Protection method and device aiming at DDoS attack

Abstract

The embodiment of the invention provides a protection method and device for a DDoS attack, and the method comprises the steps: determining a target client, obtaining a client IP for the target client, and enabling the client IP to have corresponding first gateway information; when the DDOS attack is detected, determining an attacker IP from the client IPs based on the DDOS attack; generating second gateway information; and determining other client IPs except the attacker IP as a first target IP, and sending the second gateway information to the first target IP, so that other clients corresponding to the first target IP execute business service pushing based on the second gateway information, and the DDoS attack protection efficiency is integrally improved.

Description

Technical Field

[0001] The present invention relates to the technical field of protection against DDoS attacks, and in particular to a protection method against DDoS attacks, a protection device against DDoS attacks, an electronic device and a computer-readable storage medium. Background Art

[0002] DDoS (Distributed Denial of Service) attack, also known as distributed denial of service attack, refers to multiple attackers in different locations launching attacks on one or several targets at the same time, or an attacker controlling multiple machines in different locations and using these machines to attack the victims at the same time. For the protection against DDoS attacks, the relevant technology is to screen and clean the traffic through the regional traffic cleaning center. However, the traditional protection method is inefficient, has a long RTO (Recovery Time Objective), occupies a large amount of network bandwidth, causes a waste of network resources, and is costly. Summary of the invention

[0003] The embodiments of the present invention provide a method, device, electronic device and computer-readable storage medium for protecting against DDoS attacks, so as to overcome the above problems or at least partially solve the above problems.

[0004] The embodiment of the present invention discloses a protection method against DDOS attacks, which is characterized by comprising:

[0005] Determine a target client, and obtain a client IP for the target client, wherein the client IP has corresponding first gateway information;

[0006] When the DDOS attack is detected, determining the attacker's IP from the client IP based on the DDOS attack;

[0007] generating second gateway information;

[0008] The other client IPs except the attacking party IP are determined as the first target IP, and the second gateway information is sent to the first target IP, so that other clients corresponding to the first target IP execute business service push based on the second gateway information.

[0009] The embodiment of the present invention also discloses a protection device against DDOS attacks, comprising:

[0010] A target client determination module, used to determine a target client and obtain a client IP for the target client, wherein the client IP has corresponding first gateway information;

[0011] An attacker IP determination module, configured to determine the attacker IP from the client IP based on the DDOS attack when the DDOS attack is detected;

[0012] A second gateway information generating module, used to generate second gateway information;

[0013] The business service push module is used to determine other client IPs except the attacker IP as the first target IP, and send the second gateway information to the first target IP, so that other clients corresponding to the first target IP perform business service push based on the second gateway information.

[0014] The embodiment of the present invention further discloses an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0015] The memory is used to store computer programs;

[0016] The processor is used to implement the method described in the embodiment of the present invention when executing the program stored in the memory.

[0017] The embodiment of the present invention further discloses a computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, enables the processors to execute the method described in the embodiment of the present invention.

[0018] The embodiments of the present invention include the following advantages:

[0019] The embodiment of the present invention determines the target client through the above, obtains the client IP for the target client, and the client IP has the corresponding first gateway information; when the DDOS attack is detected, the attacker IP is determined from the client IP based on the DDOS attack; the second gateway information is generated; the other client IPs except the attacker IP are determined as the first target IP, and the second gateway information is sent to the first target IP, so that other clients corresponding to the first target IP perform business service push based on the second gateway information. Together, they constitute a complete DDoS attack protection process. Through accurate identification of the target client, rapid location of the attack source, generation of backup gateways, and dynamic switching of traffic, this solution effectively improves the system's ability to resist DDoS attacks and ensures business continuity and stability.

[0020] The advantages of this solution are mainly reflected in the following aspects:

[0021] Highly targeted: Provides protection for specific clients, improving protection efficiency.

[0022] Quick response: After detecting a DDoS attack, traffic can be quickly switched to reduce service interruption time.

[0023] Flexible and scalable: It can be flexibly adjusted according to different business needs and attack scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a flowchart of a method for protecting against DDoS attacks provided in an embodiment of the present invention;

[0025] Figure 2 It is a schematic diagram of a service push process provided in an embodiment of the present invention;

[0026] Figure 3 is a timing diagram of a process for determining a target client provided in an embodiment of the present invention;

[0027] Figure 4 It is a schematic diagram showing the attacking party IP period and the gateway drift period provided in an embodiment of the present invention;

[0028] Figure 5 is a flow chart of a gateway drift method provided in an embodiment of the present invention;

[0029] Figure 6 is a flow chart of another gateway drift method provided in an embodiment of the present invention;

[0030] Figure 7 It is a flow chart of a method for constructing a honeypot mechanism provided in an embodiment of the present invention;

[0031] Figure 8 It is a structural block diagram of a protection device against DDoS attacks provided in an embodiment of the present invention;

[0032] Fig. 9 is a hardware structure block diagram of an electronic device provided in an embodiment of the present invention;

[0033] Fig.10 is a schematic diagram of a computer-readable medium provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0035] In order to enable those skilled in the art to better understand the embodiments of the present invention, the technical terms involved in the embodiments of the present invention are explained below.

[0036] Elastic IP: A public IP address that can be flexibly allocated and managed. It is an independent IP resource that can be flexibly bound to different cloud servers and can be replaced at any time.

[0037] Honeypot mechanism: It is an active defense technology in the field of network security. It is like a trap with bait set up to attract network attackers. This trap usually appears as one or more disguised systems or network services to lure attackers to invade and expose their attack methods and intentions.

[0038] DDoS attack (distributed denial of service attack) is a common type of network attack. Attackers launch attacks by controlling a large number of computers to overload the target server or network, causing service interruption and causing huge losses to enterprises and individuals. Therefore, it is particularly important to protect against DDoS attacks. DDoS attacks can cause websites, applications, etc. to be inaccessible, affecting user experience and causing economic losses. Frequent DDoS attacks can damage the brand image of the enterprise and reduce user trust. At the same time, during a DDoS attack, other types of attacks may occur, such as intrusion, data theft, etc., leading to sensitive data leakage. In addition, for enterprises that rely on network services, DDoS attacks may cause business interruption and direct economic losses. Attackers only need to rent or control a large number of botnets to launch large-scale DDoS attacks, and the defender needs to invest a lot of resources and technology to resist. At present, protection against DDoS attacks usually uses a regional traffic cleaning center to clean traffic and identify attacks. Although it can alleviate the impact of DDoS attacks to a certain extent, there are problems such as high latency, easy overload of the cleaning center, and high cost. The embodiment of the present invention provides a protection method for DDoS attacks, which combines gateway drift and a honeypot system to protect against DDoS attacks to improve the efficiency and accuracy of protection.

[0039] Reference Figure 1 , shows a flowchart of a method for protecting against DDoS attacks provided in an embodiment of the present invention, which may specifically include the following steps:

[0040] Step 101, determining a target client, obtaining a client IP for the target client, wherein the client IP has corresponding first gateway information;

[0041] Step 102, when the DDoS attack is detected, determining the attacker IP from the client IP based on the DDoS attack;

[0042] Step 103, generating second gateway information;

[0043] Step 104: determine other client IPs except the attacker IP as the first target IP, and send the second gateway information to the first target IP, so that other clients corresponding to the first target IP execute business service push based on the second gateway information.

[0044] refer to Figure 2 , Figure 2 It is a schematic diagram of a service push process provided in an embodiment of the present invention;

[0045] The Internet backend architecture of the embodiments of the present invention is a microservice architecture based on cloud technology, and the gateway is one of the core components of the microservice architecture; in actual applications, push service has become one of the key business capabilities of Internet services.

[0046] In a specific implementation, the embodiment of the present invention can determine a target client, and obtain a client IP for the target client, where the client IP has corresponding first gateway information.

[0047] According to the embodiment of the present invention, all clients accessing the first gateway based on the first gateway information can be determined as target clients.

[0048] Purpose:

[0049] Clarify the protection targets: limit the protection scope to specific client groups to improve the targeted protection.

[0050] Establish basic information: obtain client IP and first gateway information to provide basic data for subsequent traffic analysis and route switching.

[0051] Beneficial effects:

[0052] Improve protection efficiency: By narrowing the protection scope, you can protect the target clients more centrally.

[0053] Reduce the false alarm rate: Only analyze the traffic of the target client to reduce the interference to other normal users.

[0054] In a specific implementation, when the DDoS attack is detected, the embodiment of the present invention can determine the attacker's IP from the client IP based on the DDoS attack.

[0055] Purpose:

[0056] Identify the attack source: Accurately locate the IP address that initiates the DDoS attack, providing a basis for subsequent isolation and blocking.

[0057] Beneficial effects:

[0058] Improve attack source tracing capabilities: This helps trace the source of the attack and provide evidence for subsequent forensics and legal prosecution.

[0059] Provide a basis for subsequent protection: Accurately identify the attacker's IP address and take targeted protection measures.

[0060] In a specific implementation, in addition to the first gateway, the embodiment of the present invention may further configure a second gateway other than the first gateway as a backup gateway, and the embodiment of the present invention may generate the second gateway information.

[0061] Purpose:

[0062] Provide an alternative access path: Generate a new gateway information as a backup of the original gateway.

[0063] Beneficial effects:

[0064] Enhance system fault tolerance: When the original gateway is attacked, it can quickly switch to the backup gateway to ensure business continuity.

[0065] In a specific implementation, an embodiment of the present invention can determine other client IPs except the attacker's IP as the first target IP, and send the second gateway information to the first target IP, so that other clients corresponding to the first target IP can perform business service push based on the second gateway information.

[0066] Purpose:

[0067] Isolate attack traffic: Separate the attacked client IP from normal traffic.

[0068] Direct normal traffic: Direct normal client traffic to the backup gateway to ensure normal business operation.

[0069] Beneficial effects:

[0070] Protect normal users: Ensure that clients that have not been attacked can access services normally.

[0071] Mitigate the impact of attacks: Reduce the pressure on the server by isolating attack traffic.

[0072] The embodiment of the present invention aims at the problem of low protection efficiency of DDOS attacks. By quickly identifying the IP address of the attacker, the attack source can be quickly locked, the misjudgment time can be reduced, and the protection efficiency can be improved. By directing normal traffic to the backup gateway, the attack traffic can be quickly isolated, the server pressure can be reduced, and the service response speed can be improved.

[0073] To solve the problem of long RTO, the second gateway information is generated to provide a backup access path for normal users. By quickly switching normal traffic to the backup gateway, the service recovery time is shortened.

[0074] To address the problem of large bandwidth usage, we isolate attack traffic and reduce network bandwidth usage, thereby providing sufficient bandwidth resources for normal business.

[0075] To address the high cost issue, the solution in the embodiment of the present invention is implemented through software, without the need for additional hardware investment, and is relatively low in cost compared to solutions such as traditional hardware firewalls.

[0076] The embodiment of the present invention determines the target client, obtains the client IP for the target client, and the client IP has the corresponding first gateway information; when the DDOS attack is detected, the attacker IP is determined from the client IP based on the DDOS attack; the second gateway information is generated; the other client IPs except the attacker IP are determined as the first target IP, and the second gateway information is sent to the first target IP, so that other clients corresponding to the first target IP perform business service push based on the second gateway information. Together, they constitute a complete DDoS attack protection process. Through accurate identification of the target client, rapid location of the attack source, generation of the backup gateway, and dynamic switching of the traffic, the solution effectively improves the system's ability to resist DDoS attacks and ensures the continuity and stability of the business.

[0077] The advantages of this solution are mainly reflected in the following aspects:

[0078] Highly targeted: Provides protection for specific clients, improving protection efficiency.

[0079] Quick response: After detecting a DDoS attack, traffic can be quickly switched to reduce service interruption time.

[0080] Flexible and scalable: It can be flexibly adjusted according to different business needs and attack scenarios.

[0081] Optionally, in order to further improve the security of the system, the embodiment of the present invention may also introduce behavioral analysis when detecting DDOS attacks. In addition to the IP address, comprehensive judgment may be made based on information such as user behavior and traffic characteristics to improve the accuracy of attack source identification.

[0082] At the same time, protection equipment can be deployed at multiple levels such as the network edge and server side to build a multi-layer defense system.

[0083] It can also continuously monitor and optimize, conduct regular security assessments on the system, and promptly identify and fix vulnerabilities.

[0084] Based on the above embodiment, a variant embodiment of the above embodiment is proposed. It should be noted that in order to make the description concise, only the differences from the above embodiment are described in the variant embodiment.

[0085] In an optional embodiment of the present invention, the step of determining the attacker's IP from the client IP based on the DDOS attack includes:

[0086] Determine a time point after the DDOS attack is detected;

[0087] Determine the attacker information collection time based on the time node according to the preset time period;

[0088] Record the abnormal request IP in the client IP based on the information collection time of the attacker;

[0089] The abnormal request IP is determined as the attacking party IP.

[0090] The embodiment of the present invention can determine the time point after the DDOS attack is detected;

[0091] Purpose: To determine the exact time when the attack started and provide a time benchmark for subsequent analysis.

[0092] Beneficial effect: Ability to more accurately calculate attack duration, and subsequent various time windows.

[0093] The embodiment of the present invention can determine the information collection time of the attacker according to the preset time period based on the time node;

[0094] Purpose: To set a reasonable time window for collecting information about the attacker.

[0095] Beneficial effects: Too short a time window may cause some attackers to be missed, while too long a time window may introduce too much normal traffic. The preset time period needs to be adjusted according to different attack types and network environments.

[0096] The embodiment of the present invention can record the abnormal request IP in the client IP based on the information collection time of the attacker;

[0097] Purpose: To record all abnormal request IPs within the set time window.

[0098] Beneficial effect: These abnormal IPs are likely to be the attacker's IPs, providing a basis for subsequent isolation and blocking.

[0099] The embodiment of the present invention can determine the abnormal request IP as the attacking party IP.

[0100] Purpose: To directly identify the abnormal IP addresses collected previously as the attacking IP addresses.

[0101] Beneficial effects: It simplifies the process of locating the attack source and improves the protection efficiency.

[0102] In the embodiment of the present invention, by determining the time node after the DDOS attack is detected; determining the attacker information collection time according to the preset time period based on the time node; recording the abnormal request IP in the client IP based on the attacker information collection time; determining the abnormal request IP as the attacker IP; the system can quickly lock the attack source after detecting the DDoS attack, providing an accurate basis for subsequent protection measures. The whole process can be regarded as a process of abnormal traffic analysis based on a time window.

[0103] Furthermore, the embodiment of the present invention can also determine the judgment criteria of abnormal requests, which need to comprehensively consider multiple factors, such as request frequency, request content, source IP address, etc. The misjudgment rate can also be determined. Due to the complexity of the network environment, misjudgments are inevitable, so it is necessary to continuously optimize algorithms and rules.

[0104] In practical applications, in order to respond to attacks in a timely manner, the entire process needs to have high real-time performance.

[0105] The embodiments of the present invention can also introduce machine learning, use machine learning models, and establish a more accurate attack feature model by learning historical attack data to improve the accuracy of attack identification. In addition to IP addresses, comprehensive judgments can be made based on user behavior, traffic characteristics and other information to improve the accuracy of attack source identification. The time window can also be adjusted dynamically to dynamically adjust the attacker information collection time according to different attack types and network environments to improve the adaptability of the system.

[0106] In an optional embodiment of the present invention, it also includes:

[0107] Determining the number of service requests corresponding to the second gateway information;

[0108] When the number of the service requests reaches a preset threshold, the bandwidth corresponding to the first gateway information is reduced, and the bandwidth corresponding to the second gateway information is increased.

[0109] In a specific implementation, the present invention can be implemented to determine the number of service requests corresponding to the second gateway information;

[0110] Its purpose is to monitor the traffic switched to the new gateway and understand the actual load of business requests.

[0111] Beneficial effects: By monitoring the number of business requests in real time, bandwidth allocation can be adjusted dynamically to avoid wasting or insufficient bandwidth resources.

[0112] When the number of the service requests reaches a preset threshold, the bandwidth corresponding to the first gateway information is reduced, and the bandwidth corresponding to the second gateway information is increased.

[0113] Purpose: To set a trigger condition to trigger bandwidth adjustment when the number of business requests reaches a certain level; to dynamically adjust the bandwidth allocation of the two gateways according to the changes in the number of business requests.

[0114] Beneficial effects:

[0115] The preset threshold can ensure that the business traffic is smoothly transferred to the new gateway while also responding to the increase of sudden traffic in a timely manner.

[0116] Improve resource utilization: Allocate more bandwidth resources to gateways with heavier loads to avoid resource waste.

[0117] Guaranteed service quality: By dynamically adjusting bandwidth, it can be ensured that normal business can still obtain sufficient bandwidth resources when a DDoS attack occurs.

[0118] The process of adjusting the first and second gateways can be understood as a dynamic bandwidth allocation process based on load balancing. When a DDoS attack is detected and the gateway switch is completed, the system will continue to monitor the service request volume of the new gateway. Once the request volume reaches the preset threshold, it means that most of the service traffic has been smoothly transferred to the new gateway. At this time, the system will automatically reduce the bandwidth of the original gateway and allocate more bandwidth resources to the new gateway to cope with possible traffic peaks.

[0119] The mechanism of dynamically adjusting bandwidth has the following advantages:

[0120] Flexible adaptation to changes: Bandwidth allocation can be adjusted in real time according to changes in business traffic, improving the system's ability to adapt to emergencies.

[0121] Optimize resource utilization: By allocating bandwidth resources to where they are needed, resource utilization is improved and costs are reduced.

[0122] Improve system stability: When a DDoS attack occurs, it can ensure business continuity and improve system stability.

[0123] The connection with the overall plan is:

[0124] This step is closely linked to the gateway drift and DDoS awareness in the overall solution. Gateway drift provides the system with the ability to dynamically switch gateways, while this step further improves the system's protection effect by monitoring the volume of business requests and finely managing the gateway's bandwidth.

[0125] This can be further optimized by:

[0126] Set thresholds for the number of business requests: The preset thresholds need to be adjusted according to the specific business scenarios and network environment. Too high or too low thresholds will affect system performance.

[0127] Bandwidth adjustment granularity: The granularity of bandwidth adjustment will affect the response speed of the system. Too fine granularity may lead to frequent bandwidth adjustment and increase system overhead.

[0128] Algorithm optimization: More complex algorithms, such as those based on machine learning, can be used to predict changes in business traffic, thereby achieving more accurate bandwidth allocation.

[0129] By dynamically adjusting the gateway bandwidth, the flexibility and adaptability of the system can be further improved to better cope with DDoS attacks. At the same time, it also provides a reference for other scenarios that require dynamic resource adjustment.

[0130] In an optional embodiment of the present invention, it also includes:

[0131] Building a honeypot system, wherein the honeypot system includes a plurality of false business data;

[0132] The false business data is sent to the attacking party IP.

[0133] In the specific implementation, the embodiment of the present invention introduces a honeypot mechanism in order to more proactively defend against DDoS attacks. Specifically, a complete mirror system containing false data is deployed in the business background as a honeypot. Thanks to the load balancing characteristics of the microservice architecture, this deployment is very convenient. Once gateway drift occurs, we will direct the attack traffic to the honeypot and return a false business response to the attacker. This "luring the enemy in" strategy can, on the one hand, continue to attract the attention of attackers and shift their attack focus to the honeypot; on the other hand, it can also buy us more time to analyze the attack behavior and take more effective defense measures.

[0134] Specifically, the honeypot type and size can be determined:

[0135] Type: Choose the appropriate honeypot type based on the attacker's goal and attack method. For example, to attack a web application, you can deploy a fake web server; to attack a database, you can deploy a database containing fake data.

[0136] Scale: The scale of the honeypot should match that of the real system to increase its attractiveness. At the same time, the resource consumption of the honeypot system should also be considered.

[0137] Prepare fake data:

[0138] Data type: Prepare corresponding false data according to the type of honeypot. For example, for a web server, you can prepare false web pages and files; for a database, you can prepare false database tables and records.

[0139] Data volume: The data volume should be large enough to attract the attacker's interest, but care should also be taken to avoid excessive data volume that may cause system performance to degrade.

[0140] Deploy the honeypot system:

[0141] Independent environment: Deploy the honeypot system in an independent network environment to prevent attackers from attacking the real system through the honeypot.

[0142] Load balancing: Utilize the load balancing feature of the microservice architecture to isolate the honeypot system from the real system.

[0143] Monitoring: Monitor the honeypot system in real time and record all access logs and attack behaviors.

[0144] Send false business data to the attacker's IP

[0145] Traffic forwarding: When attack traffic reaches the gateway, it is forwarded to the honeypot system according to preset rules.

[0146] Response generation: After receiving a request, the honeypot system generates a corresponding false response based on the content of the request.

[0147] Response return: The generated fake response is returned to the attacker.

[0148] The whole process can be figuratively likened to setting a bait to lure attackers into a safe area and then observing and analyzing their behavior.

[0149] Characteristics of false business data:

[0150] Realism: Fake data should simulate the behavior of the real system as closely as possible to increase its appeal.

[0151] Diversity: Provide multiple types of false data to attract different types of attackers.

[0152] Dynamicity: False data is updated regularly to prevent being discovered by attackers.

[0153] The reasons for sending false business data are:

[0154] Attract attackers: False data can attract the attention of attackers, causing them to shift their attack focus to the honeypot, thereby protecting the real system.

[0155] Consume attacker resources: When attacking a honeypot, attackers consume a lot of computing resources and network bandwidth, which slows down their attack speed.

[0156] Collect attack information: By analyzing the attacker's attack behavior on the honeypot, we can understand the attacker's attack methods, tools and targets, and provide valuable information for subsequent defense work.

[0157] Building a honeypot system and sending false data to attackers is an effective way to proactively defend against DDoS attacks. In this way, we can lead attackers to a safe area, thereby protecting our real system. At the same time, we can also continuously improve our defense system by analyzing the attacker's behavior.

[0158] In an optional embodiment of the present invention, it also includes:

[0159] Obtain the attacked traffic corresponding to the attacker's IP;

[0160] Sending the mirrored traffic of the attacked traffic to the honeypot system;

[0161] Analyze the mirrored traffic based on the honeypot system to determine the second target IP that is accidentally damaged;

[0162] The second gateway information is sent to the second target IP, so that the client corresponding to the second target IP executes business service push based on the second gateway information.

[0163] The purpose of obtaining the attacked traffic corresponding to the attacker's IP is to accurately separate the attack traffic for subsequent mirroring and analysis.

[0164] In a specific implementation, it can be achieved in the following ways.

[0165] Based on IP filtering: Filter network traffic based on the determined attacker IP and extract all traffic whose source IP is the attacker IP.

[0166] Based on feature matching: In addition to IP, other features (such as port, protocol, packet content, etc.) can also be combined for more accurate traffic screening.

[0167] Based on traffic analysis: Use traffic analysis tools to conduct in-depth analysis of network traffic, identify abnormal traffic patterns, and thus determine attack traffic.

[0168] The purpose of sending the mirror traffic of the attacked traffic to the honeypot system is to copy the attack traffic and send it to the honeypot system for in-depth analysis while protecting the real business system.

[0169] In a specific implementation, it can be achieved in the following ways.

[0170] Traffic mirroring technology: Use network devices or software to copy network traffic and send a copy to the honeypot system.

[0171] Mirror ratio: The ratio of mirrored traffic can be adjusted according to the processing capacity of the honeypot system and the depth of traffic that needs to be analyzed.

[0172] The purpose of analyzing the mirror traffic based on the honeypot system and determining the second target IP that is accidentally attacked is to identify normal users who are accidentally attacked during the attack.

[0173] In a specific implementation, it can be achieved in the following ways.

[0174] Behavioral analysis: By analyzing the traffic received by the honeypot system, traffic that is inconsistent with normal user behavior can be identified.

[0175] Feature matching: Match the data collected by the honeypot system with known normal user behavior features to identify anomalies.

[0176] Machine learning: Use machine learning algorithms to model traffic data and automatically identify abnormal behavior.

[0177] The purpose of sending the second gateway information to the second target IP so that the client corresponding to the second target IP executes business service push based on the second gateway information is to guide normal users who are accidentally injured to the backup gateway and restore their normal services.

[0178] In a specific implementation, it can be achieved in the following ways.

[0179] Protocol encapsulation: Encapsulate the information of the second gateway into a specific protocol format.

[0180] Push method: Information can be pushed to the client in a variety of ways, such as HTTP, DNS, UDP, etc.

[0181] Client processing: After receiving the new gateway information, the client updates its configuration and sends subsequent requests to the new gateway.

[0182] Through the above steps, we can achieve real-time monitoring, analysis and response to attack traffic. The honeypot system acts as a bait to attract the attacker's attention and provide us with an opportunity to deeply analyze the attack behavior. By identifying normal users who are accidentally injured and directing them to the backup gateway, we can effectively protect the normal access of users.

[0183] In an optional embodiment of the present invention, the step of determining the target client includes:

[0184] When an access request for an access client is obtained, verifying the identity of the access client based on the verification public key for the access client;

[0185] When the identity of the access client is determined to be legitimate through the verification public key, a server verification token for the access client is generated, and the server verification token is sent to the access client;

[0186] The access client having the verification token is determined as the target client.

[0187] The embodiment of the present invention can perform user authentication and authorization process when determining the target client, which is usually used to protect system resources and prevent unauthorized access. It mainly involves three parts: client (user end), network and authentication server.

[0188] Detailed steps:

[0189] 1. The client initiates a request:

[0190] 1.1. The client (user) sends a request to the authentication server, indicating that it wants to obtain a certain resource or service.

[0191] 2. Authentication server verification:

[0192] 1.1. After receiving the request, the authentication server will verify the identity of the client. This verification process usually includes:

[0193] 1.1.1. Verify the public key: The server will verify whether the public key provided by the client is legal and ensure that it is trustworthy.

[0194] 1.1.2. Encrypt user unique identification: The server will use its own private key to encrypt the unique identification provided by the client and generate a unique server verification token.

[0195] 3. The server returns a token:

[0196] 3.1. The authentication server returns the generated token to the client. This token contains important information about the user's identity and is the credential for subsequent requests.

[0197] 4. Subsequent requests from the client:

[0198] 4.1. The client will send this token to the server in subsequent requests.

[0199] 5. Server verification token:

[0200] 5.1. After receiving the request, the server will verify the legitimacy of the token, including:

[0201] 5.1.1. Decrypt token: The server uses its own private key to decrypt the token and obtain the user's unique identifier.

[0202] 5.1.2. Verify the user's unique identifier: The server compares the decrypted user's unique identifier with the information in its own database to confirm the user's identity.

[0203] 5.1.3. Verify token validity period: The server will check the validity period of the token to ensure that it has not expired.

[0204] 6. Server Authorization:

[0205] 6.1. If the token verification is successful, the server will authorize the client to access the requested resources or services.

[0206] Description of each part:

[0207] Client: Usually the device used by the user, such as a computer, mobile phone, etc.

[0208] Network: used for communication between clients and servers.

[0209] Authentication server: A server responsible for verifying user identity and issuing tokens.

[0210] The purpose of this process is to ensure that only authenticated users can access system resources. By using tokens as credentials, unauthorized access can be effectively prevented. At the same time, the timeliness of tokens can also improve the security of the system.

[0211] Related concepts:

[0212] Public key and private key: A pair of keys in an asymmetric encryption algorithm, the public key is used for encryption and the private key is used for decryption.

[0213] Token: A server verification token that contains information such as user identity and is used for authentication and authorization.

[0214] The beneficial effects of determining the target client in the above manner are:

[0215] High security: The public key encryption algorithm is used to ensure the security of data.

[0216] Flexible and convenient: tokens can be stored on the client, making it convenient for users to use them in multiple applications.

[0217] Strong scalability: Token content can be customized according to different needs.

[0218] In an optional embodiment of the present invention, the second gateway information includes gateway IP information and gateway port information for the second gateway information, and the step of determining other client IPs except the attacker IP as the first target IP and sending the second gateway information to the first target IP includes:

[0219] Constructing an attacker IP list for displaying the attacker IP;

[0220] Determine other client verification tokens and first target IPs that are not in the attacker IP list based on the attacker IP list;

[0221] When the identity of the other client is verified to be legitimate through the other client verification token, the gateway IP information and the gateway port information are sent to the other client through the first target IP.

[0222] In actual applications, the gateway drift service is a dynamic load balancing mechanism that aims to intelligently adjust the allocation of system resources based on real-time traffic conditions and security threats. Its main functions are:

[0223] Attack detection and IP blocking: monitor system traffic in real time, identify and record the attacker's IP address.

[0224] User Token Management: Maintain a database containing all user Token information, record the user identity corresponding to each Token and the currently assigned gateway.

[0225] Dynamic routing configuration: Dynamically adjust the routing of user requests based on the attack situation and system load, and distribute user requests to different gateways.

[0226] Bandwidth adjustment: By adjusting the bandwidth of different gateways, load balancing is achieved and more traffic is allocated to gateways with lighter loads.

[0227] In a specific implementation, the following method can be used to determine the client IPs other than the attacker IP as the first target IP, and send the second gateway information to the first target IP.

[0228] 1. Construct an attacker IP list for displaying the attacker IP, the purpose of which is to create a list that clearly records all IP addresses involved in the attack.

[0229] Specific implementation method: By analyzing the network traffic, extract the source IP addresses of all attack requests and record these IP addresses in a list.

[0230] 2. Based on the attacker's IP list, determine the verification tokens and first target IPs of other clients that are not in the attacker's IP list, with the aim of screening out normal clients that are not involved in the attack and obtaining their authentication information and IP addresses.

[0231] Specific implementation method:

[0232] Traverse all clients: Traverse all clients in the system.

[0233] Compare IP list: Compare the IP address of each client with the attacker's IP list. If the client is not in the attacker's IP list, the client is considered to be a normal client.

[0234] Get verification token and IP: For a confirmed normal client, get its corresponding verification token and IP address (i.e., first target IP). The verification token is used to verify the legitimacy of the client identity, and the first target IP is used to send new gateway information.

[0235] 3. When the identity of the other client is verified to be legal through the token verification of the other client, the gateway IP information and the gateway port information are sent to the other client through the first target IP. The purpose is to push the new gateway information to the normal client so that it can switch to the new gateway.

[0236] Specific implementation method:

[0237] Verify identity: Use the obtained verification token to verify the identity of the client to ensure the security of the operation.

[0238] Build message: Build a push message containing the new gateway IP and port information.

[0239] Send message: Send the message to the client via the first target IP.

[0240] Client processing: After receiving the message, the client updates its configuration and sends subsequent requests to the new gateway.

[0241] Logical analysis of the entire process

[0242] Identify the attacker: Determine the attacker's IP address by analyzing network traffic.

[0243] Filter normal users: Compare all users with the attacker list to filter out normal users.

[0244] Verify identity: Use the verification token to verify the identity of the normal user.

[0245] Push new gateway information: Send new gateway information to normal users who have passed verification.

[0246] Key points and precautions

[0247] Security of verification tokens: The design and use of verification tokens need to ensure their security to prevent them from being forged by attackers.

[0248] Reliability of message transmission: Ensure the reliability of message transmission to avoid message loss or tampering.

[0249] Client configuration update: After receiving new gateway information, the client needs to update the configuration in time to ensure business continuity.

[0250] Performance optimization: For a large number of clients, it is necessary to consider how to perform authentication and message push efficiently.

[0251] Through the above steps, it is possible to quickly switch to normal clients, ensure business continuity, and improve system security. This process involves network traffic analysis, identity authentication, message push, and other aspects. It is necessary to comprehensively consider various factors to design an efficient and reliable solution.

[0252] In order to enable those skilled in the art to better understand the embodiment of the present invention, an example is used below to illustrate the embodiment of the present invention.

[0253] refer to Figure 2 , Figure 2 It is a schematic diagram of a service push process provided in an embodiment of the present invention;

[0254] Common Internet backend architectures are all microservice architectures based on cloud technology, and the gateway is one of the core components of the microservice architecture; and with the rapid development of mobile terminals, push services have become one of the key business capabilities of Internet businesses.

[0255] Based on this, the solution mainly involves the following core designs:

[0256] refer to Figure 3 , Figure 3 is a timing diagram of a process for determining a target client provided in an embodiment of the present invention;

[0257] 1. User identity:

[0258] Mature third-party push services, such as Apple's APNs, can push messages at the user device level. The user device's identifier is usually a token, which is sent to the push service along with the message to be pushed. The push service can then push the message. (The push service solution in the industry is already very mature and will not be described in detail here.)

[0259] When a client device joins the network, it will send its token to the registration and login service. After receiving the request, the service will generate a unique identifier for the client, encrypt the identifier and return it to the client. After that, any request from the client will carry the encrypted information. The gateway will cache the public key for decryption and can decrypt it after receiving the request.

[0260] The registration and login service will store the user's unique ID, token, and client IP in the database. Therefore, when any request carrying encrypted information enters the gateway, the gateway can decrypt it and know which device the request comes from with the help of the database.

[0261] refer to Figure 4 , Figure 4 It is a schematic diagram showing the attacking party IP period and the gateway drift period provided in an embodiment of the present invention;

[0262] 2.DDOS perception:

[0263] There are many network monitoring components in the industry that can monitor the usage of the system's network resources and determine whether the system is currently under attack by protocol attacks, flood attacks, etc. that may cause DDOS attacks. After the network monitoring component determines that it is under DDOS attack, it will collect information about the attacker. During this period of time, the network monitoring component will record the IP address of the abnormal request. When the attacker's information collection time is over, the network monitoring component will send a request to the gateway drift service to complete the gateway drift.

[0264] refer to Figure 5 and Figure 6 , Figure 5 is a flow chart of a gateway drift method provided in an embodiment of the present invention; Figure 6 is a flow chart of another gateway drift method provided in an embodiment of the present invention;

[0265] 3. Gateway drift:

[0266] The following business capabilities are designed on the client: receive pushed messages, parse out the IP, port and other information of the backend gateway, and then make business requests. In this way, the client has the ability to dynamically access the business backend gateway.

[0267] Deploy the gateway drift service in the background:

[0268] When the attacker information collection time of the network monitoring component ends, it will send a request with the attacker IP list to the gateway drift service. This service has two main functions:

[0269] One is to dynamically adjust bandwidth resources to different gateways, such as Figure 5Gateway 1 and Gateway 2 share bandwidth resources. When the gateway of the service traffic switches (for example, gateway a switches to gateway b), its bandwidth resources will also be dynamically adjusted.

[0270] Another is to send a push request to a third-party push service. Specifically, when the gateway drift service receives a request from the gateway, it first parses the attacker's IP list, then finds the tokens of all users who are not in the attacker's IP list in the database, and sends the IP and port information of the new gateway (such as Gateway 2) to these tokens. When Gateway 2 receives more and more business requests, the gateway drift service will reduce the bandwidth of Gateway 1 and allocate the main bandwidth resources to Gateway 2.

[0271] Dynamically adjusting bandwidth resources between different gateways is one of the core capabilities of cloud technology. It is achieved by implementing elastic IP technology (EIP) based on cloud technology supported by underlying technologies such as NAT conversion. Usually, cloud vendors provide operation and maintenance consoles, API interfaces, and other methods to adjust elastic IP bandwidth resources. The API interface method used in this solution is that the gateway drift service remotely calls the cloud platform's API interface for adjusting elastic IP bandwidth resources to achieve real-time adjustment of bandwidth resources.

[0272] It should be noted that judging the attacker by IP does have the possibility of accidental injury. This is determined by the flexible and changeable attack characteristics of DDOS. Here we can only try our best to ensure normal business requests.

[0273] refer to Figure 7 , Figure 7 It is a flow chart of a method for constructing a honeypot mechanism provided in an embodiment of the present invention;

[0274] 4. Honeypot mechanism:

[0275] If we simply intercept the attacker's request, such a security strategy would be too passive. Therefore, we need to introduce the honeypot mechanism.

[0276] Specifically, the business backend should deploy a complete backend service and a necessary database containing false business data as a honeypot system. The microservice architecture naturally has the ability to load balance and deploy multiple instances, so this is very easy to do. After the gateway drift occurs, on the one hand, the false business reply packet should be returned to the attacker through gateway 1, so that the attacker believes that his attack is still effective and worth continuing; on the other hand, the attacked traffic should be copied (modern gateways support traffic mirroring) and routed to the honeypot system. The system can perform security-related automated analysis and manual analysis. If a normal client is found to be accidentally injured, the system can also send a request to the gateway drift service and push a message to the accidentally injured client to complete the gateway drift.

[0277] Embodiment of this scheme:

[0278] 1. Develop registration and login services and deploy three instances;

[0279] 2. Develop the gateway drift service and deploy three instances;

[0280] 3. Deploy multiple gateways (some of which are hot standby gateways that do not process business traffic normally. Business traffic will be drifted to these gateways after a DDOS occurs). Bind an elastic IP address to each gateway, configure frequency limiting and other functions, and develop a gateway plug-in using plug-in technology so that the gateway can send relevant requests to the gateway drift service.

[0281] 4. Client development, support business requests through IP, support receiving message push and parsing;

[0282] 5. Deploy honeypot service instances and honeypot systems.

[0283] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0284] Reference Figure 8 , shows a structural block diagram of a protection device against DDoS attacks provided in an embodiment of the present invention, which may specifically include the following modules:

[0285] The target client determination module 801 is used to determine the target client and obtain the client IP for the target client, where the client IP has corresponding first gateway information;

[0286] The attacker IP determination module 802 is used to determine the attacker IP from the client IP based on the DDOS attack when the DDOS attack is detected;

[0287] The second gateway information generating module 803 is used to generate the second gateway information;

[0288] The business service push module 804 is used to determine other client IPs except the attacking party IP as the first target IP, and send the second gateway information to the first target IP, so that other clients corresponding to the first target IP perform business service push based on the second gateway information.

[0289] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0290] In addition, an embodiment of the present invention further provides an electronic device, such as Fig. 9 As shown, it includes a processor 901, a communication interface 902, a memory 903 and a communication bus 904, wherein the processor 901, the communication interface 902, and the memory 903 communicate with each other through the communication bus 904.

[0291] Memory 903, used for storing computer programs;

[0292] The processor 901 is configured to implement the DDoS attack protection method described in any one of the above embodiments when executing the program stored in the memory 903:

[0293] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0294] The communication interface is used for communication between the above terminal and other devices.

[0295] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0296] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0297] like Fig.10 As shown, in another embodiment provided by the present invention, a computer-readable storage medium 1001 is also provided, in which instructions are stored. When the computer-readable storage medium 1001 is run on a computer, the computer executes the protection method against DDoS attacks described in the above embodiment.

[0298] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

[0299] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of the present invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0300] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0301] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0302] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0303] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0304] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical disks.

[0305] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A protection method against DDOS attacks, characterized in that: include: Determine a target client, and obtain a client IP for the target client, wherein the client IP has corresponding first gateway information; When the DDOS attack is detected, determining the attacker's IP from the client IP based on the DDOS attack; generating second gateway information; The other client IPs except the attacking party IP are determined as the first target IP, and the second gateway information is sent to the first target IP, so that other clients corresponding to the first target IP execute business service push based on the second gateway information.

2. The method according to claim 1, characterized in that The step of determining the attacker's IP from the client IP based on the DDOS attack includes: Determine a time point after the DDOS attack is detected; Determine the information collection time of the attacker according to the preset time period based on the time node; Record the abnormal request IP in the client IP based on the information collection time of the attacker; The abnormal request IP is determined as the attacking party IP.

3. The method according to claim 1, characterized in that Also includes: Determining the number of service requests corresponding to the second gateway information; When the number of the service requests reaches a preset threshold, the bandwidth corresponding to the first gateway information is reduced, and the bandwidth corresponding to the second gateway information is increased.

4. The method according to claim 1, characterized in that: Also includes: Building a honeypot system, wherein the honeypot system includes a plurality of false business data; The false business data is sent to the attacking party IP.

5. The method according to claim 4, characterized in that Also includes: Obtain the attacked traffic corresponding to the attacker's IP; Sending the mirrored traffic of the attacked traffic to the honeypot system; Analyze the mirrored traffic based on the honeypot system to determine the second target IP that is accidentally damaged; The second gateway information is sent to the second target IP, so that the client corresponding to the second target IP executes business service push based on the second gateway information.

6. The method according to claim 1, characterized in that The step of determining the target client comprises: When an access request for an access client is obtained, verifying the identity of the access client based on the verification public key for the access client; When the identity of the access client is determined to be legitimate through the verification public key, a server verification token for the access client is generated, and the server verification token is sent to the access client; The access client having the verification token is determined as the target client.

7. The method according to claim 1, characterized in that The second gateway information includes gateway IP information and gateway port information for the second gateway information, and the step of determining other client IPs except the attacker IP as the first target IP and sending the second gateway information to the first target IP includes: Constructing an attacker IP list for displaying the attacker IP; Determine other client verification tokens and first target IPs that are not in the attacker IP list based on the attacker IP list; When the identity of the other client is verified to be legitimate through the other client verification token, the gateway IP information and the gateway port information are sent to the other client through the first target IP.

8. A protection device against DDOS attacks, characterized in that: include: A target client determination module, used to determine a target client and obtain a client IP for the target client, wherein the client IP has corresponding first gateway information; An attacker IP determination module, used for determining the attacker IP from the client IP based on the DDOS attack when the DDOS attack is detected; A second gateway information generating module, used to generate second gateway information; The business service push module is used to determine other client IPs except the attacker IP as the first target IP, and send the second gateway information to the first target IP, so that other clients corresponding to the first target IP perform business service push based on the second gateway information.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 7 when executing the program stored in the memory.

10. A computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, cause the processors to perform the method according to any one of claims 1 to 7.

Images