Network flow detection method and device

Abstract

The present application discloses a network traffic detection method and device, which relates to the field of network security technology. The method of the present application is applied to a container firewall, which is arranged between the network layer and the link layer of the container engine, and the container firewall is used to detect the network traffic received by the link layer. The method of the present application includes: capturing the network traffic from the traffic port of the link layer through a preset hook function, and detecting the network traffic to obtain a detection result; wherein the preset hook function is used to monitor the traffic port in real time, and capture the network traffic when it is monitored; when the detection result is normal, forwarding the network traffic to the network layer, so as to be transmitted to the service container corresponding to the network traffic through the network layer; when the detection result is abnormal, intercepting and discarding the network traffic.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network traffic detection method and device. Background Art

[0002] With the continuous increase of network attacks, the detection of network traffic has become particularly important in order to ensure security.

[0003] At present, the existing network traffic detection methods are generally based on virtual firewalls, especially virtual firewalls set in container engines. In the existing network traffic detection process, the protection layer built by the virtual firewall is used as the outermost layer of the entire container engine. That is to say, in the process of receiving network traffic, the port information in the network traffic needs to be modified to the port information of the virtual firewall, and then the detection is performed, and after the detection is completed, the port information of the network traffic is modified back to the original port information. That is to say, in the entire network traffic detection process, the path of the network traffic needs to be constantly adjusted to adapt to the container engine with the virtual firewall added. This makes the processing process in the existing network traffic detection process more complicated, which seriously affects the detection efficiency. Summary of the invention

[0004] The embodiments of the present application provide a network traffic detection method and device, the main purpose of which is to implement a network traffic detection method to solve the problem that the processing process in the current network traffic detection process is relatively complicated and affects the detection efficiency.

[0005] In order to solve the above technical problems, the embodiments of the present application provide the following technical solutions:

[0006] In a first aspect, the present application provides a network traffic detection method, which is applied to a container firewall, wherein the container firewall is arranged between the network layer and the link layer of the container engine, and the container firewall is used to detect the network traffic received by the link layer, and the method includes:

[0007] Capturing the network traffic from the traffic port of the link layer through a preset hook function, and detecting the network traffic to obtain a detection result; wherein the preset hook function is used to monitor the traffic port in real time and capture the network traffic when it is detected;

[0008] When the detection result is normal, forwarding the network traffic to the network layer so as to be transmitted to the service container corresponding to the network traffic through the network layer;

[0009] When the detection result is abnormal, the network traffic is intercepted and discarded.

[0010] Optionally, the container firewall includes a traffic access port;

[0011] The capturing of the network traffic from the traffic port of the link layer through a preset hook function includes:

[0012] The traffic port of the link layer is monitored, and when the network traffic is monitored, the network traffic is captured through the traffic access interface based on the preset hook function.

[0013] Optionally, the container firewall further includes a release bridge and a traffic output port, wherein the release bridge is used to forward network traffic with a detection result of normal to the traffic output port, so that the network traffic is transmitted to the outside of the container firewall through the traffic output port;

[0014] When the detection result is normal, forwarding the network traffic to the network layer includes:

[0015] When the detection result is normal, sending the network traffic from the traffic access port to the release bridge;

[0016] The network traffic is transmitted to the traffic output port through the release bridge, and the network traffic is forwarded to the network layer based on the traffic output port.

[0017] Optionally, the traffic output port includes an internal port and an external port, wherein the internal port is used to receive network traffic inside the container firewall, and the external port is used to send network traffic to the outside of the container firewall;

[0018] The transmitting the network traffic to the traffic output port through the release bridge, and forwarding the network traffic to the network layer based on the traffic output port includes:

[0019] Transmitting the network traffic to the internal port through the release bridge, and sending the network traffic to the external port based on the internal port;

[0020] The network traffic is sent through the external port to a docking port corresponding to the external port in the bridge of the network layer.

[0021] Optionally, the method further includes:

[0022] When a forwarding service anomaly is detected in the container firewall, the container firewall is controlled to perform a shielding operation so that the network traffic is directly forwarded to the network layer after being received at the traffic port of the link layer, wherein the forwarding service anomaly includes a forwarding process anomaly and a forwarding traffic anomaly, wherein the forwarding traffic anomaly is used to characterize that after the heartbeat message is received at the traffic access port, the heartbeat message is not detected at the traffic output port within a preset time period; the forwarding process anomaly is used to characterize that the process controlling the container firewall to forward is in a hung state or an exited state.

[0023] Optionally, the method further includes:

[0024] When a firewall shutdown instruction is received, based on the firewall shutdown instruction, the container firewall is controlled to perform a shielding operation so that the network traffic is directly forwarded to the network layer after the traffic port of the link layer receives the network traffic.

[0025] Optionally, controlling the container firewall to perform a shielding operation includes:

[0026] terminating the connection between the traffic access port of the container firewall and the traffic port of the link layer through a firewall control instruction;

[0027] The traffic port of the link layer is controlled to establish a communication connection with the bridge of the network layer, and the connection between the external port in the traffic output port and the docking port in the bridge of the network layer is terminated.

[0028] In a second aspect, the present application further provides a network traffic detection device, which is applied to a container firewall, wherein the container firewall is arranged between the network layer and the link layer of the container engine, and the container firewall is used to detect the network traffic received by the link layer, and the device includes:

[0029] A detection unit, used to capture the network traffic from the traffic port of the link layer through a preset hook function, and detect the network traffic to obtain a detection result; wherein the preset hook function is used to monitor the traffic port in real time and capture the network traffic when it is detected;

[0030] a forwarding unit, configured to forward the network traffic to the network layer when the detection result is normal, so as to transmit the network traffic to a service container corresponding to the network traffic through the network layer;

[0031] The execution unit is used to intercept and discard the network traffic when the detection result is abnormal.

[0032] Optionally, the container firewall includes a traffic access port;

[0033] The detection unit is specifically used to monitor the traffic port of the link layer, and when the network traffic is monitored, capture the network traffic through the traffic access interface based on the preset hook function.

[0034] Optionally, the container firewall further includes a release bridge and a traffic output port, wherein the release bridge is used to forward network traffic with a detection result of normal to the traffic output port, so that the network traffic is transmitted to the outside of the container firewall through the traffic output port;

[0035] The forwarding unit includes:

[0036] A sending module, used for sending the network traffic from the traffic access port to the release bridge when the detection result is normal;

[0037] A forwarding module is used to transmit the network traffic to the traffic output port through the release bridge, and forward the network traffic to the network layer based on the traffic output port.

[0038] Optionally, the traffic output port includes an internal port and an external port, wherein the internal port is used to receive network traffic inside the container firewall, and the external port is used to send network traffic to the outside of the container firewall;

[0039] The forwarding module comprises:

[0040] A first sending submodule, configured to transmit the network traffic to the internal port through the release bridge, and send the network traffic to the external port based on the internal port;

[0041] The second sending submodule is used to send the network traffic to the docking port corresponding to the external port in the bridge of the network layer through the external port.

[0042] Optionally, the device further comprises:

[0043] A shielding control unit is used to control the container firewall to perform a shielding operation when a forwarding service anomaly is detected in the container firewall, so that the network traffic is directly forwarded to the network layer after being received at the traffic port of the link layer, wherein the forwarding service anomaly includes a forwarding process anomaly and a forwarding traffic anomaly, wherein the forwarding traffic anomaly is used to characterize that after the heartbeat message is received at the traffic access port, the heartbeat message is not detected at the traffic output port within a preset time period; the forwarding process anomaly is used to characterize that the process controlling the container firewall to forward is in a hung state or an exited state.

[0044] Optionally, the device further comprises:

[0045] The shielding control unit is also used to control the container firewall to perform a shielding operation based on the firewall shutdown instruction when a firewall shutdown instruction is received, so that the network traffic is directly forwarded to the network layer after the traffic port of the link layer receives the network traffic.

[0046] Optionally, the shielding control unit includes:

[0047] A first control module, configured to terminate the connection between the traffic access port of the container firewall and the traffic port of the link layer through a firewall control instruction;

[0048] The second control module is used to control the traffic port of the link layer to establish a communication connection with the bridge of the network layer, and terminate the connection between the external port in the traffic output port and the docking port in the bridge of the network layer.

[0049] In a third aspect, an embodiment of the present application provides a storage medium, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the network traffic detection method of the terminal device described in the first aspect.

[0050] In a fourth aspect, an embodiment of the present application provides a network traffic detection device, which includes a storage medium; and one or more processors, wherein the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the network traffic detection method of the terminal device described in the first aspect is executed.

[0051] By means of the above technical solution, the technical solution provided by this application has at least the following advantages:

[0052] The present application provides a network traffic detection method and device, which are applied to a container firewall. The container firewall is arranged between the network layer and the link layer of the container engine. The container firewall is used to detect the network traffic received by the link layer. The present application can first capture the network traffic from the traffic port of the link layer through a preset hook function, and detect the network traffic to obtain a detection result; wherein the preset hook function is used to monitor the traffic port in real time and capture the network traffic when it is monitored; then when the detection result is normal, the network traffic is forwarded to the network layer so as to be transmitted to the service container corresponding to the network traffic through the network layer; finally, when the detection result is abnormal, the network traffic is intercepted and discarded, thereby realizing the detection function of the network traffic. Compared with the prior art, since the container firewall of the present application is actually deployed between the network layer and the link layer of the container engine, that is, after the network traffic enters the container engine, there is no need to modify the port information as in the prior art. This ensures that in the process of detecting network traffic based on the container firewall, the network traffic of the traffic port entering the link layer of the container firewall can be directly obtained based on the preset hook function, and based on the detection result, it is determined whether to forward the network traffic to the network layer or directly intercept and discard it, thereby realizing the function of directly acquiring and detecting the network traffic entering the container engine without modifying the port information of the network traffic. Subsequently, in the process of detecting network traffic, the process of modifying the network traffic port information before detection and the process of modifying the port information back to the original port information after the detection are eliminated, thereby simplifying the network traffic detection method and improving the detection efficiency. At the same time, since the preset hook function is used to obtain network traffic, that is, the existing data capture tools are directly used to obtain network traffic, this avoids the need to compile or set up scripts and programs to monitor and capture network traffic on the link layer traffic port, which can further simplify the deployment process of the firewall and make the deployment of container firewalls more convenient.

[0053] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] By reading the detailed description below with reference to the accompanying drawings, the above and other purposes, features and advantages of the exemplary embodiments of the present application will become easy to understand. In the accompanying drawings, several embodiments of the present application are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0055] Figure 1 A flow chart of a network traffic detection method provided by an embodiment of the present application is shown;

[0056] Figure 2 Another flow chart of a network traffic detection method provided by an embodiment of the present application is shown;

[0057] Figure 2-A A schematic diagram of a container engine during the execution of a network traffic detection method provided in an embodiment of the present application is shown;

[0058] Figure 3 A block diagram of a network traffic detection device provided by an embodiment of the present application is shown;

[0059] Figure 4 A block diagram showing the composition of another network traffic detection device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0060] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0061] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by technicians in the field to which this application belongs.

[0062] The present application embodiment provides a network traffic detection method, which is applied to a container firewall, wherein the container firewall is arranged between the network layer and the link layer of the container engine, and the container firewall is used to detect the network traffic received by the link layer. Specifically, Figure 1 As shown, the method includes:

[0063] 101. Capture network traffic from the traffic port of the link layer through a preset hook function, and detect the network traffic to obtain a detection result.

[0064] The preset hook function is used to monitor the traffic port in real time and capture the network traffic when it is monitored.

[0065] A hook function can be understood as a function that automatically executes a function after detecting a specific behavior or data. Specifically, in the embodiment of the present application, the preset hook function is a function that is set based on the original hook function of the system and can monitor and obtain the traffic of a certain port of the link layer, that is, the traffic port. Therefore, in this embodiment, the preset hook function deployed in the container firewall will automatically monitor the traffic port of the link layer after the container firewall is started. Since the traffic port can be understood as the data entry port for externally transmitting network traffic to the container engine, as long as there is network traffic to enter the container engine, it will appear at the traffic port of the link layer. Therefore, by monitoring the traffic port through the preset hook function, the monitoring function of the data entry port of the entire container engine is actually realized.

[0066] When the traffic port is monitored to have network traffic, it means that there is network traffic entering the container engine from the outside. At this time, the security of the network traffic needs to be tested. At this time, the network traffic can be obtained and tested based on the hook function. Of course, in this embodiment, how to perform specific detection is not the focus of this application. Therefore, any existing method can be used in the detection process, such as using a black and white list mechanism to detect network traffic, or extracting features from network traffic and performing detection based on the detection model obtained by the machine model algorithm, etc., which are not limited here.

[0067] After detection by the above method, the corresponding detection result will be obtained. The result is nothing more than two kinds of problems: there is a problem or there is no problem. For the former, it means that the network traffic is normal, so step 102 can be executed. Otherwise, it means that the network traffic is aggressive or threatening, so step 103 can be executed.

[0068] 102. When the detection result is normal, the network traffic is forwarded to the network layer so as to be transmitted to the service container corresponding to the network traffic through the network layer.

[0069] When it is determined that the detection result is normal, it means that the network traffic is not aggressive, so it is necessary to forward the network traffic subsequently. In this process, the container firewall based on this embodiment is deployed between the link layer and the network layer, so it is necessary to forward the network traffic directly to the network layer, so that the network traffic can reach the container where the corresponding service is located through the forwarding of the network layer, that is, the service container, thereby ensuring that the container engine described in this embodiment can call related functions and services based on the network traffic.

[0070] 103. When the detection result is abnormal, intercept and discard the network traffic.

[0071] When the detection result is determined to be abnormal, it means that the network traffic may be aggressive. In this case, such network traffic can continue to enter the network layer of the container engine. At this time, it is necessary to intercept and discard the network traffic, thereby ensuring that the network traffic is intercepted directly inside the container firewall when a threat is detected in the network traffic.

[0072] The present application provides a network traffic detection method, which is applied to a container firewall, wherein the container firewall is arranged between the network layer and the link layer of the container engine, and the container firewall is used to detect the network traffic received by the link layer. In an embodiment of the present application, the network traffic can be first captured from the traffic port of the link layer through a preset hook function, and the network traffic is detected to obtain a detection result; wherein the preset hook function is used to monitor the traffic port in real time and capture the network traffic when it is detected; then when the detection result is normal, the network traffic is forwarded to the network layer so that it can be transmitted to the service container corresponding to the network traffic through the network layer; finally, when the detection result is abnormal, the network traffic is intercepted and discarded, thereby realizing the detection function of the network traffic. Compared with the prior art, since the container firewall of the present application is actually deployed between the network layer and the link layer of the container engine, that is, after the network traffic enters the container engine, there is no need to modify the port information as in the prior art. This ensures that in the process of detecting network traffic based on the container firewall, the network traffic of the traffic port entering the link layer of the container firewall can be directly obtained based on the preset hook function, and based on the detection result, it is determined whether to forward the network traffic to the network layer or directly intercept and discard it, thereby realizing the function of directly acquiring and detecting the network traffic entering the container engine without modifying the port information of the network traffic. Subsequently, in the process of detecting network traffic, the process of modifying the network traffic port information before detection and the process of modifying the port information back to the original port information after the detection are eliminated, thereby simplifying the network traffic detection method and improving the detection efficiency. At the same time, since the preset hook function is used to obtain network traffic, that is, the existing data capture tools are directly used to obtain network traffic, this avoids the need to compile or set up scripts and programs to monitor and capture network traffic on the link layer traffic port, which can further simplify the deployment process of the firewall and make the deployment of container firewalls more convenient.

[0073] To explain in more detail below, the present application embodiment provides another network traffic detection method, which is applied to a container firewall. The container firewall is arranged between the network layer and the link layer of the container engine. The container firewall is used to detect the network traffic received by the link layer. Specifically, Figure 2 As shown, the method includes:

[0074] 201. Capture network traffic from the traffic port of the link layer through a preset hook function, and detect the network traffic to obtain a detection result.

[0075] The preset hook function is used to monitor the traffic port in real time and capture the network traffic when it is monitored.

[0076] In the embodiment of the present application, the container engine deployed with the container firewall can be as follows: Figure 2-A As shown, the network space set in each container in container 1, container 2 and container 3 contains a service. Generally, in the container engine, the network traffic entering through the traffic port can be forwarded to the corresponding container based on the network layer forwarding bridge to implement the service call. Specifically, in this embodiment, a container firewall as shown in the figure is deployed between the link layer and the network layer, wherein after the network traffic enters the traffic port of the link layer, the network traffic can be obtained through the traffic access port based on the container firewall, and then detected, and after the detection is passed, the network traffic is forwarded based on the release bridge to reach the traffic output port. Specifically, it can first enter the internal interface, and then realize the forwarding function of the network traffic through the external interface and the docking interface 4 on the network layer forwarding bridge. When the network traffic is forwarded to the network layer forwarding bridge, based on the container interface set for each container and the network layer forwarding bridge, there is a corresponding docking interface, then based on the correspondence between the container interface and the docking interface, the effect of forwarding the network traffic to the corresponding container can be realized. For example, when the network traffic applies for service 1, the network traffic will be transmitted based on the correspondence between the docking interface 1 and the container interface of container 1, so that the network traffic reaches the network space of container 1, thereby realizing the effect of network traffic from entering the container engine to being detected by the container firewall and reaching the specified container after passing the detection.

[0077] Specifically, based on Figure 2-A As shown, the container firewall includes a traffic access port;

[0078] Based on this, in this step, the network traffic is captured from the traffic port of the link layer through a preset hook function, including:

[0079] The traffic port of the link layer is monitored, and when the network traffic is monitored, the network traffic is captured through the traffic access interface based on the preset hook function.

[0080] In this way, after monitoring the traffic port of the link layer and discovering the network traffic, it can be captured through the traffic access interface based on the preset hook function, ensuring that the data can be transmitted according to the traffic access port when entering the container firewall, avoiding the process of setting up a separate interface each time the network traffic is captured, improving the capture efficiency, and then the overall efficiency of network traffic detection can be improved.

[0081] 202. When the detection result is normal, the network traffic is forwarded to the network layer so as to be transmitted to the service container corresponding to the network traffic through the network layer.

[0082] Specifically, the container firewall also includes a release bridge and a traffic output port, wherein the release bridge is used to forward network traffic with a detection result of normal to the traffic output port, so that the network traffic is transmitted to the outside of the container firewall through the traffic output port.

[0083] Based on this, in this step, when the detection result is normal, forwarding the network traffic to the network layer includes:

[0084] When the detection result is normal, sending the network traffic from the traffic access port to the release bridge;

[0085] The network traffic is transmitted to the traffic output port through the release bridge, and the network traffic is forwarded to the network layer based on the traffic output port.

[0086] In this way, during the forwarding process, forwarding can be performed based on a bridge, achieving flexible matching between different ports, avoiding the one-to-one correspondence between a single port and a large number of port pairs that need to be set up when there are multiple network flows, and simplifying the transmission process of network traffic, which can improve the overall detection efficiency.

[0087] Further, the traffic output port includes an internal port and an external port, wherein the internal port is used to receive network traffic inside the container firewall, and the external port is used to send network traffic to the outside of the container firewall;

[0088] Based on this, in this step, transmitting the network traffic to the traffic output port through the release bridge, and forwarding the network traffic to the network layer based on the traffic output port includes:

[0089] Transmitting the network traffic to the internal port through the release bridge, and sending the network traffic to the external port based on the internal port;

[0090] The network traffic is sent through the external port to a docking port corresponding to the external port in the bridge of the network layer.

[0091] Since the firewall used in this embodiment is a container-type firewall, the relationship between the container and the forwarding bridge can also be used during data transmission on the external network layer forwarding bridge to implement the forwarding function in a corresponding manner between the docking interface and the container interface. In this way, the internal interface is used to obtain network traffic from the release bridge and transfer it to the external interface, thereby avoiding the problem of data transmission being affected due to one port or interface corresponding to two bridges at the same time, thereby ensuring the stability of network traffic transmission.

[0092] 203. When the detection result is abnormal, intercept and discard the network traffic.

[0093] When the detection result is determined to be abnormal, the network traffic is intercepted and discarded directly inside the container firewall. This ensures that when the network traffic is abnormal, the network traffic can be controlled inside the container. Based on the principle of containers, even if the network traffic has any offensiveness and threats, as long as it is restricted to the container, the environment and data outside the container can be avoided from being affected, thereby ensuring the stability and security of the container engine.

[0094] 204. When a forwarding service anomaly is detected in the container firewall, the container firewall is controlled to perform a shielding operation so that network traffic is directly forwarded to the network layer after being received at the traffic port of the link layer.

[0095] Among them, the forwarding service anomaly includes forwarding process anomaly and forwarding traffic anomaly. The forwarding traffic anomaly is used to characterize that after the heartbeat message is received at the traffic access port, the heartbeat message is not detected at the traffic output port within a preset time period; the forwarding process anomaly is used to characterize that the process controlling the container firewall to forward is in a hung state or an exited state.

[0096] Since the container firewall is actually placed between the link layer and the network layer of the container engine during use, if there is a problem with the container firewall, it may affect the process of transmitting network traffic from the link layer to the network layer. Therefore, in this embodiment, the forwarding process of the container firewall can also be monitored to avoid affecting the use of the entire container engine due to problems with the container firewall.

[0097] Therefore, in this embodiment, the forwarding service of the container firewall can be detected based on the method of this step. Once an abnormality is detected in its forwarding service, the container firewall must be shielded to ensure that the network traffic received by the traffic port of the link layer can directly bypass the container firewall to reach the network layer. Specifically, the inspection of whether the forwarding service of the container firewall is abnormal can be analyzed based on two aspects. On the one hand, it is to determine whether the core process that controls the forwarding function of the container firewall is abnormal. The abnormality here includes that the process is in a dead state, that is, it is no longer working, and the process is determined to be exited without reason. If any of these two states is detected in the capital, it means that there is a problem with the core forwarding process that currently controls the container firewall, and it is very likely that the container firewall cannot monitor and forward the traffic normally. On the other hand, it is to determine whether there is an abnormality in the forwarding traffic. In this process, it can actually be understood that after the heartbeat message is detected at the traffic inlet port of the container firewall, the message detection is performed at the traffic output port of the container firewall. If the heartbeat message cannot be received at the traffic output port within a certain period of time, it is considered that the forwarding function of the container firewall is abnormal.

[0098] Specifically, in this step, controlling the container firewall to perform a shielding operation includes:

[0099] terminating the connection between the traffic access port of the container firewall and the traffic port of the link layer through a firewall control instruction;

[0100] The traffic port of the link layer is controlled to establish a communication connection with the bridge of the network layer, and the connection between the external port in the traffic output port and the docking port in the bridge of the network layer is terminated.

[0101] This is equivalent to connecting the communication between the container firewall and the traffic port and the network layer, and at the same time establishing a connection between the originally terminated traffic port and the network layer forwarding bridge, which can ensure that the network traffic arriving at the traffic port can bypass the container firewall and directly reach the network layer forwarding bridge, thereby achieving the effect of shielding the container firewall. At the same time, by terminating the connection between the external interface and the comparison port in the network layer, as well as the connection between the traffic interface port and the traffic port, it is avoided that the network traffic can be directly directed to the network layer after being directed to the traffic port, and on the other hand, it can be directed to the network layer based on the container firewall, resulting in data congestion, that is, it avoids the problem of a Layer 2 loop in the container engine caused by only connecting the traffic port and the network layer, ensuring the stability of the container engine.

[0102] 205. When a firewall shutdown instruction is received, based on the firewall shutdown instruction, the container firewall is controlled to perform a shielding operation so that network traffic is directly forwarded to the network layer after being received at the traffic port of the link layer.

[0103] In another case, there may be a situation where the user does not need to detect a certain batch of network traffic or a certain period of time. In this case, the firewall can be actively shielded based on the firewall shutdown instruction. In this way, when the container firewall detects the firewall shutdown instruction, it will automatically perform the screen operation so that the traffic port of the link layer can directly forward the network traffic to the network layer.

[0104] In addition, the screen operation method performed in this step is consistent with that in the previous step. The difference between the two is that one is passive and the other is active. The specific details of the shielding operation will not be repeated here. Please refer to the description of the previous steps for details.

[0105] Furthermore, as a response to the above Figure 1 and Figure 2 In order to realize the method shown in the figure, another embodiment of the present application also provides a network traffic detection device. The network traffic detection device embodiment corresponds to the aforementioned method embodiment. For ease of reading, the network traffic detection device embodiment will not repeat the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment. Specifically, Figure 3 As shown, it is applied to a container firewall, the container firewall is set between the network layer and the link layer of the container engine, and the container firewall can be used to detect the network traffic received by the link layer. The device includes:

[0106] The detection unit 31 can be used to capture the network traffic from the traffic port of the link layer through a preset hook function, and detect the network traffic to obtain a detection result; wherein the preset hook function can be used to monitor the traffic port in real time and capture the network traffic when it is detected;

[0107] The forwarding unit 32 may be configured to forward the network traffic to the network layer when the detection result is normal, so as to be transmitted to the service container corresponding to the network traffic through the network layer;

[0108] The execution unit 33 may be configured to intercept and discard the network traffic when the detection result is abnormal.

[0109] Further, such as Figure 4 As shown, the container firewall includes a traffic access port;

[0110] The detection unit 31 can be specifically used to monitor the traffic port of the link layer, and when the network traffic is monitored, capture the network traffic through the traffic access interface based on the preset hook function.

[0111] Further, such as Figure 4 As shown, the container firewall also includes a release bridge and a traffic output port, wherein the release bridge can be used to forward network traffic with a normal detection result to the traffic output port, so that the network traffic is transmitted to the outside of the container firewall through the traffic output port;

[0112] The forwarding unit 32 includes:

[0113] The sending module 321 may be used to send the network traffic from the traffic access port to the release bridge when the detection result is normal;

[0114] The forwarding module 322 may be configured to transmit the network traffic to the traffic output port via the release bridge, and forward the network traffic to the network layer based on the traffic output port.

[0115] Further, such as Figure 4 As shown, the traffic output port includes an internal port and an external port, wherein the internal port can be used to receive network traffic inside the container firewall, and the external port can be used to send network traffic to the outside of the container firewall;

[0116] The forwarding module 322 includes:

[0117] The first sending submodule 3221 may be used to transmit the network traffic to the internal port through the release bridge, and send the network traffic to the external port based on the internal port;

[0118] The second sending submodule 3222 may be configured to send the network traffic to a docking port corresponding to the external port in the bridge of the network layer through the external port.

[0119] Further, such as Figure 4 As shown, the device also includes:

[0120] The shielding control unit 34 can be used to control the container firewall to perform a shielding operation when a forwarding service anomaly is detected in the container firewall, so that the network traffic is directly forwarded to the network layer after the traffic port of the link layer receives the network traffic, wherein the forwarding service anomaly includes a forwarding process anomaly and a forwarding traffic anomaly, and the forwarding traffic anomaly can be used to indicate that after the heartbeat message is received at the traffic access port, the traffic output port is not detected within a preset time period.

[0121] The heartbeat message; the forwarding process exception is used to indicate that the process controlling the forwarding of the container firewall is in a hung state or exited state.

[0122] Further, such as Figure 4 As shown, the device also includes:

[0123] The shielding control unit 34 can also be used to control the container firewall to perform a shielding operation based on the firewall shutdown instruction when a firewall shutdown instruction is received, so that the network traffic is directly forwarded to the network layer after the traffic port of the link layer receives it.

[0124] 0Furthermore, Figure 4 As shown, the shielding control unit 34 includes:

[0125] A first control module 341 may be used to terminate the connection between the traffic access port of the container firewall and the traffic port of the link layer through a firewall control instruction;

[0126] The second control module 342 can be used to control the traffic port of the link layer and the network layer

[0127] The bridge establishes a communication connection and terminates the connection between the external port in the traffic output port and the docking port in the 5 bridge of the network layer.

[0128] The present application provides a network traffic detection method and device, which are applied to a container firewall. The container firewall is set between the network layer and the link layer of the container engine. The container firewall is used to detect the network traffic received by the link layer.

[0129] The flow port of the path layer captures the network flow through a preset hook function, and performs a test on the network flow to obtain a test result; wherein the preset hook function is used to detect the flow port in real time.

[0130] Monitor and capture network traffic when it is detected; then when the detection result is normal, forward the network traffic to the network layer so that it can be transmitted to the service container corresponding to the network traffic through the network layer; finally, when the detection result is abnormal, intercept and discard the network

[0131] Compared with the prior art, the container firewall of this application is actually deployed between the network layer and the link layer of the container engine, that is, in the network

[0132] After the network traffic enters the container engine, there is no need to modify the port information as in the prior art. This ensures that in the process of detecting network traffic based on the container firewall, the network traffic of the traffic port at the link layer of the container firewall can be directly obtained based on the preset hook function.

[0133] Based on the detection results, it is determined whether to forward the network traffic to the network layer or directly intercept and discard it. It realizes the function of directly acquiring and detecting the network traffic entering the container engine without modifying the port information of the network traffic. Then, in the process of detecting the network traffic, it is possible to avoid the process of modifying the network traffic port information before detection, and the process of modifying the port information back to the original port information after the detection is completed, thereby simplifying the network traffic detection method and improving the detection efficiency. At the same time, since the preset hook function is used in the process of acquiring the network traffic, that is, the existing data capture tool is directly used to acquire the network traffic, this avoids the process of additional compilation or setting scripts and programs to realize the monitoring and traffic capture of the network traffic of the link layer traffic port, which can further simplify the deployment process of the firewall and make the deployment of the container firewall more convenient.

[0134] An embodiment of the present application provides a storage medium, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the above-mentioned network traffic detection method.

[0135] The storage medium may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0136] An embodiment of the present application also provides a network traffic detection device, which includes a storage medium; and one or more processors, wherein the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the above-mentioned network traffic detection method is executed.

[0137] An embodiment of the present application provides a device, which includes a processor, a memory, and a program stored in the memory and executable on the processor, and is applied to a container firewall. The container firewall is arranged between the network layer and the link layer of the container engine, and the container firewall is used to detect the network traffic received by the link layer. When the processor executes the program, the following steps are implemented: capturing the network traffic from the traffic port of the link layer through a preset hook function, and detecting the network traffic to obtain a detection result; wherein the preset hook function is used to monitor the traffic port in real time, and capture the network traffic when it is monitored; when the detection result is normal, forwarding the network traffic to the network layer so as to be transmitted to the service container corresponding to the network traffic through the network layer; when the detection result is abnormal, intercepting and discarding the network traffic.

[0138] Further, the container firewall includes a traffic access port;

[0139] The capturing of the network traffic from the traffic port of the link layer through a preset hook function includes:

[0140] The traffic port of the link layer is monitored, and when the network traffic is monitored, the network traffic is captured through the traffic access interface based on the preset hook function.

[0141] Furthermore, the container firewall also includes a release bridge and a traffic output port, wherein the release bridge is used to forward network traffic with a normal detection result to the traffic output port, so that the network traffic is transmitted to the outside of the container firewall through the traffic output port;

[0142] When the detection result is normal, forwarding the network traffic to the network layer includes:

[0143] When the detection result is normal, sending the network traffic from the traffic access port to the release bridge;

[0144] The network traffic is transmitted to the traffic output port through the release bridge, and the network traffic is forwarded to the network layer based on the traffic output port.

[0145] Further, the traffic output port includes an internal port and an external port, wherein the internal port is used to receive network traffic inside the container firewall, and the external port is used to send network traffic to the outside of the container firewall;

[0146] The transmitting the network traffic to the traffic output port through the release bridge, and forwarding the network traffic to the network layer based on the traffic output port includes:

[0147] Transmitting the network traffic to the internal port through the release bridge, and sending the network traffic to the external port based on the internal port;

[0148] The network traffic is sent through the external port to a docking port corresponding to the external port in the bridge of the network layer.

[0149] Furthermore, the method further comprises:

[0150] When a forwarding service anomaly is detected in the container firewall, the container firewall is controlled to perform a shielding operation so that the network traffic is directly forwarded to the network layer after being received at the traffic port of the link layer, wherein the forwarding service anomaly includes a forwarding process anomaly and a forwarding traffic anomaly, wherein the forwarding traffic anomaly is used to characterize that after the heartbeat message is received at the traffic access port, the heartbeat message is not detected at the traffic output port within a preset time period; the forwarding process anomaly is used to characterize that the process controlling the container firewall to forward is in a hung state or an exited state.

[0151] Furthermore, the method further comprises:

[0152] When a firewall shutdown instruction is received, based on the firewall shutdown instruction, the container firewall is controlled to perform a shielding operation so that the network traffic is directly forwarded to the network layer after the traffic port of the link layer receives the network traffic.

[0153] Further, the controlling the container firewall to perform a shielding operation includes:

[0154] terminating the connection between the traffic access port of the container firewall and the traffic port of the link layer through a firewall control instruction;

[0155] The traffic port of the link layer is controlled to establish a communication connection with the bridge of the network layer, and the connection between the external port in the traffic output port and the docking port in the bridge of the network layer is terminated.

[0156] The present application also provides a computer program product, which is applied to a container firewall. The container firewall is arranged between the network layer and the link layer of the container engine. The container firewall is used to detect the network traffic received by the link layer. When executed on a data processing device, the program code is suitable for executing the initialization method with the following steps: capturing the network traffic from the traffic port of the link layer through a preset hook function, and detecting the network traffic to obtain a detection result; wherein the preset hook function is used to monitor the traffic port in real time and capture the network traffic when it is monitored; when the detection result is normal, the network traffic is forwarded to the network layer so as to be transmitted to the service container corresponding to the network traffic through the network layer; when the detection result is abnormal, the network traffic is intercepted and discarded.

[0157] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0158] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0159] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0160] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0161] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0162] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0163] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0164] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0165] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0166] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A network traffic detection method, characterized in that: Applied to a container firewall, the container firewall is arranged between the network layer and the link layer of the container engine, and the container firewall is used to detect the network traffic received by the link layer. The method includes: Capturing the network traffic from the traffic port of the link layer through a preset hook function, and detecting the network traffic to obtain a detection result; wherein the preset hook function is used to monitor the traffic port in real time and capture the network traffic when it is detected; When the detection result is normal, forwarding the network traffic to the network layer so as to be transmitted to the service container corresponding to the network traffic through the network layer; When the detection result is abnormal, intercepting and discarding the network traffic; The container firewall further includes a release bridge and a traffic output port, wherein the release bridge is used to forward network traffic with a normal detection result to the traffic output port, so that the network traffic is transmitted to the outside of the container firewall through the traffic output port; When the detection result is normal, forwarding the network traffic to the network layer includes: when the detection result is normal, sending the network traffic from the traffic access port to the release bridge; transmitting the network traffic to the traffic output port through the release bridge, and forwarding the network traffic to the network layer based on the traffic output port; The traffic output port includes an internal port and an external port, wherein the internal port is used to receive network traffic inside the container firewall, and the external port is used to send network traffic to the outside of the container firewall; The transmitting the network traffic to the traffic output port through the release bridge, and forwarding the network traffic to the network layer based on the traffic output port includes: Transmitting the network traffic to the internal port through the release bridge, and sending the network traffic to the external port based on the internal port; The network traffic is sent through the external port to a docking port corresponding to the external port in the bridge of the network layer.

2. The method according to claim 1, characterized in that The container firewall includes a traffic access port; The capturing of the network traffic from the traffic port of the link layer through a preset hook function includes: The traffic port of the link layer is monitored, and when the network traffic is monitored, the network traffic is captured through the traffic access port based on the preset hook function.

3. The method according to claim 1, characterized in that The method further comprises: When a forwarding service anomaly is detected in the container firewall, the container firewall is controlled to perform a shielding operation so that the network traffic is directly forwarded to the network layer after being received at the traffic port of the link layer, wherein the forwarding service anomaly includes a forwarding process anomaly and a forwarding traffic anomaly, wherein the forwarding traffic anomaly is used to characterize that after the heartbeat message is received at the traffic access port, the heartbeat message is not detected at the traffic output port within a preset time period; the forwarding process anomaly is used to characterize that the process controlling the container firewall to forward is in a hung state or an exited state.

4. The method according to claim 3, characterized in that The method further comprises: When a firewall shutdown instruction is received, based on the firewall shutdown instruction, the container firewall is controlled to perform a shielding operation so that the network traffic is directly forwarded to the network layer after the traffic port of the link layer receives the network traffic.

5. The method according to claim 3 or 4, characterized in that: The controlling the container firewall to perform the shielding operation includes: terminating the connection between the traffic access port of the container firewall and the traffic port of the link layer through a firewall control instruction; The traffic port of the link layer is controlled to establish a communication connection with the bridge of the network layer, and the connection between the external port in the traffic output port and the docking port in the bridge of the network layer is terminated.

6. A network traffic detection device, characterized in that: Applied to a container firewall, the container firewall is arranged between the network layer and the link layer of the container engine, the container firewall is used to detect the network traffic received by the link layer, and the device includes: A detection unit, used to capture the network traffic from the traffic port of the link layer through a preset hook function, and detect the network traffic to obtain a detection result; wherein the preset hook function is used to monitor the traffic port in real time and capture the network traffic when it is detected; a forwarding unit, configured to forward the network traffic to the network layer when the detection result is normal, so as to transmit the network traffic to a service container corresponding to the network traffic through the network layer; An execution unit, configured to intercept and discard the network traffic when the detection result is abnormal; The container firewall further includes a release bridge and a traffic output port, wherein the release bridge is used to forward network traffic with a normal detection result to the traffic output port, so that the network traffic is transmitted to the outside of the container firewall through the traffic output port; The forwarding unit includes: a sending module, which is used to send the network traffic from the traffic access port to the release bridge when the detection result is normal; a forwarding module, which is used to transmit the network traffic to the traffic output port through the release bridge, and forward the network traffic to the network layer based on the traffic output port; The traffic output port includes an internal port and an external port, wherein the internal port is used to receive network traffic inside the container firewall, and the external port is used to output network traffic to the outside of the container firewall; The forwarding module includes: a first sending submodule, used to transmit the network traffic to the internal port through the release bridge, and send the network traffic to the external port based on the internal port; a second sending submodule, used to send the network traffic to the docking port corresponding to the external port in the bridge of the network layer through the external port.

7. A storage medium, characterized in that: The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the network traffic detection method according to any one of claims 1 to 5.

8. A network traffic detection device, characterized in that: The device includes a storage medium; and one or more processors, the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the network traffic detection method described in any one of claims 1 to 5 is executed.

Images