A processing system and method for defending against ntp amplification reflection attacks

Abstract

The application relates to the technical field of Internet security, in particular to a processing system and method based on NTP amplification reflection attack defense. The processing system based on NTP amplification reflection attack defense comprises a network card provided with a matching forwarding core and a receiving queue of a feature thread; at least one forwarding core is used to acquire general traffic data in the receiving queue and perform processing; the feature thread is used to acquire NTP traffic data in the receiving queue and perform processing; an NTP session table is used to record the number of legal NTP requests; an NTP local session lookup table is used to record the number of attack NTP requests; and the operation permissions of the NTP session table and the NTP local session lookup table are open permissions for the feature thread.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet security, and in particular to a processing system and method for defense against NTP amplification reflection attacks. BACKGROUND

[0002] For information security, the robustness of the forwarding system of the firewall becomes the most important in the information security system. This is because when encountering attacks, many firewalls not only cannot defend attacks, but also affect the forwarding of normal traffic. Especially with the development of technology, more and more firewalls use multi-core processing mechanism, and the forwarding processing performance of the firewall is not only related to the processing flow and algorithm complexity, but also closely related to the competition resources of multi-core concurrent design. NTP is one of the most widely known reflection amplification denial of service attacks (Dos) and DDos (Distributed Denial of Service Attack). Its principle is to use the design flaws of the NTP protocol in the NTP server. By forging a fake MONLIST request to different NTP servers, the network time protocol NTP server can turn a small MONLIST request into a large response (theoretically can be amplified by more than 100 times), so that these responses become malicious attacks directly to the victim's computer, and then form a reflection amplification attack. Because the NTP protocol is also a UDP packet, it is connectionless, so the attacker can modify the source IP address of the request packet when sending the request packet, and when the source IP is modified as the IP of the victim, the response packet returned by the server will be returned to the IP of the victim, thus forming a reflection attack. And the NTP server will reply a large number of responses to the target attacker, and it does not verify whether the request is credible, which makes the NTP server become a good reflection source of DDoS amplification attack. For the attacked party (i.e. the victim), they receive NTP monlist requests from valid server legitimate traffic, and after amplification, the bandwidth occupied by these traffic is also larger, and the reflection attack traffic can slowly grow from tens of megabytes to tens of G, even hundreds of G. How to defend against NTP attacks, record logs, and not affect normal packet processing, and how to handle massive attacks are all design priorities. Because the processing of massive attacks itself needs to occupy more processing time, and the forwarding core also needs to process normal traffic, the CPU time slice is fixed, and if more attacks are given, it may affect normal traffic. At the same time, in a multi-core system, how to make concurrent performance not affected by competition resources is also a design difficulty. If the attack defense process is not designed well in multi-core concurrency, the lock waiting between multiple cores may occur due to competition resources, which may affect normal traffic. For example, NTP amplification attacks usually use hundreds, thousands, even tens of thousands, and hundreds of thousands of NTP servers as reflection sources. For firewalls built by multi-core systems, the IP address related information of each NTP server must be counted during the attack defense process, and each CPU of the multi-core system may receive packets with different IP addresses. Naturally, it will involve competition resources, and the massive data attack statistics function may affect multi-core concurrency, and then affect the processing of normal traffic.In the common multi-core firewall system, the NTP traffic is processed in the same way as the normal traffic. After judging that the packet is NTP traffic, each forwarding core needs to lock and query the global session lookup table to confirm whether it is NTP amplification attack. If it is an attack, it needs to lock and write the NTP statistics table. The whole process needs to be locked and processed in the multi-core system. When a large number of attacks come, since multiple forwarding cores simultaneously operate the concurrent competition resources, the influence on the normal traffic is very large. SUMMARY

[0003] In view of the deficiencies in the prior art, the present application provides a processing system and method for NTP amplification attack defense, in particular:

[0004] In one aspect, the present application provides a processing system for NTP amplification attack defense, wherein the network card is provided with a receiving queue of a matching forwarding core and a feature thread;

[0005] At least one forwarding core is used to obtain and process general traffic data in the receiving queue;

[0006] A feature thread is used to obtain and process NTP traffic data in the receiving queue;

[0007] An NTP session table is used to record the number of legal NTP requests;

[0008] An NTP local session lookup table is used to record the number of attack NTP requests;

[0009] The operation permissions of the NTP session table and the NTP local session lookup table are open permissions for the feature thread.

[0010] In another aspect, the present application further provides a processing method for NTP amplification attack defense, which is applied to a forwarding system implemented based on a DKPK platform, and comprises the following steps:

[0011] In the initialized state, the feature thread reads the NTP packet in the N+1 queue of each network card;

[0012] It is judged whether the current NTP packet is a response packet,

[0013] In the state that the current NTP packet is a non-response packet, it is determined that the current NTP packet is a legal NTP request,

[0014] In the state that the current NTP packet is a response packet, the keyword in the current NTP packet is read;

[0015] In the state that the keyword in the NTP packet is a first feature value, it is determined that the current packet is an attack packet, and the current packet is discarded;

[0016] In the case that the keyword in the NTP packet is the second characteristic value, the NTP local session table is queried, and the NTP packet is processed according to the query result.

[0017] Preferably, the processing method for defending against the NTP amplification reflection attack, in the case that the keyword in the NTP packet is the second characteristic value, the NTP local session table is queried, and the NTP packet is processed according to the query result specifically includes:

[0018] In the case that the stored information matching the current NTP packet is queried, the current packet is determined to be a legal packet,

[0019] In the case that the stored information matching the current NTP packet is not queried, the current packet is determined to be an attack packet, and the attack packet is discarded.

[0020] Preferably, the processing method for defending against the NTP amplification reflection attack further includes:

[0021] In the case that the current NTP packet is legal, the number of current legal NTP requests is updated in the NTP local session table, and the current NTP packet is forwarded;

[0022] In the case that the current NTP packet is an attack packet, the number of attack packets in the NTP local statistical table is updated.

[0023] Preferably, the processing method for defending against the NTP amplification reflection attack, in the case that the current NTP packet is an attack packet, the number of attack packets in the NTP local statistical table is updated specifically includes:

[0024] In the case that the current NTP packet is an attack packet, the source address information and the target address information of the current NTP packet are read, and the source address information and the target address information are updated to the NTP local statistical table, the NTP local statistical table at least including the number of attack packets.

[0025] Preferably, the processing method for defending against the NTP amplification reflection attack, before the initialization is completed, the predetermined thread reads the NTP packet in the N+1 queue of each network card further includes: performing initialization processing on the current forwarding system, and the initialization processing specifically includes:

[0026] In the case that the current forwarding system includes N forwarding cores, each network card is configured as N+1 network card receiving queues, and a sequential full connection mapping relationship between the forwarding cores and the network cards is established.

[0027] The NTP rule filter is configured to each network card participating in forwarding.

[0028] In another aspect, the application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable in the processor, wherein the processor implements any one of the processing methods for defending against NTP amplification reflection attacks when executing the computer program.

[0029] In another aspect, the application provides a computer program product comprising computer readable code or a readable storage medium carrying computer readable code, wherein the computer readable code, when executed in a processor of an electronic device, causes the processor in the electronic device to implement any one of the processing methods for defending against NTP amplification reflection attacks.

[0030] Compared with the prior art, the application has the following advantages:

[0031] The feature thread is specially used to process all NTP traffic. The feature thread is independent of all forwarding cores, i.e., not co-located with the forwarding cores on a physical CPU. By processing NTP traffic data through an independent feature thread, on the one hand, the process of discovering NTP attacks is simplified, and the anti-NTP amplification reflection attack defense capability of the firewall is greatly improved. On the other hand, the NTP session table, the NTP local session lookup table, and the NTP local statistics table accessed and searched are set to be lock-free operations. When a large amount of attacks arrive, the lock-free operations facilitate the searching operation and greatly improve the overall performance. The entire design makes the NTP traffic blackhole, so that the entire NTP defense process does not affect the forwarding of normal traffic, and greatly reduces the impact of attack defense on system stability, and greatly improves the stability of the system. The defense part of the overall processing system for defending against NTP amplification reflection attacks adopts a completely lock-free design, and can achieve linear growth of the performance of a multi-core system in concurrency with the increase of the number of CPUs. In addition, the entire matching packet strategy is combined with the network card hardware, thereby reducing the overhead of the packet and greatly improving the overall performance. BRIEF DESCRIPTION OF DRAWINGS

[0032] Figure 1 FIG. 1 is a structural schematic diagram of a processing system for defending against NTP amplification reflection attacks according to an embodiment of the application;

[0033] Figure 2 FIG. 2 is a flowchart of a processing method for defending against NTP amplification reflection attacks according to an embodiment of the application;

[0034] Figure 3 FIG. 3 is a flowchart of a processing method for defending against NTP amplification reflection attacks according to an embodiment of the application;

[0035] Figure 4 FIG. 4 is a structural schematic diagram of an electronic device according to an embodiment of the application. DETAILED DESCRIPTION

[0036] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative effort belong to the scope of protection of the present application.

[0037] Embodiment one

[0038] A processing system based on NTP amplification reflection attack defense, wherein the network card is provided with a matching forwarding core and a receiving queue of a feature thread;

[0039] At least one forwarding core is used to obtain general traffic data in the receiving queue and process the general traffic data;

[0040] A feature thread is used to obtain NTP traffic data in the receiving queue and process the NTP traffic data;

[0041] An NTP session table is used to record a number of legitimate NTP requests;

[0042] An NTP local session lookup table is used to record a number of attack NTP requests;

[0043] The operation permissions of the NTP session table and the NTP local session lookup table are open permissions for the feature thread. The operation permissions at least include new, delete, search, and update operations.

[0044] It should be noted that the system is newly created with the NTP session table and the NTP local session lookup table in the initialization stage, and can also include an NTP local statistical table. The NTP session table, the NTP local session lookup table, and the NTP local statistical table can only be operated or accessed by the feature thread, and the NTP session table, the NTP local session lookup table, and the NTP local statistical table are set to be lock-free operations. When a mass attack comes, the search operation is the most common call, and at this time, the lock-free operation can greatly improve the overall performance.

[0045] As shown in the schematic diagram, Figure 1 As shown in the schematic diagram, the current system includes N forwarding cores, and the network card is configured with N+1 receiving queues. A mapping relationship is established between the forwarding cores and the receiving queues. For example, the first forwarding core processes data of the first receiving queue, the second forwarding core processes data of the second receiving queue, and so on, the Nth forwarding core processes data of the Nth receiving queue, and the feature thread processes data of the N+1 queue, and the data of the N+1 queue is NTP traffic data.

[0046] In the present application, the feature thread is specially used to process all NTP traffic and operations related to NTP traffic. The feature thread is independent of all forwarding cores, i.e. not co-located with the forwarding cores on a physical CPU. By processing NTP traffic data through an independent feature thread, on the one hand, the process of NTP attack discovery is simplified, and the defense capability of the firewall against NTP amplification reflection attacks is greatly improved. On the other hand, the NTP session table, the NTP local session lookup table, and the NTP local statistics table accessed and searched are set to be lock-free operations. When a large number of attacks come, the lock-free operation can greatly improve the overall performance, and the convenient lookup operation. The entire design makes the NTP traffic blackhole, so that the entire NTP defense process does not affect the forwarding of normal traffic, and also greatly reduces the impact of attack defense on system stability, and greatly improves the stability of the system. The defense part of the entire NTP amplification reflection attack defense processing system adopts a completely lock-free design, and can achieve linear growth of the performance of the multi-core system concurrency with the increase of the number of CPUs. In addition, the entire matching packet strategy is combined with the network card hardware, thereby reducing the overhead of the packet and greatly improving the overall performance.

[0047] Embodiment two

[0048] As shown in Figure 2 A processing method based on NTP amplification reflection attack defense, wherein applied to a forwarding system implemented based on a DKPK platform, comprising:

[0049] Step S110, in the state of initialization completion, the feature thread reads the NTP packet in the N+1 queue of each network card; wherein the network card supports filter_set and rss hash rules, wherein filter_set can make fixed range of quintuple be divided into specified queue id; and the rss hash rule is to calculate the hash value according to the quintuple of the network card packet, map the low several bits of the hash result to the index of RETA (redirection table) to obtain the queue id, and divide the packet into the network card queue corresponding to the id; the present application is executed by using the characteristics of NTP traffic port=123;

[0050] Step S120, judging whether the current NTP packet is a response packet;

[0051] Step S130, in the state that the current NTP packet is a non-response packet, identifying the current NTP packet as a legal NTP request;

[0052] Step S140, in the state that the current NTP packet is a response packet, reading the keyword in the current NTP packet; illustratively, the keyword in the current NTP packet can be NTP_SESS_COUNT.

[0053] Step S150, in the case that the keyword in the NTP packet is the first characteristic value, it is determined that the current packet is an attack packet, and the current packet is discarded; illustratively, the first characteristic value is 0, and in the case that the keyword in the NTP packet is 0, the NTP packet is an attack packet. In the case that the NTP packet is an attack packet, the source address information (source IP) and the destination address (target IP) information are extracted and the related information is counted into the NTP local statistical table.

[0054] Step S160, in the case that the keyword in the NTP packet is the second characteristic value, the NTP local session table is queried, in the case that the stored information matching the current NTP packet is queried, it is determined that the current packet is a legal packet, otherwise it is determined to be an attack packet and is discarded. Illustratively, the second characteristic value is a non-zero value, i.e. NTP_SESS_COUNT! = 0, then the NTP local session table is queried, if the query is successful, the packet is forwarded based on the session table, if the NTP local session table is queried unsuccessfully, the NTP packet is an attack, and the source and destination IP addresses are extracted and the related information is counted into the NTP local statistical table.

[0055] It should be noted that the Ntp traffic processed in the characteristic thread is not all attacks, and may also include normal request traffic, this part of Ntp traffic establishes a session table item and a session query table as the general traffic, in this application, the session table and the session query table of the NTP normal traffic are designed as local resources, and the locking operation is not required for the finding, new creation and updating operations. In addition, the timeout and deletion mechanism of the NTP session table is consistent with the general session, and if the NTP session table is deleted, unlike the general traffic, the operation of NTP_SESS_COUNT-- is required, and this value is used to optimize the NTP attack traffic judgment process, and when there is no legal NTP traffic, the traffic can be judged as an attack without finding the session, and the anti-attack capability is greatly improved.

[0056] As a further preferred embodiment, the above-mentioned processing method for preventing NTP amplification reflection attack, further comprising:

[0057] Step S1601, in the case that the current NTP packet is legal, the number of current legal NTP requests in the NTP local session table is updated.

[0058] Step S1602, in the case that the current NTP packet is an attack packet, the source address information and the target address information of the current NTP packet are read, and the source address information and the target address information are updated to the NTP local statistical table, and the NTP local statistical table at least includes the number of attack packets.

[0059] As a further preferred embodiment, the above-mentioned processing method for defending against NTP amplification reflection attacks, wherein, before the initialization is completed, the predetermined thread reads the NTP packet in the N+1 queue of each network card, further comprises: performing initialization processing on the current forwarding system, and the initialization processing specifically comprises:

[0060] Step S1091, in the state that the current forwarding system contains N forwarding cores, each network card is configured as N+1 network card receiving queues, and a sequential full connection mapping relationship between the forwarding core and the network card is established.

[0061] Step S1092, configuring the NTP rule filter on each network card participating in forwarding.

[0062] Illustratively, assuming that the current firewall is a forwarding system implemented based on a dpdk platform, the forwarding system has M network cards and N forwarding cores, then in the initialization process, N+1 network card receiving queues are designed for each network card, and the forwarding core and the network card are sequentially and fully connected (each CPU processes N queues of the network card), that is, the forwarding core processes the 1, 2, 3, …, N queues of the network card.

[0063] The characteristic thread specially processes the N+1 queue of the network card, which is the N+1 queue of the network card 1, the N+1 queue of the network card 2, and the N+1 queue of the network card M, a total of M queues. The processing flow of the whole characteristic thread is to traverse the M queues to receive packets, and to process the NTP flow to judge whether it is an attack and to perform targeted processing.

[0064] In the initialization stage, the NTP rule filter is configured on each network card participating in forwarding, wherein queue_id=N+1, filter is the NTP flow rule, index=1, and the specific calling function method is rte_eth_dev_add_5tuple_filter(port_id, index, &filter, queue_id).

[0065] The whole design does not affect the forwarding of normal traffic at all, and the anti-NTP attack fully considers the multi-core resource competition, and the whole processing process does not need to be locked at all, so that the whole performance can be linearly increased with the increase of the number of CPUs.

[0066] Embodiment three

[0067] The electronic device provided in the embodiment of the application can integrate the control device based on the game running environment provided in the embodiment of the application. Figure 4 is a structural schematic diagram of an electronic device provided in the embodiment of the application. As shown in Figure 4As shown, this embodiment provides an electronic device 400, which includes: one or more processors 420; and a storage device 410 for storing one or more programs. When the one or more programs are run by the one or more processors 420, they are applied to a forwarding system implemented based on the DKPK platform. The one or more processors 420 run to implement:

[0068] Once initialization is complete, the feature thread reads NTP packets from the (N+1)th queue in each network interface card.

[0069] Determine whether the current NTP packet is a response packet.

[0070] If the current NTP packet is a non-response packet, then the current NTP packet is considered a legitimate NTP request.

[0071] If the current NTP message is a response message, read the keywords in the current NTP message;

[0072] If the keyword in the NTP packet is the first characteristic value, the current packet is identified as an attack packet and the current packet is discarded.

[0073] When the keyword in the NTP packet is the second feature value, the NTP local session table is queried, and the NTP packet is processed according to the query result.

[0074] like Figure 3 As shown, the electronic device 400 includes a processor 420, a storage device 410, an input device 430, and an output device 440; the number of processors 420 in the electronic device can be one or more. Figure 3 Taking a processor 420 as an example; the processor 420, storage device 410, input device 430, and output device 440 in the electronic device can be connected via a bus or other means. Figure 3 For example, China and Israel are connected via bus 450.

[0075] Storage device 410, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and module units, such as the program instructions corresponding to the control method based on the game running environment in the embodiments of this application.

[0076] The storage 410 can include a program storage area that can store an operating system, at least one application program required for a function, and a data storage area that can store data created according to use of the terminal, etc. In addition, the storage 410 can include a high-speed random access memory, and can further include a non-volatile memory such as at least one of a magnetic disk storage device, a flash memory device, or other non-volatile solid state memory device. In some examples, the storage 410 can further include a memory disposed remotely with respect to the processor 420, and these remote memories can be connected through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0077] The input device 430 can be used to receive inputted numbers, character information, or voice information, and to generate key signal input related to user settings and function control of the electronic device. The output device 440 can include a display screen, a speaker, etc.

[0078] Embodiment Four

[0079] In some embodiments, the above-described methods can be implemented as a computer program product. The computer program product can include a computer readable storage medium having computer readable program instructions stored thereon to perform various aspects of the present disclosure. Specifically:

[0080] In the state of initialization completion, the characteristic thread reads the NTP packet in the N+1 queue in each network card;

[0081] determining whether the current NTP packet is a response packet,

[0082] in the state that the current NTP packet is a non-response packet, determining that the current NTP packet is a legal NTP request,

[0083] in the state that the current NTP packet is a response packet, reading a keyword in the current NTP packet;

[0084] in the state that the keyword in the NTP packet is a first characteristic value, determining that the current packet is an attack packet, and discarding the current packet;

[0085] in the state that the keyword in the NTP packet is a second characteristic value, querying an NTP local session table, and processing the NTP packet according to the query result.

[0086] The computer readable storage medium described above can be a tangible device that can retain and store instructions for execution by a processor. The computer readable storage medium can be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.

[0087] Computer readable program instructions described herein can be downloaded to respective computing / processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and / or a wireless network. The network can comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device.

[0088] Computer readable program instructions for carrying out operations of the present disclosure can be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including object oriented programming languages and procedural programming languages. The computer readable program instructions can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate array (FPGA), or programmable logic array (PLA) can execute the computer readable program instructions by utilizing state information of the computer readable program instructions to configure the electronic circuitry in order to act in accord with the

[0089] These computer readable program instructions can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer readable program instructions can also be stored in a computer readable storage medium that can include non- transitory computer readable storage media that can direct a computer, a programmable data processing apparatus, and / or other devices to function in a particular manner, such that the computer readable storage medium having instructions for causing an apparatus to implement one or more functions / acts specified in the flowchart and / or block diagram block or blocks can be utilized.

[0090] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0091] The computer program product of the second aspect can include a computer readable storage medium. The computer readable storage medium can include instructions. The instructions can include one or both of: instructions for causing a computer to enable a user equipment device to receive a configuration message from a base station, the configuration message comprising an indication of a set of one or more parameters for a first type of hybrid automatic repeat request process, the first type of hybrid automatic repeat request process being associated with a first type of data; and instructions for causing a computer to enable a user equipment device to receive a configuration message from a base station, the configuration message comprising an indication of a set of one or more parameters for a first type of hybrid automatic repeat request process, the first type of hybrid automatic repeat request process being associated with a first type of data.

[0092] Embodiments of the present disclosure have been described above, with the understanding that these embodiments are exemplary only, and are not restrictive, and are not limited to the disclosed embodiments. Many modifications and changes to this disclosure would be apparent to those of ordinary skill in the art. The scope of the technology disclosed is not to be limited by the specific illustrative embodiments presented above, but only by the claims that follow. The terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting.

Claims

1. A processing system for defending against NTP amplification and reflection attacks, characterized in that, The network interface card (NIC) is configured with a receive queue that matches the forwarding core and the characteristic thread; At least one forwarding core is used to retrieve and process general traffic data from the receive queue; A special thread is used to retrieve and process NTP traffic data from the receive queue; The NTP session table is used to record the number of valid NTP requests; The NTP local session lookup table is used to record the number of NTP requests made during an attack. The operation permissions for the NTP session table and the NTP local session table are open permissions for the feature thread; Set the NTP session table and NTP local session lookup table to lock-free operation; When the system is initialized, if the current forwarding system contains N forwarding cores, each network interface card (NIC) is configured as an N+1 NIC receive queue. A sequential full-connection mapping relationship is established between the forwarding cores and NICs, and NTP rule filters are configured on each NIC participating in forwarding, so that the feature thread obtains NTP traffic data in the N+1th NIC receive queue.

2. A method for defending against NTP amplification and reflection attacks, characterized in that, Applications include forwarding systems implemented on the DPDK platform, including: The current forwarding system is initialized, specifically including: given that the current forwarding system contains N forwarding cores, each network interface card (NIC) is configured as an N+1 NIC receive queue, and a sequential full-connection mapping relationship is established between the forwarding cores and NICs; and NTP rule filters are configured on each NIC participating in forwarding. Once initialization is complete, the feature thread reads NTP packets from the (N+1)th queue in each network interface card. Determine whether the current NTP packet is a response packet. If the current NTP packet is a non-response packet, then the current NTP packet is considered a legitimate NTP request. If the current NTP message is a response message, read the keywords in the current NTP message; If the keyword in the NTP packet is the first characteristic value, the current packet is identified as an attack packet and the current packet is discarded. When the keyword in the NTP packet is the second feature value, query the NTP local session table and process the NTP packet according to the query result; When the keyword in the NTP packet is the second feature value, querying the NTP local session table and processing the NTP packet based on the query result specifically includes: If a stored record matching the current NTP packet is found, the current packet is considered a legitimate packet. If no stored information matching the current NTP packet is found, the current packet is identified as an attack packet and the attack packet is discarded. The session table and session query table for normal NTP traffic are designed as local resources, so that lookup, creation, and update operations do not require locking.

3. The processing method for defense against NTP amplification and reflection attacks according to claim 2, characterized in that, Also includes: If the current NTP packet is valid, update the number of valid NTP requests in the NTP local session table and forward the current NTP packet. Update the number of attack packets in the NTP local statistics table when the current NTP packet is an attack packet.

4. The processing method for defense against NTP amplification and reflection attacks according to claim 3, characterized in that, Updating the number of attack packets in the NTP local statistics table when the current NTP packet is an attack packet specifically includes: When the current NTP packet is an attack packet, read the source address information and destination address information of the current NTP packet, and update the source address information and destination address information to the NTP local statistics table. The NTP local statistics table contains at least the number of attack packets.

5. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements a processing method for defending against NTP amplification and reflection attacks as described in any one of claims 2-4.

6. A computer program product, characterized in that, Includes computer-readable code, or a readable storage medium carrying computer-readable code, wherein when the computer-readable code is run in the processor of an electronic device, the processor in the electronic device executes a processing method for implementing a defense against NTP amplification and reflection attacks as described in any one of claims 2-4.

Images