Network defense method and device, equipment, program product and storage medium

Abstract

The invention discloses a network defense method and device, equipment, a program product and a storage medium, and the method comprises the steps: receiving a first message sent by first equipment, and collecting N flow logs of the first equipment according to the first message, N being a positive integer; performing identity authentication on the first equipment according to the first source IP of the first message; if the identity authentication of the first device is passed, whether M second source IPs corresponding to the N flow logs comprise attacked IPs is judged according to the N flow logs, and M is a positive integer and is smaller than or equal to N; and if the M second source IPs comprise the attacked IP, reducing the flow corresponding to the attacked IP.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network management, and in particular to a network defense method and device, equipment, program product and storage medium. BACKGROUND

[0002] Network Flow (Netflow) / Sampled Flow (sFlow) is a common network monitoring technology, and Sampled Flow (sFlow) is more widely used due to its free and universal characteristics. Sampled Flow (sFlow) uses data flow random sampling technology, which can provide complete Layer 2 to Layer 7 traffic information, allowing users to analyze network transmission flow performance, trends and existing problems in detail and real time, and is used to monitor network traffic and troubleshoot network faults. However, by negotiating source ports or destination ports, distinguishing different device flow logs by message source IP, there is a potential risk of IP or port conflict or forgery, and there is a lack of device identity verification, which is vulnerable to fake message attacks, and the network security is not strong. Moreover, the current technical solution exposes flow log collection ports for all IPs, which has a large exposure surface and is vulnerable to attacks. Therefore, how to improve the security performance of network management has become a problem to be improved. SUMMARY

[0003] To solve the above technical problems, the present application provides a network defense method and device, equipment, program product and storage medium.

[0004] The network defense method provided by the present application is applied to a controller, and the method comprises the following steps: receiving a first message sent by a first device, and collecting N flow logs of the first device according to the first message, wherein N is a positive integer; performing identity authentication on the first device according to a first source IP of the first message; if the identity authentication of the first device is passed, judging whether M second source IPs corresponding to the N flow logs include an attacked IP, wherein M is a positive integer, and M is less than or equal to N; if the M second source IPs include the attacked IP, reducing the traffic corresponding to the attacked IP.

[0005] The network defense device provided by the present application is applied to a controller, and the device comprises the following: a communication unit configured to receive a first message sent by a first device, and collect N flow logs of the first device according to the first message, wherein N is a positive integer; The processing unit is configured to authenticate the first device according to a first source IP of the first packet; if the first device passes the authentication, determine whether M second source IPs corresponding to the N flow logs include an attacked IP according to the N flow logs, where M is a positive integer and M is less than or equal to N; and if the M second source IPs include the attacked IP, reduce the traffic corresponding to the attacked IP.

[0006] The network defense device provided in the application comprises a processor and a memory configured to store a computer program, wherein the processor is configured to invoke and run the computer program stored in the memory to execute the network defense method.

[0007] The computer program product provided in the application comprises a computer program configured to implement the network defense method when executed by a processor.

[0008] The computer readable storage medium provided in the application is configured to store a computer program, wherein the computer program enables a computer to execute the network defense method.

[0009] In the technical solution of the application, a first packet sent by a first device is received, and N flow logs of the first device are collected according to the first packet, where N is a positive integer; the first device is authenticated according to a first source IP of the first packet; if the first device passes the authentication, it is determined whether M second source IPs corresponding to the N flow logs include an attacked IP according to the N flow logs, where M is a positive integer and M is less than or equal to N; and if the M second source IPs include the attacked IP, the traffic corresponding to the attacked IP is reduced. In this way, the first source IP of the first packet collected from the first device is used to authenticate the first device, which effectively improves the device authentication and reduces IP or port conflicts. It is determined whether the M second source IPs include the attacked IP according to the flow logs, and the traffic corresponding to the attacked IP is reduced, so as to achieve network defense. BRIEF DESCRIPTION OF DRAWINGS

[0010] The accompanying drawings, which are included to provide a further understanding of the application, constitute a part of the application and serve to explain the application together with the description. The accompanying drawings do not limit the application in any way.

[0011] Figure 1 is a flowchart of the network defense method provided in the embodiments of the application; Figure 2 is a flowchart of the interaction between the data collection module and the device provided in the embodiments of the application; Figure 3 is a structural composition diagram of the network defense device provided in the embodiments of the application; Figure 4is a schematic structural diagram of a network defense device provided by an embodiment of the present application. Figure 5 is a schematic structural diagram of a chip of an embodiment of the present application. DETAILED DESCRIPTION

[0012] The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0013] In the following description, “some embodiments” are related to a subset of all possible embodiments, but it can be understood that “some embodiments” can be the same subset or different subsets of all possible embodiments, and can be combined with each other without conflict.

[0014] It should also be noted that the terms “first\second\third” in the embodiments of the present application are only used to distinguish similar objects, and do not represent a specific order of the objects. It can be understood that “first\second\third” can be interchanged in a specific order or sequence as allowed, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. The term “and / or” in this paper is only a description of the association relationship between the associated objects, which means that there can be three relationships, for example, A and / or B can represent the existence of A alone, the existence of A and B together, and the existence of B alone. In addition, the character “ / ” in this paper generally represents an “or” relationship between the front and rear associated objects. It should also be understood that “indication” mentioned in the embodiments of the present application can be direct indication or indirect indication, and can also represent an associated relationship. For example, A indicates B, which can mean that B can be obtained through A; it can also mean that A indirectly indicates B, for example, A indicates C, and B can be obtained through C; it can also mean that A and B have an associated relationship. It should also be understood that “corresponding” mentioned in the embodiments of the present application can mean a direct correspondence or indirect correspondence between the two, and can also mean an associated relationship between the two, or an indication and being indicated, a configuration and being configured, etc.

[0015] In order to facilitate the understanding of the technical solutions of the embodiments of the present application, the related technologies of the embodiments of the present application are described below. The following related technologies can be combined with the technical solutions of the embodiments of the present application in any way, and all belong to the protection scope of the embodiments of the present application.

[0016] Flow log: network device traffic log.

[0017] Remote Procedure Call (RPC) Introduction: RPC can be gRPC in particular, gRPC is a high-performance, open-source, cross-language and general RPC protocol framework for communication between client and server, using Hypertext Transfer Protocol Version 2 (HTTP / 2) protocol and Protocol Buffers (ProtoBuf) as serialization tools.

[0018] gRPC communication methods: gRPC has four main request / response modes, which are: (1) Simple RPC This mode is the most traditional, that is, the client initiates a request and the server returns a data.

[0019] (2) Server-side Streaming RPC This mode is that the client initiates a request and the server returns a continuous data stream. A typical example is that the client sends a stock code to the server, and the server returns real-time data of the stock to the client continuously.

[0020] (3) Client-side Streaming RPC Unlike the server-side streaming mode, this time the client continuously sends data streams to the server, and after the end of the transmission, the server returns a response. A typical example is that the Internet of Things terminal reports data to the server.

[0021] (4) Bidirectional Streaming RPC As the name implies, this is when the client and server can send data streams to each other, at which time both parties can send data to each other at the same time, that is, real-time interaction can be achieved. A typical example is a chat machine.

[0022] In some schemes, the flow log of the service board card is collected by sFlow, and the hardware cost is not greatly increased. In other schemes, a method for detecting Denial of Service (DoS) / Distributed Denial of Service (DDoS) flooding and slow Hypertext Transfer Protocol Denial of Service (HTTP DoS) attacks is introduced, but the flow logs of different devices cannot be distinguished, and the IP of the DDoS attack cannot be identified, so the abnormal traffic identified cannot be effectively processed.

[0023] Netflow / sFlow is a common network monitoring technology, and sFlow is more widely used due to its free and universal characteristics. sFlow uses data flow random sampling technology to provide complete Layer 2 to Layer 7 traffic information, allowing users to analyze network transmission flow performance, trends and problems in detail and real time, and to monitor network traffic and troubleshoot network faults.

[0024] In some schemes, the message is managed based on the information of the destination port or the source port, so as to realize the isolation management of different devices. In other schemes, the flow logs of different devices are distinguished based on the source IP of the message, and the flow logs of different devices are isolated and managed. According to the packet characteristics such as the source and destination IP, the source and destination port and the packet length of the device flow log, detecting DDoS attack traffic based on machine learning algorithm or traditional information entropy algorithm is a common technology, but most schemes stop at the detection stage and cannot perform DDoS defense. Some schemes directly generate a blocking flow table to block the detected DDoS attack IP, and if the detection method has false positives, the impact is too large and not flexible enough.

[0025] However, by port negotiation (source port or destination port), the flow logs of different devices are distinguished based on the source IP, which has the risk of potential IP or port conflict or forgery, and lacks device identity verification, is vulnerable to fake message attacks, and has poor network security. All IP exposure flow log collection ports have a large exposure surface and are vulnerable to attacks.

[0026] Therefore, how to improve the security performance of network management as much as possible and reduce the attack probability has become a problem that needs to be considered in network management. Therefore, the following technical solutions of the embodiments of the present application are proposed.

[0027] In order to facilitate the understanding of the technical solutions of the embodiments of the present application, the technical solutions of the present application are described in detail below through specific embodiments. The above related technologies can be combined with the technical solutions of the embodiments of the present application as optional schemes, and all belong to the protection scope of the embodiments of the present application. The embodiments of the present application include at least part of the following contents.

[0028] Figure 1 is a flow diagram of a network defense method provided by an embodiment of the present application, applied to a controller, such as Figure 1 As shown, the network defense method comprises the following steps: Step 101: receiving a first packet sent by a first device, and collecting N flow logs of the first device according to the first packet, wherein N is a positive integer.

[0029] Step 102: performing identity authentication on the first device according to a first source IP of the first packet.

[0030] Step 103: if the identity authentication on the first device is passed, determining whether M second source IPs corresponding to the N flow logs include an attacked IP, wherein M is a positive integer, and M is less than or equal to N.

[0031] Step 104: if the M second source IPs include the attacked IP, reducing a flow corresponding to the attacked IP.

[0032] In some embodiments, the first device can be a Customer Premise Equipment (CPE) or a Virtual Client Device (vCPE), and the first packet is a sFlow packet.

[0033] In some embodiments, the controller receives a first packet sent by a first device, i.e., a sFlow packet, collects N flow logs of the first device according to the first packet, the first packet includes a first source IP, i.e., a source IP outside a sFlow packet, therefore, the controller can perform identity authentication on the first device based on the first source IP, i.e., identity verification, each flow log includes a corresponding source IP, when the identity authentication on the first device is passed, determines whether M second source IPs of the N flow logs include an attacked IP, if the M second source IPs include the attacked IP, reduces a flow corresponding to the attacked IP, to implement network defense. In this way, the device is authenticated by the IP of the packet, and IP or port conflict does not occur, improving network security.

[0034] It can be understood that the present application takes the controller and the first device as an example to illustrate the network defense method, in actual process, the controller is connected with at least one first device, the packets of multiple first devices are acquired, the corresponding flow logs are collected, then it is determined whether the source IP of the flow log is an attacked IP, and defense is performed.

[0035] It should also be understood that in the embodiments of the present application, the first source IP of the first packet is the IP address of the first device.

[0036] It can be understood that the flow log collected by the first device is at least one flow log, and the at least one flow log includes at least one source IP, that is, M second source IPs, that is, the second source IP is the source IP of the flow log, and the same source IP may exist in the source IPs corresponding to the N flow logs, and therefore M is less than or equal to N.

[0037] In some embodiments, the controller includes a data collection module, an abnormal flow detection module and a defense module, wherein the data collection module receives the first message sent by the first device, collects N flow logs of the first device according to the first message, wherein N is a positive integer, performs identity authentication on the first device according to the first source IP of the first message, and if the identity authentication of the first device is passed, the abnormal flow detection module judges whether the M second source IPs corresponding to the N flow logs include the attacked IP according to the N flow logs, wherein M is a positive integer, and M is less than or equal to N, and if the M second source IPs include the attacked IP, the defense module reduces the flow corresponding to the attacked IP to realize network defense.

[0038] In some embodiments, before the data collection module of the controller receives the first message sent by the first device, the first device needs to establish a connection with the controller.

[0039] In some embodiments, the controller establishes a connection with the first device through the data collection module, or the controller includes a connection module and establishes a connection with the first device by using the connection module.

[0040] In some embodiments, the method further includes: receiving an online registration request sent by the first device, the online registration request including online state information, fingerprint information and IP information of the first device; sending an online registration result to the first device; if the online registration result is registration success, establishing a RPC bidirectional flow connection between the first device based on the RPC certificate of the first device and the first device, and the RPC bidirectional flow connection represents the online state of the first device, wherein when the online state of the first device is online, the RPC bidirectional flow connection is established.

[0041] In some embodiments, the RPC can be gRPC.

[0042] In some embodiments, the first device sends an online registration request to the controller, and the online registration request is an example of a Hypertext Transfer Protocol Secure (HTTPS) request of "HelloReq", wherein the online registration request includes online state information, fingerprint information and IP information of the first device. After receiving the online registration request sent by the first device, the controller responds to the online registration request of the first device and sends an online registration result to the first device. If the online registration result is registration success, a gRPC bidirectional stream connection is established between the first device and the gRPC certificate of the first device based on the gRPC bidirectional stream connection, and the gRPC bidirectional stream connection represents the online state of the first device, wherein the online state of the first device represents the establishment of the gRPC bidirectional stream connection when the first device is online.

[0043] In some embodiments, the first device initializes a gRPC client (gRPCClient) according to the local gRPC certificate, and establishes a gRPC bidirectional stream connection with the server (controller). In this way, the controller cannot perceive the online state of the device, and the gRPC bidirectional stream connection can reflect the online state of the device. When the device is online, the connection is established, and when the device is offline, the connection is disconnected. By using the gRPC certificate of the first device as a prerequisite for accessing the port, the network security is enhanced. It can be understood that the first device has a local gRPC certificate, and the gRPC bidirectional stream connection is established with the controller based on the certificate.

[0044] In some embodiments, the fingerprint information of the first device includes a hardware serial number, a Media Access Control (MAC) address and an operating system version, and specific fingerprint information is not limited in the present application and can be determined according to actual conditions.

[0045] In the embodiments of the present application, the flow log collection port is hidden before the controller and the first device establish a control connection, which is generally a User Datagram Protocol (UDP) 6789 port. The gRPC certificate is used as a condition for accessing the port, and after the control connection is established, the controller only opens the 6789 port for the current IP (i.e. the IP of the first device). The gRPC certificate and the port hiding increase the network security.

[0046] In some embodiments, after the gRPC bidirectional stream connection is established, the method further includes: performing identity authentication on the first device based on the fingerprint information and the IP information of the first device.

[0047] In some embodiments, after the first device establishes the gRPC bidirectional stream connection with the controller, the first device is authenticated based on the fingerprint information and the IP information of the first device. Specifically, the first device completes the authentication based on the fingerprint information and the IP information of the first device through the control connection.

[0048] In some embodiments, the method further comprises: when the authentication of the first device is passed, allowing the IP address of the first device to access the first port, and sending first configuration information to the first device, the first configuration information being used by the first device to create a first component, the first component being used to collect traffic information of the first device, the first component being used to send first packets to a second component of the controller, the first port being a listening port of the second component.

[0049] In some embodiments, the first port is a UDP 6789 port. The first component is a sFlow Agent, and the second component is a sFlow Collector.

[0050] Specifically, the controller fixes the UDP 6789 port as a listening port of the sFlow Collector. By default, the UDP 6789 port denies access of all IP addresses. Therefore, when the authentication of the first device is passed, the controller allows the IP address of the first device to access the first port, and sends first configuration information to the first device, the first device creating a sFlow Agent based on the first configuration information. The first configuration information includes the address of the sFlow Collector, the length of the UDP packet, and the sampling rate, etc.

[0051] In some embodiments, the controller allows the IP address of the first device to access the first port, that is, the controller whitelists the IP address of the first device. Specifically, the controller whitelists the IP address of the first device through an IP table (iptables).

[0052] In some embodiments, the method further comprises: creating an IP table, the IP table including one or more IP addresses, the one or more IP addresses including the IP address of the first device; wherein the traffic corresponding to each IP address in the IP table is denied access to the first port.

[0053] In some embodiments, before the controller whitelists the IP address of the first device through the IP table (iptables), an IP table needs to be created, the IP table including one or more IP addresses, the one or more IP addresses including the IP address of the first device; wherein the traffic corresponding to each IP address in the IP table is denied access to the first port.

[0054] In some embodiments, allowing the IP address of the first device to access the first port comprises: matching the IP address of the first device in the IP table, and if the matching succeeds, creating a first command, the first command being used to allow traffic corresponding to the IP address of the first device to access the first port.

[0055] In some embodiments, when the first device passes the authentication of the controller, matching the IP address of the first device in the IP table, and if the matching succeeds, creating a first command, the first command being used to allow traffic corresponding to the IP address of the first device to access the first port. That is, the controller allows the IP address of the first device to access the first port.

[0056] In some embodiments, the method further comprises: when the online state of the first device is offline, creating a second command, the second command being used to prohibit traffic corresponding to the IP address of the first device to access the first port.

[0057] In some embodiments, when the first device is online, a gRPC bidirectional stream connection is established, and when the first device is offline, the gRPC bidirectional stream connection is disconnected, thus the controller needs to block the IP address of the first device, that is, prohibit traffic corresponding to the IP address of the first device to access the first port.

[0058] Specifically, when the online state of the first device is offline, a second command is created, the second command being used to prohibit traffic corresponding to the IP address of the first device to access the first port. In this way, the exposure surface can be minimized, and the risk of being attacked can be reduced.

[0059] In some embodiments, after the first device receives the first configuration information sent by the controller, the first device creates a first component according to the first configuration information, and sends the creation result to the controller.

[0060] Specifically, the first device creates a sFlow Agent according to the configuration, and responds to the creation result.

[0061] In some embodiments, the first configuration information comprises an address of a second component; and receiving the first message sent by the first device comprises: receiving the first message sent by the first device to the address of the second component.

[0062] In some embodiments, the first device transmits the first message to the controller according to the address information of the second component, and transmits the corresponding flow log. Specifically, the device transmits the sFlow message to the controller according to the address of the sFlow Collector, and transmits the flow log.

[0063] It can be understood that the second component of the controller is used to receive the first message sent by the first device.

[0064] In some embodiments, authenticating the first device according to the first source IP of the first message comprises: authenticating the first device according to the first source IP, the fingerprint information of the first device and the first correspondence relationship, wherein the first correspondence relationship comprises a correspondence relationship between an interface IP address of the first device, the fingerprint information of the first device and the first device, and the interface IP address of the first device is the first source IP.

[0065] In some embodiments, after the controller receives the first message and the flow log sent by the first device when the first device creates the first component, the controller authenticates the first device according to the source IP of the first message and the fingerprint information of the first device initially uploaded.

[0066] Specifically, the controller database stores a correspondence relationship among a device interface IP address, a device fingerprint and a device, i.e., the first correspondence relationship, so that the controller can uniquely determine which device reports the flow log according to the outer source IP (i.e., the first source IP) of the reported sampling flow message (sFlow message) and the device fingerprint information in the data part of the sampling flow message (sFlow message). That is, the first device is authenticated according to the first source IP, the fingerprint information of the first device and the first correspondence relationship.

[0067] It can be understood that the interface IP address of the first device is the IP information of the first device in the online registration request.

[0068] In some embodiments, determining whether the M second source IPs corresponding to the N flow logs include the attacked IP according to the N flow logs comprises: comparing an information entropy of a source IP set of the N flow logs with a first threshold, wherein the source IP set comprises the M second source IPs; and if the information entropy of the source IP set is greater than the first threshold, it is determined that the M second source IPs include the attacked IP.

[0069] In some embodiments, after receiving the flow log of the first device, the controller calculates an information entropy of a source IP set of the flow log, compares the calculated information entropy with a first threshold, and if the information entropy is greater than the first threshold, it is considered that the source IP set includes the attacked IP, i.e., the M second source IPs include the attacked IP. Exemplarily, the first threshold is the information entropy of the source IP set of the normal traffic. The definition of the first threshold can be determined according to actual conditions, which is not limited in the present application.

[0070] In some embodiments, the calculation method of the information entropy of the source IP set is shown in formula (1): (1) wherein, the number of times the i-th source IP in the source IP set appears in N samples (N flow logs), the information entropy of the source IP set, n is the number of source IPs, which is equivalent to the aforementioned M.

[0071] For example, after the controller is connected with the first device, the controller receives the first packet sent by the first device, collects N flow logs of the first device based on the first packet, and corresponds to n source IPs (equivalent to the aforementioned M second source IPs), where n is less than or equal to N, the number of times one of the source IPs appears in the N flow logs, the information entropy of the source IP set, that is, the information entropy of the source IPs corresponding to the flow logs included in the first packet.

[0072] In some embodiments, the information entropy of the source IP set is greater than a first threshold value, and the flow logs collected from the first device include DDoS traffic, so it can be considered that the M second source IPs include the attacked IP. When it is determined that the M second source IPs include the attacked IP, the source IP with the largest weight is selected from the source IP set as the DDoS attack IP, that is, the source IP with the largest weight is selected from the M second source IPs as the DDoS attack IP. the largest source IP is the DDoS attack IP.

[0073] It can be understood that for DDoS attack traffic, the information entropy of the source IP will increase compared with normal traffic.

[0074] In some embodiments, reducing the traffic of the attacked IP includes: generating a defense flow table item, and applying the defense flow table item to the traffic corresponding to the attacked IP, the defense flow table item being used to reduce the speed of the traffic attacking the attacked IP.

[0075] In some embodiments, when the controller determines that the second source IP is the attacked IP, the network defense is implemented by reducing the traffic of the attacked IP. In some embodiments, the controller generates a defense flow table item, and applies the defense flow table item to the traffic corresponding to the attacked IP, the defense flow table item being used to reduce the speed of the traffic attacking the attacked IP.

[0076] Specifically, the controller first configures a speed limiting "Meter table item", and then issues a defense flow table item to apply the "Meter table item" to the traffic sent to the victim IP, so as to reduce the attack traffic rate. The matching field of the flow table item is the source IP, the source port and the destination IP. The source IP is the attacked IP, and the destination IP is the IP of the controller.

[0077] In some embodiments, the defense flow table item includes a first field, and the first field is the idle timeout time of the defense flow table item; the method further includes: if the idle time of the defense flow table item exceeds the idle timeout time, determining that the defense flow table item is invalid.

[0078] Specifically, the defense flow entry sets an "idle_timeout field" (i.e., a first field), and the field value is 10s, i.e., the idle timeout time is 10s. This means that when the attacker stops attacking for 10s, the defense flow entry does not match any data packet within 10s, and the defense flow entry is automatically invalidated, thereby reducing the influence range of the detection module DDoS attack traffic false alarm.

[0079] The technical scheme of the embodiment of the application receives a first message sent by a first device, collects N flow logs of the first device according to the first message, wherein N is a positive integer; performs identity authentication on the first device according to a first source IP of the first message; if the identity authentication of the first device is passed, judges whether M second source IPs corresponding to the N flow logs include an attacked IP according to the N flow logs, wherein M is a positive integer, and M is less than or equal to N; if the M second source IPs include the attacked IP, reduces the traffic corresponding to the attacked IP. In this way, the identity authentication of the device is effectively improved by performing identity authentication on the first device according to the first source IP of the first message of the first device collected, and IP or port conflicts are reduced. Whether the M second source IPs include the attacked IP is determined according to the flow logs, and the traffic corresponding to the attacked IP is reduced, so as to realize network defense.

[0080] The technical scheme of the embodiment of the application is exemplified below in combination with a specific application example.

[0081] The embodiment of the application proposes a DDoS traffic detection and active defense scheme in a software-defined wide area network (SD-WAN) scenario. The controller in the embodiment of the application mainly consists of the following three modules: (1) Data collection module: The data collection module of the controller collects device flow logs according to the sampling flow messages (sFlow messages) reported by the devices (CPE, vCPE).

[0082] (2) Abnormal traffic detection module: Abnormal traffic is analyzed based on the flow logs, and victim IP and DDoS attack IP are found out.

[0083] (3) Defense module: When the victim IP and the DDoS attack IP are located, a rate limiting flow table is generated for DDoS defense.

[0084] The following is a detailed description of each module.

[0085] 1) Data collection module: The controller collects device flow logs according to the sampling flow message (sFlow message) reported by the device (CPE, vCPE), and distinguishes the device according to the outer source IP of the reported sampling flow message (sFlow message). The embodiments of the application enhance network security through the following two points: I. The device is uniquely identified by the device fingerprint (such as hardware serial number, MAC address, operating system version, etc.) and the source IP of the sampling flow message (sFlow message) when the device first registers online, which enhances device identity verification and does not cause IP or port conflicts.

[0086] II. The flow log collection port (usually UDP 6789 port) is hidden before the controller and the device establish a control connection, and the gRPC certificate is used as the condition for port access. After the control connection is established, the controller only opens the 6789 port for the current IP, that is, the network security is increased by the gRPC certificate and port hiding.

[0087] Figure 2 is the interaction process diagram of the data collection module provided by the embodiments of the application and the device, wherein the forwarding plane (device) corresponds to the first device, and the control plane (controller) corresponds to the controller, as shown in Figure 2 The specific steps are as follows: Step 201: The device sends an HTTPS request of "HelloReq" to the controller.

[0088] The device sends an HTTPS request of "HelloReq" to the controller when it first registers online, and reports the online state of the controller device, the fingerprint information (such as hardware serial number, MAC address, operating system version, etc.) of the device, and the IP information of the device.

[0089] Step 202: The controller returns a request response.

[0090] The controller responds to the online registration result of the device, and the response can be "HelloResp", which is a response to "HelloReq".

[0091] Step 203: The device initializes the gRPC client and establishes a gRPC bidirectional stream connection with the controller.

[0092] The device initializes the gRPC client (gRPC Client) according to the local gRPC certificate, and establishes a gRPC bidirectional stream connection with the server. The reason why the embodiments of the application use gRPC bidirectional stream as the control connection is as follows: The controller cannot perceive the online state of the device, and the gRPC bidirectional stream connection can reflect the online state of the device. The connection is established when the device is online, and the connection is disconnected when the device is offline. The gRPC certificate is used as the condition for port access, which enhances network security.

[0093] Step 204: The controller sends a create sFlow agent request.

[0094] The controller fixes the UDP 6789 port as the listening port of the sFlow Collector. By default, the 6789 port denies access of all IPs. When the device completes authentication through the gRPC control connection, that is, can access the port, the controller passes the IP address of the device through the IP table (iptables), and the specific passing method is as described above, which is not repeated here, and issues the basic configuration of the sFlow Agent to the device, creates the sFlow Agent, wherein the basic configuration includes, for example, the sFlow Collector address, the UDP message length, and the sampling rate.

[0095] When the device is offline and the gRPC bidirectional stream is disconnected, the controller blocks the current device IP again, minimizes the exposure surface, and reduces the risk of attack.

[0096] Step 205: The device returns a create sFlow agent response.

[0097] The device creates the sFlow agent according to the issued configuration and responds to the creation result. The response can be "createsFlowAgentResp".

[0098] Step 206: The device transmits flow log data to the controller.

[0099] The device transmits the sFlow message to the controller according to the issued sFlow Collector address, and transmits the flow log. The controller database saves the correspondence between the device interface IP address and the device fingerprint and the device. According to the outer source IP of the reported sFlow message and the device fingerprint in the data part of the sFlow message, it is uniquely determined which device reports the flow log. The controller saves the cleaned flow log of the device to the distributed database, and provides an HTTP / gRPC interface for users to call.

[0100] 2) Abnormal flow detection module The controller abnormal flow identification module calculates the information entropy x of the source IP of the flow log, and compares it with the information entropy y (equivalent to the first threshold value described above) of the source IP of the normal flow. If x>y, it is considered that there is DDoS flow, and the source IP with the largest weight is determined as the DDoS attack IP. The calculation formula of the source IP information entropy is shown in formula (1), which is not repeated here.

[0101] 3) Defense module When the victim IP is located, the defense module starts to work. The defense module of the embodiment of the application adopts the method of issuing flow table items to limit the rate of attack traffic for defense. In order to limit the rate, the embodiment of the application first configures a rate limiting "Meter table item", and then issues a defense flow table item to apply the "Meter table item" to the traffic sent to the victim IP, thereby reducing the rate of attack traffic. The matching field of the flow table item is source IP, source port and destination IP. The embodiment of the application sets an "idle_timeout field" for the defense flow table item, and the field value is 10s. This means that when the attacker stops attacking for 10s, the defense flow table item does not match any packet within 10s, and the defense flow table item is automatically invalidated, thereby reducing the influence range of the false alarm of the detection module DDoS attack traffic.

[0102] Since the embodiment of the application adopts the method of rate limiting for defense, even if the victim IP is located incorrectly, the communication between normal servers can be guaranteed to a certain extent. In order to limit the rate of attack traffic at the entrance of the network, the embodiment of the application issues the defense flow table item to the vCPE.

[0103] The technical solution of the embodiment of the application uniquely identifies the device through the device fingerprint (such as hardware serial number, MAC address, operating system version, etc.) of the device registered online for the first time and the source IP of the sample flow packet (sFlow packet) of the controller, enhancing device identity verification. The device fingerprint is also applicable to the network address translation (Network Address Translation, NAT) scenario, and the device can still be uniquely identified in the NAT scenario without IP conflict. The controller and the device hide the flow log collection port (generally UDP 6789 port) before establishing a control connection, and use the gRPC certificate as the condition for port access. The device completes authentication through the control connection, that is, can access the port, and the controller only opens the 6789 port for the current IP. The gRPC certificate and port hiding increase network security. The controller dynamically adjusts the IP table (iptables) rule for port hiding based on device authentication, reduces the exposure surface, and reduces the risk of being attacked.

[0104] The controller centrally controls the user flow log, and the user does not need to separately deploy a sample flow collector (sFlowCollector) or subscribe to a flow log service, saving deployment time and reducing user cost.

[0105] For user flow logs, on the one hand, user online behavior (both access to public network and intranet traffic) can be monitored in real time, and on the other hand, the link quality of the export router accessing the public network can be analyzed and predicted based on the user flow logs, a reference for dynamically adjusting the bandwidth is provided, and the bandwidth utilization is improved. The information entropy algorithm is used to analyze and process the traffic, and the abnormal traffic does not need to be defined and marked in advance, and the abnormal traffic can be automatically identified and located. At the same time, by taking the information entropy of the traffic without abnormal traffic as a threshold, the subjectivity and uncertainty of the threshold can be avoided, and the accuracy and stability of the abnormal traffic identification are improved. In view of the potential misjudgment of the information entropy algorithm, the flow table item scheme is used to reduce the influence range of DDoS attack detection false alarm, and the possibility of scheme landing is improved.

[0106] Figure 3 is a structural composition schematic diagram of a network defense device provided by the embodiment of the application, and is applied to a controller, as shown in Figure 3 The network defense device comprises: A communication unit 301 is configured to receive a first message sent by a first device, and collect N flow logs of the first device according to the first message, wherein N is a positive integer. A processing unit 302 is configured to perform identity authentication on the first device according to a first source IP of the first message; if the identity authentication of the first device is passed, judge whether M second source IPs corresponding to the N flow logs include an attacked IP or not according to the N flow logs, wherein M is a positive integer, and M is less than or equal to N; if the M second source IPs include the attacked IP, reduce the traffic corresponding to the attacked IP.

[0107] In some embodiments, the communication unit 301 is configured to receive an online registration request sent by the first device, the online registration request comprising online state information, fingerprint information and IP information of the first device; send an online registration result to the first device; and the processing unit 302 is configured to, if the online registration result is registration success, establish a remote procedure call (RPC) bidirectional flow connection between the first device based on an RPC certificate of the first device, and the first device, and the RPC bidirectional flow connection represents the online state of the first device, wherein the online state of the first device is represented by the establishment of the RPC bidirectional flow connection when the first device is online.

[0108] In some embodiments, after the RPC bidirectional flow connection is established, the processing unit 302 is configured to perform identity authentication on the first device based on the fingerprint information and the IP information of the first device.

[0109] In some embodiments, the processing unit 302 is configured to allow the IP address of the first device to access the first port when the identity authentication of the first device is passed; and the communication unit 301 is configured to send first configuration information to the first device, the first configuration information being used by the first device to create a first component, the first component being configured to collect traffic information of the first device, and the first component being configured to send a first packet to a second component of the controller, the first port being a listening port of the second component.

[0110] In some embodiments, the processing unit 302 is configured to create an IP table, the IP table including one or more IP addresses, the one or more IP addresses including the IP address of the first device; and each IP address in the IP table corresponds to traffic that is denied to access the first port.

[0111] In some embodiments, the processing unit 302 is configured to match the IP address of the first device in the IP table, and if the matching is successful, create a first command, the first command being used to allow the traffic corresponding to the IP address of the first device to access the first port.

[0112] In some embodiments, the processing unit 302 is configured to, when the online state of the first device is offline, create a second command, the second command being used to prohibit the traffic corresponding to the IP address of the first device to access the first port.

[0113] In some embodiments, the first configuration information includes an address of the second component; and the communication unit 301 is configured to receive the first packet sent by the first device to the address of the second component.

[0114] In some embodiments, the processing unit 302 is configured to perform identity authentication on the first device according to the first source IP, the fingerprint information of the first device, and a first correspondence relationship, the first correspondence relationship including a correspondence relationship between an interface IP address of the first device, the fingerprint information of the first device, and the first device, the interface IP address of the first device being the first source IP.

[0115] In some embodiments, the processing unit 302 is configured to compare an information entropy of a source IP set of N flow logs with a first threshold value, the source IP set including M second source IPs; and if the information entropy of the source IP set is greater than the first threshold value, determine that the M second source IPs include the attacked IP.

[0116] In some embodiments, the processing unit 302 is configured to generate a defense flow entry, and apply the defense flow entry to the traffic corresponding to the attacked IP, the defense flow entry being used to reduce the speed of the traffic attacking the attacked IP.

[0117] In some embodiments, the defense flow entry includes a first field, the first field being an idle timeout time of the defense flow entry; the processing unit 302 is configured to determine that the defense flow entry is invalid if an idle time of the defense flow entry exceeds the idle timeout time.

[0118] Those skilled in the art should understand that, Figure 3 The implementation functions of the units in the network defense device shown can be understood with reference to the related descriptions of the foregoing methods. Figure 3 The functions of the units in the network defense device shown can be implemented by programs running on the processor, or by specific logic circuits.

[0119] Figure 4 is a schematic structural diagram of a network defense device 400 provided by an embodiment of the present application. The network defense device can be a controller, Figure 4 The network defense device 400 shown includes a processor 410, which can call and run computer programs from a memory to implement the method in the embodiment of the present application.

[0120] Optionally, as Figure 4 The network defense device 400 shown can further include a memory 420. The processor 410 can call and run computer programs from the memory 420 to implement the method in the embodiment of the present application.

[0121] The memory 420 can be a separate device independent of the processor 410, or can be integrated in the processor 410.

[0122] Optionally, as Figure 4 The network defense device 400 shown can further include a transceiver 430, and the processor 410 can control the transceiver 430 to communicate with other devices, specifically, to send information or data to other devices, or receive information or data sent by other devices.

[0123] The transceiver 430 can include a transmitter and a receiver. The transceiver 430 can further include an antenna, and the number of antennas can be one or more.

[0124] Optionally, the network defense device 400 can be specifically a controller of the embodiment of the present application, and the network defense device 400 can implement the corresponding processes implemented by the controller in the various methods of the embodiment of the present application. For brevity, details are not repeated here.

[0125] Figure 5 is a schematic structural diagram of a chip of the embodiment of the present application. Figure 5The chip 500 shown includes a processor 510, which can call and run a computer program from a memory to implement the method in the embodiments of the present application.

[0126] Optionally, as shown, the chip 500 can also include a memory 520. Among them, the processor 510 can call and run a computer program from the memory 520 to implement the method in the embodiments of the present application. Figure 5

[0127] Among them, the memory 520 can be a separate device independent of the processor 510, or can be integrated in the processor 510.

[0128] Optionally, the chip 500 can also include an input interface 530. Among them, the processor 510 can control the input interface 530 to communicate with other devices or chips, specifically, it can acquire information or data sent by other devices or chips.

[0129] Optionally, the chip 500 can also include an output interface 540. Among them, the processor 510 can control the output interface 540 to communicate with other devices or chips, specifically, it can output information or data to other devices or chips.

[0130] Optionally, the chip can be applied to the controller in the embodiments of the present application, and the chip can implement the corresponding processes realized by the controller in each method of the embodiments of the present application. For the sake of brevity, it will not be repeated here.

[0131] It should be understood that the chip mentioned in the embodiments of the present application can also be referred to as a system chip, a system chip, a chip system or a system on chip, etc.

[0132] ​It should be understood that the processor of the embodiments of the present application can be an integrated circuit chip having a signal processing capability. In the implementation process, each step of the method embodiments described above can be completed by the integrated logic circuit of hardware or the instruction in the form of software in the processor. The processor described above can be a general processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. The disclosed methods, steps and logic block diagrams in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor or the like. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware code processor for execution, or can be executed by a combination of hardware and software modules in the code processor. The software module can be located in a random access memory, a flash memory, a read only memory, a programmable read only memory or an electrically erasable programmable memory, a register or other mature storage medium in the art. The storage medium is located in the memory, and the processor reads the information in the memory, and combines the hardware to complete the steps of the above method.

[0133] It is to be understood that the memory in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (Read-Only Memory, ROM), a programmable read-only memory (Programmable ROM, PROM), an erasable programmable read-only memory (Erasable PROM, EPROM), an electrically erasable programmable read-only memory (Electrically EPROM, EEPROM) or a flash memory. The volatile memory can be a random access memory (Random Access Memory, RAM) used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (Static RAM, SRAM), dynamic random access memory (Dynamic RAM, DRAM), synchronous dynamic random access memory (Synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (Double Data Rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (Enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (Synchlink DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM). It should be noted that the memory of the system and method described herein is intended to include, but not limited to, these and any other suitable types of memory.

[0134] It should be understood that the above-mentioned memory is exemplary but not limiting, for example, the memory in the embodiments of the present application can also be static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synch link DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM) and the like. That is, the memory in the embodiments of the present application is intended to include, but not limited to, these and any other suitable types of memory.

[0135] The embodiments of the present application also provide a computer program product comprising a computer program.

[0136] Optionally, the computer program product can be applied to the controller in the embodiments of the present application, and the computer program realizes the corresponding process realized by the controller in the various methods of the embodiments of the present application when executed by the processor. For the sake of brevity, details are not repeated here.

[0137] The embodiments of the present application further provide a computer readable storage medium for storing the computer program.

[0138] Optionally, the computer readable storage medium can be applied to the controller in the embodiments of the present application, and the computer program enables the computer to execute the corresponding process realized by the controller in the various methods of the embodiments of the present application. For the sake of brevity, details are not repeated here.

[0139] Those skilled in the art can understand that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized in electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0140] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, and details are not repeated here.

[0141] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or other forms.

[0142] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0143] In addition, each function unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit.

[0144] The functions, if implemented in the form of software function units and sold or used as independent products, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application, essentially or in part, or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and various other media that can store program codes.

[0145] The above is merely specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which shall be covered within the protection scope of the present application.

Claims

1. A network defense method, characterized in that: Applied to a controller, the method includes: Receive a first message sent by a first device, and collect N flow logs of the first device according to the first message, where N is a positive integer; authenticating the first device according to the first source IP address of the first message; If the identity authentication of the first device is passed, determining whether the M second source IP addresses corresponding to the N flow logs include the attacked IP address according to the N flow logs, where M is a positive integer and M is less than or equal to N; If the M second source IPs include an attacked IP, the traffic corresponding to the attacked IP is reduced.

2. The method according to claim 1, characterized in that The method further comprises: receiving an online registration request sent by the first device, the online registration request including online status information, fingerprint information, and IP information of the first device; Sending an online registration result to the first device; If the online registration result is successful, an RPC bidirectional stream connection is established between the first device and the first device based on the remote procedure call RPC certificate of the first device. The RPC bidirectional stream connection represents the online status of the first device, wherein the online status of the first device is the establishment of the RPC bidirectional stream connection when it is online.

3. The method according to claim 2, characterized in that After establishing the RPC bidirectional stream connection, the method further includes: The identity of the first device is authenticated based on the fingerprint information and IP information of the first device.

4. The method according to claim 3, characterized in that The method further comprises: After the identity authentication of the first device is passed, the IP address of the first device is allowed to access the first port, and first configuration information is sent to the first device. The first configuration information is used by the first device to create a first component. The first component is used to collect traffic information of the first device. The first component is used to send the first message to the second component of the controller. The first port is the listening port of the second component.

5. The method according to claim 4, characterized in that The method further comprises: Creating an IP table, the IP table including one or more IP addresses, the one or more IP addresses including the IP address of the first device; wherein traffic corresponding to each IP address in the IP table is denied access to the first port; The allowing the IP address of the first device to access the first port includes: The IP address of the first device is matched in the IP table. If the match is successful, a first command is created, where the first command is used to allow traffic corresponding to the IP address of the first device to access the first port.

6. The method according to claim 5, characterized in that The method further comprises: When the online status of the first device is offline, a second command is created, where the second command is used to prohibit traffic corresponding to the IP address of the first device from accessing the first port.

7. The method according to any one of claims 4 to 6, characterized in that The first configuration information includes an address of the second component; and the receiving a first message sent by the first device includes: Receive the first message sent by the first device to the address of the second component.

8. The method according to any one of claims 2 to 6, characterized in that The performing identity authentication on the first device according to the first source IP address of the first message includes: The first device is authenticated based on the first source IP, the fingerprint information of the first device and a first correspondence, wherein the first correspondence includes the interface IP address of the first device, the correspondence between the fingerprint information of the first device and the first device, and the interface IP address of the first device is the first source IP.

9. The method according to any one of claims 1 to 6, characterized in that The determining, based on the N flow logs, whether the M second source IP addresses corresponding to the N flow logs include an attacked IP address includes: Comparing the information entropy of the source IP set of the N flow logs with a first threshold, wherein the source IP set includes M second source IPs; If the information entropy of the source IP set is greater than the first threshold, it is determined that the M second source IPs include the attacked IP.

10. The method according to any one of claims 1 to 6, characterized in that Reducing the traffic of the attacked IP includes: Generate a defense flow entry, apply the defense flow entry to the traffic corresponding to the attacked IP, and use the defense flow entry to reduce the speed of the traffic attacking the attacked IP.

11. The method according to claim 10, characterized in that The defense flow entry includes a first field, where the first field is an idle timeout period of the defense flow entry; and the method further includes: If the idle time of the defense flow entry exceeds the idle timeout time, it is determined that the defense flow entry is invalid.

12. A network defense device, characterized in that: Applicable to a controller; the device comprises: a communication unit, configured to receive a first message sent by a first device, and collect N flow logs of the first device according to the first message, where N is a positive integer; A processing unit is used to authenticate the first device based on the first source IP of the first message; if the identity authentication of the first device is passed, it is determined based on the N flow logs whether the M second source IPs corresponding to the N flow logs include the attacked IP, where M is a positive integer and M is less than or equal to N; if the M second source IPs include the attacked IP, the traffic corresponding to the attacked IP is reduced.

13. A network defense device, characterized in that: include: A processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory to execute the method according to any one of claims 1 to 11.

14. A computer program product, characterized in that include: A computer program which, when executed by a processor, implements the method according to any one of claims 1 to 11.

15. A computer-readable storage medium, characterized in that Used to store a computer program, wherein the computer program causes a computer to execute the method according to any one of claims 1 to 11.

Images