Service flow processing method, device and equipment and computer readable storage medium
By monitoring service traffic on the firewall and enabling the target IPS engine for detection at high traffic, the problem of firewall's time delay and packet loss rate increases when dealing with high traffic is solved, and traffic processing is optimized and cost reduction is achieved.
Patent Information
- Application Number
- CN202411277960.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-12
- Publication Date
- 2024-12-27
AI Technical Summary
When existing firewalls deal with increased business traffic, they will lead to increased latency and packet loss rates, or they will need to expand horizontally, affecting user experience and increasing costs.
By monitoring the metric value of the service traffic, when its average value exceeds the preset threshold, the target IPS engine in the target Pod is enabled for intrusion prevention detection, reducing the firewall's parsing and processing load, and stopping the IPS engine detection when the traffic metric returns to normal. , controls its hibernation or deletion.
It effectively avoids the increase in the latency and packet loss rate of the firewall under high traffic conditions, reduces the need for horizontal expansion of the firewall, optimizes the user experience and reduces security expenses.
Smart Images
Figure CN119210814A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security technology, and in particular to a service flow processing method, device, equipment and computer-readable storage medium. Background Art
[0002] In the Internet age where cyber attacks are frequent, people have put forward higher requirements for network security. In the cloud computing environment, firewalls are the first security barrier for cloud services and play a vital role in protection.
[0003] However, in the face of the growing business traffic, the firewall will always have bottlenecks when parsing and processing. In this case, the only way to deal with the increased business traffic is to increase the service delay and packet loss rate or to expand the firewall horizontally. The above processing will greatly affect the user experience or require users to spend more on security. Summary of the invention
[0004] The present application provides a business traffic processing method, device, equipment and computer-readable storage medium, which can solve the technical problems existing in the prior art that increasing the service delay and packet loss rate or coping with increased business traffic by horizontally expanding the firewall will affect the user experience or increase user costs.
[0005] In a first aspect, an embodiment of the present application provides a service traffic processing method, the service traffic processing method comprising:
[0006] When the average value of the monitoring index of the service traffic passing through the firewall within the preset time period is greater than the corresponding preset threshold, the target intrusion prevention system IPS engine in the target Pod associated with the target IP is enabled;
[0007] When the target IPS engine is in operation, a first status notification is sent to the firewall, so that the firewall stops parsing and processing the target service traffic corresponding to the target IP after receiving the first status notification;
[0008] When the target business traffic reaches the target Pod, the target business traffic is directed to the target IPS engine so that the target IPS engine can perform intrusion prevention detection on the target business traffic.
[0009] In combination with the first aspect, in one implementation, the monitoring indicator value includes bandwidth and / or latency.
[0010] In combination with the first aspect, in one implementation, after the target service traffic reaches the target Pod, the target service traffic is directed to the target IPS engine so that the target IPS engine performs intrusion prevention detection on the target service traffic, further comprising:
[0011] The intrusion prevention detection results obtained by the target IPS engine in each detection cycle are sent to the firewall.
[0012] In combination with the first aspect, in one implementation, after the target service traffic reaches the target Pod, the target service traffic is directed to the target IPS engine so that the target IPS engine performs intrusion prevention detection on the target service traffic, further comprising:
[0013] When the average value of the monitoring index of the business traffic passing through the firewall within the preset time period is not greater than the corresponding preset threshold, the target business traffic is directed to the firewall for analysis and processing;
[0014] An adjustment notification is sent to the target IPS engine, so that the target IPS engine stops performing intrusion prevention detection on the target business traffic in the target Pod after receiving the adjustment notification.
[0015] In combination with the first aspect, in one implementation, after sending the adjustment notification to the target IPS engine, the method further includes:
[0016] Delete the target IPS engine or put the target IPS engine into sleep mode.
[0017] In a second aspect, an embodiment of the present application provides a service flow processing device, the service flow processing device comprising:
[0018] An enabling module, used to enable a target intrusion prevention system IPS engine in a target Pod associated with a target IP when the average value of the monitoring indicator value of the service traffic passing through the firewall within a preset time period is greater than a corresponding preset threshold value;
[0019] A sending module, used for sending a first status notification to the firewall when the target IPS engine is in the running state, so that the firewall stops parsing and processing the target service traffic corresponding to the target IP after receiving the first status notification;
[0020] The guiding module is used to guide the target business traffic to the target IPS engine when the target business traffic reaches the target Pod, so that the target IPS engine can perform intrusion prevention detection on the target business traffic.
[0021] In combination with the second aspect, in one embodiment, the guiding module is also used to guide the target business traffic to the firewall for parsing and processing when the average value of the monitoring index value of the business traffic passing through the firewall within a preset time period is not greater than the corresponding preset threshold; the sending module is also used to send an adjustment notification to the target IPS engine, so that the target IPS engine stops performing intrusion defense detection on the target business traffic in the target Pod after receiving the adjustment notification.
[0022] In conjunction with the second aspect, in one implementation, the service flow processing device further includes a management module, which is used to:
[0023] Delete the target IPS engine or put the target IPS engine into sleep mode.
[0024] In a third aspect, an embodiment of the present application provides a business traffic processing device, which includes a processor, a memory, and a business traffic processing program stored on the memory and executable by the processor, wherein when the business traffic processing program is executed by the processor, the steps of the business traffic processing method described in the first aspect are implemented.
[0025] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a business traffic processing program is stored, wherein when the business traffic processing program is executed by a processor, the steps of the business traffic processing method described in the first aspect are implemented.
[0026] The beneficial effects brought by the technical solution provided in the embodiments of the present application include:
[0027] In an embodiment of the present application, when the average value of the monitoring index value of the business traffic passing through the firewall within a preset time period is greater than the corresponding preset threshold value, the target intrusion prevention system IPS engine in the target Pod associated with the target IP is enabled; when the target IPS engine is in operation, a first status notification is sent to the firewall so that the firewall stops parsing and processing the target business traffic corresponding to the target IP after receiving the first status notification; when the target business traffic reaches the target Pod, the target business traffic is directed to the target IPS engine so that the target IPS engine can perform intrusion prevention detection on the target business traffic. Through the embodiment of the present application, when the business traffic is high, the target business traffic in the business traffic is directed to the target IPS engine for intrusion prevention detection, without the need to horizontally expand the firewall, and can effectively ensure that the service delay and packet loss rate meet user needs. BRIEF DESCRIPTION OF THE DRAWINGS
[0028] Figure 1 This is a flow chart of an embodiment of a method for processing business traffic of the present application;
[0029] Figure 2 This is a functional module diagram of an embodiment of a service flow processing device of the present application;
[0030] Figure 3 This is a schematic diagram of the hardware structure of the business traffic processing device involved in the embodiment of the present application. DETAILED DESCRIPTION
[0031] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0032] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.
[0033] In a first aspect, an embodiment of the present application provides a method for processing business traffic.
[0034] In one embodiment, referring to Figure 1 , Figure 1 This is a flow chart of an embodiment of the service flow processing method of the present application. Figure 1 As shown, the service traffic processing method includes:
[0035] Step S10, when the average value of the monitoring index value of the service traffic passing through the firewall within the preset time period is greater than the corresponding preset threshold, the target intrusion prevention system IPS engine in the target Pod associated with the target IP is enabled;
[0036] In this embodiment, the business traffic passing through the firewall can be monitored in real time or at preset time intervals to obtain a number of monitoring index values. Taking 15 minutes as an example, the preset time period is calculated based on the monitoring index values obtained within 15 minutes, and then the average value is compared with the preset threshold. If the average value is greater than the preset threshold, it means that the business traffic passing through the firewall at this time continues to be high. The target intrusion prevention system IPS engine in the target Pod associated with the target IP is enabled. Among them, the monitoring index value is used to characterize the size of the business traffic, and is selected based on actual needs. IPS is the abbreviation of Intrusion Prevention System, and its full name is Intrusion Prevention System.
[0037] The destination IP is the IP recorded in the firewall's protection list. For example, the destination IP includes IP1, IP2, and IP3. Among them, the target Pod associated with IP1 is Pod1, the target Pod associated with IP2 is Pod2, and the target Pod associated with IP3 is Pod3. Then, when the average value of the monitoring index value of the business traffic passing through the firewall within the preset time is greater than the corresponding preset threshold, IPS Engine 1 in Pod1, IPS Engine 2 in Pod2, and IPS Engine 3 in Pod3 are enabled.
[0038] Among them, for enabling IPS Engine 1, if IPS Engine 1 exists in Pod1 but is in dormant state, IPS Engine 1 can be directly awakened, and IPS Engine 1 will actively establish association with the firewall after awakening. If IPS Engine 1 does not exist in Pod1, the process of installing IPS Engine 1 in Pod1 is executed, and after successful installation, Engine 1 will actively establish association with the firewall.
[0039] The implementation example of enabling any IPS engine is the same as that described above and will not be described in detail here.
[0040] Furthermore, in one embodiment, the monitoring indicator value includes bandwidth and / or latency.
[0041] In this embodiment, two situations are assumed:
[0042] Case 1: The average bandwidth of the service traffic passing through the firewall within the preset time period is greater than 80% of the firewall bandwidth specification;
[0043] Case 2: The average value of the delay of the service traffic passing through the firewall within a preset time period is greater than the preset delay threshold.
[0044] When any one or both of the above conditions are met, the target intrusion prevention system IPS engine in the target Pod associated with the target IP is enabled.
[0045] Step S20, when the target IPS engine is in the running state, sending a first state notification to the firewall, so that the firewall stops parsing and processing the target service traffic corresponding to the target IP after receiving the first state notification;
[0046] In this embodiment, when the target IPS engine is in operation, a first status notification is sent to the firewall so that the firewall knows that the target IPS engine is running after receiving the first status notification. The firewall then no longer needs to parse and process the target business traffic that will flow through the target IPS engine, that is, stops parsing and processing the target business traffic corresponding to the target IP.
[0047] For example, the target IP is IP1, the target Pod associated with IP1 is Pod1, and the target IPS engine is IPS engine 1. When the firewall receives the first status notification sent by IPS engine 1, it will no longer process the service message corresponding to IP1 (that is, the target service traffic), that is, the target service traffic directly passes through the firewall and enters Pod1.
[0048] Step S30, when the target service traffic reaches the target Pod, the target service traffic is directed to the target IPS engine so that the target IPS engine performs intrusion prevention detection on the target service traffic.
[0049] In this embodiment, when the target business traffic reaches the target Pod, the target business traffic is directed to the target IPS engine so that the target IPS engine can perform traffic analysis, threat detection and other processing on the target business traffic. After processing, the target business traffic is intercepted or released based on the processing results and the processing strategy.
[0050] The processing strategy is sent from the firewall to the target IPS engine.
[0051] In an embodiment of the present application, when the average value of the monitoring index value of the business traffic passing through the firewall within a preset time period is greater than the corresponding preset threshold value, the target intrusion prevention system IPS engine in the target Pod associated with the target IP is enabled; when the target IPS engine is in operation, a first status notification is sent to the firewall so that the firewall stops parsing and processing the target business traffic corresponding to the target IP after receiving the first status notification; when the target business traffic reaches the target Pod, the target business traffic is directed to the target IPS engine so that the target IPS engine can perform intrusion prevention detection on the target business traffic. Through the embodiment of the present application, when the business traffic is high, the target business traffic in the business traffic is directed to the target IPS engine for intrusion prevention detection, without the need to horizontally expand the firewall, and can effectively ensure that the service delay and packet loss rate meet user needs.
[0052] Furthermore, in one embodiment, after step S30, the method further includes:
[0053] The intrusion prevention detection results obtained by the target IPS engine in each detection cycle are sent to the firewall.
[0054] In this embodiment, the target IPS engine continuously performs intrusion prevention detection on the target service traffic, summarizes the intrusion prevention detection results obtained in each detection cycle, and sends them to the firewall.
[0055] Furthermore, in one embodiment, after step S30, the method further includes:
[0056] When the average value of the monitoring index of the business traffic passing through the firewall within the preset time period is not greater than the corresponding preset threshold, the target business traffic is directed to the firewall for analysis and processing;
[0057] An adjustment notification is sent to the target IPS engine, so that the target IPS engine stops performing intrusion prevention detection on the target business traffic in the target Pod after receiving the adjustment notification.
[0058] In this embodiment, referring to the embodiment of step S10, if the average value is not greater than the preset threshold, it means that the business traffic passing through the firewall is continuously low at this time, and the firewall can parse and process all business traffic, that is, guide the target business traffic to the firewall for parsing and processing. In order to avoid repeated processing of the target business traffic, an adjustment notification is sent to the target IPS engine, so that the target IPS engine stops performing intrusion defense detection on the target business traffic in the target Pod after receiving the adjustment notification.
[0059] Furthermore, in one embodiment, after sending the adjustment notification to the target IPS engine, the method further includes:
[0060] Delete the target IPS engine or put the target IPS engine into sleep mode.
[0061] In this embodiment, when the target IPS engine is not needed to perform intrusion prevention detection on the target service traffic in the target Pod, the target IPS engine can be controlled to enter a dormant state. It should be noted that the target IPS engine is like a program, and the target IPS engine can be controlled to enter a dormant state by closing the program process. The target IPS engine can also be deleted to release the resources occupied by the target IPS engine.
[0062] In a second aspect, an embodiment of the present application also provides a service flow processing device.
[0063] In one embodiment, referring to Figure 2 , Figure 2 This is a functional module diagram of an embodiment of a service flow processing device of the present application. Figure 2 As shown, the service flow processing device includes:
[0064] An enabling module 10 is used to enable a target intrusion prevention system IPS engine in a target Pod associated with a target IP when the average value of the monitoring index value of the service traffic passing through the firewall within a preset time period is greater than a corresponding preset threshold value;
[0065] The sending module 20 is used to send a first status notification to the firewall when the target IPS engine is in the running state, so that the firewall stops parsing and processing the target service traffic corresponding to the target IP after receiving the first status notification;
[0066] The guiding module 30 is used to guide the target business traffic to the target IPS engine after the target business traffic reaches the target Pod, so that the target IPS engine can perform intrusion prevention detection on the target business traffic.
[0067] Furthermore, in one embodiment, the monitoring indicator value includes bandwidth and / or latency.
[0068] Furthermore, in one embodiment, the sending module 20 is further configured to:
[0069] The intrusion prevention detection results obtained by the target IPS engine in each detection cycle are sent to the firewall.
[0070] Furthermore, in one embodiment, the guiding module 30 is also used to guide the target business traffic to the firewall for parsing and processing when the average value of the monitoring index value of the business traffic passing through the firewall within a preset time period is not greater than the corresponding preset threshold; the sending module 20 is also used to send an adjustment notification to the target IPS engine, so that the target IPS engine stops performing intrusion defense detection on the target business traffic in the target Pod after receiving the adjustment notification.
[0071] Furthermore, in one embodiment, the service flow processing device further includes a management module, which is used to:
[0072] Delete the target IPS engine or put the target IPS engine into sleep mode.
[0073] Among them, the functional implementation of each module in the above-mentioned business traffic processing device corresponds to the various steps in the above-mentioned business traffic processing method embodiment, and its functions and implementation processes will not be repeated here one by one.
[0074] In a third aspect, an embodiment of the present application provides a business traffic processing device, which may be a personal computer (PC), a laptop computer, a server, or other device with data processing capabilities.
[0075] Reference Figure 3 , Figure 3 The hardware structure diagram of the service flow processing device involved in the embodiment of the present application is shown in FIG. In the embodiment of the present application, the service flow processing device may include a processor, a memory, a communication interface, and a communication bus.
[0076] The communication bus may be of any type and is used to interconnect the processor, the memory, and the communication interface.
[0077] Communication interfaces include input / output (I / O) interfaces, physical interfaces, and logical interfaces, which are used to interconnect devices within the service traffic processing device, and interfaces used to interconnect the service traffic processing device with other devices (such as other computing devices or user devices). Physical interfaces can be Ethernet interfaces, optical fiber interfaces, ATM interfaces, etc.; user devices can be display screens (Display), keyboards (Keyboard), etc.
[0078] The memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.
[0079] The processor may be a general-purpose processor, and the general-purpose processor may call the service flow processing program stored in the memory and execute the service flow processing method provided in the embodiment of the present application. For example, the general-purpose processor may be a central processing unit (CPU). The method executed when the service flow processing program is called may refer to the various embodiments of the service flow processing method of the present application, and will not be repeated here.
[0080] Those skilled in the art will understand that Figure 3 The hardware structure shown in the figure does not constitute a limitation on the present application, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.
[0081] In a fourth aspect, an embodiment of the present application also provides a computer-readable storage medium.
[0082] The computer-readable storage medium of the present application stores a service flow processing program, wherein when the service flow processing program is executed by a processor, the steps of the service flow processing method as described above are implemented.
[0083] Among them, the method implemented when the business traffic processing program is executed can refer to the various embodiments of the business traffic processing method of the present application, and will not be repeated here.
[0084] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.
[0085] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit "first", "second" and "third" to different types.
[0086] In the description of the embodiments of the present application, "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.
[0087] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; the “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.
[0088] In some processes described in the embodiments of the present application, multiple operations or steps that appear in a specific order are included, but it should be understood that these operations or steps may not be executed in the order in which they appear in the embodiments of the present application or in parallel, and the sequence number of the operation is only used to distinguish the different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed in sequence or in parallel, and these operations or steps may be combined.
[0089] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present application.
[0090] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.
Claims
1. A method for processing business traffic, characterized in that: The service flow processing method comprises: When the average value of the monitoring index of the service traffic passing through the firewall within the preset time period is greater than the corresponding preset threshold, the target intrusion prevention system IPS engine in the target Pod associated with the target IP is enabled; When the target IPS engine is in operation, a first status notification is sent to the firewall, so that the firewall stops parsing and processing the target service traffic corresponding to the target IP after receiving the first status notification; When the target business traffic reaches the target Pod, the target business traffic is directed to the target IPS engine so that the target IPS engine can perform intrusion prevention detection on the target business traffic.
2. The service flow processing method according to claim 1, characterized in that: The monitoring indicator value includes bandwidth and / or latency.
3. The service flow processing method according to claim 1, characterized in that: After the target service traffic reaches the target Pod, the target service traffic is directed to the target IPS engine so that the target IPS engine performs intrusion prevention detection on the target service traffic, the method further includes: The intrusion prevention detection results obtained by the target IPS engine in each detection cycle are sent to the firewall.
4. The service flow processing method according to claim 1, characterized in that: After the target service traffic reaches the target Pod, the target service traffic is directed to the target IPS engine so that the target IPS engine performs intrusion prevention detection on the target service traffic, the method further includes: When the average value of the monitoring index of the business traffic passing through the firewall within the preset time period is not greater than the corresponding preset threshold, the target business traffic is directed to the firewall for analysis and processing; An adjustment notification is sent to the target IPS engine, so that the target IPS engine stops performing intrusion prevention detection on the target business traffic in the target Pod after receiving the adjustment notification.
5. The service flow processing method according to claim 4, characterized in that: After sending the adjustment notification to the target IPS engine, it also includes: Delete the target IPS engine or put the target IPS engine into sleep mode.
6. A service flow processing device, characterized in that: The service flow processing device comprises: An enabling module, used to enable a target intrusion prevention system IPS engine in a target Pod associated with a target IP when the average value of the monitoring indicator value of the service traffic passing through the firewall within a preset time period is greater than a corresponding preset threshold value; A sending module, used for sending a first status notification to the firewall when the target IPS engine is in the running state, so that the firewall stops parsing and processing the target service traffic corresponding to the target IP after receiving the first status notification; The guiding module is used to guide the target business traffic to the target IPS engine when the target business traffic reaches the target Pod, so that the target IPS engine can perform intrusion prevention detection on the target business traffic.
7. The service flow processing device according to claim 6, characterized in that: The guiding module is also used to guide the target business traffic to the firewall for analysis and processing when the average value of the monitoring index value of the business traffic passing through the firewall within a preset time period is not greater than the corresponding preset threshold value; The sending module is also used to send an adjustment notification to the target IPS engine, so that the target IPS engine stops performing intrusion prevention detection on the target business traffic in the target Pod after receiving the adjustment notification.
8. The service flow processing device according to claim 7, characterized in that: The service flow processing device also includes a management module, which is used to: Delete the target IPS engine or put the target IPS engine into sleep mode.
9. A service flow processing device, characterized in that: The service traffic processing device includes a processor, a memory, and a service traffic processing program stored in the memory and executable by the processor, wherein when the service traffic processing program is executed by the processor, the steps of the service traffic processing method as described in any one of claims 1 to 5 are implemented.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a service flow processing program, wherein when the service flow processing program is executed by a processor, the steps of the service flow processing method according to any one of claims 1 to 5 are implemented.