A method and device for monitoring abnormal traffic of an SRv6 tunnel based on flowspec technology

Abstract

The application discloses a method and device for SRv6 tunnel abnormal flow monitoring based on a flowspec technology, wherein the method comprises the following steps: the flowspec defines a five-tuple related attribute in a multi-protocol BGP route; through the definition of the flowspec, an abnormal identifier defined by an SRv6 tunnel abnormal flow monitoring and early warning center is matched with flow through a specified SRv6 tunnel abnormal flow monitoring client, and if the abnormal flow is matched, related information of the abnormal flow is returned to the SRv6 tunnel abnormal flow monitoring and early warning center to present related results. The method and device can realize real-time and high-precision abnormal flow monitoring of the SRv6 tunnel based on the flowspec technology, and have end-to-end abnormal flow monitoring capability in the whole network.

Description

Technical Field

[0001] This invention relates to the field of abnormal flow monitoring, and in particular to a method and apparatus for abnormal flow monitoring of SRv6 tunnels based on flowspec technology. Background Technology

[0002] Traditional abnormal traffic monitoring systems are limited to deployment at the network's egress edge, monitoring only fixed areas of network equipment, and have coarse-grained OAM (Operation, Administration, and Maintenance) granularity with minute-level data collection cycles. They cannot capture sudden abnormal traffic spikes and lack a service-oriented abnormal traffic monitoring mechanism that can monitor both physical devices and links, as well as logical links such as VPN tunnels. The multi-service nature of SRv6 (IPv6 Segmented Routing) networks places higher demands on network management, particularly network security. This necessitates a real-time, high-precision abnormal traffic monitoring mechanism with end-to-end service-based abnormal traffic monitoring capabilities across the entire network, capable of timely, efficient, and accurate detection of abnormal traffic in SRv6 tunnels. Summary of the Invention

[0003] To address the above issues, this invention provides a method and apparatus for monitoring abnormal traffic in SRv6 tunnels based on flowspec technology. This method enables real-time and high-precision abnormal traffic monitoring of SRv6 tunnels using flowspec (traffic description) technology, and also provides end-to-end abnormal traffic monitoring capabilities across the entire network.

[0004] To achieve the above objectives, the present invention adopts the following technical solution:

[0005] In one embodiment of the present invention, a method for monitoring abnormal traffic in SRv6 tunnels based on flowspec technology is proposed, the method comprising:

[0006] flowspec defines the properties related to the five-tuple in multi-protocol BGP routing;

[0007] Based on the definition of flowspec, the abnormal identifiers defined by the SRv6 tunnel abnormal traffic monitoring and early warning center are matched with the traffic flowing through the specified SRv6 tunnel abnormal traffic monitoring client. If abnormal traffic is matched, the relevant information of the abnormal traffic is returned to the SRv6 tunnel abnormal traffic monitoring and early warning center for presentation of relevant results.

[0008] Furthermore, the SRv6 tunnel abnormal flow monitoring and early warning center creates monitoring tasks according to business maintenance needs and sends the monitoring tasks to the designated SRv6 tunnel abnormal flow monitoring controller.

[0009] The SRv6 tunnel abnormal flow monitoring and early warning center receives monitoring information returned by the SRv6 tunnel abnormal flow monitoring controller, reads and analyzes the monitoring index values, writes the monitoring results into the database for storage, and presents the monitoring results through a graphical interface.

[0010] Furthermore, the SRv6 tunnel abnormal traffic monitoring controller receives the monitoring task sent by the SRv6 tunnel abnormal traffic monitoring and early warning center, parses the monitoring information in the monitoring task, constructs a flow route, which contains the five-tuple and TCP control field related attributes as well as the action attributes of the specified operation, carries the relevant control attributes with the help of multi-protocol BGP, updates the flow route message at the second level through BGP routing, and sends the message to the designated SRv6 tunnel abnormal traffic monitoring client;

[0011] The SRv6 tunnel abnormal flow monitoring controller receives monitoring information returned by the SRv6 tunnel abnormal flow monitoring client, stores it in the monitoring task queue cache according to the monitoring task number, and then returns the monitoring information to the SRv6 tunnel abnormal flow monitoring and early warning center according to the monitoring task number.

[0012] Furthermore, the SRv6 tunnel abnormal traffic monitoring client receives a message of a flow route constructed by the SRv6 tunnel abnormal traffic monitoring controller, writes the message of the flow route into the routing table of port traffic interaction, generates a dynamic filtering list based on the abnormal identifier of the flow route, monitors all traffic flowing through the SRv6 tunnel interface, and returns monitoring information to the designated SRv6 tunnel abnormal traffic monitoring controller if abnormal traffic is detected.

[0013] In one embodiment of the present invention, a device for monitoring abnormal flow in SRv6 tunnels based on flowspec technology is also proposed, the device comprising:

[0014] The SRv6 tunnel abnormal flow monitoring and early warning center is used for creating and maintaining SRv6 tunnel abnormal flow monitoring tasks, monitoring the monitoring process, collecting, storing and analyzing monitoring information, graphically presenting monitoring results and outputting monitoring reports.

[0015] The SRv6 tunnel abnormal flow monitoring controller is used to send monitoring information to the SRv6 tunnel abnormal flow monitoring client and send the monitoring information returned by the SRv6 tunnel abnormal flow monitoring client to the SRv6 tunnel abnormal flow monitoring early warning center.

[0016] The SRv6 tunnel abnormal traffic monitoring client is used to receive monitoring information sent by the SRv6 tunnel abnormal traffic monitoring controller. By matching the abnormal identifier in the monitoring information with all traffic flowing through the SRv6 tunnel interface through the attributes related to the five-tuple in the multi-protocol BGP route defined by flowspec, it feeds back the monitoring information to the SRv6 tunnel abnormal traffic monitoring controller.

[0017] Furthermore, the SRv6 tunnel abnormal flow monitoring and early warning center is specifically used for:

[0018] Create monitoring tasks according to business maintenance needs, and send the monitoring tasks to the designated SRv6 tunnel abnormal traffic monitoring controller;

[0019] It receives monitoring information returned by the SRv6 tunnel abnormal flow monitoring controller, reads and analyzes the monitoring index values, writes the monitoring results into the database for storage, and presents the monitoring results through a graphical interface.

[0020] Furthermore, the SRv6 tunnel abnormal flow monitoring controller is specifically used for:

[0021] Receive monitoring tasks sent by the SRv6 tunnel abnormal traffic monitoring and early warning center, parse the monitoring information in the monitoring tasks, construct a flow route, which contains the five-tuple and TCP control field related attributes as well as the action attributes of the specified operation, carry the relevant control attributes with the help of multi-protocol BGP, update the flow route message quickly at the second level through BGP routing, and send the message to the specified SRv6 tunnel abnormal traffic monitoring client.

[0022] Receive monitoring information returned by the SRv6 tunnel abnormal traffic monitoring client, store it in the monitoring task queue cache according to the monitoring task number, and then return the monitoring information to the SRv6 tunnel abnormal traffic monitoring and early warning center according to the monitoring task number.

[0023] Furthermore, the SRv6 tunnel abnormal traffic monitoring client is specifically used for:

[0024] Receive a message of a flow route constructed by the SRv6 tunnel abnormal traffic monitoring controller, write the message of the flow route into the routing table of port traffic interaction, generate a dynamic filtering list based on the abnormal identifier of the flow route, monitor all traffic flowing through the SRv6 tunnel interface, and if abnormal traffic is detected, return monitoring information to the designated SRv6 tunnel abnormal traffic monitoring controller.

[0025] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it realizes the aforementioned abnormal traffic monitoring of SRv6 tunnels based on flowspec technology.

[0026] In one embodiment of the present invention, a computer-readable storage medium is also provided, which stores a computer program that performs SRv6 tunnel anomaly traffic monitoring based on flowspec technology.

[0027] Beneficial effects:

[0028] 1. In this invention, the flowspec technology defines 12 attributes of the five-tuple in multi-protocol BGP routing, namely destination prefix, source prefix, IP protocol, port, destination port, source port, ICMP type, ICMP code, TCP flag, packet length, DSCP, and fragment encoding, so that it can meet the identification and processing of flows in various business scenarios.

[0029] 2. This invention is similar to an access control list for routing, providing network maintenance personnel with a flexible and efficient method for identifying abnormal traffic, and enabling flexible deployment of different VPN tunnels based on business needs.

[0030] 3. This invention improves network security, flexibility and efficiency by rapidly applying abnormal traffic identification information to routers in SRv6 tunnels through second-level updates of BGP routes. Attached Figure Description

[0031] Figure 1 This is a schematic diagram of the method for monitoring abnormal flow in SRv6 tunnels based on flowspec technology according to the present invention;

[0032] Figure 2 This is a schematic diagram of the deployment of SRv6 tunnel abnormal flow monitoring according to an embodiment of the present invention;

[0033] Figure 3 This is a schematic diagram of the device structure for monitoring abnormal flow in SRv6 tunnels based on flowspec technology according to the present invention.

[0034] Figure 4 This is a schematic diagram of the computer device structure of the present invention. Detailed Implementation

[0035] The principles and spirit of the present invention will now be described with reference to several exemplary embodiments. It should be understood that these embodiments are provided merely to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. Rather, these embodiments are provided to make this disclosure more thorough and complete, and to fully convey the scope of this disclosure to those skilled in the art.

[0036] Those skilled in the art will recognize that embodiments of the present invention can be implemented as an apparatus, device, device, method, or computer program product. Therefore, this disclosure can be specifically implemented in the following forms: entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0037] According to an embodiment of the present invention, a method and apparatus for monitoring abnormal SRv6 tunnel traffic based on Flowspec technology are proposed, comprising three functional elements: an SRv6 tunnel abnormal traffic monitoring and early warning center, an SRv6 tunnel abnormal traffic monitoring controller, and an SRv6 tunnel abnormal traffic monitoring client. The SRv6 tunnel abnormal traffic monitoring and early warning center is deployed at the core location of the network area, mainly realizing functions such as creating SRv6 tunnel abnormal traffic monitoring tasks, maintaining monitoring tasks, monitoring the monitoring process, collecting and storing monitoring information, analyzing monitoring information, graphically presenting monitoring results, and outputting monitoring reports. The SRv6 tunnel abnormal traffic monitoring controller is deployed at the monitoring location in the network area, mainly realizing the sending of monitoring information to the SRv6 tunnel abnormal traffic monitoring client and sending the monitoring information returned by the SRv6 tunnel abnormal traffic monitoring client back to the SRv6 tunnel abnormal traffic monitoring and early warning center. The SRv6 tunnel abnormal traffic monitoring client mainly realizes the receiving and feedback of monitoring information sent by the SRv6 tunnel abnormal traffic monitoring controller. The SRv6 tunnel abnormal traffic monitoring client can be an SRv6 tunnel router or other device deployed with SRv6 tunnel services within the network area.

[0038] The principles and spirit of the present invention will be explained in detail below with reference to several representative embodiments.

[0039] Flowspec is a Network Layer Reachability Information (NLRI) of the BGP routing protocol, used to match anomaly identifiers defined by the SRv6 tunnel anomaly traffic monitoring and early warning center with traffic flowing through a specified SRv6 tunnel anomaly traffic monitoring client. By using Flowspec, the SRv6 tunnel anomaly traffic monitoring and early warning center can send monitoring information to identify certain types of anomaly traffic. Once the SRv6 tunnel anomaly traffic monitoring client identifies anomaly traffic, it immediately returns the monitoring information to the SRv6 tunnel anomaly traffic monitoring and early warning center to present the relevant monitoring results.

[0040] The flowspec uses AFI (Address Family Identifier) ​​1 (IPv4) and the subsequent AFI (SAFI, Subsequence Address Family Identifier) ​​133 (flowspec Filter) to define a new multiprotocol network layer accessibility information (MP_REACH_NLRI) for defining flowspec and flowspec layer 4 (traffic-rate, traffic-action, redirect, and traffic-marking) flowspec types. The source and destination IPs, source and destination ports, and protocol fields are added to the NLRI and advertised to the relevant peers (routers that establish BGP neighbor relationships are called BGP peers) in BGP route update messages (routers running the BGP routing protocol send route update information when there are route updates).

[0041] The following lists the 12 attributes included in MP_REACH_NLRI:

[0042] (1) Target prefix --- Define the target prefix to be matched;

[0043] (2) Source prefix --- Define the source prefix;

[0044] (3) IP Protocol --- contains a set of pairs used to match the IP protocol value bytes in IP packets;

[0045] (4) Port --- Defines the port that TCP, UDP, or both will affect;

[0046] (5) Target Port --- Define the target port that will be affected by flowspec;

[0047] (6) Source Port --- Defines the source port that will be affected by flowspec;

[0048] (7) ICMP type;

[0049] (8) ICMP code;

[0050] (9) TCP flags;

[0051] (10) Packet length --- matches the total length of the IP packet;

[0052] (11) DSCP --- Matches the service category identifier;

[0053] (12) Fragment encoding.

[0054] Figure 1This is a schematic diagram of the method for monitoring abnormal traffic in SRv6 tunnels based on flowspec technology according to the present invention. Figure 1 As shown, the method includes:

[0055] 1. The SRv6 tunnel abnormal traffic monitoring and early warning center creates monitoring tasks according to business maintenance needs. The tasks include the monitoring task number, the SRv6 tunnel abnormal traffic monitoring controller number (IP address), the SRv6 tunnel abnormal traffic monitoring client number (IP address), the monitoring area (a set of SRv6 tunnel abnormal traffic monitoring clients), the monitoring type (IP, port and protocol), the abnormality identifier (IP address, TCP / UDP port number and protocol number), and the monitoring time. The monitoring task is then sent to the designated SRv6 tunnel abnormal traffic monitoring controller.

[0056] 2. Upon receiving the monitoring task, the SRv6 tunnel anomaly traffic monitoring controller parses the monitoring information in the task and constructs a flow route. This flow route can be statically configured manually via command line on the SRv6 tunnel anomaly traffic monitoring controller, such as manually configuring `ipv4-flow vpn-instance vpn-instance-name peer ipv4-address validation-disable`. Alternatively, it can be automatically generated in conjunction with devices like NetFlow, utilizing the BGP neighbor relationship established between the SRv6 tunnel anomaly traffic monitoring controller and the SRv6 tunnel anomaly traffic monitoring client, and through the dynamic BGP IPv6 running on both sides. The FlowSpecification function generates a flow route, which contains a five-tuple (source IP, destination IP, source port, destination port, and protocol) and 17 attributes including TCP control fields (source port number, destination port number, sequence number, acknowledgment number, checksum, flags, and window size). It also includes 17 attributes such as destination prefix, source prefix, IP protocol, destination port, source port, packet length, DSCP, fragment encoding, sequence number, acknowledgment number, checksum, flags, window size, rate limiting, redirect IP, redirect rt, and redirect policy, as well as action attributes for specified operations (permit, deny, and redirect). The SRv6 tunnel abnormal traffic monitoring controller uses MP-BGP (Multi-Protocol BGP) to carry relevant control attributes (Origin attribute, AS_Path attribute, Next_Hop attribute, MP_REACH_NLRI attribute, and MP_UNREACH_NLRI attribute), and quickly updates the flow route in packets at the second level (the route update interval for IBGP peers is 15 seconds, and the route update interval for EBGP peers is 30 seconds), and sends them to the designated SRv6 tunnel abnormal traffic monitoring client.

[0057] 3. After receiving the packet containing this flow route, the designated SRv6 tunnel abnormal traffic monitoring client writes it into its respective inteflow.0 (port traffic interaction) routing table. Based on the abnormal identifier of this flow route, it generates a dynamic filtering list (filter) to identify the specified abnormal traffic flowing through its respective port. (The SRv6 tunnel abnormal traffic monitoring client receives the flow route sent by the SRv6 tunnel abnormal traffic monitoring controller via BGP route update. This route contains 17 attribute information used to identify abnormal traffic, as well as action attributes such as permit, deny, and redirect. The above information combined together constitutes a dynamic filtering list, which is a filter. This dynamic filtering list is then written into the respective port forwarding table to monitor the traffic flowing through its respective port at any time.)

[0058] 4. Once the SRv6 tunnel abnormal traffic monitoring client identifies abnormal traffic, it immediately returns monitoring information to the SRv6 tunnel abnormal traffic monitoring controller, including the SRv6 tunnel abnormal traffic monitoring client number (IP address), abnormality type information (IP, port and protocol), abnormal indicators (IP address, TCP / UDP port number and protocol number) and monitoring time.

[0059] 5. After receiving the monitoring information sent by the SRv6 tunnel abnormal traffic monitoring client, the SRv6 tunnel abnormal traffic monitoring controller stores the information in the monitoring task queue cache according to the monitoring task number, and sends the monitoring information to the SRv6 tunnel abnormal traffic monitoring and early warning center according to the monitoring task number. The information includes the monitoring task number, the SRv6 tunnel abnormal traffic monitoring controller number (IP address), the SRv6 tunnel abnormal traffic monitoring client number (IP address), monitoring type information (IP, port and protocol), abnormal indicators (IP address, TCP / UDP port number and protocol number), and monitoring time.

[0060] 6. After receiving the monitoring information returned by the SRv6 tunnel abnormal flow monitoring controller, the SRv6 tunnel abnormal flow monitoring and early warning center reads and analyzes the monitoring indicator data (IP address, TCP / UDP port number and protocol number), writes the monitoring results into the database for storage, and presents the monitoring results through a graphical interface.

[0061] It should be noted that although the operation of the method of the present invention has been described in a specific order in the above embodiments and figures, this does not require or imply that the operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0062] To provide a clearer explanation of the above-mentioned SRv6 tunnel abnormal flow monitoring based on flowspec technology, a specific embodiment will be used for illustration below. However, it is worth noting that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation of the present invention.

[0063] Example:

[0064] A company leases a network from a telecom operator to connect its branch offices in different geographical locations using SRv6 tunneling technology, such as... Figure 2 As shown, assume there are 4 routers distributed in the network, and they have established BGP neighbor relationships with each other through the BGP routing protocol. Router-1 and Router-4 have established two SRv6 tunnels due to business needs. The internal network of Branch Office-1 is connected to Router-1, and the internal network of Branch Office-2 is connected to Router-4.

[0065] To ensure timely, accurate, and efficient detection of abnormal traffic in SRv6 tunnels, the operator deployed an SRv6 tunnel abnormal traffic monitoring method based on Flowspec technology. Recently, worm viruses have re-emerged, particularly a worm called "EternalBlue," which has attacked the internal networks of several enterprises, severely impacting their internal office work and production. Due to the need to guarantee the quality of service for large customer leased lines, the operator plans to implement abnormal traffic monitoring for "EternalBlue" worms within the SRv6 tunnels leased by this enterprise, promptly notifying the enterprise of the monitoring results to facilitate appropriate virus handling.

[0066] The operator created a monitoring task through the SRv6 tunnel abnormal traffic monitoring and early warning center. It selected the SRv6 tunnel abnormal traffic monitoring controller number that provides monitoring services to the enterprise (the IP address of the specified SRv6 tunnel abnormal traffic monitoring controller was added to the monitoring task), and the SRv6 tunnel abnormal traffic monitoring client numbers at both ends of the SRv6 tunnel providing services to the enterprise (the IP addresses of router-1 and router-4 were added to the monitoring task). The monitoring type was selected as "protocol," the anomaly identifier was selected as the attack port number "TCP 445" carried by the "EternalBlue" worm virus, and the monitoring period was selected as "one month." The SRv6 tunnel abnormal traffic monitoring and early warning center then distributed the created monitoring task to the specified SRv6 tunnel abnormal traffic monitoring controller.

[0067] After receiving a monitoring task, the designated SRv6 tunnel abnormal traffic monitoring controller first parses the monitoring information in the monitoring task to obtain the SRv6 tunnel abnormal traffic monitoring client information to be deployed for this monitoring task, monitoring type information, abnormal identification information, and monitoring time information. Then, it constructs a flow route, including the neighbor information received for route update (IP address of router-1 and IP address of router-4) and TCP 445 port number information. It uses the second-level update message of BGP routing to update the flow route and sends the flow route message to the SRv6 tunnel abnormal traffic monitoring client (router-1 and router-4).

[0068] After receiving the packet indicating the flow route, the designated SRv6 tunnel abnormal traffic monitoring clients (Router-1 and Router-4) write it into their respective inteflow.0 routing tables and generate a dynamic filtering list based on the abnormal identifier (TCP 445). They then immediately monitor all traffic flowing through the SRv6 tunnel interface of their respective routers. Once abnormal traffic is detected within the monitoring time frame, they return monitoring information to the SRv6 tunnel abnormal traffic monitoring controller, including the monitoring client number (router's IP address) that detected the abnormal traffic, the abnormal protocol information (TCP 445), and the detection time.

[0069] After receiving the monitoring information returned by the SRv6 tunnel abnormal traffic monitoring client, the SRv6 tunnel abnormal traffic monitoring controller will return the monitoring information to the SRv6 tunnel abnormal traffic monitoring and early warning center in combination with the corresponding monitoring task number. This information includes the corresponding monitoring task number, the SRv6 tunnel abnormal traffic monitoring controller number (IP address), the SRv6 tunnel abnormal traffic monitoring client number (router IP address), monitoring type information (protocol), abnormal indicators (TCP445), and the discovery time.

[0070] After receiving the monitoring information returned by the SRv6 tunnel abnormal traffic monitoring controller, the SRv6 tunnel abnormal traffic monitoring and early warning center reads and analyzes the monitoring indicator data (corresponding monitoring task number, controller IP address, router IP address, TCP 445 and discovery time), writes the monitoring results into the database for storage, and presents the monitoring results through a graphical interface. The operator's maintenance personnel then notify the relevant personnel of the enterprise to carry out subsequent virus remediation work.

[0071] Based on the same inventive concept, this invention also proposes a device for monitoring abnormal flow in SRv6 tunnels based on flowspec technology. The implementation of this device can refer to the implementation of the method described above, and repeated details will not be repeated. The term "module" used below can refer to a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0072] Figure 3 This is a schematic diagram of the device structure for monitoring abnormal flow in SRv6 tunnels based on flowspec technology, as per the present invention. Figure 3 As shown, the device includes:

[0073] The SRv6 tunnel abnormal flow monitoring and early warning center 101 is used for creating and maintaining SRv6 tunnel abnormal flow monitoring tasks, monitoring the monitoring process, collecting, storing and analyzing monitoring information, graphically presenting monitoring results, and outputting monitoring reports; specifically as follows:

[0074] According to business maintenance needs, create monitoring tasks and send the monitoring tasks to the designated SRv6 tunnel abnormal traffic monitoring controller 102;

[0075] The system receives monitoring information returned by the SRv6 tunnel abnormal flow monitoring controller 102, reads and analyzes the monitoring index values, writes the monitoring results into the database for storage, and presents the monitoring results through a graphical interface.

[0076] The SRv6 tunnel abnormal flow monitoring controller 102 is used to send monitoring information to the SRv6 tunnel abnormal flow monitoring client 103, and to send the monitoring information returned by the SRv6 tunnel abnormal flow monitoring client 103 to the SRv6 tunnel abnormal flow monitoring early warning center 101; specifically as follows:

[0077] Receive the monitoring task sent by the SRv6 tunnel abnormal traffic monitoring and early warning center 101, parse the monitoring information in the monitoring task, construct a flow route, which contains the five-tuple and TCP control field related attributes as well as the action attributes of the specified operation, carry the relevant control attributes with the help of multi-protocol BGP, update the flow route message quickly at the second level through BGP routing, and send the message to the designated SRv6 tunnel abnormal traffic monitoring client 103;

[0078] The system receives monitoring information returned by the SRv6 tunnel abnormal traffic monitoring client 103, stores it in the monitoring task queue cache according to the monitoring task number, and then returns the monitoring information to the SRv6 tunnel abnormal traffic monitoring and early warning center 101 according to the monitoring task number.

[0079] The SRv6 tunnel abnormal traffic monitoring client 103 receives monitoring information sent by the SRv6 tunnel abnormal traffic monitoring controller 102. Using the attributes related to the five-tuple in the multi-protocol BGP route defined by flowspec, it matches the abnormal identifier in the monitoring information with all traffic flowing through the SRv6 tunnel interface and feeds back the monitoring information to the SRv6 tunnel abnormal traffic monitoring controller 102. Specifically:

[0080] The system receives a message of a flow route constructed by the SRv6 tunnel abnormal traffic monitoring controller 102, writes the message of the flow route into the routing table of port traffic interaction, generates a dynamic filtering list based on the abnormal identifier of the flow route, monitors all traffic flowing through the SRv6 tunnel interface, and returns monitoring information to the designated SRv6 tunnel abnormal traffic monitoring controller 102 if abnormal traffic is detected.

[0081] It should be noted that although several modules of the SRv6 tunnel abnormal flow monitoring device based on flowspec technology have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of the present invention, the features and functions of two or more modules described above can be embodied in one module. Conversely, the features and functions of one module described above can be further divided and embodied by multiple modules.

[0082] Based on the aforementioned inventive concept, such as Figure 4 As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220. When the processor 220 executes the computer program 230, it realizes the aforementioned abnormal traffic monitoring of SRv6 tunnels based on flowspec technology.

[0083] Based on the aforementioned inventive concept, the present invention also proposes a computer-readable storage medium storing a computer program that performs the aforementioned SRv6 tunnel abnormal flow monitoring based on flowspec technology.

[0084] This invention proposes a method and apparatus for monitoring abnormal traffic in SRv6 tunnels based on FlowSpec technology. FlowSpec technology defines 12 attributes of a five-tuple in a multi-protocol BGP route: destination prefix, source prefix, IP protocol, port, destination port, source port, ICMP type, ICMP code, TCP flags, packet length, DSCP, and fragment encoding. This allows it to meet the needs of traffic identification and processing in various service scenarios. This method and apparatus are similar to access control lists for routes, providing network maintenance personnel with a flexible and efficient method for identifying abnormal traffic. It can also be flexibly deployed for different VPN tunnels based on service requirements. Through second-level updates of BGP routes, the identification information of abnormal traffic is quickly applied to routers in the SRv6 tunnel, improving network security, flexibility, and efficiency.

[0085] While the spirit and principles of the invention have been described with reference to several specific embodiments, it should be understood that the invention is not limited to the disclosed specific embodiments, and the division of aspects does not imply that features in these aspects cannot be combined for benefit; such division is merely for ease of description. The invention is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

[0086] Regarding the limitation of the scope of protection of this invention, those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solution of this invention are still within the scope of protection of this invention.

Claims

1. A method for monitoring abnormal flow in SRv6 tunnels based on flowspec technology, characterized in that, The method includes: flowspec defines the properties related to the five-tuple in multi-protocol BGP routing; Based on the definition of flowspec, the abnormal identifier defined by the SRv6 tunnel abnormal traffic monitoring and early warning center is matched with the traffic flowing through the specified SRv6 tunnel abnormal traffic monitoring client. If abnormal traffic is matched, the relevant information of the abnormal traffic is returned to the SRv6 tunnel abnormal traffic monitoring and early warning center for the presentation of relevant results. The SRv6 tunnel abnormal flow monitoring and early warning center creates monitoring tasks according to business maintenance needs and sends the monitoring tasks to the designated SRv6 tunnel abnormal flow monitoring controller. The SRv6 tunnel abnormal flow monitoring and early warning center receives monitoring information returned by the SRv6 tunnel abnormal flow monitoring controller, reads and analyzes the monitoring index values, writes the monitoring results into the database for storage, and presents the monitoring results through a graphical interface. The SRv6 tunnel abnormal traffic monitoring controller receives monitoring tasks sent by the SRv6 tunnel abnormal traffic monitoring and early warning center, parses the monitoring information in the monitoring tasks, constructs a flow route, which contains the five-tuple and TCP control field related attributes as well as the action attributes of the specified operation. It carries the relevant control attributes with the help of multi-protocol BGP, updates the flow route message at the second level through BGP routing, and sends the message to the designated SRv6 tunnel abnormal traffic monitoring client. The SRv6 tunnel abnormal flow monitoring controller receives the monitoring information returned by the SRv6 tunnel abnormal flow monitoring client, stores it in the monitoring task queue cache according to the monitoring task number, and then returns the monitoring information to the SRv6 tunnel abnormal flow monitoring and early warning center according to the monitoring task number. The SRv6 tunnel abnormal traffic monitoring client receives a message of a flow route constructed by the SRv6 tunnel abnormal traffic monitoring controller, writes the message of the flow route into the routing table of port traffic interaction, generates a dynamic filtering list based on the abnormal identifier of the flow route, monitors all traffic flowing through the SRv6 tunnel interface, and returns monitoring information to the designated SRv6 tunnel abnormal traffic monitoring controller if abnormal traffic is detected.

2. A device for monitoring abnormal flow in SRv6 tunnels based on flowspec technology, characterized in that, The device includes: The SRv6 tunnel abnormal flow monitoring and early warning center is used for creating and maintaining SRv6 tunnel abnormal flow monitoring tasks, monitoring the monitoring process, collecting, storing and analyzing monitoring information, graphically presenting monitoring results, and outputting monitoring reports; specifically, it is used for: Create monitoring tasks according to business maintenance needs, and send the monitoring tasks to the designated SRv6 tunnel abnormal traffic monitoring controller; Receive monitoring information returned by the SRv6 tunnel abnormal flow monitoring controller, read and analyze the monitoring index values, write the monitoring results into the database for storage, and present the monitoring results through a graphical interface; The SRv6 tunnel abnormal flow monitoring controller is used to send monitoring information to the SRv6 tunnel abnormal flow monitoring client and to send the monitoring information returned by the SRv6 tunnel abnormal flow monitoring client to the SRv6 tunnel abnormal flow monitoring early warning center; specifically used for: Receive monitoring tasks sent by the SRv6 tunnel abnormal traffic monitoring and early warning center, parse the monitoring information in the monitoring tasks, construct a flow route, which contains the five-tuple and TCP control field related attributes as well as the action attributes of the specified operation, carry the relevant control attributes with the help of multi-protocol BGP, update the flow route message quickly at the second level through BGP routing, and send the message to the specified SRv6 tunnel abnormal traffic monitoring client. Receive monitoring information returned by the SRv6 tunnel abnormal traffic monitoring client, store it in the monitoring task queue cache according to the monitoring task number, and then return the monitoring information to the SRv6 tunnel abnormal traffic monitoring and early warning center according to the monitoring task number; The SRv6 tunnel abnormal traffic monitoring client receives monitoring information from the SRv6 tunnel abnormal traffic monitoring controller. Using the attributes related to the five-tuple in the multi-protocol BGP route defined by flowspec, it matches the abnormal identifier in the monitoring information with all traffic flowing through the SRv6 tunnel interface and feeds back the monitoring information to the SRv6 tunnel abnormal traffic monitoring controller. Specifically, it is used for: Receive a message of a flow route constructed by the SRv6 tunnel abnormal traffic monitoring controller, write the message of the flow route into the routing table of port traffic interaction, generate a dynamic filtering list based on the abnormal identifier of the flow route, monitor all traffic flowing through the SRv6 tunnel interface, and if abnormal traffic is detected, return monitoring information to the designated SRv6 tunnel abnormal traffic monitoring controller.

3. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of claim 1.

4. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that performs the method of claim 1.

Images