Anti-DDoS function abstraction method suitable for cloud native system

Abstract

The invention discloses an anti-DDoS (Distributed Denial of Service) function abstraction method applicable to a cloud native system, which belongs to the technical field of network security and is characterized by comprising the following steps of: a, abstracting an anti-DDoS function into two types of capabilities; b, constructing a first capability pool and a second capability pool according to the capability classification; and c, the cloud native system automatically generates rules through user requirements, and dynamically adjusts capability configuration according to network traffic characteristics, attack modes and system security requirements. According to the method, the anti-DDoS function is abstracted into the capacity in the overlay network, unified deployment is carried out in the overlay network, deployment is flexible, and flexible combination and linkage of the anti-DDoS system function can be achieved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an anti-DDoS function abstraction method suitable for a cloud native system. Background Art

[0002] DDoS attack is a distributed denial of service attack. DDoS attack is one of the most important means of attack in current network attacks. Its characteristic is that DDoS attack can quickly exhaust the resources of the target system through a large number of requests, causing it to be unable to provide services normally. With the popularization of the Internet and the increase in the connection of various devices, the scale and frequency of DDoS attacks are also growing, bringing greater challenges to network security.

[0003] Cloud-network integration refers to the combination of cloud computing and communication networks, which fully utilizes the respective advantages of cloud computing and networks. Cloud computing can dynamically adjust resources according to demand, while the network realizes fast data transmission and wider coverage, with high flexibility and elasticity. Cloud-network integration development deploys supercomputing power to the user end, realizes cloud-edge integration, and achieves full network coverage through central cloud and edge cloud, bringing cloud-network capabilities to the extreme. Cloud native aims to use cloud computing, containerization and microservice technologies to build highly flexible and easy-to-manage applications and give full play to the potential of cloud computing. Cloud native can deploy applications according to demand, and applications can be flexibly combined and linked, and automated management can be performed to achieve flexible deployment of network functions and improve the response speed and efficiency of applications. Cloud-network integration provides flexible and sufficient basic conditions for various cloud-native businesses. On the basis of cloud native, with the help of the concept of softwareization, traditional anti-DDoS is abstracted into capabilities, breaking through the constraints of the existing network structure, realizing flexible combination and linkage of system functions, and having the characteristics of deployment, orchestration, expansion and update, solving the problems of rigid and high cost of traditional hardware deployment. Traditional anti-DDoS methods require the deployment of corresponding hardware devices and software functions in the physical network, which results in the lack of flexibility and elasticity of traditional anti-DDoS systems and the inability to be deployed on demand.

[0004] A Chinese patent document with publication number CN117375942A and publication date January 9, 2024 discloses a method and device for preventing DDoS attacks based on node cleaning, the method comprising: monitoring network traffic information of a protected server, and analyzing the network traffic information to obtain abnormal network traffic, when the size of the abnormal network traffic exceeds the defense threshold corresponding to the protected server, obtaining a preset traffic cleaning node set, pulling the abnormal network traffic to the traffic cleaning node set, and performing node cleaning on the abnormal network traffic through a preset traffic cleaning method to obtain a network traffic cleaning result, the network traffic cleaning result comprising a first target network abnormal traffic and a first normal access traffic, and injecting the first normal access traffic back to the protected server according to a preset traffic injection route.

[0005] The method and device for preventing DDoS attacks based on node cleaning disclosed in the patent document can prevent DDoS attacks. However, the anti-DDoS system has poor deployment flexibility and cannot achieve flexible combination and linkage of anti-DDoS system functions. Summary of the invention

[0006] In order to overcome the defects of the above-mentioned prior art, the present invention provides an anti-DDoS function abstraction method suitable for cloud native systems. The present invention abstracts the anti-DDoS function into a capability in an overlay network, and uniformly deploys it in the overlay network. The deployment is flexible, and flexible combination and linkage of anti-DDoS system functions can be achieved.

[0007] The present invention is achieved through the following technical solutions: A method for abstracting anti-DDoS functions applicable to a cloud native system, characterized by comprising the following steps: a. Abstract the anti-DDoS function into two types of capabilities; b. Construct the first capability pool and the second capability pool according to the classification of capabilities; c. The cloud-native system automatically generates rules based on user needs and dynamically adjusts capability configuration based on network traffic characteristics, attack patterns, and system security requirements.

[0008] In step a, the two types of capabilities refer to flow-based detection and cleaning capabilities and IP-based source address management capabilities.

[0009] The flow-based detection and cleaning capabilities include drainage, detection, cleaning and reinjection.

[0010] The flow-based detection and cleaning capability is used to detect data traffic in the cloud native system, remove DDoS attack data flows, and inject the cleaned traffic back into the cloud native system.

[0011] The IP-based source address management capabilities include source address verification, source address detection, blacklist and whitelist, and trusted source collection.

[0012] The IP-based source address governance capability is used to manage the source addresses of data in the cloud native system and to control the source addresses of DDoS attacks.

[0013] In step b, the first capability pool and the second capability pool are both uniformly controlled by the policy automation component of the cloud native system.

[0014] The unified control of the policy automation component specifically means that when user needs arise, the policy automation component selects corresponding capabilities from the first capability pool and the second capability pool according to the policy, combines and links the various capabilities, and deploys the capabilities in the cloud native system.

[0015] Any capabilities in the first capability pool and the second capability pool are independent of each other and are used for independent deployment, allocation, orchestration, expansion and update.

[0016] The flow-based detection and cleaning capability is located in the first capability pool, and the IP-based source address management capability is located in the second capability pool.

[0017] The capability described in the present invention refers to a virtualized component abstracted from a traditional anti-DDoS function, which decouples the traditional anti-DDoS function from the hardware, implements the network function in a virtualized environment through network programming, uses a management and orchestration system to configure, manage and optimize the virtual network function, and deploys it in a container at any location on the physical network in the cloud native system.

[0018] The strategy described in the present invention is achieved by the control center analyzing user needs, perceiving the current network status of the cloud native system, and predicting future attacks, abstracting the capabilities and combining and linking them in a set order to form a service chain that is then deployed to the cloud native system.

[0019] The beneficial effects of the present invention are mainly manifested in the following aspects: 1. The present invention, a. abstracts the anti-DDoS function into two types of capabilities; b. constructs a first capability pool and a second capability pool according to the classification of capabilities; c. the cloud native system automatically generates rules according to user needs, and dynamically adjusts the capability configuration according to network traffic characteristics, attack patterns and system security requirements. Compared with the prior art, the anti-DDoS function is abstracted as a capability in the overlay network, and is uniformly deployed in the overlay network. The deployment is flexible, and flexible combination and linkage of anti-DDoS system functions can be achieved.

[0020] 2. In the present invention, the two types of capabilities can be seamlessly migrated and deployed in cloud-native systems, enhancing the flexibility of anti-DDoS attack strategies.

[0021] 3. In order to solve the problem that anti-DDoS strategies in current networks are difficult to combine and automatically execute, the present invention builds a capability pool, which is uniformly controlled by the policy automation components of the cloud native system, so as to realize the automation of anti-DDoS strategies.

[0022] 4. The present invention uses cloud servers to abstract the anti-DDoS function in the existing physical network into capabilities in the overlay network. Each capability can be independently deployed, allocated, orchestrated, expanded and updated, making deployment more flexible.

[0023] 5. In the present invention, the cloud native system automatically generates a set of rules based on user needs, and dynamically adjusts the configuration and scale of capability abstraction according to network traffic characteristics, attack patterns, and system security requirements to achieve adaptive capabilities against DDoS attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments: Figure 1 It is a schematic diagram of the abstraction of functions in the present invention; Figure 2 The diagram is a schematic diagram of a service chain in which the capabilities in the capability pool are combined and linked. DETAILED DESCRIPTION

[0025] Example 1 See also Figure 1 , an anti-DDoS function abstraction method suitable for cloud native systems, including the following steps: a. Abstract the anti-DDoS function into two types of capabilities; b. Construct the first capability pool and the second capability pool according to the classification of capabilities; c. The cloud-native system automatically generates rules based on user needs and dynamically adjusts capability configuration based on network traffic characteristics, attack patterns, and system security requirements.

[0026] The capability refers to the virtualized components abstracted from traditional anti-DDoS functions, which decouple traditional anti-DDoS functions from hardware, implement network functions in a virtualized environment through network programming, and use management and orchestration systems such as MANO to configure, manage and optimize virtual network functions, which are deployed in containers at any location on the physical network in the cloud native system.

[0027] MANO refers to a unified framework for managing various virtual network functions and basic network virtualization architecture, which is used for business orchestration and device management.

[0028] This embodiment is the most basic implementation method. a. The anti-DDoS function is abstracted into two types of capabilities. b. A first capability pool and a second capability pool are constructed according to the classification of capabilities. c. The cloud native system automatically generates rules based on user needs and dynamically adjusts capability configuration according to network traffic characteristics, attack patterns, and system security requirements. Compared with the existing technology, the anti-DDoS function is abstracted as a capability in the overlay network and uniformly deployed in the overlay network. The deployment is flexible and can achieve flexible combination and linkage of anti-DDoS system functions.

[0029] Example 2 See also Figure 1 , an anti-DDoS function abstraction method suitable for cloud native systems, including the following steps: a. Abstract the anti-DDoS function into two types of capabilities; b. Construct the first capability pool and the second capability pool according to the classification of capabilities; c. The cloud-native system automatically generates rules based on user needs and dynamically adjusts capability configuration based on network traffic characteristics, attack patterns, and system security requirements.

[0030] In step a, the two types of capabilities refer to flow-based detection and cleaning capabilities and IP-based source address management capabilities.

[0031] The flow-based detection and cleaning capabilities include drainage, detection, cleaning and reinjection.

[0032] The flow-based detection and cleaning capability is used to detect data traffic in the cloud native system, remove DDoS attack data flows, and inject the cleaned traffic back into the cloud native system.

[0033] The capability refers to the virtualized components abstracted from traditional anti-DDoS functions, which decouple traditional anti-DDoS functions from hardware, implement network functions in a virtualized environment through network programming, and use management and orchestration systems such as MANO to configure, manage and optimize virtual network functions, which are deployed in containers at any location on the physical network in the cloud native system.

[0034] MANO refers to a unified framework for managing various virtual network functions and basic network virtualization architecture, which is used for business orchestration and device management.

[0035] This embodiment is a preferred implementation method. The two types of capabilities can be seamlessly migrated and deployed in the cloud-native system, enhancing the flexibility of the anti-DDoS attack strategy.

[0036] Example 3 See also Figure 1 , an anti-DDoS function abstraction method suitable for cloud native systems, including the following steps: a. Abstract the anti-DDoS function into two types of capabilities; b. Construct the first capability pool and the second capability pool according to the classification of capabilities; c. The cloud-native system automatically generates rules based on user needs and dynamically adjusts capability configuration based on network traffic characteristics, attack patterns, and system security requirements.

[0037] In step a, the two types of capabilities refer to flow-based detection and cleaning capabilities and IP-based source address management capabilities.

[0038] The flow-based detection and cleaning capabilities include drainage, detection, cleaning and reinjection.

[0039] The flow-based detection and cleaning capability is used to detect data traffic in the cloud native system, remove DDoS attack data flows, and inject the cleaned traffic back into the cloud native system.

[0040] The IP-based source address management capabilities include source address verification, source address detection, blacklist and whitelist, and trusted source collection.

[0041] The IP-based source address governance capability is used to manage the source addresses of data in the cloud native system and to control the source addresses of DDoS attacks.

[0042] The capability refers to the virtualized components abstracted from traditional anti-DDoS functions, which decouple traditional anti-DDoS functions from hardware, implement network functions in a virtualized environment through network programming, and use management and orchestration systems such as MANO to configure, manage and optimize virtual network functions, which are deployed in containers at any location on the physical network in the cloud native system.

[0043] MANO refers to a unified framework for managing various virtual network functions and basic network virtualization architecture, which is used for business orchestration and device management.

[0044] This embodiment is another preferred implementation method. In order to address the problem that anti-DDoS policies in the current network are difficult to combine and automatically execute, anti-DDoS policy automation can be achieved by building a capability pool and uniformly controlling it through the policy automation components of the cloud native system.

[0045] Example 4 See also Figure 1 , an anti-DDoS function abstraction method suitable for cloud native systems, including the following steps: a. Abstract the anti-DDoS function into two types of capabilities; b. Construct the first capability pool and the second capability pool according to the classification of capabilities; c. The cloud-native system automatically generates rules based on user needs and dynamically adjusts capability configuration based on network traffic characteristics, attack patterns, and system security requirements.

[0046] In step a, the two types of capabilities refer to flow-based detection and cleaning capabilities and IP-based source address management capabilities.

[0047] The flow-based detection and cleaning capabilities include drainage, detection, cleaning and reinjection.

[0048] The flow-based detection and cleaning capability is used to detect data traffic in the cloud native system, remove DDoS attack data flows, and inject the cleaned traffic back into the cloud native system.

[0049] The IP-based source address management capabilities include source address verification, source address detection, blacklist and whitelist, and trusted source collection.

[0050] The IP-based source address governance capability is used to manage the source addresses of data in the cloud native system and to control the source addresses of DDoS attacks.

[0051] In step b, the first capability pool and the second capability pool are both uniformly controlled by the policy automation component of the cloud native system.

[0052] The unified control of the policy automation component specifically means that when user needs arise, the policy automation component selects corresponding capabilities from the first capability pool and the second capability pool according to the policy, combines and links the various capabilities, and deploys the capabilities in the cloud native system.

[0053] The capability refers to the virtualized components abstracted from traditional anti-DDoS functions, which decouple traditional anti-DDoS functions from hardware, implement network functions in a virtualized environment through network programming, and use management and orchestration systems such as MANO to configure, manage and optimize virtual network functions, which are deployed in containers at any location on the physical network in the cloud native system.

[0054] MANO refers to a unified framework for managing various virtual network functions and basic network virtualization architecture, which is used for business orchestration and device management.

[0055] This embodiment is another preferred implementation method. By using cloud servers, the anti-DDoS function in the existing physical network is abstracted into capabilities in the overlay network. Each capability can be independently deployed, allocated, orchestrated, expanded and updated, making deployment more flexible.

[0056] Example 5 See also Figure 1 and Figure 2 , an anti-DDoS function abstraction method suitable for cloud native systems, including the following steps: a. Abstract the anti-DDoS function into two types of capabilities; b. Construct the first capability pool and the second capability pool according to the classification of capabilities; c. The cloud-native system automatically generates rules based on user needs and dynamically adjusts capability configuration based on network traffic characteristics, attack patterns, and system security requirements.

[0057] In step a, the two types of capabilities refer to flow-based detection and cleaning capabilities and IP-based source address management capabilities.

[0058] The flow-based detection and cleaning capabilities include drainage, detection, cleaning and reinjection.

[0059] The flow-based detection and cleaning capability is used to detect data traffic in the cloud native system, remove DDoS attack data flows, and inject the cleaned traffic back into the cloud native system.

[0060] The IP-based source address management capabilities include source address verification, source address detection, blacklist and whitelist, and trusted source collection.

[0061] The IP-based source address governance capability is used to manage the source addresses of data in the cloud native system and to control the source addresses of DDoS attacks.

[0062] In step b, the first capability pool and the second capability pool are both uniformly controlled by the policy automation component of the cloud native system.

[0063] The unified control of the policy automation component specifically means that when user needs arise, the policy automation component selects corresponding capabilities from the first capability pool and the second capability pool according to the policy, combines and links the various capabilities, and deploys the capabilities in the cloud native system.

[0064] Any capabilities in the first capability pool and the second capability pool are independent of each other and are used for independent deployment, allocation, orchestration, expansion and update.

[0065] The flow-based detection and cleaning capability is located in the first capability pool, and the IP-based source address management capability is located in the second capability pool.

[0066] The capability refers to the virtualized components abstracted from traditional anti-DDoS functions, which decouple traditional anti-DDoS functions from hardware, implement network functions in a virtualized environment through network programming, and use management and orchestration systems such as MANO to configure, manage and optimize virtual network functions, which are deployed in containers at any location on the physical network in the cloud native system.

[0067] MANO refers to a unified framework for managing various virtual network functions and basic network virtualization architecture, which is used for business orchestration and device management.

[0068] This embodiment is the best implementation method. The cloud native system automatically generates a set of rules based on user needs, and dynamically adjusts the configuration and scale of capability abstraction based on network traffic characteristics, attack patterns, and system security requirements to achieve adaptive capabilities against DDoS attacks.

[0069] The basic principles of the present invention are as follows: Traditional anti-DDoS functions are abstracted into capabilities with the help of software concepts to achieve flexible service deployment and fast dynamic response, including building a capability pool to support on-demand allocation and scheduling capabilities. At the same time, capability abstraction strategies are used to dynamically adjust resources according to traffic characteristics and attack patterns, thereby improving the overall response speed and resource utilization efficiency of the cloud native system.

[0070] Abstracting functions into capabilities with the help of software-based concepts specifically means that with the help of software-based concepts, security functions, collection functions, drainage functions, and injection functions that are dependent on hardware or software environments are extracted through software-based methods, so that functions are separated from their original hardware or software environments and transformed into capabilities that can be deployed, orchestrated, expanded, and updated, and can be deployed anywhere in the cloud-native system. Flexible service deployment is specifically reflected in the fact that the abstracted capabilities can be deployed anywhere in the cloud-native system and are compatible with the components in the cloud-native system; fast dynamic response is specifically reflected in the fact that the abstracted capabilities can be deployed, orchestrated, expanded, and updated according to user needs.

[0071] The capability pool is a collection of multiple abstracted capabilities. Each capability in the capability pool is independent of each other and can be independently deployed, allocated, orchestrated, expanded and updated. The capability pool is uniformly controlled by the policy automation of the cloud native system. When user needs arise, the policy automation selects the corresponding capabilities from the capability pool according to the generated policy, combines and links each capability, and deploys the capabilities in the cloud native system to meet user needs in the form of a service chain. The capability abstraction strategy is specifically reflected in the system automatically generating a set of rules based on user needs. The rules dynamically adjust the configuration and scale of capability abstraction based on network traffic characteristics, attack patterns and system security requirements to achieve adaptive capabilities against DDoS attacks. The capability abstraction strategy allows capabilities to be seamlessly migrated and deployed in the cloud native system, enhancing the flexibility of anti-DDoS attack strategies.

[0072] A capability pool is built based on the traffic detection and cleaning capabilities, which include diversion, detection, cleaning, and reinjection. Policy automation selects anti-DDoS policies composed of capabilities from the capability pool to detect data traffic in the cloud native system, remove DDoS attack data flows, and reinject the cleaned traffic into the cloud native system.

[0073] A capability pool is built based on the IP source address governance capability, which includes source address verification, source address detection, blacklist and whitelist, and trusted source collection. Policy automation selects anti-DDoS policies composed of capabilities from the capability pool to manage the source addresses of data in the cloud native system and control the source addresses of DDoS attacks.

Claims

1. A method for abstracting anti-DDoS functions applicable to cloud native systems, characterized in that: The following steps are involved: a. Abstract the anti-DDoS function into two types of capabilities; b. Construct the first capability pool and the second capability pool according to the classification of capabilities; c. The cloud-native system automatically generates rules based on user needs and dynamically adjusts capability configuration based on network traffic characteristics, attack patterns, and system security requirements.

2. According to claim 1, a method for abstracting anti-DDoS functions applicable to cloud native systems is characterized by: In step a, the two types of capabilities refer to flow-based detection and cleaning capabilities and IP-based source address management capabilities.

3. According to claim 2, a method for abstracting anti-DDoS functions applicable to cloud native systems is characterized by: The flow-based detection and cleaning capabilities include drainage, detection, cleaning and reinjection.

4. The anti-DDoS function abstraction method applicable to a cloud native system according to claim 3, characterized in that: The flow-based detection and cleaning capability is used to detect data traffic in the cloud native system, remove DDoS attack data flows, and inject the cleaned traffic back into the cloud native system.

5. According to claim 2, the anti-DDoS function abstraction method applicable to cloud native systems is characterized by: The IP-based source address management capabilities include source address verification, source address detection, blacklist and whitelist, and trusted source collection.

6. The anti-DDoS function abstraction method applicable to a cloud native system according to claim 5, characterized in that: The IP-based source address governance capability is used to manage the source addresses of data in the cloud native system and to control the source addresses of DDoS attacks.

7. The anti-DDoS function abstraction method applicable to a cloud native system according to claim 1, characterized in that: In step b, the first capability pool and the second capability pool are both uniformly controlled by the policy automation component of the cloud native system.

8. The anti-DDoS function abstraction method applicable to a cloud native system according to claim 7, characterized in that: The unified control of the policy automation component specifically means that when user needs arise, the policy automation component selects corresponding capabilities from the first capability pool and the second capability pool according to the policy, combines and links the various capabilities, and deploys the capabilities in the cloud native system.

9. The anti-DDoS function abstraction method applicable to a cloud native system according to claim 1, characterized in that: Any capabilities in the first capability pool and the second capability pool are independent of each other and are used for independent deployment, allocation, orchestration, expansion and update.

10. The anti-DDoS function abstraction method applicable to a cloud native system according to claim 2, characterized in that: The flow-based detection and cleaning capability is located in the first capability pool, and the IP-based source address management capability is located in the second capability pool.

Images