Traffic cleaning method, device, detection area and alliance chain for DDoS attacks

Abstract

The present invention provides a traffic cleaning method, device, detection area and alliance chain for DDoS attacks, and relates to the field of communication technology. The method includes: when a distributed denial of service attack is detected, if the attack source of the distributed denial of service attack does not belong to the first detection area, then writing a first near-source cleaning request to the alliance chain; reading a first near-source cleaning response from the alliance chain, wherein the first near-source cleaning response includes a cleaning response flow; comparing the cleaning response flow with the current actual cleaning flow of the first detection area to obtain a near-source cleaning result. It effectively solves the problems in the prior art that linkage cleaning requires additional mitigation equipment or cloud dispatching centers, that due to the attribution and differentiation of inter-domain equipment, it is difficult for inter-domain equipment to be linked and intercommunicated, and that cross-domain near-source protection cleaning for the attack source IP cannot be achieved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a traffic cleaning method, device, detection area and alliance chain for DDoS attacks. Background Art

[0002] Conventional distributed denial of service attack DDoS source tracing is generally based on the attack traffic from which interface of the router enters the domain, and the position of the router in the domain, so that the attack source can be traced within the domain. At this time, the cleaning is linked with the cleaning equipment in the domain, and the near-source cleaning is completed in the domain of the border router. However, when the DDoS attack occurs in two different domains, forming a cross-network and cross-domain attack, the existing tracing method can only be traced back to the border router, and the near-source cleaning is only completed at the border router within the domain, mainly for the protection target object to be detected, and the linkage defense cleaning is implemented according to the destination IP. To solve the cross-domain linkage coordination problem, the existing solutions include adding additional linkage protection equipment or cloud scheduling center, which is responsible for processing and responding to the linkage mechanism. However, the additional protection mitigation equipment or cloud scheduling center has a high cost expenditure, and the anti-D attack equipment between domains is attributable and the equipment is differentiated. It is difficult for the inter-domain equipment to be linked and interconnected, and it is impossible to achieve cross-domain near-source protection cleaning for the attack source IP. Summary of the invention

[0003] The purpose of the present invention is to provide a traffic cleaning method, device, detection area and alliance chain for DDoS attacks. By writing the inter-domain near-source cleaning process links and information into the alliance chain using the consensus mechanism of the alliance chain, the problems in the prior art of additional mitigation equipment or cloud scheduling center for linkage cleaning are effectively solved, and the problems of difficulty in linkage and intercommunication between domain devices due to the ownership and differentiation of inter-domain devices and the inability to achieve cross-domain near-source protection cleaning for the attack source IP are solved.

[0004] To achieve the above object, an embodiment of the present invention provides a traffic cleaning method for a distributed denial of service attack DDoS, which is applied to a first detection area and includes:

[0005] When a distributed denial of service attack is detected, if the attack source of the distributed denial of service attack does not belong to the first detection area, a first near-source cleaning request is written to the alliance chain;

[0006] Reading a first near-source cleaning response from the alliance chain, where the first near-source cleaning response includes cleaning response traffic;

[0007] Compare the cleaning response flow rate with the current actual cleaning flow rate of the first detection area to obtain a near-source cleaning result;

[0008] Wherein, after the second detection area performs traffic cleaning for the distributed denial of service attack, the first near-source cleaning response is written to the alliance chain;

[0009] The attack source of the distributed denial of service attack belongs to the second detection area.

[0010] Furthermore, the step of comparing the cleaning response flow rate with the current actual cleaning flow rate of the first detection area to obtain a near-source cleaning result includes:

[0011] When traffic cleaning is performed for the distributed denial of service attack and the traffic cleaning amount is greater than a preset value, the near-source cleaning result is obtained as a near-source cleaning confirmation result.

[0012] Furthermore, the method also includes: writing the confirmation result into the alliance chain.

[0013] Furthermore, the method further comprises:

[0014] Reading a second near-source cleaning request from the alliance chain, and determining, according to the second near-source cleaning request, whether an attack source of a second distributed denial-of-service attack corresponding to the second near-source cleaning request belongs to the first detection area;

[0015] After determining that the attack source of the second distributed denial of service attack belongs to the first detection area, performing near-source traffic cleaning;

[0016] According to the near-source traffic cleaning, a second near-source cleaning response is determined, and the second near-source cleaning response is written into the alliance chain.

[0017] Furthermore, the first near-source cleaning request includes:

[0018] A cleaning task identification ID, each of the first near-source cleaning requests corresponds to a cleaning task;

[0019] a cleaning request initiator ID, where each cleaning request initiator of the first near-source cleaning request corresponds to a cleaning node;

[0020] The IP address of the source of the distributed denial of service attack.

[0021] Furthermore, the near-source cleaning response includes:

[0022] Cleaning task identification ID, cleaning responder ID, cleaning response flow, cleaning start time and cleaning end time.

[0023] Further, the reading the first near-source cleaning response from the alliance chain includes:

[0024] The first near-source cleaning response is read, and the first near-source cleaning response is first decrypted to obtain the cleaning response flow.

[0025] Furthermore, the traffic cleaning is performed for the distributed denial of service attack, and the traffic cleaning amount is greater than a preset value, including:

[0026] Calculating a cleaning flow deviation according to the cleaning response flow and the actual cleaning flow;

[0027] If the cleaning traffic deviation is less than the first threshold, traffic cleaning is performed for the distributed denial of service attack, and the traffic cleaning amount is greater than a preset value;

[0028] The cleaning flow deviation is calculated by the following formula:

[0029]

[0030] Furthermore, the step of writing the near-source cleaning confirmation result into the alliance chain includes:

[0031] The near-source cleaning confirmation result is first encrypted, and the encrypted near-source cleaning confirmation result is written into the alliance chain.

[0032] Furthermore, the near-source cleaning confirmation result includes: cleaning task identification ID, cleaning request initiator ID, cleaning responder ID and actual cleaning flow;

[0033] Wherein, each cleaning responder of the near-source cleaning response corresponds to a cleaning node.

[0034] An embodiment of the present invention further provides a traffic cleaning method for distributed denial of service attacks DDoS, which is applied to a consortium chain and includes:

[0035] Obtaining the near-source cleaning confirmation result written in the first detection area and the first near-source cleaning response written in the second detection area;

[0036] The near-source cleaning confirmation result is obtained by comparing the cleaning response flow with the current actual cleaning flow of the first detection area; the cleaning response flow is carried in the first near-source cleaning response read from the alliance chain when a distributed denial of service attack occurs and the attack source does not belong to the first detection area;

[0037] The first near-source cleaning response is written into the alliance chain after the second detection area cleans the near-source traffic of the distributed denial of service attack belonging to the attack source of this area.

[0038] Further, the obtaining of the near-source cleaning confirmation result written in the first detection area and the first near-source cleaning response written in the second detection area includes:

[0039] Acquire the near-source cleaning confirmation result, and perform a first decryption on the near-source cleaning confirmation result to obtain an actual cleaning flow rate;

[0040] The first near-source cleaning response is obtained, and a second decryption is performed on the first near-source cleaning response to obtain cleaning response traffic.

[0041] Furthermore, the method further comprises:

[0042] Calculating the cleaning flow deviation at preset intervals according to the near-source cleaning confirmation result and the first near-source cleaning response;

[0043] A settlement cleaning flow between the first detection area and the second detection area is determined according to the cleaning flow deviation.

[0044] Further, determining the settlement cleaning flow between the first detection area and the second detection area according to the cleaning flow deviation degree includes:

[0045] When the cleaning flow deviation is less than the first threshold, the settlement cleaning flow is the cleaning response flow;

[0046] When the cleaning flow deviation is greater than or equal to the first threshold and less than or equal to the second threshold, the settlement cleaning flow is the average value of the cleaning response flow and the actual cleaning flow;

[0047] When the cleaning flow deviation is greater than a second threshold, the settled cleaning flow is the actual cleaning flow.

[0048] To achieve the above purpose, an embodiment of the present invention further provides a traffic cleaning device for distributed denial of service attacks DDoS, comprising:

[0049] A first writing module is used to write a first near-source cleaning request to the alliance chain when a distributed denial of service attack is detected and if the attack source of the distributed denial of service attack does not belong to the first detection area;

[0050] A first reading module is used to read a first near-source cleaning response from the alliance chain, where the first near-source cleaning response includes a cleaning response flow;

[0051] A comparison module, used for comparing the cleaning response flow rate with the current actual cleaning flow rate of the first detection area to obtain a near-source cleaning result;

[0052] Wherein, after the second detection area performs traffic cleaning for the distributed denial of service attack, the first near-source cleaning response is written to the alliance chain;

[0053] The attack source of the distributed denial of service attack belongs to the second detection area.

[0054] To achieve the above object, an embodiment of the present invention further provides a detection device, applied to a first detection area, comprising: a first transceiver and a first processor;

[0055] The first transceiver is used for, when a distributed denial of service attack is detected, if the attack source of the distributed denial of service attack does not belong to the first detection area, writing a first near-source cleaning request to the alliance chain;

[0056] Reading a first near-source cleaning response from the alliance chain, where the first near-source cleaning response includes cleaning response traffic;

[0057] The first processor is used to compare the cleaning response flow rate with the current actual cleaning flow rate of the first detection area to obtain a near-source cleaning result;

[0058] Wherein, after the second detection area performs traffic cleaning for the distributed denial of service attack, the first near-source cleaning response is written to the alliance chain;

[0059] The attack source of the distributed denial of service attack belongs to the second detection area.

[0060] To achieve the above object, an embodiment of the present invention further provides a consortium chain entity, including: a third transceiver;

[0061] The third transceiver is used to obtain the near-source cleaning confirmation result written in the first detection area and the first near-source cleaning response written in the second detection area;

[0062] The near-source cleaning confirmation result is obtained by comparing the cleaning response flow with the current actual cleaning flow of the first detection area; the cleaning response flow is carried in the first near-source cleaning response read from the alliance chain when a distributed denial of service attack occurs and the attack source does not belong to the first detection area;

[0063] The first near-source cleaning response is written into the alliance chain after the second detection area cleans the near-source traffic of the distributed denial of service attack belonging to the attack source of this area.

[0064] To achieve the above-mentioned purpose, an embodiment of the present invention provides a cleaning terminal, including a transceiver, a processor, a memory, and a program or instruction stored in the memory and executable on the processor; when the processor executes the program or instruction, the traffic cleaning method for the distributed denial of service attack DDoS as described above is implemented.

[0065] To achieve the above-mentioned purpose, an embodiment of the present invention provides a readable storage medium having a program or instruction stored thereon, which, when executed by a processor, implements the traffic cleaning method for distributed denial of service attack DDoS as described above.

[0066] The beneficial effects of the above technical solution of the present invention are as follows:

[0067] The traffic cleaning method for distributed denial of service attacks DDoS in the embodiment of the present invention writes the inter-domain near-source cleaning process links and information into the alliance chain using the consensus mechanism of the alliance chain. This solves the problem that linkage cleaning in the prior art requires the addition of new mitigation equipment or cloud dispatching centers, effectively reducing cost expenditures. It can also solve the problems of difficulty in near-source cleaning intercommunication and low linkage efficiency caused by inter-domain device ownership and device differentiation, effectively improve the efficiency of cross-domain near-source cleaning, and realize cross-domain near-source protection cleaning for the attack source IP. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 This is one of the flow charts of the DDoS traffic cleaning method according to an embodiment of the present invention;

[0069] Figure 2 This is a second flow chart of the DDoS traffic cleaning method according to an embodiment of the present invention;

[0070] Figure 3 This is a third flow chart of the DDoS traffic cleaning method according to an embodiment of the present invention;

[0071] Figure 4 A logical schematic diagram of calculation of the settlement cleaning flow rate according to an embodiment of the present invention;

[0072] Figure 5 A logical schematic diagram of a DDoS traffic cleaning method according to an embodiment of the present invention;

[0073] Figure 6 This is one of the structural block diagrams of the DDoS traffic cleaning device according to an embodiment of the present invention;

[0074] Figure 7 This is the second structural block diagram of the DDoS traffic cleaning device according to an embodiment of the present invention;

[0075] Figure 8 This is the third structural block diagram of the DDoS traffic cleaning device according to an embodiment of the present invention;

[0076] Fig. 9 This is one of the structural diagrams of the detection area of ​​an embodiment of the present invention;

[0077] Fig.10 This is the second structural diagram of the detection area of ​​an embodiment of the present invention;

[0078] Fig.11 This is the third structural diagram of the detection area of ​​an embodiment of the present invention;

[0079] Fig.12 4 is a structural block diagram of a cleaning terminal according to an embodiment of the present invention. DETAILED DESCRIPTION

[0080] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0081] It should be understood that the references to "one embodiment" or "an embodiment" throughout the specification mean that the specific features, structures, or characteristics associated with the embodiment are included in at least one embodiment of the present invention. Therefore, the references to "in one embodiment" or "in an embodiment" appearing throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0082] In various embodiments of the present invention, it should be understood that the size of the serial numbers of the following processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0083] Additionally, the terms "system" and "network" are often used interchangeably herein.

[0084] In the embodiments provided in the present application, it should be understood that "B corresponding to A" means that B is associated with A, and B can be determined according to A. However, it should also be understood that determining B according to A does not mean determining B only according to A, and B can also be determined according to A and / or other information.

[0085] When describing the embodiments of the present invention, some concepts used in the following description are first explained.

[0086] A consortium chain is a blockchain jointly managed by several organizations. Multiple pre-selected nodes are designated as accounting nodes within the consortium chain. The generation of each block is jointly determined by all pre-selected nodes using a consensus mechanism. Other access nodes can read the information on the chain, but do not ask about the accounting process. The consortium chain uses distributed ledgers and distributed consensus technology to form data indestructibility. Modified distributed database.

[0087] like Figure 1 As shown, a traffic cleaning method for a distributed denial of service attack DDoS according to an embodiment of the present invention is applied to a first detection area, and includes:

[0088] Step 101, when a distributed denial of service attack is detected, if the attack source of the distributed denial of service attack does not belong to the first detection area, a first near-source cleaning request is written to the alliance chain;

[0089] Step 102, reading a first near-source cleaning response from the alliance chain, where the first near-source cleaning response includes cleaning response traffic;

[0090] Step 103, comparing the cleaning response flow rate with the current actual cleaning flow rate of the first detection area to obtain a near-source cleaning result;

[0091] Wherein, after the second detection area performs traffic cleaning for the distributed denial of service attack, the first near-source cleaning response is written to the alliance chain;

[0092] The attack source of the distributed denial of service attack belongs to the second detection area.

[0093] The traffic cleaning method for distributed denial of service attacks DDoS in the embodiment of the present invention writes the inter-domain near-source cleaning process links and information into the alliance chain using the consensus mechanism of the alliance chain. This solves the problem that linkage cleaning in the prior art requires the addition of new mitigation equipment or cloud dispatching centers, effectively reducing cost expenditures. It can also solve the problems of difficulty in near-source cleaning intercommunication and low linkage efficiency caused by inter-domain device ownership and device differentiation, effectively improve the efficiency of cross-domain near-source cleaning, and realize cross-domain near-source protection cleaning for the attack source IP.

[0094] Optionally, comparing the cleaning response flow rate with the current actual cleaning flow rate of the first detection area to obtain a near-source cleaning result includes:

[0095] When traffic cleaning is performed for the distributed denial of service attack and the traffic cleaning amount is greater than a preset value, the near-source cleaning result is obtained as a near-source cleaning confirmation result.

[0096] By comparing the actual cleaning traffic with the cleaning response traffic, the cleaned traffic is recorded and the confirmation result provides data support for the traffic settlement of the alliance chain.

[0097] The traffic cleaning method for distributed denial of service attacks DDoS in the embodiment of the present invention writes the inter-domain near-source cleaning process links and information into the alliance chain using the consensus mechanism of the alliance chain. This solves the problem that linkage cleaning in the prior art requires the addition of new mitigation equipment or cloud dispatching centers, effectively reducing cost expenditures. It can also solve the problems of difficulty in near-source cleaning intercommunication and low linkage efficiency caused by inter-domain device ownership and device differentiation, effectively improve the efficiency of cross-domain near-source cleaning, and realize cross-domain near-source protection cleaning for the attack source IP.

[0098] Optionally, the method further includes: writing the confirmation result into the alliance chain.

[0099] Optionally, the method further comprises:

[0100] Reading a second near-source cleaning request from the alliance chain, and determining, according to the second near-source cleaning request, whether an attack source of a second distributed denial-of-service attack corresponding to the second near-source cleaning request belongs to the first detection area;

[0101] After determining that the attack source of the second distributed denial of service attack belongs to the first detection area, performing near-source traffic cleaning;

[0102] According to the near-source traffic cleaning, a second near-source cleaning response is determined, and the second near-source cleaning response is written into the alliance chain.

[0103] Here, the first detection area can be used as a detection area that sends a near-source cleaning request after being attacked by DDoS, and can also be used as a detection area that receives a near-source cleaning request and then performs traffic cleaning on the attack.

[0104] The traffic cleaning method for distributed denial of service attacks DDoS in the embodiment of the present invention writes the inter-domain near-source cleaning process links and information into the alliance chain using the consensus mechanism of the alliance chain. This solves the problem that linkage cleaning in the prior art requires the addition of new mitigation equipment or cloud dispatching centers, effectively reducing cost expenditures. It can also solve the problems of difficulty in near-source cleaning intercommunication and low linkage efficiency caused by inter-domain device ownership and device differentiation, effectively improve the efficiency of cross-domain near-source cleaning, and realize cross-domain near-source protection cleaning for the attack source IP.

[0105] Optionally, the first near-source cleaning request includes:

[0106] A cleaning task identification ID, each of the first near-source cleaning requests corresponds to a cleaning task;

[0107] The ID of the cleaning request initiator, each cleaning request initiator of the first near-source cleaning request corresponds to a cleaning node;

[0108] The IP address of the source of the distributed denial of service attack.

[0109] The cleaning task identification ID is used to distinguish different cleaning tasks. The attack source IP address of the distributed denial of service attack includes the IP address or address group corresponding to the cleaning responder.

[0110] Optionally, the first near-source cleaning response includes:

[0111] Cleaning task identification ID, cleaning responder ID, cleaning response flow, cleaning start time and cleaning end time.

[0112] The cleaning responder ID is used to determine the identity of the cleaning responder, the cleaning start time indicates the start time of the cleaning responder to perform traffic cleaning, and the cleaning end time indicates the end time of the cleaning responder to perform traffic cleaning.

[0113] Optionally, reading the second near-source cleaning response from the alliance chain includes:

[0114] The first near-source cleaning response is read, and the first near-source cleaning response is first decrypted to obtain the cleaning response flow.

[0115] The information data hiding technology in the smart contract hides the cleaning traffic data of each domain, making the real cleaning traffic data between domains invisible to each other. Only the smart contract program can obtain the original real cleaning traffic data through the hiding technology to ensure the authenticity and reliability of the traffic data and avoid forging the cleaning confirmation data based on the cleaning response traffic data.

[0116] In one embodiment of the present invention, only mutually trusted domains within the alliance chain can encrypt information written into the alliance chain and decrypt information read from the alliance chain by means of public and private keys.

[0117] The traffic cleaning method for distributed denial of service attacks DDoS in the embodiment of the present invention writes the inter-domain near-source cleaning process links and information into the alliance chain using the consensus mechanism of the alliance chain. This solves the problem that linkage cleaning in the prior art requires the addition of new mitigation equipment or cloud dispatching centers, effectively reducing cost expenditures. It can also solve the problems of difficulty in near-source cleaning intercommunication and low linkage efficiency caused by inter-domain device ownership and device differentiation, effectively improve the efficiency of cross-domain near-source cleaning, and realize cross-domain near-source protection cleaning for the attack source IP.

[0118] Optionally, the performing traffic cleaning for the distributed denial of service attack, and the traffic cleaning amount is greater than a preset value, includes:

[0119] Calculating a cleaning flow deviation according to the cleaning response flow and the actual cleaning flow;

[0120] If the cleaning traffic deviation is less than the first threshold, traffic cleaning is performed for the distributed denial of service attack, and the traffic cleaning amount is greater than a preset value;

[0121] The cleaning flow deviation is calculated by the following formula:

[0122]

[0123] Optionally, the cleaning flow deviation is the ratio of the difference between the actual cleaning flow and the cleaning response flow to the actual cleaning flow within a near-source clear response-confirmation cycle.

[0124] Whether the distributed denial of service attack has been mitigated is judged based on the cleaning traffic deviation, which provides a judgment standard for the calculation of the settlement cleaning traffic.

[0125] Optionally, writing the near-source cleaning confirmation result into the alliance chain includes:

[0126] The near-source cleaning confirmation result is first encrypted, and the encrypted near-source cleaning confirmation result is written into the alliance chain.

[0127] The information data hiding technology in the smart contract hides the cleaning traffic data of each domain, making the real cleaning traffic data between domains invisible to each other. Only the smart contract program can obtain the original real cleaning traffic data through the hiding technology to ensure the authenticity and reliability of the traffic data and avoid forging the cleaning confirmation data based on the cleaning response traffic data.

[0128] In one embodiment of the present invention, only mutually trusted domains within the alliance chain can encrypt information written into the alliance chain and decrypt information read from the alliance chain by means of public and private keys.

[0129] The traffic cleaning method for distributed denial of service attacks DDoS in the embodiment of the present invention writes the inter-domain near-source cleaning process links and information into the alliance chain using the consensus mechanism of the alliance chain. This solves the problem that linkage cleaning in the prior art requires the addition of new mitigation equipment or cloud dispatching centers, effectively reducing cost expenditures. It can also solve the problems of difficulty in near-source cleaning intercommunication and low linkage efficiency caused by inter-domain device ownership and device differentiation, effectively improve the efficiency of cross-domain near-source cleaning, and realize cross-domain near-source protection cleaning for the attack source IP.

[0130] Optionally, the near-source cleaning confirmation result includes: a cleaning task identification ID, a cleaning request initiator ID, a cleaning responder ID, and an actual cleaning flow rate;

[0131] Wherein, each cleaning responder of the near-source cleaning response corresponds to a cleaning node.

[0132] The traffic cleaning method for distributed denial of service attacks DDoS in the embodiment of the present invention writes the inter-domain near-source cleaning process links and information into the alliance chain using the consensus mechanism of the alliance chain. This solves the problem that linkage cleaning in the prior art requires the addition of new mitigation equipment or cloud dispatching centers, effectively reducing cost expenditures. It can also solve the problems of difficulty in near-source cleaning intercommunication and low linkage efficiency caused by inter-domain device ownership and device differentiation, effectively improve the efficiency of cross-domain near-source cleaning, and realize cross-domain near-source protection cleaning for the attack source IP.

[0133] like Figure 2 As shown, the embodiment of the present invention also provides a traffic cleaning method for a distributed denial of service attack DDoS, which is applied to the second detection area and includes:

[0134] Step 201, reading a first near-source cleaning request from the alliance chain, and determining, according to the first near-source cleaning request, whether the attack source of the first distributed denial of service attack corresponding to the first near-source cleaning request belongs to the second detection area;

[0135] Step 202, after determining that the attack source of the first distributed denial of service attack belongs to the second detection area, perform near-source traffic cleaning;

[0136] Step 203: Determine a first near-source cleaning response according to the near-source traffic cleaning, and write the first near-source cleaning response into the alliance chain.

[0137] Optionally, the second detection area determines whether the attack source of the first distributed denial of service attack belongs to the second detection area according to the attack source IP address of the first distributed denial of service attack in the first near-source cleaning request.

[0138] According to the near-source traffic cleaning, the cleaning response traffic is determined, and the first near-source cleaning response including the cleaning response traffic is written into the alliance chain.

[0139] The traffic cleaning method for distributed denial of service attacks DDoS in the embodiment of the present invention writes the inter-domain near-source cleaning process links and information into the alliance chain using the consensus mechanism of the alliance chain. This solves the problem that linkage cleaning in the prior art requires the addition of new mitigation equipment or cloud dispatching centers, effectively reducing cost expenditures. It can also solve the problems of difficulty in near-source cleaning intercommunication and low linkage efficiency caused by inter-domain device ownership and device differentiation, effectively improve the efficiency of cross-domain near-source cleaning, and realize cross-domain near-source protection cleaning for the attack source IP.

[0140] Optionally, writing the first near-source cleaning response into the alliance chain includes:

[0141] The first near-source cleaning response is second encrypted, and the encrypted first near-source cleaning response is written into the alliance chain.

[0142] The information data hiding technology in the smart contract hides the cleaning traffic data of each domain, making the real cleaning traffic data between domains invisible to each other. Only the smart contract program can obtain the original real cleaning traffic data through the hiding technology to ensure the authenticity and reliability of the traffic data and avoid forging the cleaning confirmation data based on the cleaning response traffic data.

[0143] In one embodiment of the present invention, only mutually trusted domains within the alliance chain can encrypt information written into the alliance chain and decrypt information read from the alliance chain by means of public and private keys.

[0144] The traffic cleaning method for distributed denial of service attacks DDoS in the embodiment of the present invention writes the inter-domain near-source cleaning process links and information into the alliance chain using the consensus mechanism of the alliance chain. This solves the problem that linkage cleaning in the prior art requires the addition of new mitigation equipment or cloud dispatching centers, effectively reducing cost expenditures. It can also solve the problems of difficulty in near-source cleaning intercommunication and low linkage efficiency caused by inter-domain device ownership and device differentiation, effectively improve the efficiency of cross-domain near-source cleaning, and realize cross-domain near-source protection cleaning for the attack source IP.

[0145] like Figure 3 As shown, an embodiment of the present invention further provides a traffic cleaning method for a distributed denial of service attack DDoS, which is applied to a consortium chain and includes:

[0146] Step 301, obtaining the near-source cleaning confirmation result written in the first detection area and the first near-source cleaning response written in the second detection area;

[0147] The near-source cleaning confirmation result is obtained by comparing the cleaning response flow with the current actual cleaning flow of the first detection area; the cleaning response flow is carried in the first near-source cleaning response read from the alliance chain when a distributed denial of service attack occurs and the attack source does not belong to the first detection area;

[0148] The first near-source cleaning response is written into the alliance chain after the second detection area cleans the near-source traffic of the distributed denial of service attack belonging to the attack source of this area.

[0149] The traffic cleaning method for distributed denial of service attacks DDoS in the embodiment of the present invention writes the inter-domain near-source cleaning process links and information into the alliance chain using the consensus mechanism of the alliance chain. This solves the problem that linkage cleaning in the prior art requires the addition of new mitigation equipment or cloud dispatching centers, effectively reducing cost expenditures. It can also solve the problems of difficulty in near-source cleaning intercommunication and low linkage efficiency caused by inter-domain device ownership and device differentiation, effectively improve the efficiency of cross-domain near-source cleaning, and realize cross-domain near-source protection cleaning for the attack source IP.

[0150] Optionally, obtaining the near-source cleaning confirmation result written in the first detection area and the first near-source cleaning response written in the second detection area includes:

[0151] Acquire the near-source cleaning confirmation result, and perform a first decryption on the near-source cleaning confirmation result to obtain an actual cleaning flow rate;

[0152] The first near-source cleaning response is obtained, and a second decryption is performed on the first near-source cleaning response to obtain cleaning response traffic.

[0153] The information data hiding technology in the smart contract hides the cleaning traffic data of each domain, making the real cleaning traffic data between domains invisible to each other. Only the smart contract program can obtain the original real cleaning traffic data through the hiding technology to ensure the authenticity and reliability of the traffic data and avoid forging the cleaning confirmation data based on the cleaning response traffic data.

[0154] In one embodiment of the present invention, the information written into the alliance chain can be decrypted by means of public and private keys to obtain the actual cleaning flow and cleaning response flow, which is used to ensure the authenticity and reliability of the flow data and avoid forging cleaning confirmation data based on the cleaning response flow data.

[0155] Optionally, the method further comprises:

[0156] Calculating the cleaning flow deviation at preset intervals according to the near-source cleaning confirmation result and the first near-source cleaning response;

[0157] A settlement cleaning flow between the first detection area and the second detection area is determined according to the cleaning flow deviation.

[0158] According to the cleaning traffic deviation, the amount of traffic cleaning performed by the second detection area against the distributed denial of service attack is confirmed, thereby ensuring the accuracy of the traffic settlement calculation between the first detection area and the second detection area.

[0159] Optionally, determining the settlement cleaning flow between the first detection area and the second detection area according to the cleaning flow deviation includes:

[0160] When the cleaning flow deviation is less than the first threshold, the settlement cleaning flow is the cleaning response flow;

[0161] When the cleaning flow deviation is greater than or equal to the first threshold and less than or equal to the second threshold, the settlement cleaning flow is the average value of the cleaning response flow and the actual cleaning flow;

[0162] When the cleaning flow deviation is greater than a second threshold, the settled cleaning flow is the actual cleaning flow.

[0163] The cleaning flow deviation is less than the first threshold, that is, the cleaning responder cleans almost all the attack flow; the cleaning flow deviation is greater than or equal to the first threshold and less than or equal to the second threshold, that is, the cleaning responder cleans most of the attack flow; the cleaning flow deviation is greater than the second threshold, that is, the cleaning responder cleans a very small part of the attack flow.

[0164] like Figure 4 As shown, the calculation process of the settlement cleaning flow is as follows: the alliance chain decrypts the near-source cleaning confirmation result and the near-source cleaning response through data hiding at preset intervals to obtain the cleaning response flow and the cleaning confirmation flow. The flow deviation is calculated based on the cleaning response flow and the cleaning confirmation flow, and the cross-domain flow cleaning calculation is performed to obtain the settlement cleaning flow.

[0165] For example, in the form of a smart contract, based on the cross-domain traffic cleaning calculation method, traffic calculations between alliance cleaning nodes are performed regularly every month.

[0166] The information data hiding technology in the smart contract hides the cleaned traffic data of each domain, making the real cleaned traffic data between domains invisible to each other. Only the smart contract program can obtain the original real cleaned traffic data through the hiding technology. It is used to ensure the authenticity and reliability of the traffic data and avoid forging the cleaned confirmation traffic data based on the cleaned response traffic data.

[0167] like Figure 5 As shown, the logical process of the traffic cleaning method for distributed denial of service attack DDoS in the embodiment of the present invention is as follows:

[0168] After the first detection area detects a distributed denial of service attack, it first traces the attack source of the distributed denial of service attack; after determining that it does not belong to the first detection area, it issues a near-source cleaning request and writes it into the alliance chain; the second detection area or the third detection area reads the near-source cleaning request; after decrypting the near-source cleaning request, it determines whether the attack source of the attack belongs to the second detection area or the third detection area; after determining that the attack source of the attack belongs to the second detection area, it performs traffic cleaning on the attack; after the traffic cleaning is completed, a near-source cleaning response is sent; the near-source cleaning response is first encrypted and then written to the alliance chain; the first detection area reads the near-source cleaning response, decrypts the near-source cleaning response, and obtains the cleaning response traffic; the cleaning response traffic is compared with the current actual cleaning traffic of the first detection area to obtain the near-source cleaning result.

[0169] The first detection area performs a second encryption on the near-source cleaning result and writes it into the alliance chain; the alliance chain entity obtains the near-source cleaning confirmation result, and performs a first decryption on the near-source cleaning confirmation result to obtain the actual cleaning flow; obtains the near-source cleaning response, and performs a second decryption on the near-source cleaning response to obtain the cleaning response flow; according to the near-source cleaning confirmation result and the near-source cleaning response, the cleaning flow deviation is calculated at preset time intervals; according to the cleaning flow deviation, the settlement cleaning flow between the first detection area and the second detection area is determined.

[0170] like Figure 6 As shown, an embodiment of the present invention further provides a traffic cleaning device 600 for a distributed denial of service attack DDoS, comprising:

[0171] The first writing module 601 is used to write a first near-source cleaning request to the alliance chain when a distributed denial of service attack is detected and if the attack source of the distributed denial of service attack does not belong to the first detection area;

[0172] A first reading module 602 is used to read a first near-source cleaning response from the alliance chain, where the first near-source cleaning response includes cleaning response traffic;

[0173] A comparison module 603 is used to compare the cleaning response flow rate with the current actual cleaning flow rate of the first detection area to obtain a near-source cleaning result;

[0174] Wherein, after the second detection area performs traffic cleaning for the distributed denial of service attack, the first near-source cleaning response is written to the alliance chain;

[0175] The attack source of the distributed denial of service attack belongs to the second detection area.

[0176] The traffic cleaning device for distributed denial of service attack DDoS of the embodiment of the present invention writes the inter-domain near-source cleaning process links and information into the alliance chain using the consensus mechanism of the alliance chain. It solves the problem that linkage cleaning in the prior art requires the addition of mitigation equipment or cloud dispatch center, and effectively reduces cost expenditure. It can also solve the problem of difficulty in near-source cleaning intercommunication and low linkage efficiency caused by the ownership and differentiation of inter-domain equipment, effectively improve the efficiency of cross-domain near-source cleaning, and realize cross-domain near-source protection cleaning for the attack source IP.

[0177] like Figure 7 As shown, an embodiment of the present invention further provides a traffic cleaning device 700 for a distributed denial of service attack DDoS, comprising:

[0178] The second reading module 701 is used to read the first near-source cleaning request from the alliance chain, and determine whether the attack source of the first distributed denial of service attack corresponding to the first near-source cleaning request belongs to the second detection area according to the first near-source cleaning request;

[0179] A cleaning module 702, configured to clean near-source traffic after determining that the attack source of the first distributed denial of service attack belongs to the second detection area;

[0180] The second writing module 703 is used to determine a first near-source cleaning response according to the near-source traffic cleaning, and write the first near-source cleaning response into the alliance chain.

[0181] The traffic cleaning device for distributed denial of service attack DDoS of the embodiment of the present invention writes the inter-domain near-source cleaning process links and information into the alliance chain using the consensus mechanism of the alliance chain. It solves the problem that linkage cleaning in the prior art requires the addition of mitigation equipment or cloud dispatch center, and effectively reduces cost expenditure. It can also solve the problem of difficulty in near-source cleaning intercommunication and low linkage efficiency caused by the ownership and differentiation of inter-domain equipment, effectively improve the efficiency of cross-domain near-source cleaning, and realize cross-domain near-source protection cleaning for the attack source IP.

[0182] like Figure 8 As shown, an embodiment of the present invention further provides a traffic cleaning device 800 for a distributed denial of service attack DDoS, comprising:

[0183] An acquisition module 801 is used to acquire a near-source cleaning confirmation result written in the first detection area and a first near-source cleaning response written in the second detection area;

[0184] The near-source cleaning confirmation result is obtained by comparing the cleaning response flow with the current actual cleaning flow of the first detection area; the cleaning response flow is carried in the first near-source cleaning response read from the alliance chain when a distributed denial of service attack occurs and the attack source does not belong to the first detection area;

[0185] The first near-source cleaning response is written into the alliance chain after the second detection area cleans the near-source traffic of the distributed denial of service attack belonging to the attack source of this area.

[0186] The traffic cleaning device for distributed denial of service attack DDoS of the embodiment of the present invention writes the inter-domain near-source cleaning process links and information into the alliance chain using the consensus mechanism of the alliance chain. It solves the problem that linkage cleaning in the prior art requires the addition of mitigation equipment or cloud dispatch center, and effectively reduces cost expenditure. It can also solve the problem of difficulty in near-source cleaning intercommunication and low linkage efficiency caused by the ownership and differentiation of inter-domain equipment, effectively improve the efficiency of cross-domain near-source cleaning, and realize cross-domain near-source protection cleaning for the attack source IP.

[0187] like Fig. 9 As shown, an embodiment of the present invention further provides a detection device 900, which is applied to a first detection area and includes: a first transceiver 910 and a first processor 920;

[0188] The first transceiver 910 is used to write a first near-source cleaning request to the alliance chain when a distributed denial of service attack is detected and if the attack source of the distributed denial of service attack does not belong to the first detection area;

[0189] Reading a first near-source cleaning response from the alliance chain, where the first near-source cleaning response includes cleaning response traffic;

[0190] The first processor 920 is used to compare the cleaning response flow rate with the current actual cleaning flow rate of the first detection area to obtain a near-source cleaning result;

[0191] Wherein, after the second detection area performs traffic cleaning for the distributed denial of service attack, the first near-source cleaning response is written to the alliance chain;

[0192] The attack source of the distributed denial of service attack belongs to the second detection area.

[0193] like Fig.10 As shown, an embodiment of the present invention further provides a detection device 1000, which is applied to a second detection area and includes: a second transceiver 1010 and a second processor 1020;

[0194] The second transceiver 1010 is used to read the first near-source cleaning request from the alliance chain, and determine whether the attack source of the first distributed denial of service attack corresponding to the first near-source cleaning request belongs to the second detection area according to the first near-source cleaning request;

[0195] The second processor 1020 is configured to perform near-source traffic cleaning after determining that the attack source of the first distributed denial of service attack belongs to the second detection area;

[0196] The second transceiver 1010 is further configured to determine a first near-source cleaning response according to the near-source traffic cleaning, and write the first near-source cleaning response into the alliance chain.

[0197] like Fig.11 As shown, an embodiment of the present invention further provides a consortium chain entity 1100, including: a third transceiver 1110;

[0198] The third transceiver 1110 is used to obtain the first near-source cleaning confirmation result written in the first detection area and the near-source cleaning response written in the second detection area;

[0199] The near-source cleaning confirmation result is obtained by comparing the cleaning response flow with the current actual cleaning flow of the first detection area; the cleaning response flow is carried in the first near-source cleaning response read from the alliance chain when a distributed denial of service attack occurs and the attack source does not belong to the first detection area;

[0200] The first near-source cleaning response is written into the alliance chain after the second detection area cleans the near-source traffic of the distributed denial of service attack belonging to the attack source of this area.

[0201] A cleaning terminal according to an embodiment of the present invention, Fig.12 As shown, it includes a transceiver 1210, a processor 1200, a memory 1220, and a program or instruction stored in the memory 1220 and executable on the processor 1200; when the processor 1200 executes the program or instruction, the above-mentioned traffic cleaning method applied to distributed denial of service attack DDoS is implemented.

[0202] The transceiver 1210 is used to receive and send data under the control of the processor 1200 .

[0203] Among them, Fig.12In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically one or more processors represented by processor 1200 and various circuits of memory represented by memory 1220 are linked together. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 1210 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 1200 is responsible for managing the bus architecture and general processing, and the memory 1220 may store data used by the processor 1200 when performing operations.

[0204] A readable storage medium according to an embodiment of the present invention stores a program or instruction thereon. When the program or instruction is executed by a processor, the steps in the traffic cleaning method for distributed denial of service attack DDoS as described above are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0205] The processor is a processor in the traffic cleaning device for distributed denial of service attack DDoS described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0206] It should be further explained that the terminals described in this specification include but are not limited to smart phones, tablet computers, etc., and many of the functional components described are called modules in order to more particularly emphasize the independence of their implementation methods.

[0207] In the embodiment of the present invention, module can be implemented with software so that it can be executed by various types of processors. For example, an executable code module of an identification can include one or more physical or logical blocks of computer instructions, for example, it can be constructed as an object, process or function. Nevertheless, the executable code of the identified module does not need to be physically located together, but can include different instructions stored in different positions, and when these instructions are logically combined together, it constitutes a module and realizes the specified purpose of the module.

[0208] In fact, executable code module can be a single instruction or many instructions, and can even be distributed on a plurality of different code segments, distributed among different programs, and distributed across a plurality of memory devices. Similarly, operating data can be identified in the module, and can be implemented and organized in the data structure of any appropriate type according to any appropriate form. The operating data can be collected as a single data set, or can be distributed in different locations (including on different storage devices), and can only be present on a system or network as an electronic signal at least in part.

[0209] When a module can be implemented by software, considering the level of existing hardware technology, a person skilled in the art can build a corresponding hardware circuit to implement the corresponding function of the module that can be implemented by software without considering the cost. The hardware circuit includes a conventional very large scale integration (VLSI) circuit or gate array and existing semiconductors such as logic chips, transistors, or other discrete components. The module can also be implemented by a programmable hardware device, such as a field programmable gate array, a programmable array logic, a programmable logic device, etc.

[0210] The above exemplary embodiments are described with reference to the accompanying drawings, and many different forms and embodiments are feasible without departing from the spirit and teachings of the present invention. Therefore, the present invention should not be constructed as a limitation of the exemplary embodiments proposed herein. More specifically, these exemplary embodiments are provided so that the present invention will be perfect and complete, and the scope of the present invention will be conveyed to those who are familiar with the technology. In these figures, the component sizes and relative sizes may be exaggerated for clarity. The terms used here are only based on the purpose of describing specific exemplary embodiments and are not intended to be limiting. As used herein, unless the text clearly indicates otherwise, the singular forms "one", "an" and "the" are intended to include these multiple forms. It will be further understood that the terms "including" and / or "comprising" when used in this specification indicate the presence of the features, integers, steps, operations, components and / or components, but do not exclude the presence or increase of one or more other features, integers, steps, operations, components, components and / or their groups. Unless otherwise indicated, when stated, a range of values ​​includes the upper and lower limits of that range and any subranges therebetween.

[0211] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A traffic cleaning method for distributed denial of service attack DDoS, applied to a first detection area, characterized in that: include: When a distributed denial of service attack is detected, if the attack source of the distributed denial of service attack does not belong to the first detection area, a first near-source cleaning request is written to the alliance chain; Reading a first near-source cleaning response from the alliance chain, where the first near-source cleaning response includes cleaning response traffic; Compare the cleaning response flow rate with the current actual cleaning flow rate of the first detection area to obtain a near-source cleaning result; Wherein, after the second detection area performs traffic cleaning for the distributed denial of service attack, the first near-source cleaning response is written to the alliance chain; The attack source of the distributed denial of service attack belongs to the second detection area.

2. The method for cleaning traffic of distributed denial of service attack DDoS according to claim 1, characterized in that: The step of comparing the cleaning response flow rate with the current actual cleaning flow rate of the first detection area to obtain a near-source cleaning result includes: When traffic cleaning is performed for the distributed denial of service attack and the traffic cleaning amount is greater than a preset value, the near-source cleaning result is obtained as a near-source cleaning confirmation result.

3. The traffic cleaning method for distributed denial of service attack DDoS according to claim 1 is characterized in that: The method further comprises: Reading a second near-source cleaning request from the alliance chain, and determining, according to the second near-source cleaning request, whether an attack source of a second distributed denial-of-service attack corresponding to the second near-source cleaning request belongs to the first detection area; After determining that the attack source of the second distributed denial of service attack belongs to the first detection area, performing near-source traffic cleaning; According to the near-source traffic cleaning, a second near-source cleaning response is determined, and the second near-source cleaning response is written into the alliance chain.

4. The method for cleaning traffic of distributed denial of service attack DDoS according to claim 1, characterized in that: The first near-source cleaning request includes: A cleaning task identification ID, each of the first near-source cleaning requests corresponds to a cleaning task; a cleaning request initiator ID, where each cleaning request initiator of the first near-source cleaning request corresponds to a cleaning node; The IP address of the source of the distributed denial of service attack.

5. The traffic cleaning method for distributed denial of service attack DDoS according to claim 1 is characterized in that: The reading the first near-source cleaning response from the alliance chain includes: The first near-source cleaning response is read, and the first near-source cleaning response is first decrypted to obtain the cleaning response flow.

6. The method for cleaning traffic of distributed denial of service attack DDoS according to claim 2, characterized in that: The traffic cleaning is performed for the distributed denial of service attack, and the traffic cleaning amount is greater than a preset value, including: Calculating a cleaning flow deviation according to the cleaning response flow and the actual cleaning flow; If the cleaning traffic deviation is less than the first threshold, traffic cleaning is performed for the distributed denial of service attack, and the traffic cleaning amount is greater than a preset value; The cleaning flow deviation is calculated by the following formula:

7. The method for cleaning traffic of distributed denial of service attack DDoS according to claim 2, characterized in that: The method further comprises: The near-source cleaning confirmation result is first encrypted, and the encrypted near-source cleaning confirmation result is written into the alliance chain.

8. A traffic cleaning method for distributed denial of service attack DDoS, applied to alliance chain, characterized in that: include: Obtaining the near-source cleaning confirmation result written in the first detection area and the first near-source cleaning response written in the second detection area; The near-source cleaning confirmation result is obtained by comparing the cleaning response flow with the current actual cleaning flow of the first detection area; the cleaning response flow is carried in the first near-source cleaning response read from the alliance chain when a distributed denial of service attack occurs and the attack source does not belong to the first detection area; The first near-source cleaning response is written into the alliance chain after the second detection area cleans the near-source traffic of the distributed denial of service attack belonging to the attack source of this area.

9. The method for cleaning traffic of distributed denial of service attack DDoS according to claim 8, characterized in that: The obtaining of the near-source cleaning confirmation result written in the first detection area and the first near-source cleaning response written in the second detection area includes: Acquire the near-source cleaning confirmation result, and perform a first decryption on the near-source cleaning confirmation result to obtain an actual cleaning flow rate; The first near-source cleaning response is obtained, and a second decryption is performed on the first near-source cleaning response to obtain cleaning response traffic.

10. The method for cleaning traffic of distributed denial of service attack DDoS according to claim 8, characterized in that: The method further comprises: Calculating the cleaning flow deviation at preset intervals according to the near-source cleaning confirmation result and the first near-source cleaning response; A settlement cleaning flow between the first detection area and the second detection area is determined according to the cleaning flow deviation.

11. The method for cleaning traffic of distributed denial of service attack DDoS according to claim 10, characterized in that: The step of determining the settlement cleaning flow rate between the first detection area and the second detection area according to the cleaning flow rate deviation includes: When the cleaning flow deviation is less than the first threshold, the settlement cleaning flow is the cleaning response flow; When the cleaning flow deviation is greater than or equal to the first threshold and less than or equal to the second threshold, the settlement cleaning flow is the average value of the cleaning response flow and the actual cleaning flow; When the cleaning flow deviation is greater than a second threshold, the settled cleaning flow is the actual cleaning flow.

12. A traffic cleaning device for distributed denial of service attacks DDoS, characterized in that: include: A first writing module is used to write a first near-source cleaning request to the alliance chain when a distributed denial of service attack is detected and if the attack source of the distributed denial of service attack does not belong to the first detection area; A first reading module is used to read a first near-source cleaning response from the alliance chain, where the first near-source cleaning response includes a cleaning response flow; A comparison module, configured to compare the cleaning response flow rate with the current actual cleaning flow rate of the first detection area to obtain a near-source cleaning result; Wherein, after the second detection area performs traffic cleaning for the distributed denial of service attack, the first near-source cleaning response is written to the alliance chain; The attack source of the distributed denial of service attack belongs to the second detection area.

13. A detection device, applied to a first detection area, characterized in that: include: a first transceiver and a first processor; The first transceiver is used for, when a distributed denial of service attack is detected, if the attack source of the distributed denial of service attack does not belong to the first detection area, writing a first near-source cleaning request to the alliance chain; Reading a first near-source cleaning response from the alliance chain, where the first near-source cleaning response includes cleaning response traffic; The first processor is used to compare the cleaning response flow rate with the current actual cleaning flow rate of the first detection area to obtain a near-source cleaning result; Wherein, after the second detection area performs traffic cleaning for the distributed denial of service attack, the first near-source cleaning response is written to the alliance chain; The attack source of the distributed denial of service attack belongs to the second detection area.

14. A consortium chain entity, characterized in that: include: A third transceiver; The third transceiver is used to obtain the near-source cleaning confirmation result written in the first detection area and the first near-source cleaning response written in the second detection area; The near-source cleaning confirmation result is obtained by comparing the cleaning response flow with the current actual cleaning flow of the first detection area; the cleaning response flow is carried in the first near-source cleaning response read from the alliance chain when a distributed denial of service attack occurs and the attack source does not belong to the first detection area; The first near-source cleaning response is written into the alliance chain after the second detection area cleans the near-source traffic of the distributed denial of service attack belonging to the attack source of this area.

15. A cleaning terminal, comprising: A transceiver, a processor, a memory, and a program or instruction stored in the memory and executable on the processor; characterized in that when the processor executes the program or instruction, the method for cleaning the traffic of a distributed denial of service attack DDoS as described in any one of claims 1 to 7 is implemented, or the method for cleaning the traffic of a distributed denial of service attack DDoS as described in any one of claims 8 to 11 is implemented.

16. A readable storage medium having a program or instruction stored thereon, characterized in that: When the program or instruction is executed by the processor, it implements the traffic cleaning method for the distributed denial of service attack DDoS as described in any one of claims 1-7, or implements the traffic cleaning method for the distributed denial of service attack DDoS as described in any one of claims 8-11.

Images