] Through this step, the measurement process of the programmable switch is given different measurement targets and tasks according to the network status characteristics at different time nodes.

[0067] The specific method of step (2) is as follows:

[0068] (2.1) After the message passes the status statistics action in step (1), the current switch measurement status type is determined based on the measurement status type ID inserted in the metadata.

[0069] (2.2) If the measurement status is normal, the flow-level measurement module in the switch is bypassed and the message is forwarded directly.

[0070] (2.3) If the measurement status is abnormal, according to the sketch processing process, the sketch processing pipeline deployed in the flow-level measurement module consists of three modules, representing the three major stages of sketch processing: hash feature extraction, message attribute calculation, and hash conflict reduction. Each stage contains multiple parallel sub-modules to choose from to form a complete sketch processing pipeline. Different measurement states correspond to different sets of processing sub-modules.

[0071] Look up the table based on the measurement status ID in the metadata, such as Figure 3 As shown, the table lookup results (the ID numbers of the subsequent processing submodules) are carried in the metadata. Based on the table lookup results in the metadata, the flow-level measurement module within the switch selects appropriate submodules to form a specific sketch processing pipeline to detect large flows and attack target flows. Based on the sketch processing process, the sketch processing pipeline deployed within the flow-level measurement module consists of three modules, representing the three stages of sketch processing: hash feature extraction, packet attribute calculation, and hash conflict reduction. Each stage contains multiple parallel submodules to select from to form a complete sketch processing pipeline.

[0072] For (2.3), there are four specific sub-steps:

[0073] First, the message is matched with a submodule. When a message enters any stage of the pipeline, the ID number in the metadata must be matched with the ID number of the submodule in that stage. The submodule that successfully matches can receive and process the message, while the submodule that fails to match will not process the message.

[0074] Second, the message enters the hash feature extraction module for sketch processing. Figure 3 As shown in the figure, if the matched submodule ID is 1, the submodule selects n appropriate hash functions to perform hash operations on the source IP (SrcIP) and destination IP (DstIP) of the message, and uses HASH1(SrcIP, DstIP) to represent the action processing of the submodule, which serves the large flow detection task; if the matched submodule ID is 2, the submodule selects n appropriate hash functions to perform hash operations on the SrcIP and DstIP of the message respectively, and uses HASH2(SrcIP) and HASH2(DstIP) to represent the action processing of the submodule, which serves the attack detection task.

[0075] Third, the message enters the message attribute calculation module for sketch processing. Figure 3As shown in the figure, if the matched submodule ID is 1, the submodule accumulates the index results calculated by n HASH1 (SrcIP, DstIP) in the previous stage at the corresponding register of the sketch table entry to serve the large flow detection task; if the matched submodule ID is 2, the submodule performs bit filling at the corresponding register of the sketch table entry based on the index results calculated by n HASH2 (SrcIP) and HASH2 (DstIP) in the previous stage. The specific operation is that the submodule calls a specific random hash function h r Perform hash calculation on the attribute attr(i) of message i (if the index calculation input is SrcIP, the attribute is DstIP; if the index calculation input is DstIP, the attribute is SrcIP), satisfying like Figure 4 As shown, m is the bit length of the sketch table entry storage unit, and the interval [0,1) is divided into m equal parts, [0,1 / m), [1 / m,2 / m), …, [m-1 / m,1). Each interval corresponds to a bit in the sketch table entry storage unit. According to h r The interval that the result of (attr(i)) falls into will have the corresponding bit position set to 1, serving the attack detection task.

[0076] Fourth, the message enters the hash collision reduction module for sketch processing. Figure 3 As shown, if the matched submodule ID is 1, then the submodule will be used to calculate the n accumulated results V1, V2, V3...V obtained in the first two stages. n Take the minimum value as the statistical result, that is, r1=MIN(V1,V2,V3……V n ), serving the large flow detection task; if the matched submodule ID is 2, such as Figure 3 As shown, the submodule is for the n-bit filling results V1, V2, V3...V obtained in the first two stages n Perform bitwise AND as the statistical result, i.e. r2=V1&V2&V3……&V n , serving the attack detection task.

[0077] Through this step, the subsequent action processing of the message (bypass flow level measurement module, sketch large flow detection, sketch attack detection) is determined according to the current measurement status of the switch.

[0078] The specific method of the path planning algorithm in step (3) is as follows:

[0079] (3.1) According to the measurement status type ID in the metadata, determine whether the current switch measurement status is the attack detection status. According to the method in step (2), select the submodules serving the attack detection task to form the sketch processing pipeline.

[0080] (3.2) In the first flow detection cycle E flow In order to simultaneously detect different types of attackers with heavy hitter attributes, for the two heavy hitter types of DDoS and superspreader attacks, the sketch measurement resources in the flow-level measurement module are divided into two sub-tables S1 and S2, which are responsible for DDoS attack detection and superspreader detection respectively. Figure 5 As shown, considering the size of the sketch table entry: number of rows d, number of columns w, unit width m, the size of S1 and S2 is obtained as follows: number of rows d / 2, number of columns w, unit width m. For S1, the hash feature extraction module in step (2) uses d / 2 H2 (DstIP), and the message attribute calculation module uses h r (SrcIP); for S2, the hash feature extraction module in step (2) uses d / 2 H2(SrcIP), and the message attribute calculation module uses h r (DatIP).

[0081] (3.3) Each subsequent flow detection cycle E flow According to the previous E flow The flow-level measurement module selects the main task in the current detection cycle from the two detection tasks of DDoS and superspreader. flow The existing message is calculated and counted by two sub-tables S1 and S2 to obtain V1&V2&V3...&V d / 2 =2 m -1, such as Figure 5 As shown, the task type represented by the sub-table is the main task in the current detection cycle. flow The number of rows in the sub-table is increased by 1, and the number of rows in the other sub-table is reduced by 1. In order to ensure that a Multiple heavyhitter attacks can always be captured. During the iterative process of the above operations, any E flow It is necessary to ensure that the number of rows in the sub-table responsible for non-main tasks is not less than 1.

[0082] Through this step, the measurement in the attack detection state can simultaneously take into account attacks with multiple heavy hitter attributes, adaptively distinguish attack types, and allocate appropriate measurement resources to improve measurement efficiency.

[0083] The specific method of step (4) is as follows:

[0084] (4.1) In each flow detection cycle E flow The sketch in the flow-level measurement module identifies the detected suspicious heavy hitters (including large flows / DDoS / superspreaders) (large flows are identified by IP pairs, DDoS attacks are identified by DstIP, and superspreader attacks are identified by SrcIP) and stores them in the precise statistical flow table. The definition of a suspicious heavy hitter is:

[0085] For the large flow detection task: the IP pair (SrcIP, DstIP) that makes the statistical result r1≥ε, ​​ε is the preset large flow statistical threshold.

[0086] For attack detection tasks (DDoS): make the statistical result r1=2 m -1 for DstIP.

[0087] For the attack detection task (superspreader): make the statistical result r1=2 m -1 of SrcIP.

[0088] (4.2) In each flow detection cycle E flow In the switch, the packets entering the flow-level measurement module first need to be matched in the precise statistical flow table. The packets that fail to match need to be sent to the sketch processing pipeline. The packets that successfully match only need to complete the precise statistics in the flow table before being forwarded. The flow identifiers that do not meet the heavy hitter condition obtained by the precise statistics will be deleted from the flow table. Figure 6 As shown in the figure, the precise statistics flow table uses the m-bits wide register Cnt to perform precise statistics for each suspicious heavy hitter. flow The criteria used by the precise flow table to determine whether a suspected heavy hitter is a real heavy hitter are:

[0089] For large flow detection tasks (identified as (SrcIP, DstIP)): Cnt is accumulated when the message matches successfully. flow The flow that completes Cnt≥ε within a certain period can be retained in the precise statistics flow table. The RF flag representing the successful verification in the table entry is set to 1.

[0090] For attack detection tasks (identified as DstIP): the message matching is successful using h r (SrcIP) performs bit filling of Cnt, and flow Internal completion Cnt=2m The -1 value can be retained in the precise statistics flow table. The RF bit representing the verification success flag in the table entry is set to 1.

[0091] For attack detection task (identified as SrcIP): the message matching is successful using h r (DstIP) performs bit filling of Cnt, in E flow Internal completion Cnt=2 m The -1 value can be retained in the precise statistics flow table. The RF bit representing the verification success flag in the table entry is set to 1.

[0092] In any E flow The traffic identifiers that meet the heavy hitter condition and are accurately counted will be retained in the flow table until the end of the entire measurement state period T.

[0093] (4.3) Accurate Statistics While accurately counting the flow table, the auxiliary items are recorded for each flow identifier in the table entry to further analyze the heavy hitter features captured in the table. Figure 6 As shown, the auxiliary item (Ainf) is mainly used to count the number of times E that the identification item RF has been set to 1 exists in the entire measurement period T. flow The statistics during this period always meet the heavy hitter criteria in (4.2):

[0094] For large flow detection tasks (identified as (SrcIP, DstIP)): Cnt is accumulated when the message matches successfully. flow If Cnt≥ε and RF=1, Ainf=Ainf+1 can be performed.

[0095] For attack detection tasks (identified as DstIP): the message matching is successful using h r (SrcIP) performs bit filling of Cnt, and flow Internal completion Cnt=2 m -1, and RF=1, Ainf=Ainf+1 can be performed.

[0096] For attack detection task (identified as SrcIP): the message matching is successful using h r (DstIP) performs bit filling of Cnt, in E flow Internal completion Cnt=2 m -1, and RF=1, Ainf=Ainf+1 can be performed.

[0097] After the entire measurement period T, the Ainf value can be used to determine the continuity of the measured heavy hitter, including verifying the burstiness of large flows and the persistence of DDoS attacks. The heavy hitter flags retained in the accurate statistics flow table are the measurement results.

[0098] This step combines precise statistical flow tables with the multi-level heavy hitter detection and verification mechanism designed using Sketch to obtain more accurate and intuitive heavy hitter measurement results. It also provides additional statistical data for subsequent defense decision analysis. Specific embodiment 1:

[0100] If the heavy hitter detection method logic for programmable switches needs to be applied to a programmable switch interface with a rate of 10G, the workflow is as follows.

[0101] (1) Set the detection time parameter: Status statistics period E state 1ms; attack detection state duration T a is 5s, the corresponding flow detection period E flow 100ms; the duration of the high flow detection state is T h is 60s, the corresponding flow detection period is E flow 1s.

[0102] (2) Set the detection threshold parameters: the bandwidth utilization abnormal threshold θ1 is 65%, the UDP packet and TCP packet ratio abnormal threshold θ2 is 80%, the average packet length abnormal threshold θ3 is 330 bytes; the large flow statistics threshold ε is 230.

[0103] (3) Set the detection resource parameters: 600K for the sketch table and 100K for the precise statistics flow table.

[0104] (4) Burn the heavy hitter detection logic into the programmable switch and place it in the experimental environment.

[0105] Experiment 1: Single Task Detection Accuracy Test

[0106] Purpose of the experiment:

[0107] Verify the effectiveness of the system for heavy hitter detection.

[0108] Experimental steps:

[0109] 1. Start the built network topology, such as Figure 7As shown, the network interface of the programmable switch is connected to four servers, and a virtual host group is established in the servers to send background traffic to each other.

[0110] 2. Randomly select one of three types of heavy hitter traffic (including large flow traffic such as elephant flow, attack traffic such as DDoS attack, and attack traffic such as superspreader attack), mix it with normal background traffic, divide it into different subsets according to the same time slice length, and replay it crosswise on four servers.

[0111] 3. Check the heavy hitter identification reserved items in the system's accurate statistics flow table and compare them with the actual heavy hitter situation in the background traffic.

[0112] 4. Select the heavy hitter traffic type without repetition and conduct multiple experiments.

[0113] Experiment 2: Multiple Task Detection Adaptability Test

[0114] Purpose of the experiment:

[0115] Verify the accuracy and reconfigurability of the system in heavy hitter detection in a real complex network environment.

[0116] Experimental steps:

[0117] 1. Such as Figure 7 Start the established network topology.

[0118] 2. The CAIDA real network dataset is divided into different subsets according to the same time slice length, and four servers replay them crosswise.

[0119] 3. Check the heavy hitter identification reserved items in the system's accurate statistics flow table and compare them with the actual heavy hitter situation in the background traffic.

[0120] 4. Check the auxiliary item (Ainf) corresponding to the heavy hitter indicator in the system's accurate statistics flow table and compare it with the actual heavy hitter situation in the background traffic.

[0121] Experiment 3: Deployment of Adaptive Heavy Hitter Detection System Throughput Test

[0122] Purpose of the experiment:

[0123] Test the impact of deploying adaptive heavy hitter detection logic in programmable switches on packet forwarding capabilities.

[0124] Experimental steps:

[0125] 1. Prepare two sets of programmable switches of the same model, one with adaptive heavy hitter detection logic deployed and the other without. Figure 7 Build the same network topology respectively.

[0126] 2. The CAIDA real network dataset was replayed for each of the two devices in a loop, with a time period of 1 hour. The average packet forwarding rate of the two devices was periodically tested using a network tester.

[0127] 3. Compare the packet forwarding rate of programmable switches that deploy adaptive heavy hitter detection logic with that of programmable switches that do not deploy it.

[0128] It should be noted that the above embodiments are not intended to limit the scope of protection of the present invention, and equivalent changes or substitutions made on the basis of the above technical solutions fall within the scope of protection of the claims of the present invention.

Claims

1. An adaptive heavy hitter detection method for programmable switches, characterized in that: The method comprises the following steps: (1) In each state statistics period E state The state detection module in the programmable switch collects statistics on multi-dimensional state characteristics based on the received messages and determines the current switch measurement state based on the statistical results. The measurement state includes three types of states: normal state, large flow detection state, and attack detection state. (2) During the duration T of each measurement state, according to the current switch measurement state type, the reconfigurable sketch belonging to the flow-level measurement module in the programmable switch will adaptively select the corresponding processing logic to complete the corresponding measurement task. (3) In each attack detection state duration T a In the flow level measurement module, the reconfigurable sketch will be based on each flow detection cycle E flow The measurement resource allocation is adaptively adjusted based on the results, thereby improving the measurement accuracy of attack traffic during the entire measurement state. (4) In each flow detection cycle E flow The reconfigurable sketch in the flow-level measurement module will mark the measured suspicious heavy hitter traffic and store it in the precise statistical flow table in the flow-level measurement module for further refined detection. Finally, the iterative update of the precise statistical flow table in each measurement state is completed to obtain the measurement results.

2. The adaptive heavy hitter detection method for a programmable switch according to claim 1, characterized in that: The specific method of step (1) is as follows: (1.1) Deploy multiple registers in a programmable switch with a time length E state Periodically record basic data related to the message, (1.2) Using the basic data of register statistics, the time length E state Periodically calculate multi-dimensional state features, (1.3) After calculating the multi-dimensional state features, the measurement mode state machine determines the measurement state type that the switch is about to transition to. The measurement state includes three types of states: normal state, high flow detection state, and attack detection state.

3. The adaptive heavy hitter detection method for a programmable switch according to claim 1, characterized in that: The specific method of step (2) is as follows: (2.1) Determine the current switch measurement status type, (2.2) If the measurement status is normal, bypass the flow level measurement module in the switch. (2.3) If the measurement status is abnormal, based on whether the queried measurement status is a large flow detection state or an attack detection state, the flow-level measurement module in the switch selects appropriate submodules to form a specific sketch processing pipeline to complete the detection of large flows / attack target flows.

4. The adaptive heavy hitter detection method for a programmable switch according to claim 1, characterized in that: The specific method of step (3) is as follows: (3.1) Determine whether the current switch measurement state is attack detection state, (3.2) In the first flow detection cycle E flow For two heavy hitter attacks, DDoS and superspreader, the sketch measurement resources in the flow-level measurement module are evenly distributed. (3.3) Each subsequent flow detection cycle E flow According to the previous E flow Based on the detection situation, the flow-level measurement module adaptively adjusts the size of sketch measurement resources allocated to DDoS and superspreader attack detection.

5. The adaptive heavy hitter detection method for a programmable switch according to claim 1, characterized in that: The specific method of the overlapping path elimination algorithm in step (4) is as follows: (4.1) In each flow detection cycle E flow In the flow-level measurement module, the sketch identifies the detected suspicious heavyhitter and stores it in the precise statistical flow table. (4.2) In each flow detection cycle E flow In the switch, the packets entering the flow-level measurement module first need to be matched in the precise statistical flow table. The packets that fail to match need to be sent to the sketch processing pipeline. The packets that successfully match only need to complete the precise statistics in the flow table before being forwarded. The flow identifiers that do not meet the heavy hitter condition obtained by the precise statistics will be deleted from the flow table. (4.3) Accurate Statistics While accurately counting, the flow table also completes the recording of auxiliary items for each flow identifier in the table entry, which is used to further analyze the heavy hitter characteristics captured in the table.

Images