Data transmission method and apparatus, electronic device, and storage medium

Abstract

Embodiments of the present application provide a data transmission method and device, electronic equipment and storage medium. Relate to network security technical field, the method comprises the following steps: receiving a data packet; at least one of the source address information and the destination address information of the data packet is matched with the preset address in the blacklist to obtain a matching result; according to the matching result and the preconfigured routing strategy, the next hop address of the data packet is determined to discard or send the data packet. The data transmission method provided by the embodiments of the present application can realize dynamic routing defense based on routing strategy, the present application can combine the preconfigured routing strategy defined by the blacklist, the source address and the destination address of the data packet, dynamically guide the malicious data packet to the black hole routing (invalid routing address), discard the malicious data packet, and guide the legal data packet to the safe next hop address, so as to ensure that the attack can be timely blocked, the safety of the network is guaranteed, and the normal sending of the legal data packet is maintained.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network security technology, and in particular to a data transmission method, apparatus, electronic device and storage medium. Background Technology

[0002] With the rapid development of internet technology, the traffic data on the network is of varying quality, including malicious traffic and viruses. Therefore, in order to maintain network security, it is necessary to isolate malicious traffic and guide legitimate traffic. The commonly used technical solutions are as follows: network management software is used to analyze network routing traffic, detect abnormal or malicious traffic in the network, and then network administrators manually implement various routing policies in the network to isolate malicious traffic from the network and guide legitimate traffic to a safe location.

[0003] This approach requires network administrators to monitor network conditions in real time and manually implement routing policies to isolate malicious traffic from the network. It cannot dynamically and in real time adjust routing policies, thus failing to achieve the goal of dynamic routing defense.

[0004] Therefore, there is an urgent need for a data transmission method to guide the direction of data packet transmission and achieve dynamic routing defense. Summary of the Invention

[0005] This invention provides a data transmission method, apparatus, electronic device, and storage medium to guide the direction of data packet transmission and achieve dynamic routing defense.

[0006] The first aspect of this invention provides a data transmission method applied to a switch, the method comprising:

[0007] Receive data packets, the data packets carrying at least source address information and destination address information;

[0008] At least one of the source address information and destination address information of the data packet is matched with a preset address in the blacklist to obtain a matching result; the blacklist includes at least one preset address, which is an address that contains malicious traffic;

[0009] Based on the matching results and the pre-configured routing policy, the next-hop address of the data packet is determined so that the data packet can be dropped or sent.

[0010] Optionally, determining the next-hop address of the data packet based on the matching result and a pre-configured routing policy includes:

[0011] Data packets whose source address matches any preset address are considered malicious data packets;

[0012] The next-hop address of the data packet is determined to be an invalid routing address, so the malicious data packet is dropped.

[0013] Optionally, determining the next-hop address of the data packet based on the matching result and a pre-configured routing policy includes:

[0014] Data packets whose source address does not match any of the preset addresses are considered valid data packets;

[0015] Based on the destination address of the legitimate data packet, a first route entry is matched from the routing table of the switch, and the first next-hop address corresponding to the first route entry is determined. If the first next-hop address does not match any of the preset addresses, the first next-hop address is used as the secure next-hop address.

[0016] Send the legitimate data packet to the secure next-hop address.

[0017] Optionally, determining the next-hop address of the data packet based on the matching result and a pre-configured routing policy further includes:

[0018] If the first next-hop address successfully matches any preset address, the first routing entry corresponding to the first next-hop address is excluded, and the second routing entry is re-matched from the routing table of the switch to determine the second next-hop address corresponding to the second routing entry, until the second next-hop address does not match any preset address, and the second next-hop address is used as the secure next-hop address.

[0019] Optionally, the method further includes:

[0020] Obtain the blacklist determined by third-party network monitoring software according to the preset cycle.

[0021] Optionally, the method further includes:

[0022] Collect network traffic information, which includes: packet source address, packet destination address, protocol, port, and traffic size;

[0023] The network traffic information is sent to third-party network monitoring software so that the software can analyze the network traffic information and obtain a blacklist.

[0024] A second aspect of the present invention provides a data transmission apparatus applied to a switch, the apparatus comprising:

[0025] A receiving module is used to receive data packets, wherein the data packets carry at least source address information and destination address information;

[0026] The matching module is used to match at least one of the source address information and destination address information of the data packet with a preset address in the blacklist to obtain a matching result; the blacklist includes at least one preset address, which is an address that contains malicious traffic;

[0027] The data packet processing module is used to determine the next-hop address of the data packet based on the matching result and the pre-configured routing policy, so as to discard or send the data packet.

[0028] Optionally, the data packet processing module is specifically used for:

[0029] Data packets whose source address matches any preset address are considered malicious data packets;

[0030] The next-hop address of the data packet is determined to be an invalid routing address, so the malicious data packet is dropped.

[0031] Optionally, the data packet processing module is specifically used for:

[0032] Data packets whose source address does not match any of the preset addresses are considered valid data packets;

[0033] Based on the destination address of the legitimate data packet, a first route entry is matched from the routing table of the switch, and the first next-hop address corresponding to the first route entry is determined. If the first next-hop address does not match any of the preset addresses, the first next-hop address is used as the secure next-hop address.

[0034] Send the legitimate data packet to the secure next-hop address.

[0035] Optionally, the data packet processing module is further configured to:

[0036] If the first next-hop address successfully matches any preset address, the first routing entry corresponding to the first next-hop address is excluded, and the second routing entry is re-matched from the routing table of the switch to determine the second next-hop address corresponding to the second routing entry, until the second next-hop address does not match any preset address, and the second next-hop address is used as the secure next-hop address.

[0037] Optionally, the device further includes:

[0038] The acquisition module is used to acquire blacklists determined by third-party network monitoring software according to preset periods.

[0039] Optionally, the device further includes:

[0040] The collection module is used to collect network traffic information, which includes: data packet source address, data packet destination address, protocol, port, and traffic size;

[0041] The sending module is used to send the network traffic information to third-party network monitoring software, so that the third-party network monitoring software can analyze the network traffic information and obtain a blacklist.

[0042] A third aspect of the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the data transmission method as described in the first aspect of the present invention.

[0043] A fourth aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the data transmission method as described in the first aspect of the present invention.

[0044] The data transmission method provided by the embodiments of the present invention can realize dynamic routing defense based on routing policies. Specifically, the embodiments of the present invention can combine the pre-configured routing policies defined in the blacklist with the source address and destination address of the data packet to dynamically redirect malicious data packets to black hole routes (invalid routing addresses) to discard malicious data packets and redirect legitimate data packets to secure next-hop addresses, thereby ensuring that attacks can be blocked in a timely manner, protecting network security, and maintaining the normal transmission of legitimate data packets. Attached Figure Description

[0045] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 This is a flowchart of a data transmission method according to an embodiment of the present invention;

[0047] Figure 2 This is a flowchart of another data transmission method according to an embodiment of the present invention;

[0048] Figure 3 This is a flowchart of another data transmission method according to an embodiment of the present invention;

[0049] Figure 4 This is a schematic diagram of the execution flow of a data transmission method according to an embodiment of the present invention;

[0050] Figure 5This is a structural block diagram of a data transmission device according to an embodiment of the present invention. Detailed Implementation

[0051] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0052] Specifically, refer to Figure 1 The flowchart illustrates a data transmission method according to an embodiment of the present invention. This data transmission method is applied to a switch. Specifically, the data transmission method provided by this embodiment may include the following steps:

[0053] S101, Receive data packet, the data packet carrying at least source address information and destination address information.

[0054] In this embodiment of the invention, the data packets received by the network switch carry at least source address information and destination address information, so that the network switch can determine whether the source or destination of the data packets is a malicious address based on the source address information and destination address information.

[0055] S102, at least one of the source address information and destination address information of the data packet is matched with a preset address in the blacklist to obtain a matching result.

[0056] Specifically, the blacklist includes at least one preset address, which is an address that contains malicious traffic.

[0057] In this embodiment of the invention, the network switch can obtain a blacklist of addresses containing malicious traffic in real time from third-party network monitoring software (e.g., NetFlow), or it can maintain a blacklist of addresses containing malicious traffic locally.

[0058] Specifically, NetFlow is a network usage analysis tool that helps administrators collect and analyze network traffic data. With NetFlow, administrators can collect detailed information such as the source address, destination address, protocol, port, and traffic size of data packets, and then send the collected information back to the NetFlow Server for analysis to identify addresses suspected of malicious traffic.

[0059] In this embodiment of the invention, a blacklist can also be determined based on any other feasible monitoring suite or monitoring method in the related technologies, thereby making network monitoring and judgment more flexible, more accurate and faster.

[0060] Specific malicious traffic addresses can include: addresses that generate a large number of duplicate data packets, addresses that send excessive data packets to a certain port, and addresses that send data packets to a large number of different destination addresses at the same time.

[0061] S103, based on the matching result and the pre-configured routing policy, determine the next-hop address of the data packet, so as to discard or send the data packet.

[0062] In this embodiment of the invention, the switch can determine the next-hop address of a data packet based on at least one of the source address information and the destination address information, combined with a specific routing policy defined in the blacklist, so as to discard malicious data packets and redirect the legitimate data packets to a secure next-hop address.

[0063] In this embodiment of the invention, a malicious data packet refers to a data packet whose source address matches any preset address in the blacklist; a legitimate data packet refers to a data packet whose source address does not match any preset address in the blacklist.

[0064] In this embodiment of the invention, the secure next-hop address refers to the next-hop address that is not in the blacklist and is matched based on the destination address of the legitimate data packet.

[0065] In this embodiment of the invention, the pre-configured routing policy can be interpreted as:

[0066] Source-side defense strategies are used to redirect malicious data packets to invalid routing addresses;

[0067] The destination defense strategy is used to match the next-hop address from the routing table of the network switch based on the destination address of the legitimate data packet, and find the address that does not match any preset address in the blacklist.

[0068] In this embodiment of the invention, dynamic routing defense based on routing policies can combine blacklists and pre-configured routing policies to dynamically redirect malicious data packets to black hole routes (invalid routing addresses) to discard malicious data packets and redirect legitimate data packets to secure next-hop addresses, thereby ensuring timely blocking of attacks, protecting network security, and maintaining the normal transmission of legitimate data packets.

[0069] Reference Figure 2 This diagram illustrates a flowchart of another data transmission method according to an embodiment of the present invention, which is applied to a switch. Specifically, the data transmission method provided in this embodiment of the present invention may include the following steps:

[0070] S201, Receive data packet, the data packet carrying at least source address information and destination address information.

[0071] S202, at least one of the source address information and destination address information of the data packet is matched with a preset address in the blacklist to obtain a matching result.

[0072] Steps S201-S202 are similar to steps S101-S101 above, and will not be repeated here.

[0073] S203, a data packet whose source address matches any preset address is considered a malicious data packet.

[0074] In this embodiment of the invention, a data packet whose source address matches any preset address can be regarded as originating from an address recorded in the blacklist that contains malicious traffic, and thus the data packet is regarded as a malicious data packet.

[0075] S204, determine that the next-hop address of the data packet is an invalid routing address, and discard the malicious data packet.

[0076] In this embodiment of the invention, when a network switch determines that a data packet is malicious, it directly identifies the next-hop address of the malicious data packet as an invalid routing address, redirects the malicious data packet to a black hole route, and discards the data packet. Thus, this embodiment of the invention can discard malicious data packets, preventing them from being transmitted in the network and endangering network security.

[0077] S205 treats data packets whose source address does not match any of the preset addresses as legitimate data packets.

[0078] In this embodiment of the invention, the source address information carried by the data packet is used to determine whether the data packet originates from a preset address recorded in the blacklist. If the data packet does not originate from a preset address recorded in the blacklist, the data packet can be considered a legitimate data packet.

[0079] S206, based on the destination address of the legitimate data packet, match the first routing entry from the routing table of the switch, determine the first next-hop address corresponding to the first routing entry, and if the first next-hop address does not match any of the preset addresses, use the first next-hop address as the secure next-hop address.

[0080] In this embodiment of the invention, a matching mechanism commonly used in related technologies (e.g., the longest prefix matching mechanism) can be used to determine the first routing entry for a legitimate data packet and to determine the first next-hop address.

[0081] The Longest Prefix Match Algorithm (LPM) is a routing lookup mechanism used by almost all routers in the industry. When a router receives an IP packet, it compares the destination IP address of the packet with all routing entries in its local routing table bit by bit until it finds the longest matching routing entry, which is then used as the target routing entry (i.e., the first routing entry in this embodiment of the invention).

[0082] Specifically, in this embodiment of the invention, a matching mechanism can be used to determine multiple routing entries in the routing table of the switch that match the destination address of the legitimate data packet, as well as the priority order of the multiple routing entries, which can be determined by the degree of matching.

[0083] For example, taking the longest prefix matching mechanism as an example, the routing entries recorded in the routing table can be compared with the destination IP address of the data packet. The destination IP address and the network mask of the routing entry can be performed with a "logical AND" operation to determine multiple matching routing entries. Then, according to the longest matching principle, the routing entry with the longer matching degree is taken as the first routing entry.

[0084] Specifically, after determining the first routing entry, the first next-hop address corresponding to the legitimate data packet can be determined based on the first routing entry.

[0085] Furthermore, in this embodiment of the invention, the first next-hop address can be judged to determine whether the destination of the data packet is an address with malicious traffic, so as to avoid legitimate traffic being unable to be sent normally.

[0086] Specifically, the first next-hop address is matched with a preset address recorded in the blacklist. If the first next-hop address does not match any of the preset addresses recorded in the blacklist, the first next-hop address is used as a safe next-hop address.

[0087] S207, the legitimate data packet is sent to the secure next-hop address.

[0088] In this embodiment of the invention, by judging the next-hop address, legitimate data packets can be sent to a secure next-hop address, thus preventing legitimate data packets from being corrupted by malicious addresses.

[0089] S208, if the first next-hop address successfully matches any preset address, exclude the first routing entry corresponding to the first next-hop address, re-match the second routing entry from the routing table of the switch, determine the second next-hop address corresponding to the second routing entry, until the second next-hop address does not match any preset address, and use the second next-hop address as the secure next-hop address.

[0090] In this embodiment of the invention, if the first next-hop address successfully matches any preset address, it is determined that the first next-hop address is an address with malicious traffic, and the legitimate data packets should be redirected to prevent legitimate data packets from being sent to the first next-hop address.

[0091] Specifically, in this embodiment of the invention, if the first routing entry corresponding to the first next-hop address is excluded, the second routing entry can be re-matched from the routing table of the switch, and the second next-hop address corresponding to the second routing entry can be judged until the second next-hop address does not match any of the preset addresses, and the second next-hop address is used as the safe next-hop address.

[0092] Specifically, in this embodiment of the invention, the second routing directory can be selected sequentially according to the priority order of multiple routing entries that match the destination address of the legitimate data packet as determined in step S206.

[0093] When all switches in a network system employ the data transmission method provided in this embodiment of the invention, for legitimate data packets, the transmission path of these packets can be prevented from involving addresses recorded in the blacklist that contain malicious traffic. This achieves secure transmission of legitimate data packets.

[0094] Reference Figure 3 This diagram illustrates a flowchart of another data transmission method according to an embodiment of the present invention, which is applied to a switch. Specifically, the data transmission method provided in this embodiment of the present invention may include the following steps:

[0095] S301, Collect network traffic information, which includes: data packet source address, data packet destination address, protocol, port, and traffic size.

[0096] In this embodiment of the invention, the switch can collect network traffic information such as the source address of data packets, the destination address of data packets, the protocol, the port, and the traffic volume, so as to analyze and monitor the network security status.

[0097] S302, the network traffic information is sent to third-party network monitoring software so that the third-party network monitoring software can analyze the network traffic information and obtain a blacklist.

[0098] Specifically, in this embodiment of the invention, the third-party network monitoring software can be NetFlow. The switch can send the collected network traffic information to NetFlow so that NetFlow can analyze the network traffic information to identify addresses suspected of having malicious traffic and record the addresses in the blacklist.

[0099] S303 retrieves the blacklist determined by third-party network monitoring software according to a preset cycle.

[0100] In this embodiment of the invention, the switch can obtain a blacklist determined by third-party network monitoring software according to a preset period.

[0101] Specifically, in this embodiment of the invention, the switch can also collect network traffic information according to a preset period and send the network traffic information to third-party network monitoring software. The third-party network monitoring software obtains a periodically updated blacklist based on the periodically updated network traffic information. Thus, the switch can also obtain the periodically updated real-time blacklist from the third-party network monitoring software according to a preset period to maintain the real-time nature of the information and ensure that malicious traffic attacks can be blocked in a timely manner.

[0102] S304, Receive data packet, the data packet carrying at least source address information and destination address information.

[0103] S305, at least one of the source address information and destination address information of the data packet is matched with a preset address in the blacklist to obtain a matching result; the blacklist includes at least one preset address, which is an address with malicious traffic.

[0104] S306. Based on the matching result and the pre-configured routing policy, determine the next-hop address of the data packet, so as to discard or send the data packet.

[0105] Steps S304-S306 are similar to steps S101-S103 above, and will not be described again here.

[0106] Reference Figure 4 This diagram illustrates the execution flow of a data transmission method according to an embodiment of the present invention. Specifically, this embodiment can be executed by Switch PoE. The execution flow includes:

[0107] S1 obtains a blacklist of malicious traffic from NetFlow.

[0108] S2, Configure PBR, [Rule: Match source IP and blacklisted IPs] [Execute: Determine if the next-hop address is an invalid routing address (drop packets)].

[0109] PBR (Policy-Based Routing) is a technology that selects different routing paths based on specific policies and conditions. In a network, when a data packet enters a router, the router selects the next hop according to its routing table. PBR, however, can achieve more flexible traffic forwarding by matching different conditions (such as source IP address, destination IP address, protocol type, etc.) and selecting a specific routing path based on the matching results.

[0110] In this embodiment of the invention, based on step S2, a source-side defense strategy can be implemented, specifically, the next-hop address of all data packets whose source address matches the address recorded in the blacklist can be redirected to an invalid routing address.

[0111] Specifically, identify all packet pairs whose source IP addresses match the blacklist, assign the next-hop address of these packets to an invalid route address (the address of the pre-configured black hole route), and discard packets originating from addresses containing malicious traffic.

[0112] S3 uses the longest prefix matching algorithm to match the destination address of the data packet from the routing table to determine the routing entry.

[0113] In this embodiment of the invention, the longest prefix matching algorithm can be used to compare the routing entries recorded in the routing table with the destination IP address of the data packet, perform a logical AND operation between the destination IP address and the network mask of the routing entry to determine multiple matching routing entries, and then, according to the longest matching principle, take the routing entry with the longer matching degree as the first routing entry.

[0114] S4. Determine whether a route entry is matched. If no route entry is matched, proceed to step S5. If a route entry is matched, proceed to step S6.

[0115] S5, terminate the data transmission process of this data packet, wait for the preset period of time, and then re-execute step S1.

[0116] S6, determine whether the next-hop address of the matched route entry matches any preset address in the blacklist; if it matches, execute S7, otherwise execute S8.

[0117] S7, exclude the routing entries determined in S6, redetermine matching routing entries, and return to step S3.

[0118] S8, configure BPR [rule: match destination IP and blacklisted IPs] [execute: determine the next-hop address as a safe next-hop address (redirect packets to the safe next hop)]. Then proceed to step S5.

[0119] In this embodiment of the invention, based on step S8, a destination defense strategy can be implemented. Specifically, the next-hop address that does not match any preset address in the blacklist can be matched from the routing table of the network switch according to the destination address of the legitimate data packet, and the next-hop address of the legitimate data packet is redirected to a safe next address to avoid the legitimate data packet being attacked by malicious traffic.

[0120] In this embodiment of the invention, dynamic routing defense based on policy routing can be implemented. Specifically, by periodically obtaining a blacklist from NetFlow, addresses that may contain malicious traffic can be accurately identified. Through LPM matching and issuing PBR routes, malicious data packets are dynamically redirected to black hole routing addresses (invalid routing addresses), while legitimate data packets are redirected to secure next-hop addresses. This ensures that attacks can be blocked in a timely manner to protect network security. Furthermore, by redirecting legitimate data packets, attacks on legitimate data packets recorded in the blacklist can be prevented, further protecting network security.

[0121] Based on the same inventive concept, embodiments of the present invention provide a data transmission device applied to a switch. Figure 5 This is a schematic diagram of a data transmission device provided in an embodiment of the present invention, as shown below. Figure 5 As shown, the device includes:

[0122] The receiving module 501 is used to receive data packets, wherein the data packets carry at least source address information and destination address information;

[0123] The matching module 502 is used to match at least one of the source address information and destination address information of the data packet with a preset address in the blacklist to obtain a matching result; the blacklist includes at least one preset address, which is an address that contains malicious traffic;

[0124] The data packet processing module 503 is used to determine the next-hop address of the data packet based on the matching result and the pre-configured routing policy, so as to discard or send the data packet.

[0125] Optionally, the data packet processing module 503 is specifically used for:

[0126] Data packets whose source address matches any preset address are considered malicious data packets;

[0127] The next-hop address of the data packet is determined to be an invalid routing address, so the malicious data packet is dropped.

[0128] Optionally, the data packet processing module 503 is specifically used for:

[0129] Data packets whose source address does not match any of the preset addresses are considered valid data packets;

[0130] Based on the destination address of the legitimate data packet, a first route entry is matched from the routing table of the switch, and the first next-hop address corresponding to the first route entry is determined. If the first next-hop address does not match any of the preset addresses, the first next-hop address is used as the secure next-hop address.

[0131] Send the legitimate data packet to the secure next-hop address.

[0132] Optionally, the data packet processing module 503 is further configured to:

[0133] If the first next-hop address successfully matches any preset address, the first routing entry corresponding to the first next-hop address is excluded, and the second routing entry is re-matched from the routing table of the switch to determine the second next-hop address corresponding to the second routing entry, until the second next-hop address does not match any preset address, and the second next-hop address is used as the secure next-hop address.

[0134] Optionally, the device further includes:

[0135] The acquisition module is used to acquire blacklists determined by third-party network monitoring software according to preset periods.

[0136] Optionally, the device further includes:

[0137] The collection module is used to collect network traffic information, which includes: data packet source address, data packet destination address, protocol, port, and traffic size;

[0138] The sending module is used to send the network traffic information to third-party network monitoring software, so that the third-party network monitoring software can analyze the network traffic information and obtain a blacklist.

[0139] Based on the same inventive concept, embodiments of the present invention provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps of the data transmission method as described in any of the above embodiments of the present invention.

[0140] Based on the same inventive concept, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the data transmission method as described in any of the above embodiments of the present invention.

[0141] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0142] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0143] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0144] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0145] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0146] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0147] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present invention.

[0148] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0149] The present invention has provided a detailed description of a data transmission method, apparatus, electronic device, and storage medium. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A data transmission method, characterized in that, Applied to a switch, the method includes: Receive data packets, the data packets carrying at least source address information and destination address information; At least one of the source address information and destination address information of the data packet is matched with a preset address in the blacklist to obtain a matching result; the blacklist includes at least one preset address, which is an address that contains malicious traffic; Based on the matching results and the pre-configured routing policy, the next-hop address of the data packet is determined so that the data packet can be dropped or sent. Determining the next-hop address of the data packet based on the matching result and the pre-configured routing policy includes: Data packets whose source address does not match any of the preset addresses are considered valid data packets; Based on the destination address of the legitimate data packet, a first route entry is matched from the routing table of the switch, and the first next-hop address corresponding to the first route entry is determined. If the first next-hop address does not match any of the preset addresses, the first next-hop address is used as the secure next-hop address. If the first next-hop address successfully matches any preset address, the first routing entry corresponding to the first next-hop address is excluded, and the second routing entry is re-matched from the routing table of the switch to determine the second next-hop address corresponding to the second routing entry, until the second next-hop address does not match any preset address, and the second next-hop address is used as the secure next-hop address; Send the legitimate data packet to the secure next-hop address.

2. The data transmission method according to claim 1, characterized in that, Based on the matching results and the pre-configured routing policy, the next-hop address of the data packet is determined, including: Data packets whose source address matches any preset address are considered malicious data packets; The next-hop address of the data packet is determined to be an invalid routing address, so the malicious data packet is dropped.

3. The data transmission method according to claim 1, characterized in that, The method further includes: Obtain the blacklist determined by third-party network monitoring software according to the preset cycle.

4. The data transmission method according to claim 3, characterized in that, The method further includes: Collect network traffic information, which includes: packet source address, packet destination address, protocol, port, and traffic size; The network traffic information is sent to third-party network monitoring software so that the software can analyze the network traffic information and obtain a blacklist.

5. A data transmission device, characterized in that, Applied to a switch, the device includes: A receiving module is used to receive data packets, wherein the data packets carry at least source address information and destination address information; The matching module is used to match at least one of the source address information and destination address information of the data packet with a preset address in the blacklist to obtain a matching result; the blacklist includes at least one preset address, which is an address that contains malicious traffic; A data packet processing module is used to determine the next-hop address of a data packet based on the matching result and a pre-configured routing policy, so as to discard or send the data packet. Determining the next-hop address of the data packet based on the matching result and the pre-configured routing policy includes: treating data packets whose source address does not match any preset addresses as legitimate data packets; matching a first routing entry from the routing table of the switch based on the destination address of the legitimate data packet, determining the first next-hop address corresponding to the first routing entry, and if the first next-hop address does not match any preset addresses, using the first next-hop address as a secure next-hop address; if the first next-hop address matches any preset address, excluding the first routing entry corresponding to the first next-hop address, re-matching a second routing entry from the routing table of the switch, determining the second next-hop address corresponding to the second routing entry, until the second next-hop address does not match any preset addresses, using the second next-hop address as a secure next-hop address; and sending the legitimate data packet to the secure next-hop address.

6. The data transmission device according to claim 5, characterized in that, The data packet processing module is specifically used for: Data packets whose source address matches any preset address are considered malicious data packets; The next-hop address of the data packet is determined to be an invalid routing address, so the malicious data packet is dropped.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the data transmission method according to any one of claims 1-4.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the steps of the data transmission method according to any one of claims 1-4.

Images