Message processing method, device and equipment, and storage medium

Abstract

The application provides a message processing method and device, equipment and storage medium, relates to the field of information security, and is used for improving the accuracy of network attack defense. The method comprises the following steps: intercepting a message set in a preset time window from a network communication device, and determining at least one access target involved in the message set and an entropy value of each access target; for any access target in the at least one access target, when the entropy value of the access target is in an abnormal range, determining the number of source network addresses corresponding to the source physical address of the access target according to a message sub-set corresponding to the access target in the message set; if the number is greater than a set number threshold, updating a message interception strategy according to an address information set involved in the message sub-set; and sending the updated message interception strategy to the network communication device, so that the network communication device performs message interception processing according to the updated message interception strategy.

Description

Technical Field

[0001] This application relates to the field of information security technology, specifically to a message processing method, apparatus, device, and storage medium. Background Technology

[0002] A Distributed Denial of Service (DDoS) attack is a network attack that sends a large number of data packets to a target Internet Protocol address (IP address), causing the target IP address's host device to suffer bandwidth consumption and service disruptions, thus preventing legitimate users from obtaining normal services. Defense against DDoS attacks typically involves the kernel protocol stack processing and filtering network data streams, determining whether a DDoS attack has occurred based on the source IP address of the data, and taking corresponding DDoS attack mitigation measures.

[0003] As network technology continues to develop and user demands continue to increase, the scale of internet traffic is becoming increasingly massive. As a result, the false positive rate of judging whether a DDoS attack has occurred solely based on the source IP address is gradually increasing, which is no longer sufficient to meet the current DDoS attack defense needs. Summary of the Invention

[0004] This application provides a message processing method, apparatus, device, and storage medium to improve the accuracy of network attack defense.

[0005] On the one hand, a message processing method is provided, the method comprising:

[0006] The network communication device intercepts a set of messages within a preset time window and determines at least one access target involved in the set of messages and the entropy value of each access target, wherein the entropy value is used to characterize the total number of accesses to each access target.

[0007] For any of the at least one access target, when the entropy value of the access target is outside the normal range, the number of source network addresses corresponding to the source physical address of the access target is determined based on the packet subset corresponding to the access target in the packet set.

[0008] If the number exceeds a set threshold, the packet interception policy is updated based on the set of address information involved in the packet subset.

[0009] The updated message interception policy is sent to the network communication device so that the network communication device can perform message interception processing based on the updated message interception policy.

[0010] On the one hand, a message processing apparatus is provided, comprising:

[0011] The interception unit is used to intercept a set of messages within a preset time window from the network communication device, and to determine at least one access target involved in the set of messages and the entropy value of each access target, wherein the entropy value is used to characterize the total number of accesses of each access target;

[0012] The determining unit is configured to, for any one of the at least one access target, when the entropy value of the access target is within an abnormal range, determine the number of source network addresses corresponding to the source physical address of the access target based on the packet subset corresponding to the access target in the packet set.

[0013] The update unit is used to update the packet interception strategy based on the set of address information involved in the packet subset if the number is greater than a set number threshold.

[0014] The sending unit is used to send the updated message interception policy to the network communication device, so that the network communication device can perform message interception processing based on the updated message interception policy.

[0015] Optionally, the determining unit is specifically used for:

[0016] For at least one source network address involved in the aforementioned message set, perform the following operations respectively:

[0017] For a given source network address, determine whether the source network address is located in a valid address table, which is obtained based on historically determined valid packets;

[0018] If the source network address is not in the legal address table, then the entropy value of the access target involved in the message corresponding to the source network address is determined.

[0019] Optionally, the determining unit is specifically used for:

[0020] If the source network address is in the legal address table, the packet corresponding to the source network address is stored in the cache queue, so that the packet can be read from the cache queue and sent to the corresponding access target.

[0021] Optionally, the determining unit is specifically used for:

[0022] If the number is not greater than the set number threshold, then each message in the message subset is determined to be a valid message;

[0023] Each message is stored in a cache queue, and messages are read from the cache queue and sent to the corresponding access target.

[0024] Optionally, the interception unit is specifically used for:

[0025] For each of the at least one access target, perform the following operations:

[0026] For a given access target, the entropy value corresponding to the access target is obtained based on the number of packets involving the access target within the preset time window and the total number of all packets within the preset time window.

[0027] Optionally, the interception unit is specifically used for:

[0028] The message set is stored in the user-space storage space, and a notification message is sent to the user-space detection program. The notification message contains the storage address information of the message set.

[0029] The user-space detection program reads the packet set based on the storage address information and determines at least one access target involved in the packet set and the entropy value of each access target.

[0030] On one hand, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of any of the above methods.

[0031] On the one hand, a computer storage medium is provided that stores computer program instructions thereon, which, when executed by a processor, implement the steps of any of the above methods.

[0032] On one hand, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of any of the methods described above.

[0033] The beneficial effects of the embodiments of this application are as follows:

[0034] In this embodiment, a set of packets within a preset time window is intercepted from the network communication device, and at least one access target involved in the packet set and the entropy value of each access target are determined. For any access target among the at least one access target, when the entropy value of the access target is within an abnormal range, the number of source network addresses corresponding to the source physical address of the access target is determined based on the packet subset corresponding to the access target in the packet set. If the number exceeds a set threshold, the packet interception policy is updated based on the address information set involved in the packet subset, and the updated packet interception policy is sent to the network communication device so that the network communication device can perform packet interception processing according to the updated packet interception policy. This embodiment calculates the entropy value by targeting the access target of the packet and combines it with the number of source network addresses corresponding to the source physical address of the access target to comprehensively determine whether the access target has been subjected to a DDoS attack. This avoids attackers from evading attack detection by means such as spoofing source IP addresses, and improves the accuracy of network attack defense compared to attack detection methods based on source IP addresses.

[0035] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0037] Figure 1 This is a schematic diagram illustrating an application scenario provided in the embodiments of this application;

[0038] Figure 2 A system architecture diagram of the message processing device provided in the embodiments of this application;

[0039] Figure 3 A flowchart illustrating a message processing method provided in an embodiment of this application;

[0040] Figure 4 A schematic diagram of a time window provided for an embodiment of this application;

[0041] Figure 5 A schematic diagram of the mapping table Table1 provided in the embodiments of this application;

[0042] Figure 6 A schematic diagram of the mapping table Table2 provided in an embodiment of this application;

[0043] Figure 7A schematic diagram of the mapping table Table3 provided in the embodiments of this application;

[0044] Figure 8 A flowchart illustrating another message processing method provided in an embodiment of this application;

[0045] Figure 9 This is a schematic diagram of the structure of the message processing apparatus provided in the embodiments of this application;

[0046] Figure 10 This is a schematic diagram of the composition structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. Unless otherwise specified, the embodiments and features in the embodiments of this application can be arbitrarily combined with each other. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0048] To facilitate understanding of the technical solutions provided in the embodiments of this application, some key terms used in the embodiments of this application will be explained below:

[0049] DDoS attacks are a type of network attack that uses a large number of legitimate distributed servers to send requests to a target, thereby preventing normal, legitimate users from obtaining services. They primarily involve continuously sending a large number of attack packets with forged source addresses to network service ports, causing the target server's half-open connection queue to become full, maliciously consuming the target server's bandwidth and host resources, ultimately leading to network or system overload and paralysis, and the cessation of normal network services. DDoS attacks can mutate like viruses, including common CC attacks, TCP / UDP / DNS / SYN / ICMP / NTP / SSDP / ACK / HTTP Flood attacks and their variants such as Land / Teardrop / Smurf / Ping of Death, etc.

[0050] The design concept of the embodiments of this application is briefly introduced below:

[0051] Currently, the main protection methods and handling processes against DDoS attacks involve network communication devices receiving network data packets sent by terminal devices, sending them to the kernel protocol stack for processing (generally the Linux kernel), obtaining information such as the source IP and destination IP of the terminal device corresponding to the data packet, and calculating a specific entropy value to determine whether the current service network is under a DDoS attack. Packets carrying out DDoS attacks are then dropped to protect the normal access of legitimate users. However, with the continuous development of network technology and the increasing demands of users, DDoS defense technologies and products are struggling to keep up with current technological development needs, mainly in the following aspects:

[0052] (1) As the scale of Internet traffic grows larger and larger, in the face of the network communication era of 1000Mbps / 10Gbps / 40Gbps, or even 100Gbps, the network communication device sends a large number of received messages to the kernel protocol stack for complex logic processing. However, the data processing efficiency of the kernel protocol stack can no longer keep up with the sending speed of the network communication device, resulting in low data processing efficiency. A large amount of data is waiting to be processed in the kernel protocol stack, and the waiting time increases significantly.

[0053] (2) Related technologies rely on the source IP address of data packets to determine whether a DDoS attack has been launched. However, the false positive rate is high. Furthermore, DDoS attacks can forge source IP addresses. Therefore, the source IP-based judgment method can no longer meet the accuracy requirements of current DDoS attack defense.

[0054] In view of the above problems, this application provides a message processing method that intercepts a set of messages within a preset time window from a network communication device and determines at least one access target involved in the message set and the entropy value of each access target. For any access target among the at least one access target, when the entropy value of the access target is within an abnormal range, the number of source network addresses corresponding to the source physical address of the access target is determined based on the message subset corresponding to the access target in the message set. If this number exceeds a set threshold, the message interception policy is updated based on the address information set involved in the message subset, and the updated message interception policy is sent to the network communication device so that the network communication device performs message interception processing according to the updated message interception policy. This application calculates the entropy value by targeting the access target of the message and combines it with the number of source network addresses corresponding to the source physical address of the access target to comprehensively determine whether the access target has been subjected to a DDoS attack. This avoids attackers from evading attack detection by means such as spoofing source IP addresses, and improves the accuracy of network attack defense compared to attack detection methods based on source IP addresses.

[0055] To improve message processing efficiency, this application embodiment also intercepts network message data packets on the receiving path from the network communication device to the kernel protocol stack, so that message data packets with DDoS attack threats are processed before entering the Linux kernel protocol stack, thereby improving data packet processing performance.

[0056] The following is a brief introduction to the application scenarios to which the technical solutions of the embodiments of this application are applicable. It should be noted that the application scenarios described below are only for illustrating the embodiments of this application and are not intended to limit the scope. In specific implementation, the technical solutions provided by the embodiments of this application can be flexibly applied according to actual needs.

[0057] The technical solutions provided in this application can be applied to network attack defense scenarios for various network devices, such as... Figure 1 The diagram shown is an application scenario diagram provided by an embodiment of this application. In this scenario, there may be a message processing device 100, an attack client 101, a legitimate client 102, a protection server 103, and a network 104.

[0058] The message processing device 100 can be a computer device with certain processing capabilities, such as a mobile phone, a personal computer (PC), or a server, and can be configured to execute any of the methods provided in this application embodiment. For ease of description, the following description uses a server capable of executing the method as the execution subject to illustrate the implementation of the method. It should be understood that using a server as the execution subject is merely an illustrative example and should not be construed as a limitation of the method. The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms, but is not limited to these.

[0059] Both the attacking client 101 and the legitimate client 102 can be applications installed on devices such as mobile phones, personal computers (PCs), tablets (PADs), laptops, desktop computers, and mobile internet devices (MIDs) to access the service port of the protection server and send message data packets to the protection server. This application embodiment does not impose specific limitations.

[0060] The protection server 103 is a computer device protected by the message processing method provided in this application embodiment, such as a server, router, gateway device, etc. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms, but it is not limited to these.

[0061] In practical applications, both attacking clients and legitimate clients send messages to the protection server, which first arrive at the message processing device. The message processing device processes the received messages based on the message processing method provided in this application embodiment, and determines whether the client corresponding to the message is an attacking client based on the processing result. If it is determined that the client corresponding to the message is an attacking client, the attack message is discarded. If it is determined that the client corresponding to the message is not an attacking client, the message is sent to the corresponding protection server, thus allowing the message to reach the corresponding protection server, so as to achieve the purpose of defending against DDoS attacks against the protection server.

[0062] The message processing device 100, the attack client 101, the legitimate client 102, and the protection server 103 can be connected via a network 104. This network 104 can be a wired network or a wireless network. For example, the wireless network can be a mobile cellular network, such as a fourth-generation (4G) network, a fifth-generation (5G) network, or a New Radio (NR) network, or it can be a Wireless-Fidelity (WIFI) network. Of course, it can also be other possible networks, and this embodiment of the invention does not limit them.

[0063] It should be noted that, Figure 1 The examples shown are merely illustrative. In reality, the number of message processing devices, attacking clients, legitimate clients, and protection servers is unlimited and is not specifically limited in this embodiment.

[0064] like Figure 2 The diagram shown is a system architecture diagram of the message processing device provided in this application embodiment. The message processing device specifically includes the following modules:

[0065] (1) The forwarding channel module is used to intercept network packets sent to the kernel protocol stack from network communication devices such as network cards, and to obtain the latest legal address table from the list storage module. When the source network address of the network packet is not in the legal address table, the network packet is forwarded to the packet detection module for attack detection; otherwise, the network packet is forwarded to the cache queue module, and packets are read from the cache queue module in sequence and sent to the corresponding access target.

[0066] (2) List storage module, which stores a legal address table containing a set of source network addresses corresponding to multiple legal clients, used to query whether the source network address of the network packet exists in the legal address table when the forwarding channel module intercepts the network packet from the network communication device.

[0067] (3) A message detection module is used to detect the legitimacy of network messages by considering the access target, entropy value, and the number of source network addresses corresponding to the source physical address of the access target. Legitimate messages are stored in a cache queue module, and the message interception policy is updated and sent to the forwarding channel module based on the address information of illegal messages. The forwarding channel module then sends the updated message interception policy to the network communication device so that the network communication device can perform message interception processing.

[0068] (4) Cache queue module: Stores valid messages to be sent to the corresponding access target through cache queue, controls and balances the message sending and receiving speed, and avoids packet loss when the forwarding channel module receives data packets faster than it sends data packets.

[0069] (5) Alarm monitoring module, which is used to send the attack information corresponding to the illegal message to the associated terminal device through the communication protocol when the attack detection module detects illegal message, so as to provide network attack alarm reminder.

[0070] It should be noted that Figure 2 The components and structures shown in the functional module architecture diagram are merely exemplary and not restrictive. In real-world scenarios, other components and structures may be included as needed.

[0071] The message processing method provided by the exemplary embodiments of this application will be described below with reference to the accompanying drawings and the application scenarios described above. It should be noted that the application scenarios described above are only shown to facilitate understanding of the spirit and principles of this application, and the embodiments of this application are not limited in any way in this respect.

[0072] See Figure 3 The diagram shown is a flowchart of the message processing method provided in this application embodiment. The example uses a message processing device as the execution subject. The specific implementation flow of this method is as follows:

[0073] Step 301: Intercept the set of messages within a preset time window from the network communication device, and determine at least one access target involved in the message set and the entropy value of each access target.

[0074] In this embodiment of the application, the message processing device intercepts the set of messages sent to the kernel protocol stack from network communication devices such as network cards through the forwarding channel module, and determines the multiple access targets involved by the set of messages within the time window, as well as the entropy value representing the total number of accesses to each access target.

[0075] In one possible implementation, the specific service port of the server accessed by the message can be determined based on the source MAC address, destination IP address, and destination port information contained in the message. The entropy value of each access target represents the number of times the message set accesses the access target. The entropy value of the access target can be used to determine whether there are any illegal messages in the messages received by the access target.

[0076] In one possible implementation, the forwarding channel module can intercept all network packets from the network interface card (NIC) via the Express DataPath (XDP) program. XDP offers superior data processing performance compared to the kernel protocol stack XDP. Before network packets enter the kernel protocol stack, XDP redirects them to a memory buffer in the user-space application for processing, reducing CPU processing time.

[0077] In one possible implementation, when packet data is intercepted and forwarded by XDP to the user-space memory buffer, in order to distinguish between the instantaneous traffic congestion that may be caused by DDoS attacks and a large number of legitimate users accessing the service, the user-space application can use sliding window technology to process the packet data. For example... Figure 4 As shown, the unit of the time window is a data packet. The window size can be preset to 100 data packets, for example. A mapping table is constructed using the 5-tuple information of the 100 data packets in the time window. Of course, it can also be set to other possible values. This application embodiment does not limit this.

[0078] For example, multiple mapping tables can be constructed using key-value pairs by utilizing the source IP address, source port, destination IP address, destination port, and other information included in the five-tuple information of the message data packet.

[0079] Among them, such as Figure 5 As shown, the key in the mapping table Table1 stores the source MAC address corresponding to 100 data packets in this time window, and the value, which corresponds one-to-one with the key, stores the source IP address, destination IP address, and destination port of the data packet.

[0080] like Figure 6 As shown, the key in the mapping table Table2 stores the information set of the source MAC address, destination IP address and destination port corresponding to each of the 100 data packets in the time window, which is used to indicate the access target corresponding to the data packet. The value key, which corresponds one-to-one with the key key, stores the access number corresponding to the access target. The packet detection module can determine the access target involved in the packet data and the entropy value corresponding to the access target through Table2.

[0081] In one possible implementation, such as Figure 7 As shown, a mapping table Table3 can also be constructed to record the access targets involved in historical packet data and the entropy values ​​corresponding to the access targets. In the mapping table Table3, the key stores the source MAC address, destination IP address, and destination port corresponding to the packet data. The value, which corresponds one-to-one with the key, stores the entropy value corresponding to the packet data. If a new corresponding entropy value is calculated for the key value, the value stored in Table3 will be updated. Table3 will be cleared every preset time and reconstructed to correspond to the latest time window.

[0082] In one possible implementation, as described above Figure 5 As shown, the message detection module determines the entropy value corresponding to each access target involved in the message set by using the number of messages involving each access target within a preset time window and the total number of all messages within the preset time window.

[0083] For example, the current time window is divided into groups of 20 packets each, resulting in five groups. Using a mapping table (Table2), the number of accesses corresponding to the source MAC address, destination IP address, and destination port of each of the five groups of packets within the current time window is counted. The ratio of the number of accesses to the destination of each of the five groups of packets to the total number of accesses to all destinations within the current time window is calculated. Then, using the entropy calculation formula, the entropy value corresponding to this ratio is calculated within the current time window. The entropy value is used to accurately determine whether the specific service port of the protected server is under a DDoS attack, as shown below:

[0084]

[0085] H(x)=-∑P(x)log2P(x),x={x1,x2,x3,x4,x5}

[0086] Here, all data packets in the current time window are divided into multiple groups of equal size for calculation. x represents the number of data packet groups. For example, dividing the current time window into groups of 20 data packets results in five groups: x1 (data packets 1-20 in the first group), x2 (data packets 21-40 in the second group), x3 (data packets 41-60 in the third group), x4 (data packets 61-80 in the fourth group), and x5 (data packets 81-100 in the second group). P(x) is the ratio of the number of accesses corresponding to the access target of this group of data packets to the total number of accesses corresponding to the access targets of all data packets in the current time window. H(x) is the entropy value of all data packets in the current time window.

[0087] In one possible implementation, before making the above judgment, the forwarding channel module can combine the legal address table provided by the list storage module to match the network packet data with the legal address table for preliminary legality determination, thereby reducing the processing pressure on the device. For multiple source network addresses involved in the packet set, it is determined whether each source network address is in the legal address table. If the source network address is not in the legal address table, the entropy value of the access target involved in the packet corresponding to the source network address is determined. If the source network address is in the legal address table, the packet corresponding to the source network address is stored in the cache queue, so that the packet can be read from the cache queue and sent to the corresponding access target.

[0088] For example, the legitimate address table is statistically obtained by the list storage module based on the detection results of historical packet data by the packet detection module. Unlike related technologies that use a single hash table to store data, the list storage module utilizes Bloom filter technology, optimizing multiple hash functions through calculation and extensive experimentation. This reduces the memory occupied by the legitimate address table when storing a large amount of legitimate IP address information, and also allows for faster data retrieval and a lower probability of collisions. When the Bloom filter stores the legitimate address table, after receiving a packet data, the forwarding channel module first extracts the source IP address of the packet data and queries it in the legitimate address table provided by the Bloom filter. When a packet arrives, it checks whether the source IP address exists. If it does, the packet corresponding to the source network address is stored in the cache queue; otherwise, it is sent to the packet detection module for subsequent entropy calculation and other processes to determine whether the packet is an illegal packet.

[0089] Step 302: For any one of the at least one access target, when the entropy value of the access target is outside the normal range, determine the number of source network addresses corresponding to the source physical address of the access target based on the packet subset corresponding to the access target in the packet set.

[0090] In this embodiment, the message detection module calculates the entropy value corresponding to the access target and also needs to determine whether the entropy value is within the normal range. When the entropy value is determined to be within the abnormal range, the legality of the message is further determined by the number of source network addresses corresponding to the source physical address of the access target.

[0091] In one possible implementation, the packet detection module can determine whether the entropy value corresponding to the access target is within a normal range by judging whether the entropy value is greater than a preset entropy threshold. If the entropy value is less than or equal to the preset entropy threshold, it is determined that the entropy value is within an abnormal range. The situation where the entropy value is less than or equal to the preset entropy threshold and is within an abnormal range could indicate not only that the access target is suffering from a DDoS attack, but also short-term congestion caused by a large number of legitimate data packets accessing the target. Therefore, it is necessary to combine other methods for further judgment, such as determining the number of source network addresses corresponding to the source physical address of the access target to further determine the legitimacy of the packet.

[0092] In one possible implementation, if it is determined that the entropy value corresponding to the access target is greater than a preset entropy value threshold and is within the normal range, then the source IP address of the client corresponding to the packet is determined to be valid, and the source IP address is stored in the valid address table in the list storage module to avoid repeated calculation of the entropy value.

[0093] Step 303: Determine whether the number of source network addresses corresponding to the source physical address of the access target is greater than a preset number threshold. If yes, proceed to step 304; otherwise, proceed to step 305.

[0094] In this embodiment of the application, the message detection module determines the legality of the message by judging whether the number of source network addresses corresponding to the source physical address of the access target is greater than a preset number threshold.

[0095] In one possible implementation, the packet detection module can determine whether the source MAC address of the access target corresponds one-to-one with the source IP address by using the source MAC address stored in the key of the mapping table Table1 and the corresponding source IP address, destination IP address, and destination port stored in the value. Since DDoS attacks forge a large number of source IP addresses, when it is determined that the source MAC address of the access target in Table1 has multiple corresponding source IP addresses, it can be determined that the access target is under DDoS attack and the packet is an illegal packet. If it is determined that a source MAC address of the access target corresponds to only one source IP address, it means that the client corresponding to the packet is a normal and legitimate access user, and the source IP address is stored in the legitimate address table in the list storage module so that it can be directly distributed without checking its legitimacy during subsequent distribution, thus improving the efficiency of packet distribution.

[0096] Step 304: Update the packet interception policy based on the set of address information involved in the packet subset.

[0097] In this embodiment of the application, after the message detection module determines that the message subset is an illegal message, it updates the corresponding message interception policy according to the address information involved.

[0098] For example, the address information set can be a combination of source MAC address, destination IP and destination port involved in the packet subset. By updating the corresponding packet loss policy, the packets corresponding to the combination of information can be intercepted and dropped to achieve the purpose of defending against DDoS attacks.

[0099] Step 305: Store each packet in the packet subset corresponding to the access target to the cache queue, so as to read the packet from the cache queue and send it to the corresponding access target.

[0100] In this embodiment of the application, after the message detection module determines that the message subset is a legitimate message, it stores each message in the cache queue module to achieve normal data communication.

[0101] For example, since the XDP technology used by the forwarding channel module does not have a corresponding queue buffering mechanism, packet loss may occur when XDP receives data packets faster than it sends them. Therefore, the buffer queue module controls and balances the speed at which XDP sends and receives packets, thereby avoiding packet loss events.

[0102] Step 306: Send the updated message interception policy to the network communication device so that the network communication device can perform message interception processing based on the updated message interception policy.

[0103] In this embodiment, the message detection module updates the message interception policy and sends it to the forwarding channel module, which then sends it to network communication devices such as the network card. This enables the network communication devices to intercept and discard the corresponding messages according to the message information indicated by the message interception policy, thereby achieving the purpose of defending against DDoS attacks.

[0104] For example, XDP can use Berkeley Packet Filter (BPF) technology to download packet interception policies as bytecode into network devices such as network interface cards (NICs). Based on these packet interception policies, the NICs use an embedded neural network processing unit (NPU) to drop the corresponding illegal packets, thereby achieving the function of defending against DDoS attacks.

[0105] In one possible implementation, such as Figure 8The following is a detailed implementation flow of a message processing method provided in an embodiment of this application:

[0106] Step 801: Initialize the time window.

[0107] Step 802: Receive message data packets within the current time window.

[0108] Step 803: Extract the quintuple information from the message data packet and construct mapping tables Table1 and Table2 based on the information.

[0109] Step 804: Calculate the entropy value of the access target in the current time window based on the source MAC address, destination IP address and destination port information indicated in the mapping table Table2, and the corresponding number of accesses.

[0110] Step 805: Determine whether the entropy value is less than the preset entropy threshold. If yes, proceed to step 806; otherwise, proceed to step 807.

[0111] Step 806: Based on the source MAC address of the access target, determine whether the number of source network addresses corresponding to the source MAC address in the mapping table Table1 is greater than a set threshold. If yes, proceed to step 808; otherwise, proceed to step 807.

[0112] Step 807: Store the message data packet in the cache queue module.

[0113] Step 808: Update the packet interception policy based on the source MAC address, destination IP address, and destination port information, and send it to the network card so that the network card can perform the corresponding packet interception processing according to the packet interception policy.

[0114] Step 809: Clear the information of the current time window, as well as the mapping tables Table1 and Table2 of the current time window.

[0115] Please see Figure 9 Based on the same inventive concept, embodiments of this application also provide a message processing apparatus 9, which includes:

[0116] The interception unit 901 is used to intercept a set of messages within a preset time window from the network communication device, and to determine at least one access target involved in the message set and the entropy value of each access target. The entropy value is used to characterize the total number of accesses of each access target.

[0117] The determining unit 902 is used to determine the number of source network addresses corresponding to the source physical address of the access target when the entropy value of the access target is in an abnormal range for any access target among at least one access target; based on the packet subset corresponding to the access target in the packet set.

[0118] The update unit 903 is used to update the packet interception policy based on the set of address information involved in the packet subset if the number exceeds a set threshold.

[0119] The sending unit 904 is used to send the updated message interception policy to the network communication device so that the network communication device can perform message interception processing based on the updated message interception policy.

[0120] Optionally, unit 902 is specifically used for:

[0121] For each of the at least one source network address involved in the packet set, perform the following operations:

[0122] For a given source network address, determine whether the source network address is in the valid address table, which is obtained based on historically determined valid packets;

[0123] If the source network address is not in the valid address table, then determine the entropy value of the access target involved in the message corresponding to the source network address.

[0124] Optionally, unit 902 is specifically used for:

[0125] If the source network address is in the valid address table, the packet corresponding to the source network address is stored in the cache queue, so that the packet can be read from the cache queue and sent to the corresponding access target.

[0126] Optionally, unit 902 is specifically used for:

[0127] If the number is not greater than the set number threshold, then each message in the message subset is determined to be a valid message;

[0128] Each message is stored in a cache queue, so that messages can be read from the cache queue and sent to the corresponding access target.

[0129] Optionally, the interception unit 901 is specifically used for:

[0130] For at least one access target, perform the following operations respectively:

[0131] For a given access target, the entropy value corresponding to the access target is obtained based on the number of packets involving the access target within a preset time window and the total number of all packets within the preset time window.

[0132] Optionally, the interception unit 901 is specifically used for:

[0133] The message set is stored in the user-space storage space, and a notification message is sent to the user-space detection program. The notification message contains the storage address information of the message set.

[0134] The user-space detection program reads the packet set based on the storage address information and determines at least one access target involved in the packet set and the entropy value of each access target.

[0135] The aforementioned device intercepts a set of packets within a preset time window from a network communication device, identifies at least one access target involved in the packet set, and determines the entropy value of each access target. For any access target among the at least one access target, if the entropy value of that access target is within an abnormal range, the device determines the number of source network addresses corresponding to the source physical address of the access target based on the packet subset corresponding to the access target in the packet set. If this number exceeds a set threshold, the device updates the packet interception policy based on the address information set involved in the packet subset and sends the updated packet interception policy to the network communication device, enabling the network communication device to perform packet interception processing according to the updated policy. This device calculates the entropy value based on the access target targeted by the packet and combines this with the number of source network addresses corresponding to the source physical address of the access target to comprehensively determine whether the access target has been subjected to a DDoS attack. This prevents attackers from evading attack detection by means such as spoofing source IP addresses, thus improving the accuracy of network attack defense compared to attack detection methods based on source IP addresses.

[0136] For ease of description, the above sections are divided into functional units (or modules) and described separately. Of course, in implementing this application, the functions of each unit (or module) can be implemented in one or more software or hardware components. This device can be used to execute the methods shown in the embodiments of this application; therefore, the functions that each functional module of the device can achieve can be referred to the descriptions of the foregoing embodiments, and will not be repeated here.

[0137] Please see Figure 10 Based on the same technical concept, embodiments of this application also provide a computer device. In one embodiment, the computer device, as shown in the figure, may include a memory 1001, a communication module 1003, and one or more processors 1002.

[0138] The memory 1001 is used to store computer programs executed by the processor 1002. The memory 1001 may mainly include a program storage area and a data storage area, wherein the program storage area may store the operating system; and the data storage area may store various operation instruction sets, etc.

[0139] Memory 1001 may be volatile memory, such as random-access memory (RAM); memory 1001 may also be non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD), or solid-state drive (SSD); or memory 1001 may be any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 1001 may be a combination of the above-described memories.

[0140] The processor 1002 may include one or more central processing units (CPUs) or digital processing units, etc. The processor 1002 is used to implement the above-described message processing method when it calls a computer program stored in the memory 1001.

[0141] The communication module 1003 is used to communicate with other network devices.

[0142] This application embodiment does not limit the specific connection medium between the memory 1001, communication module 1003, and processor 1002. This application embodiment... Figure 10 The memory 1001 and the processor 1002 are connected via a bus 1004, and the bus 1004 is in Figure 10 The diagram uses thick lines to describe the connections between other components; these are for illustrative purposes only and should not be considered limiting. Bus 1004 can be divided into address bus, data bus, control bus, etc. For ease of description, Figure 10 It is described using only a thick line, but does not indicate that there is only one bus or one type of bus.

[0143] The memory 1001 stores a computer storage medium, which stores computer-executable instructions for implementing the message processing methods of the embodiments of this application. The processor 1002 is used to execute the message processing methods of the above embodiments.

[0144] Based on the same inventive concept, embodiments of this application also provide a storage medium storing a computer program, which, when executed on a computer, causes the computer processor to perform the steps in the message processing methods according to various embodiments of this application described above.

[0145] In some possible implementations, various aspects of the message processing method provided in this application can also be implemented as a program product, which includes program code. When the program product is run on a computer device, the program code is used to cause the computer device to perform the steps in the message processing method according to various exemplary embodiments of this application described above. For example, the computer device can perform the steps of each embodiment.

[0146] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0147] The program product of the embodiments of this application may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a computing device. However, the program product of this application is not limited thereto. In this application, the readable storage medium may be any tangible medium that contains or stores a program that may be used by or in conjunction with a command execution system, apparatus, or device.

[0148] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with a command execution system, apparatus, or device.

[0149] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0150] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0151] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0152] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0153] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0154] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0155] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A message processing method, characterized in that, The method includes: The network communication device intercepts a set of packets within a preset time window and determines at least one access target involved in the packet set and the entropy value of each access target. The access target involved in each packet in the packet set is a set of information about the source MAC address, destination IP address and destination port of each packet. The entropy value of each access target is determined based on the ratio of the total number of accesses of each access target to the total number of packets included in the packet set within the preset time window. For any of the at least one access target, when the entropy value of any access target is outside the normal range, the number of source network addresses corresponding to the source physical address of any access target is determined based on the packet subset corresponding to any access target in the packet set. If the number of source network addresses corresponding to the source physical address of any of the access targets is greater than a set number threshold, then based on the address information set involved in the packet subset, the packet interception policy is updated. The updated packet interception policy indicates that the packets corresponding to the address information set are intercepted. The updated message interception policy is sent to the network communication device so that the network communication device can perform message interception processing based on the updated message interception policy.

2. The method as described in claim 1, characterized in that, Determining at least one access target involved in the message set and the entropy value of each access target includes: For at least one source network address involved in the aforementioned message set, perform the following operations respectively: For a given source network address, determine whether the source network address is located in a valid address table, which is obtained based on historically determined valid packets; If the source network address is not in the legal address table, then the entropy value of the access target involved in the message corresponding to the source network address is determined.

3. The method as described in claim 2, characterized in that, After determining whether a source network address is in the valid address table for a given source network address, the method further includes: If the source network address is in the legal address table, the packet corresponding to the source network address is stored in the cache queue, so that the packet can be read from the cache queue and sent to the corresponding access target.

4. The method as described in claim 1, characterized in that, After determining the number of source network addresses corresponding to the source physical address of any access target based on the subset of packets corresponding to any access target in the packet set, the method further includes: If the number of source network addresses corresponding to the source physical address of any access target is not greater than the set number threshold, then each packet in the packet subset is determined to be a valid packet. Each message is stored in a cache queue, and messages are read from the cache queue and sent to the corresponding access target.

5. The method according to any one of claims 1 to 4, characterized in that, Determining at least one access target involved in the message set within the preset time window and the entropy value of each access target includes: For each of the at least one access target, perform the following operations: For a given access target, the entropy value corresponding to the access target is obtained based on the number of packets involving the access target within the preset time window and the total number of all packets within the preset time window.

6. The method according to any one of claims 1 to 4, characterized in that, After intercepting the set of messages within a preset time window from the network communication device, the method further includes: The message set is stored in the user-space storage space, and a notification message is sent to the user-space detection program. The notification message contains the storage address information of the message set. Determining at least one access target involved in the message set and the entropy value of each access target includes: The user-space detection program reads the packet set based on the storage address information and determines at least one access target involved in the packet set and the entropy value of each access target.

7. A message processing apparatus, characterized in that, The device includes: An interception unit is configured to intercept a set of packets within a preset time window from a network communication device, and determine at least one access target involved in the packet set and the entropy value of each access target. The access target involved in each packet in the packet set is a set of information about the source MAC address, destination IP address, and destination port of each packet. The entropy value of each access target is determined based on the ratio of the total number of accesses of each access target to the total number of packets included in the packet set within the preset time window. The determining unit is configured to, for any one of the at least one access target, when the entropy value of any one access target is within an abnormal range, determine the number of source network addresses corresponding to the source physical address of any one access target based on the packet subset corresponding to any one access target in the packet set. The update unit is used to update the packet interception policy based on the address information set involved in the packet subset if the number of source network addresses corresponding to the source physical address of any access target is greater than a set number threshold. The updated packet interception policy indicates that the packets corresponding to the address information set should be intercepted. The sending unit is used to send the updated message interception policy to the network communication device, so that the network communication device can perform message interception processing based on the updated message interception policy.

8. A computer device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When a computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 6.

Images