Software-defined network flow rule security detection and tracing method and device

Abstract

The present application relates to a method and device for security detection and tracing of software-defined network flow rules, wherein the method includes: intercepting the current network top-level security policy, forwarding rules and flow rules stored in the data plane from a preset software-defined network controller, and converting the security policy into a concrete security rule based on a preset conversion rule; encoding and storing the security rules, forwarding rules and flow rules based on a preset data structure, and calculating the actual scope of each rule; simulating the actual behavior of data packets in the network and the security behavior that meets the security policy requirements through a pre-established network topology-hardware device-logical function network behavior model, identifying unsafe network behavior, and tracing it back to the unsafe network rules that caused the behavior. Thus, the technical problem that it is difficult to verify the consistency of network behavior with network security policy, and that the general verification tools used are slow and not timely, is solved, thereby improving the user experience.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method and device for security detection and tracing of software-defined network flow rules. Background Art

[0002] To address the deployment, monitoring, and management challenges of traditional network architectures, the software-defined networking (SDN) architecture has been proposed. This architecture decouples the data plane and control plane, which reside within the same network devices in traditional networks. The data plane, comprised of packet forwarding devices, implements data transmission, while the control plane, comprised of controllers, logically implements centralized network control. In the SDN architecture and processing flow, the control plane primarily manages the configuration of underlying hardware devices through dynamically issued flow rules. Switches fully trust received flow rules and execute forwarding, discarding, and other actions on packets accordingly. The legitimacy, consistency, and security of flow rules are fundamental to ensuring the availability and reliability of SDNs.

[0003] However, while flow rules dynamically manage the network, they can also introduce security risks. For example, flow rules issued by the control plane may violate the network's top-level security policies, leading to unsafe network behavior. These security issues arise from a variety of sources. First, third-party applications can maliciously construct flow rules to launch security attacks. Specifically, the control plane hosts a large number of applications, yet there are no sophisticated mechanisms for source management, content review, and permission control for these applications. Attackers can exploit this by writing malicious third-party applications or exploiting application vulnerabilities to issue flow rules with security risks to underlying network devices. This can lead to various active network attacks, such as man-in-the-middle attacks and black hole attacks, or bypass security-related rules. Second, due to the diverse types of network data acquired, the varying flow rule calculation logic, and the lack of communication coordination mechanisms, conflicting flow rules issued by multiple applications and business processing logic modules within the controller can result in flow rule misconfiguration. These security vulnerabilities can lead to serious consequences, including network outages, forwarding black holes, and security policy bypasses.

[0004] Furthermore, related technologies often focus on network connectivity metrics, ignoring whether the network behavior indicated by flow rules complies with network security policies. Furthermore, in software-defined network environments, controllers can dynamically manage the network by issuing, deleting, and updating flow rules. Effective flow rules often change, and compared to traditional networks, flow rule matching domains in software-defined networks are more diverse and rich. These characteristics cause the state space of flow rules to grow exponentially and change rapidly. However, the general-purpose verification tools used in related technologies generally only perform well in small state spaces, making them difficult to adapt to the challenges of dynamic verification. Summary of the Invention

[0005] The present application provides a software-defined network flow rule security detection and tracing method and device to solve the technical problems that it is difficult to verify the consistency of network behavior and network security policy, and the common verification tools used are slow and not timely, thereby improving user experience.

[0006] The first embodiment of the present application provides a method for security detection and tracing of software-defined network flow rules, including the following steps:

[0007] Intercept the current network top-level security policy, forwarding rules, and flow rules stored in the data plane from the preset software-defined network controller, and convert the abstract security policy into concrete security rules based on the preset conversion rules;

[0008] Encoding and storing the security rules, the forwarding rules, and the flow rules based on a preset data structure, and calculating the actual scope of each rule; and

[0009] Through the pre-established network topology-hardware equipment-logical function network behavior model, the actual behavior of data packets in the network and the safe behavior that meets the security policy requirements are simulated, unsafe network behavior is identified, and the unsafe network rules that cause the behavior are traced back.

[0010] According to one embodiment of the present application, intercepting the current network top-level security policy, forwarding rules, and flow rules stored in the data plane from a preset software-defined network controller, and converting the security policy into a concrete security rule based on a preset conversion rule, includes:

[0011] Extracting the current network top-level security policy, forwarding rules, and flow rules stored in the data plane from the preset software-defined network controller, and extracting network behavior features from the security policy, the forwarding rules, and the flow rules based on a preset network behavior feature extraction strategy, so as to represent the security policy in a two-tuple form, represent the forwarding rule in a first four-tuple form, and represent the flow rule in a second four-tuple form;

[0012] Based on the preset abstract network behavior specification, each security policy in the security policy is converted into a concrete security rule, and the concrete security rule is represented in the form of a third quadruple.

[0013] According to one embodiment of the present application, intercepting the current network top-level security policy, forwarding rules, and flow rules stored in the data plane from a preset software-defined network controller, and converting the security policy into a concrete security rule based on a preset conversion rule, further includes:

[0014] When the security policy, the forwarding rule and / or the flow rule are changed, extracting the changed security policy, the forwarding rule and / or the flow rule;

[0015] Based on a preset network behavior feature extraction strategy, network behavior features are extracted from the changed security policy, the forwarding rule, and the flow rule respectively.

[0016] According to one embodiment of the present application, encoding and storing the security rules, the forwarding rules, and the flow rules based on a preset data structure, and calculating the actual scope of each rule, includes:

[0017] Each rule is represented as a unique matching domain logical predicate based on the maych field of any number of fields, and the logical predicate is encoded using the BDD (Binary Decision Diagram) data structure;

[0018] Eliminate the scope covered by the flow rule with a higher priority from the matching domain logical predicate of each rule to obtain the actual scope logical predicate of each rule;

[0019] A bidirectional mapping relationship is established between the security rule, the forwarding rule, the flow rule and the actual scope logical predicate respectively.

[0020] According to one embodiment of the present application, before simulating the actual behavior of data packets in the network and the safe behavior that meets the security policy requirements through the pre-established network topology-hardware device-logical function network behavior model, identifying unsafe network behavior, and tracing the unsafe network rules that cause the behavior, the method further includes:

[0021] Determining the types and quantities of hardware devices according to the preset software-defined network controller information, and establishing a topological relationship between hardware devices according to the types and quantities of the hardware devices to obtain a network topology model;

[0022] Construct each logical function module in the hardware, establish a mapping for each data packet and its corresponding logical operation, and obtain a logical function model;

[0023] According to the actual network behavior and network security behavior, a mapping relationship and a connection relationship between logical functions and between logical function logical ports and the physical ports of the hardware device are established to obtain a hardware device model;

[0024] The pre-established network topology-hardware device-logical function network behavior model is obtained according to the network topology model, the logical function model and the hardware device model.

[0025] According to one embodiment of the present application, the method of simulating the actual behavior of data packets in the network and the safe behavior that meets the security policy requirements through a pre-established network topology-hardware device-logical function network behavior model, identifying unsafe network behavior, and tracing the unsafe network rules that cause the behavior includes:

[0026] Simulating the enforcement of a network security policy, and calculating a first predicate set that can reach each hardware output port under the enforcement of the network security policy;

[0027] Simulating a non-enforced execution of a network security policy, and calculating a second predicate set that can reach each of the hardware output ports under the non-enforced execution of the network security policy;

[0028] Check for network black hole issues and look for packets that are not sent to a valid next-hop switch;

[0029] Identify data packets that violate network security policies and find data packets that behave inconsistently when the network security policies are enforced and when the network security policies are not enforced;

[0030] Trace the abnormal rules that cause network black holes and unsafe network behavior, output the abnormalities to the network administrator, issue a warning, and send the flow rules that do not have abnormalities and network security risks to the data plane to officially take effect in the network.

[0031] According to the software-defined network flow rule security detection and tracing method provided in the embodiment of the present application, by dynamically extracting the change information of the security policy, forwarding rules and flow rules in the network from the software-defined network controller, it is ensured that the model can track and simulate the latest status of the network in real time; the abstract network security policy is concretized into security rules, and then the actual network behavior and security behavior model are established for comparative verification; the network verification calculation efficiency is improved by adopting efficient coding methods, dynamic incremental updates of network models and other technologies, and finally the detection and tracing of network black holes and flow rules that violate network security policies are achieved, thereby improving the security of software-defined network flow rules. In this way, the technical problems in related technologies that it is difficult to verify the consistency of network behavior and network security policies, and the general verification tools used are slow and not timely are solved, thereby improving the user experience.

[0032] A second embodiment of the present application provides a software-defined network flow rule security detection and tracing device, including:

[0033] A conversion module, configured to intercept the current network top-level security policy, forwarding rules, and flow rules stored in the data plane from a preset software-defined network controller, and convert the security policy into concrete security rules based on preset conversion rules;

[0034] a processing module, configured to encode and store the security rules, the forwarding rules, and the flow rules based on a preset data structure, and calculate an actual scope of each rule; and

[0035] The identification module is used to simulate the actual behavior of data packets in the network and the safe behavior that meets the security policy requirements through the pre-established network topology-hardware equipment-logical function network behavior model, identify unsafe network behavior, and trace it back to the unsafe network rules that cause the behavior.

[0036] According to one embodiment of the present application, the conversion module is specifically configured to:

[0037] Extracting the current network top-level security policy, forwarding rules, and flow rules stored in the data plane from the preset software-defined network controller, and extracting network behavior features from the security policy, the forwarding rules, and the flow rules based on a preset network behavior feature extraction strategy, so as to represent the security policy in a two-tuple form, represent the forwarding rule in a first four-tuple form, and represent the flow rule in a second four-tuple form;

[0038] Based on the preset abstract network behavior specification, each security policy in the security policy is converted into a concrete security rule, and the concrete security rule is represented in the form of a third quadruple.

[0039] According to one embodiment of the present application, the conversion module is further configured to:

[0040] When the security policy, the forwarding rule and / or the flow rule are changed, extracting the changed security policy, the forwarding rule and / or the flow rule;

[0041] Based on a preset network behavior feature extraction strategy, network behavior features are extracted from the changed security policy, the forwarding rule, and the flow rule respectively.

[0042] According to one embodiment of the present application, the processing module is specifically configured to:

[0043] Encode each rule's match field based on any number of fields into a unique match domain logical predicate;

[0044] Eliminate the scope covered by the flow rule with a higher priority from the matching domain logical predicate of each rule to obtain the actual scope logical predicate of each rule;

[0045] A bidirectional mapping relationship is established between the security rule, the forwarding rule, the flow rule and the actual scope logical predicate respectively.

[0046] According to one embodiment of the present application, before simulating the actual behavior of data packets in the network and the security behavior that meets the security policy requirements through the pre-established network topology-hardware device-logical function network behavior model, identifying unsafe network behavior, and tracing the unsafe network rules that cause the behavior, the identification module is further used to:

[0047] Determining the types and quantities of hardware devices according to the preset software-defined network controller information, and establishing a topological relationship between hardware devices according to the types and quantities of the hardware devices to obtain a network topology model;

[0048] Construct each logical function module in the hardware, establish a mapping for each data packet and its corresponding logical operation, and obtain a logical function model;

[0049] According to the actual network behavior and network security behavior, a mapping relationship and a connection relationship between logical functions and between logical function logical ports and the physical ports of the hardware device are established to obtain a hardware device model;

[0050] The pre-established network topology-hardware device-logical function network behavior model is obtained according to the network topology model, the logical function model and the hardware device model.

[0051] According to one embodiment of the present application, the identification module is specifically configured to:

[0052] Simulating the enforcement of a network security policy, and calculating a first predicate set that can reach each hardware output port under the enforcement of the network security policy;

[0053] Simulating a non-enforced execution of a network security policy, and calculating a second predicate set that can reach each of the hardware output ports under the non-enforced execution of the network security policy;

[0054] Check for network black hole issues and look for packets that are not sent to a valid next-hop switch;

[0055] Identify data packets that violate network security policies and find data packets that behave inconsistently when the network security policies are enforced and when the network security policies are not enforced;

[0056] Trace the abnormal rules that cause network black holes and unsafe network behavior, output the abnormalities to the network administrator, issue a warning, and send the flow rules that do not have abnormalities and network security risks to the data plane to officially take effect in the network.

[0057] According to the software-defined network flow rule security detection and tracing device provided in the embodiment of the present application, by dynamically extracting the change information of the security policy, forwarding rules and flow rules in the network from the software-defined network controller, it is ensured that the model can track and simulate the latest status of the network in real time; the abstract network security policy is concretized into security rules, and then the actual network behavior and security behavior model are established for comparative verification; the network verification calculation efficiency is improved by adopting efficient coding methods, dynamic incremental updates of network models and other technologies, and finally the detection and tracing of network black holes and flow rules that violate network security policies are achieved, thereby improving the security of software-defined network flow rules. In this way, the technical problems in related technologies that it is difficult to verify the consistency of network behavior and network security policies, and the general verification tools used are slow and not timely are solved, thereby improving the user experience.

[0058] The third aspect of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the program to implement the software-defined network flow rule security detection and tracing method as described in the above embodiment.

[0059] The fourth aspect of the present application provides a computer-readable storage medium on which a computer program is stored. The program is executed by a processor to implement the software-defined network flow rule security detection and tracing method as described in the above embodiment.

[0060] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0062] Figure 1 A flowchart of a software-defined network flow rule security detection and tracing method provided according to an embodiment of the present application;

[0063] Figure 2 This is a flowchart of a software-defined network flow rule security detection and tracing method according to an embodiment of the present application;

[0064] Figure 3 A flowchart for extracting, visualizing, and representing network rules for one embodiment of the present application;

[0065] Figure 4 This is a schematic diagram of a logical predicate BDD representation of a port in rule 1 according to an embodiment of the present application;

[0066] Figure 5 This is a schematic diagram of a logical predicate BDD representation of an IP address prefix in rule 1 of an embodiment of the present application;

[0067] Figure 6 This is a schematic diagram of a logical predicate BDD representation of rule 1 in one embodiment of the present application, which includes both a port and an IP address prefix;

[0068] Figure 7 This is a schematic diagram of a logical predicate BDD representation of rule 2 in one embodiment of the present application, which includes both a port and an IP address prefix;

[0069] Figure 8 This is a schematic diagram of a logical predicate BDD representation of the union of rule 1 and rule 2 according to an embodiment of the present application;

[0070] Figure 9 A flowchart of the actual scope of the coding and calculation rules of an embodiment of the present application;

[0071] Figure 10 This is a schematic diagram of the network topology-hardware device-logical function three-level network behavior model architecture of an embodiment of the present application;

[0072] Figure 11 A flowchart of constructing a three-level network behavior model of network topology-hardware equipment-logical function according to an embodiment of the present application;

[0073] Figure 12 This is a flowchart of identifying unsafe network behaviors and tracing unsafe network rules according to an embodiment of the present application;

[0074] Figure 13 Schematic diagram of a software-defined network flow rule security detection and tracing device according to an embodiment of the present application;

[0075] Figure 14 A schematic diagram of the structure of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0076] The following describes in detail embodiments of the present application. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0077] The following describes the software-defined network flow rule security detection and tracing method and device of the embodiment of the present application with reference to the accompanying drawings. In view of the technical problems that the related technologies mentioned in the above background technology only focus on network connectivity indicators without verifying the consistency of network behavior and network security policy, and the general verification tools used are difficult to adapt to the highly dynamic and large state space flow rules in the software-defined network, resulting in a slow verification process and no timeliness, the present application provides a software-defined network flow rule security detection and tracing method. In this method, by dynamically extracting the change information of security policies, forwarding rules and flow rules in the network from the software-defined network controller, it is ensured that the model can track and simulate the latest state of the network in real time; the abstract network security policy is concretized into security rules, and then the actual network behavior and security behavior model are established for comparative verification; the network verification calculation efficiency is improved by using efficient coding methods, dynamic incremental updates of network models and other technologies, and finally the detection and tracing of network black holes and flow rules that violate network security policies are achieved, thereby improving the security of software-defined network flow rules. Thus, the technical problems that it is difficult to verify the consistency of network behavior and network security policies in the related technologies and the general verification tools used are slow and do not have timeliness are solved, and the user experience is improved.

[0078] Specifically, Figure 1 A flowchart of a software-defined network flow rule security detection and tracing method provided in an embodiment of the present application.

[0079] like Figure 1 As shown, the software-defined network flow rule security detection and tracing method includes the following steps:

[0080] In step S101, the current network top-level security policy, forwarding rules and flow rules stored in the data plane are intercepted from the preset software-defined network controller, and the security policy is converted into a concrete security rule based on the preset conversion rule.

[0081] It should be noted that the embodiment of the present application takes different actions in the two situations of initial deployment to the software-defined network controller and continuous operation in the controller. In the first case, by writing a controller application or calling the API (Application Programming Interface) exposed by the controller, the controller internal module is queried for the currently effective network top-level security policy stored in the control plane, the forwarding rules calculated and determined by the forwarding module, and the flow rules sent to the data plane; in the second case, by writing a controller application, the controller internal module is interacted with, the change events of the rules of interest are subscribed, and the details of the changed rules are extracted. At the same time, this method will intercept the current change information and wait for the security test results of the subsequent steps for this change. If it does not introduce unsafe network behavior, this change will be sent to the control plane for execution. If there is a security problem, the embodiment of the present application will remain in the interception state and issue an alarm.

[0082] Furthermore, the rules directly obtained from the controller in the embodiment of the present application can be divided into two categories. The first category is clear and specific rules, such as the flow rules sent to the data plane for execution and the forwarding rules calculated by the forwarding module. This method extracts the fields that directly determine the network behavior from such rules and represents each rule in the form of a four-tuple. The second category is abstract and fuzzy policies, such as the top-level network security policy. Compared with the first category of rules, such policies lack fields such as priority and the hardware device that actually performs the operation. This method first represents each policy in the form of a two-tuple, then refines it into a set of specific rules, and finally represents each processed rule in the same four-tuple form as the first category of rules.

[0083] Furthermore, in some embodiments, the current network top-level security policy, forwarding rules, and flow rules stored in the data plane are intercepted from a preset software-defined network controller, and the security policy is converted into a concrete security rule based on a preset conversion rule, including: extracting the current network top-level security policy, forwarding rules, and flow rules stored in the data plane from the preset software-defined network controller, and extracting the strategy based on the preset network behavior characteristics, extracting network behavior characteristics from the security policy, forwarding rules, and flow rules respectively, to represent the security policy in the form of a binary tuple, and representing the forwarding rule in the form of a first quadruple, and representing the flow rule in the form of a second quadruple; based on the preset abstract network behavior specification, each security policy in the security policy is converted into a concrete security rule, and the concrete security rule is represented in the form of a third quadruple.

[0084] Furthermore, in some embodiments, the current network top-level security policy, forwarding rules and flow rules stored in the data plane are intercepted from a preset software-defined network controller, and the security policy is converted into a concrete security rule based on the preset conversion rules. It also includes: when the security policy, forwarding rules and / or flow rules change, the changed security policy, forwarding rules and / or flow rules are extracted; based on the preset network behavior feature extraction strategy, network behavior features are extracted from the changed security policy, forwarding rules and flow rules respectively.

[0085] Specifically, the embodiment of the present application obtains clear and specific network rules, such as Figure 2 、 Figure 3 As shown, the following steps are included:

[0086] S301, rule initialization: extract security policies, forwarding rules, and flow rules from the controller and express them in the form of two-tuples / four-tuples.

[0087] Specifically, the embodiment of the present application interacts with the internal modules of the controller by writing a controller application or calling the API exposed by the controller, extracting the set of top-level network security policies currently in effect in the controller (such as the ACL (Access Control List) input by the network administrator, the network security requirements of security applications such as firewalls, etc.) SP (security policy, security policy), the forwarding rule set FR (forwarding rule, forwarding rule) and the flow rule set FE (flow entry, flow rule) calculated and determined by the forwarding module. According to the features extracted from the rules, each forwarding rule FR and flow rule FE is represented as<match field,action,priority,switch> In the form of a quadruple, each security policy SP is represented as<match field,action> The form of a two-tuple. Match field is the matching domain, action is the action to be taken on the matching data packets, priority is the priority, and switch is the data plane hardware that processes the data packets.

[0088] S302, dynamic rule update: subscribe to rule changes from the controller, and express the changed policies and rules in the form of two-tuples / four-tuples.

[0089] Specifically, in order to adapt to the dynamic changes in network status and flow rules in software-defined networks, the embodiments of the present application trigger the above-mentioned process when the controller sends flow rule change information to the data plane (such as flow rule addition, update, deletion, etc.). The embodiments of the present application intercept the changed policies and rules through the written controller application, which are expressed in the form of the above-mentioned two-tuple and four-tuple respectively. After the inspection is completed to confirm that the change of the flow rule does not affect the network security attributes, the change information is pushed to the data plane hardware facilities.

[0090] S303, network security policy visualization: convert the abstract network security policy into a set of visualized security rules, expressed in the form of a quadruple.

[0091] The network security policy is merely an abstract network behavior specification stored in the control plane module of the software-defined network controller. Compared to flow rules, it does not specify the hardware device that actually performs the operation, nor does it have fields such as priority. The embodiment of the present application adopts the same processing logic as the module in the controller that converts the abstract policy into a rule instance, supplementing the priority and execution hardware information for the network security policy, converting it into a set of specific rules that can implement the security requirements of the policy, and representing this set of rules in the form of the aforementioned four-tuple. The set of security rules is denoted as SR.

[0092] In step S102, based on a preset data structure, security rules, forwarding rules and flow rules are encoded and stored, and the actual scope of each rule is calculated.

[0093] Among them, the predicate represents the range specified by all fields in the match field of each rule. The predicate is a Boolean formula, in which each variable represents a bit in the packet header or the rule matching field. A predicate can represent a set of packets / matching fields whose Boolean formula calculation results are true, and an empty set is specified if the predicate is false. The predicates of the embodiments of the present application are all represented by BDD, which is a rooted, directed acyclic graph. Logical operations can be efficiently performed on BDD using graph-based algorithms. When representing a rule with multiple matching fields, the predicate representation of each matching field can be calculated separately, and then the intersection of all matching fields can be taken, such as Figure 4 、 Figure 5 、 Figure 6 As shown, that is:

[0094] rule1=field1∧field2∧……∧field m

[0095] Here, when there are multiple rules with the same behavior, the predicates of all rules can be merged by taking the union method, such as Figure 7 、 Figure 8 As shown, that is:

[0096] predicate1=rule1∨rule2∨……∨rule n

[0097] It should be noted that the relevant literature describes BDD as having three advantages over other data structures (tuple representation, firewall decision graph, and wildcard expression) in representing predicates. (1) Unique representation: Given a predicate, its BDD representation is unique, so there is no need to spend time and computing power to verify whether different expressions are equivalent. (2) Representation efficiency: For rules specified by prefix or suffix, the number of nodes in the BDD graph representing a forwarding rule is ≤ 2 + n, where n is the number of bits in the destination address field. (3) Computational efficiency: Graph-based algorithms can be used to efficiently perform logical operations on BDDs.

[0098] Furthermore, in some embodiments, based on a preset data structure, security rules, forwarding rules and flow rules are encoded and stored, and the actual scope of each rule is calculated, including: encoding each rule based on the matchfield of any multiple fields into a unique matching domain logical predicate; removing the scope covered by the flow rules with higher priority from the matching domain logical predicate of each rule to obtain the actual scope logical predicate of each rule; and establishing a bidirectional mapping relationship between the security rules, forwarding rules and flow rules and the actual scope logical predicate respectively.

[0099] For example, if Figure 9 FIG. 1 is a flowchart of encoding and calculating the actual scope of a rule according to an embodiment of the present application. The embodiment of the present application calculates the actual scope predicate of the rule based on the rule matching field using the actual scope calculation algorithm and establishes a bidirectional mapping between the rule and the atomic predicate, including the following steps:

[0100] S901, calculate the matching domain predicate of each rule. Use the predicate to encode the match field of each rule based on any multiple fields (such as source IP address, destination IP address, source port number, destination port number, etc.) into a unique matching domain logical predicate, i.e., rp match .

[0101] S902, calculate the actual scope predicate. From the matching domain predicate rp of each rule match Eliminate the scope covered by the higher priority flow rules and obtain the actual scope predicate rp of the rule hit .

[0102] The embodiment of the present application uses atomic predicates to represent the actual scope predicate rp of all rules in a hardware device. hitThe set of all atomic predicates in a hardware device is called AP. AP can completely represent the entire state space of the flow rule matching domain, and the atomic predicates in the set {ap1, ap2, ..., ap n} has the following properties:

[0103] a)

[0104] b)

[0105] c)

[0106] d)

[0107] The actual scope predicate rp of each rule hit can be represented by the disjunction of a set of atomic predicates in AP, rp hit = true when S(rp hit )={1,2,…,n};rp hit =false

[0108] During the computation, each atomic predicate can be represented by a natural number. The disjunction / conjunction calculation of two predicates can be simplified to the union / intersection of two sets of natural numbers, effectively improving computational efficiency. This method does not merge atomic predicates to minimize the number of atomic predicates n; this allows for subsequent tracing back to specific rules based on the atomic predicates.

[0109] The algorithm for the actual scope of the rule varies depending on the rule status (insert, delete, and update). The rule that has been changed is called r, and the existing rules are called r. i (1) Insert a new rule and compare it with all existing rules. Update the actual scope predicate of the rule with lower priority; (2) delete the old rule, compare the new rule with all existing rules, and see if it satisfies r i .priority≤r.priority and When Update; (3) Update of old rules is equivalent to first deleting the old rules and then inserting the new rules.

[0110] In step S103, the actual behavior of data packets in the network and the security behavior that meets the security policy requirements are simulated through the pre-established network topology-hardware equipment-logical function network behavior model, unsafe network behavior is identified, and the unsafe network rules that cause the behavior are traced back.

[0111] For example, if Figure 10FIG. 1 is a schematic diagram of a three-level network behavior model architecture of network topology, hardware equipment, and logical function according to an embodiment of the present application, including:

[0112] (1) Logical function model, which is the logical usage function of the hardware device (i.e., forwarding, input security rules, output network security rules, and flow rules). Each logical function has its internal rules (i.e., security rules, forwarding rules, and flow rules) and a set of logical ports. The logical ports represent different operations on data packets (e.g., input, output to port 1, allow through, etc.).

[0113] (2) Hardware device model: Each hardware device has its actual physical port. In addition, the hardware device model also includes the type, quantity and topological relationship of the device's internal logical functions.

[0114] (3) Network topology model, including the types, quantity and topological relationships of hardware devices in the network.

[0115] Specifically, the embodiment of the present application first establishes a network topology model based on the internal information of the controller; then, various functional modules within each hardware are constructed based on the various rules obtained, that is, a mapping relationship is established between the data packets represented by the actual scope predicates and the logical operations represented by the logical function logical ports; finally, the internal topology of the hardware device is established, that is, based on the actual network behavior and network security behavior, a mapping and connection relationship between logical functions and between logical function logical ports and physical ports of hardware devices is established.

[0116] Furthermore, in some embodiments, before simulating the actual behavior of data packets in the network and the safe behavior that complies with security policy requirements through a pre-established network topology-hardware device-logical function network behavior model, identifying unsafe network behavior, and tracing back to the unsafe network rules that cause the behavior, it also includes: determining the type and quantity of hardware devices based on preset software-defined network controller information, and establishing a topological relationship between hardware based on the type and quantity of hardware devices to obtain a network topology model; constructing each logical function module in the hardware, establishing a mapping for each data packet and its corresponding logical operation, and obtaining a logical function model; establishing a mapping relationship and connection relationship between logical functions and between logical function logical ports and physical ports of hardware devices based on the actual network behavior and network security behavior to obtain a hardware device model; obtaining a pre-established network topology-hardware device-logical function network behavior model based on the network topology model, the logical function model and the hardware device model.

[0117] Specifically, if Figure 11 FIG. 1 is a flowchart of constructing a three-level network behavior model of network topology-hardware device-logical function according to an embodiment of the present application, including the following steps:

[0118] S1101, establish a network topology model, determine the types and quantities of hardware devices, and establish topological relationships between hardware devices.

[0119] Furthermore, the embodiments of the present application interact with the internal modules of the controller by writing a controller application or calling the API exposed by the controller, extracting network device and topology information from the controller, establishing hardware devices in the network according to the type, quantity and topological relationship of the hardware devices, and establishing connection relationships between hardware ports.

[0120] S1102, establishing a logical function model, constructing each logical function module in the hardware, and establishing a mapping for each data packet and its corresponding logical operation.

[0121] Specifically, each hardware device has only one flow rule logic function, which has one input logical port and multiple output logical ports. Among the output logical ports, the "default" port corresponds to data packets that cannot match any rule (that is, the packet drop operation is taken), and the remaining ports correspond one-to-one to the physical ports of the hardware device. Constructing the flow rule function is to establish a mapping from the functional logical port to the atomic predicate based on the flow rule set FE: the mapping from the output logical port to the atomic predicate is denoted as Action2Ap, the mapping from the atomic predicate to the output logical port is Ap2Action, the set of all output logical ports is Action, one output logical port is a, and a corresponds to the action field of the rule.

[0122] In each logical function model, each atomic predicate ap has only one corresponding logical port a, Ap2Action(ap) = a, a∈Action; each logical port corresponds to a set of atomic predicates, Action2Ap(a) = {ap∈AP|Ap2Action(ap) = a}.

[0123] It should be noted that, depending on the configuration, each hardware device has one forwarding logic function and several (or zero) input and output security policy logic functions. The construction process is similar to that of the flow rule logic function. The input and output security policy functions use the security rule set SR, while the forwarding function uses the forwarding rule set FR.

[0124] S1103: Establish a hardware device model, and establish mapping and connection relationships between logical functions and between logical function logical ports and physical ports of hardware devices based on actual network behavior and network security behavior.

[0125] Specifically, when simulating the actual behavior of the network, the data packet enters the physical input port of the hardware device, passes through the flow rule logic function, and is output to the designated physical output port or is discarded; when simulating the network security behavior, the data packet enters the physical input port of the hardware device, first passes through the input security rule logic function (if any), is output to the forwarding logic function input port or is discarded, and then is output to the output security rule logic function (if any) input port or is discarded, and finally is output to the designated physical output port or is discarded.

[0126] Furthermore, in some embodiments, through a pre-established network topology-hardware device-logical function network behavior model, the actual behavior of data packets in the network and the security behavior that meets the security policy requirements are simulated, unsafe network behavior is identified, and the source is traced to the unsafe network rules that cause the behavior, including: simulating the enforcement of network security policies, calculating the first predicate set that can reach each hardware output port under the enforcement of network security policies; simulating the non-enforcement of network security policies, calculating the second predicate set that can reach each hardware output port under the non-enforcement of network security policies; checking network black hole problems, and finding data packets that are not sent to a valid next-hop switch; identifying data packets that violate network security policies, and finding data packets with inconsistent behavior under the enforcement of network security policies and under the non-enforcement of network security policies; tracing back to the abnormal rules that cause network black holes and unsafe network behavior, outputting abnormalities to the network administrator, and issuing warnings, and sending flow rules that do not have abnormalities and network security risks to the data plane to officially take effect in the network.

[0127] Specifically, the embodiment of the present application simulates the situation where all possible data packets in the network space (i.e., the atomic predicate set AP in the network) are input from the physical ports of all hardware devices in the network. After the data packet enters the hardware device, different paths are selected according to the mandatory / non-mandatory execution of the security policy, and logical operations (such as taking the intersection) are performed with the predicates corresponding to the logical ports of the logical functions passed through, and finally a predicate set that can reach the specified destination physical port is obtained, and security issues existing in the network are identified through a specified algorithm.

[0128] For example, if Figure 12 FIG. 1 is a flowchart of identifying unsafe network behaviors and tracing unsafe network rules according to an embodiment of the present application, including the following steps:

[0129] S1201, simulating the enforcement of network security policies, and calculating the atomic predicates that can reach each hardware output port in this case.

[0130] Specifically, the embodiment of the present application takes the atomic predicate set AP in the network as its input for each port of all hardware devices in the network. After the AP enters the network, it passes through the input port security rule logic function, forwarding logic function, and output port security rule logic function in sequence, that is, Figure 10 As shown in the dotted path, each output port of the switch finally obtains a set of atomic predicates (eg, AP′1), which contains all atomic predicates that can reach the port.

[0131] S1202, simulating a non-mandatory execution of the network security policy, and calculating an atomic predicate that can reach each hardware output port in this case.

[0132] Specifically, the embodiment of the present application takes the atomic predicate set AP in the network as its input for each port of all hardware devices in the network, and only passes through the flow rule logic function after entering the network, that is, Figure 10 As shown in the solid line path, each output port of the switch finally obtains a set of atomic predicates (e.g., PP″1), which contains all atomic predicates that can reach the port.

[0133] S1203: Check the network black hole problem and find the data packets that are not sent to the valid next-hop switch.

[0134] Specifically, there are packets that are discarded by switches in the network, or the output port to which the packets are sent is not connected to other devices. Such packets are not sent to the valid next-hop switch, which is a network black hole. For each switch in the network, is the atomic predicate corresponding to the network black hole, where porti is the output port with a link connected to other hardware devices.

[0135] S1204, identifying data packets that violate the network security policy, and searching for data packets with inconsistent behaviors when the network security policy is enforced or not.

[0136] Specifically, for each output port of each switch in the network, compare AP′ porti With AP porti , record all inconsistent atomic predicates and get the atomic predicate set

[0137] S1205, traces back to the abnormal rules that cause network black holes and unsafe network behaviors, outputs the abnormalities to the network administrator, and issues a warning.

[0138] Specifically, for the abnormal atomic predicate set AP found in S1203 and S1204 blackhole ,AP insecure In this embodiment, each atomic predicate api The actual scope predicate fe for each flow rule j ·p hit Perform logical conjunction operation, if there is ap i ∧fe j ·p hit =ap i , then the flow rule fe j These are rules that specify network black holes or unsafe network behavior. Once the problem is traced back to the corresponding rule, the system reports anomalies and issues warnings to network administrators.

[0139] S1206: Change the security rules. For flow rules that do not contain any anomalies or network security risks, send them to the data plane and make them take effect in the network.

[0140] Those skilled in the art should understand that the above embodiments of the present application are merely examples for illustrating the present application, and are not intended to limit the implementation methods of the present application.

[0141] According to the software-defined network flow rule security detection and tracing method proposed in the embodiment of the present application, by dynamically extracting the change information of the security policy, forwarding rules and flow rules in the network from the software-defined network controller, it is ensured that the model can track and simulate the latest status of the network in real time; the abstract network security policy is concretized into security rules, and then the actual network behavior and security behavior model are established for comparative verification; the network verification calculation efficiency is improved by adopting efficient coding methods, dynamic incremental updates of network models and other technologies, and finally the detection and tracing of network black holes and flow rules that violate network security policies are achieved, thereby improving the security of software-defined network flow rules. In this way, the technical problems in related technologies that it is difficult to verify the consistency of network behavior and network security policies, and the general verification tools used are slow and not timely are solved, thereby improving the user experience.

[0142] Next, a software-defined network flow rule security detection and tracing device proposed according to an embodiment of the present application will be described with reference to the accompanying drawings.

[0143] Figure 13 It is a block diagram of a software-defined network flow rule security detection and tracing device according to an embodiment of the present application.

[0144] like Figure 13 As shown, the software-defined network flow rule security detection and tracing device 10 includes: a conversion module 100, a processing module 200 and an identification module 300.

[0145] The conversion module 100 is used to intercept the current network top-level security policy, forwarding rules and flow rules stored in the data plane from the preset software-defined network controller, and convert the security policy into a concrete security rule based on the preset conversion rules;

[0146] A processing module 200 is used to encode and store security rules, forwarding rules, and flow rules based on a preset data structure, and calculate the actual scope of each rule; and

[0147] The identification module 300 is used to simulate the actual behavior of data packets in the network and the security behavior that meets the security policy requirements through a pre-established network topology-hardware device-logical function network behavior model, identify unsafe network behavior, and trace it back to the unsafe network rules that cause the behavior.

[0148] Furthermore, in some embodiments, the conversion module 100 is specifically configured to:

[0149] Extracting the current network top-level security policy, forwarding rules, and flow rules stored in the data plane from a preset software-defined network controller, and extracting a strategy based on a preset network behavior feature, respectively extracting network behavior features from the security policy, forwarding rules, and flow rules, so as to represent the security policy in a two-tuple form, and represent the forwarding rule in a first four-tuple form, and represent the flow rule in a second four-tuple form;

[0150] Based on the preset abstract network behavior specifications, each security policy in the security policy is converted into a concrete security rule, and the concrete security rule is represented in the form of a third quadruple.

[0151] Furthermore, in some embodiments, the conversion module 100 is further configured to:

[0152] When security policies, forwarding rules and / or flow rules are changed, extract the changed security policies, forwarding rules and / or flow rules;

[0153] Based on the preset network behavior feature extraction strategy, network behavior features are extracted from the changed security policy, forwarding rules and flow rules respectively.

[0154] Furthermore, in some embodiments, the processing module 200 is specifically configured to:

[0155] Encode each rule's match field based on any number of fields into a unique match domain logical predicate;

[0156] Eliminate the scope covered by higher-priority flow rules from the matching domain logical predicate of each rule to obtain the actual scope logical predicate of each rule;

[0157] Furthermore, in some embodiments, before simulating the actual behavior of data packets in the network and the safe behavior that complies with security policy requirements using a pre-established network topology-hardware device-logical function network behavior model, identifying unsafe network behavior, and tracing the unsafe network rules that cause the behavior, the identification module 300 is further configured to:

[0158] Determine the type and quantity of hardware devices according to the preset software-defined network controller information, and establish the topological relationship between hardware devices according to the type and quantity of hardware devices to obtain a network topology model;

[0159] Construct each logical function module in the hardware, establish a mapping for each data packet and its corresponding logical operation, and obtain a logical function model;

[0160] Based on the actual network behavior and network security behavior, establish the mapping relationship and connection relationship between logical functions and between logical function logical ports and physical ports of hardware devices to obtain the hardware device model;

[0161] A pre-established network topology-hardware device-logical function network behavior model is obtained according to the network topology model, the logical function model and the hardware device model.

[0162] Furthermore, in some embodiments, the identification module 300 is specifically configured to:

[0163] Simulate the enforcement of network security policies and calculate the first set of predicates that can reach each hardware output port under the condition of network security policies being enforced;

[0164] Simulate the non-enforcement of network security policies and calculate the second predicate set that can reach each hardware output port under the non-enforcement of network security policies;

[0165] Check for network black hole issues and look for packets that are not sent to a valid next-hop switch;

[0166] Identify data packets that violate network security policies and find data packets that behave inconsistently when network security policies are enforced and when they are not enforced;

[0167] Trace the abnormal rules that cause network black holes and unsafe network behavior, output the abnormalities to the network administrator, issue a warning, and send the flow rules that do not have abnormalities and network security risks to the data plane to officially take effect in the network.

[0168] It should be noted that the above explanation of the embodiment of the software-defined network flow rule security detection and tracing method is also applicable to the software-defined network flow rule security detection and tracing device of this embodiment, and will not be repeated here.

[0169] According to the software-defined network flow rule security detection and tracing device proposed in the embodiment of the present application, by dynamically extracting the change information of the security policy, forwarding rules and flow rules in the network from the software-defined network controller, it is ensured that the model can track and simulate the latest status of the network in real time; the abstract network security policy is concretized into security rules, and then the actual network behavior and security behavior model are established for comparative verification; the network verification calculation efficiency is improved by adopting efficient coding methods, dynamic incremental updates of network models and other technologies, and finally the detection and tracing of network black holes and flow rules that violate network security policies are achieved, thereby improving the security of software-defined network flow rules. In this way, the technical problems in related technologies that it is difficult to verify the consistency of network behavior and network security policies, and the general verification tools used are slow and not timely are solved, thereby improving the user experience.

[0170] Figure 14 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may include:

[0171] Memory 1401 , processor 1402 , and computer programs stored in the memory 1401 and executable on the processor 1402 .

[0172] When the processor 1402 executes the program, the software-defined network flow rule security detection and tracing method provided in the above embodiment is implemented.

[0173] Furthermore, the electronic device further includes:

[0174] The communication interface 1403 is used for communication between the memory 1401 and the processor 1402 .

[0175] The memory 1401 is used to store computer programs that can be run on the processor 1402 .

[0176] The memory 1401 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0177] If the memory 1401, processor 1402, and communication interface 1403 are implemented independently, the communication interface 1403, memory 1401, and processor 1402 can be interconnected via a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be divided into address buses, data buses, control buses, etc. For ease of representation, Figure 12 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0178] Optionally, in a specific implementation, if the memory 1401, the processor 1402 and the communication interface 1403 are integrated on a chip, the memory 1401, the processor 1402 and the communication interface 1403 can communicate with each other through an internal interface.

[0179] The processor 1402 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0180] An embodiment of the present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned software-defined network flow rule security detection and tracing method.

[0181] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0182] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Thus, a feature specified as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of this application, "N" means at least two, for example, two, three, etc., unless otherwise specifically defined.

[0183] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may be performed out of the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present application belong.

[0184] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or N wires (electronic devices), a portable computer disk cartridge (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and a portable compact disc read-only memory (CDROM). Furthermore, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or otherwise processing it in a suitable manner if necessary, and then storing it in a computer memory.

[0185] It should be understood that various parts of the present application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiment, the N steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0186] Those skilled in the art will appreciate that all or part of the steps in the method for implementing the above-mentioned embodiment can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiment.

[0187] In addition, the functional units in the various embodiments of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into a module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0188] The storage medium mentioned above may be a read-only memory, a magnetic disk, or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present application. Persons skilled in the art may make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present application.

Claims

1. A software-defined network flow rule security detection and tracing method, characterized in that: The following steps are involved: Intercept the current network top-level security policy, forwarding rules, and flow rules stored in the data plane from the preset software-defined network controller, and convert the security policy into concrete security rules based on the preset conversion rules; Based on a preset data structure, encode and store the security rules, the forwarding rules, and the flow rules, and calculate the actual scope of each rule; as well as Through the pre-established network topology-hardware device-logical function network behavior model, the actual behavior of data packets in the network and the safe behavior that meets the security policy requirements are simulated, unsafe network behavior is identified, and the source is traced to the unsafe network rules that cause the behavior. Further, it includes: simulating the mandatory execution of network security policies, calculating the first predicate set that can reach each hardware output port when the network security policy is mandatory, simulating the non-mandatory execution of network security policies, calculating the second predicate set that can reach each hardware output port when the network security policy is non-mandatory, checking network black hole problems, and finding data packets that are not sent to the valid next-hop switch, identifying data packets that violate network security policies, finding data packets with inconsistent behaviors when the network security policy is mandatory and when the network security policy is non-mandatory, tracing back to the abnormal rules that cause network black holes and unsafe network behavior, outputting abnormalities to network administrators, and issuing warnings, and sending flow rules that do not have abnormalities and network security risks to the data plane to officially take effect in the network.

2. The method according to claim 1, characterized in that The method intercepts the current network top-level security policy, forwarding rules, and flow rules stored in the data plane from the preset software-defined network controller, and converts the security policy into concrete security rules based on the preset conversion rules, including: Extracting the current network top-level security policy, forwarding rules, and flow rules stored in the data plane from the preset software-defined network controller, and extracting network behavior features from the security policy, the forwarding rules, and the flow rules based on a preset network behavior feature extraction strategy, so as to represent the security policy in a two-tuple form, represent the forwarding rule in a first four-tuple form, and represent the flow rule in a second four-tuple form; Based on the preset abstract network behavior specification, each security policy in the security policy is converted into a concrete security rule, and the concrete security rule is represented in the form of a third quadruple.

3. The method according to claim 2, characterized in that The method further includes intercepting the current network top-level security policy, forwarding rules, and flow rules stored in the data plane from the preset software-defined network controller, and converting the security policy into a concrete security rule based on the preset conversion rule. When the security policy, the forwarding rule and / or the flow rule are changed, extracting the changed security policy, the forwarding rule and / or the flow rule; Based on a preset network behavior feature extraction strategy, network behavior features are extracted from the changed security policy, the forwarding rule, and the flow rule respectively.

4. The method according to claim 1, wherein The encoding and storing of the security rules, the forwarding rules, and the flow rules based on a preset data structure, and calculating the actual scope of each rule, include: Encode each rule based on any number of fields into a unique matching domain logical predicate; Eliminate the scope covered by the flow rule with a higher priority from the matching domain logical predicate of each rule to obtain the actual scope logical predicate of each rule; A bidirectional mapping relationship is established between the security rule, the forwarding rule, the flow rule and the actual scope logical predicate respectively.

5. The method according to claim 1, wherein Before simulating the actual behavior of data packets in the network and the safe behavior that complies with security policy requirements through the pre-established network topology-hardware device-logical function network behavior model, identifying unsafe network behavior, and tracing the unsafe network rules that cause the behavior, the following steps are also included: Determining the types and quantities of hardware devices according to the preset software-defined network controller information, and establishing a topological relationship between hardware devices according to the types and quantities of the hardware devices to obtain a network topology model; Construct each logical function module in the hardware, establish a mapping for each data packet and its corresponding logical operation, and obtain a logical function model; According to the actual network behavior and network security behavior, a mapping relationship and a connection relationship between logical functions and between logical function logical ports and the physical ports of the hardware device are established to obtain a hardware device model; The pre-established network topology-hardware device-logical function network behavior model is obtained according to the network topology model, the logical function model and the hardware device model.

6. A software-defined network flow rule security detection and tracing device, characterized in that: include: A conversion module, configured to intercept the current network top-level security policy, forwarding rules, and flow rules stored in the data plane from a preset software-defined network controller, and convert the security policy into concrete security rules based on preset conversion rules; a processing module, configured to encode and store the security rules, the forwarding rules, and the flow rules based on a preset data structure, and calculate an actual scope of each rule; as well as The identification module is used to simulate the actual behavior of data packets in the network and the safe behavior that meets the security policy requirements through a pre-established network topology-hardware device-logical function network behavior model, identify unsafe network behavior, and trace the source to the unsafe network rules that cause the behavior. Further, it is specifically used to: simulate the mandatory execution of network security policies, calculate the first predicate set that can reach each hardware output port when the network security policies are mandatory, simulate the non-mandatory execution of network security policies, calculate the second predicate set that can reach each hardware output port when the network security policies are non-mandatory, check network black hole problems, and find data packets that are not sent to the valid next-hop switch, identify data packets that violate network security policies, find data packets with inconsistent behavior when the network security policies are mandatory and when the network security policies are non-mandatory, trace the source to the abnormal rules that cause network black holes and unsafe network behavior, output the abnormalities to the network administrator, and issue a warning, and send the flow rules that do not have abnormalities and network security risks to the data plane to officially take effect in the network.

7. The device according to claim 6, characterized in that The conversion module is specifically used to: Extracting the current network top-level security policy, forwarding rules, and flow rules stored in the data plane from the preset software-defined network controller, and extracting network behavior features from the security policy, the forwarding rules, and the flow rules based on a preset network behavior feature extraction strategy, so as to represent the security policy in a two-tuple form, represent the forwarding rule in a first four-tuple form, and represent the flow rule in a second four-tuple form; Based on the preset abstract network behavior specification, each security policy in the security policy is converted into a concrete security rule, and the concrete security rule is represented in the form of a third quadruple.

8. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the software-defined network flow rule security detection and tracing method as described in any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the software-defined network flow rule security detection and tracing method as described in any one of claims 1 to 5.

Images