Real-time policy based traffic processing method and system

Abstract

The application relates to a real-time strategy-based traffic processing method and system. The method comprises the following steps: a router acquires real-time access traffic from an external network; a real-time attack detection strategy is updated according to snapshot information of the real-time access traffic, the real-time attack detection strategy comprising a destination IP self-learning table; attack detection is performed on the real-time access traffic based on the real-time attack detection strategy; when the real-time access traffic is attack traffic, a real-time attack protection strategy is generated, the real-time protection strategy comprising a current alarm table; and traffic in the router is cleaned according to the real-time attack protection strategy. The real-time strategy-based traffic processing method and system can make a separate attack detection strategy for each accessed destination IP, make the attack detection strategy more suitable for the actual situation of a target network, provide accurate detection strategy data support for detection equipment in a traffic cleaning system, and make the traffic cleaning system better play a role.

Description

Technical Field

[0001] This disclosure relates to the field of computer information processing, and more specifically, to a traffic processing method and system based on real-time strategies. Background Technology

[0002] Distributed Denial of Service (DDoS) attacks, as one of the most representative types of network attacks, refer to multiple hosts working together as an attack platform to exhaust the system resources of the attacked network by using various service requests, making the attacked network unable to process the normal requests of legitimate users, thereby causing significant economic losses.

[0003] Existing technologies have proposed traffic scrubbing systems to address the above situations. These systems detect and scrub traffic before DDoS threats impact critical services and applications, ensuring stable network operation and normal business operations. The traffic scrubbing system includes a unified management platform to maintain traffic information received by the server and attack detection policies. Once deployed and operational, the unified management platform needs to be configured with attack detection policies to provide data support for detection devices, thereby accurately detecting attacks and protecting the target network.

[0004] Current technologies employ a method of learning the peak traffic volume of a target network during normal access periods and then using a weighted average of these peak traffic volumes over different learning cycles to formulate attack detection strategies for a unified management platform. After a period of learning, the unified management platform distributes the attack detection strategies (traffic size thresholds) to detection devices, which then refer to these strategies to perform attack detection on traffic accessing the target network. However, existing attack detection strategy formulation techniques suffer from several drawbacks: over-reliance on initial values, failure to consider fluctuations in network traffic peaks over time, and a limited range of target network profiles. These existing technologies cannot provide accurate detection strategy data support for traffic scrubbing systems, thus failing to adequately protect the target network.

[0005] Therefore, a new traffic processing method and system based on real-time policies is needed.

[0006] The information disclosed in the background section is only intended to enhance the understanding of the background of this application, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0007] In view of this, this application provides a traffic processing method and system based on real-time policies, which can formulate individual attack detection policies for each accessed destination IP, making the attack detection policies more in line with the actual situation of the target network, providing accurate detection policy data support for the detection equipment in the traffic scrubbing system, and enabling the traffic scrubbing system to play a better role.

[0008] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.

[0009] According to one aspect of this application, a traffic processing method based on a real-time policy is proposed. The method includes: a router acquiring real-time access traffic from an external network; updating a real-time attack detection policy based on snapshot information of the real-time access traffic, the real-time attack detection policy including a destination IP self-learning table; performing attack detection on the real-time access traffic based on the real-time attack detection policy; generating a real-time attack protection policy when the real-time access traffic is attack traffic, the real-time protection policy including a current alarm table; and cleaning the traffic in the router according to the real-time attack protection policy.

[0010] In one exemplary embodiment of this application, updating the real-time attack detection strategy based on the snapshot information of the real-time access traffic includes: a traffic detection device acquiring real-time access traffic through mirroring or traffic splitting; the traffic detection device sending the snapshot information of the real-time access traffic to a management platform; the management platform updating the destination IP self-learning table based on the snapshot information; and generating a real-time attack detection strategy based on the destination IP self-learning table.

[0011] In one exemplary embodiment of this application, the management platform updates the destination IP self-learning table based on the snapshot information, including: establishing a destination IP self-learning table based on the traffic characteristics of each attacked destination IP; and periodically updating the destination IP self-learning table.

[0012] In one exemplary embodiment of this application, periodically updating the destination IP self-learning table includes: acquiring relevant traffic information within a preset time period; and updating the traffic peak size threshold table, traffic protocol ratio threshold table, source IP number threshold table, and source IP tracing threshold table in the destination IP self-learning table according to the relevant information.

[0013] In one exemplary embodiment of this application, attack detection of the real-time access traffic based on a real-time attack detection strategy includes: a traffic detection device performing attack detection on the real-time access traffic based on the real-time attack detection strategy.

[0014] In one exemplary embodiment of this application, when the real-time access traffic is attack traffic, generating a real-time attack protection strategy includes: when the real-time access traffic is attack traffic, the traffic detection device sends alarm information to the management platform; the management platform updates the current alarm table based on the destination IP self-learning table and traffic snapshots; and the real-time attack protection strategy is generated based on the current alarm table.

[0015] In one exemplary embodiment of this application, the management platform updates the current alarm table based on the destination IP self-learning table and traffic snapshots, including: establishing a container with the currently attacked destination IP as the key value; storing the currently attacked destination IP and its corresponding attack start time, attack end time, current status, and number of hits in the container; and updating the current alarm table based on the destination IP self-learning table and traffic snapshots.

[0016] In one exemplary embodiment of this application, cleaning traffic in the router according to the real-time attack protection strategy includes: the switch directing traffic in the router to a traffic cleaning device based on the real-time attack protection strategy; the traffic cleaning device cleaning the traffic; and the switch injecting the cleaned traffic back into the router.

[0017] According to one aspect of this application, a traffic processing system based on a real-time policy is proposed. The system includes: a router for acquiring real-time access traffic from an external network; a traffic detection device for performing attack detection on the real-time access traffic based on a real-time attack detection policy, the real-time attack detection policy including a destination IP self-learning table; and sending snapshot information of the real-time access traffic to a management platform; a management platform for updating the destination IP self-learning table in real-time according to the snapshot information; and generating a real-time attack protection policy when the real-time access traffic is attack traffic; and a traffic scrubbing device for scrubbing the traffic in the router according to the real-time attack protection policy.

[0018] In one exemplary embodiment of this application, it further includes: a switch, configured to direct traffic in the router to a traffic scrubbing device based on the real-time attack protection strategy; and to inject the scrubbed traffic back into the router.

[0019] According to one aspect of this application, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs; and, when the one or more programs are executed by the one or more processors, causing the one or more processors to implement the method as described above.

[0020] According to one aspect of this application, a computer-readable medium is provided having a computer program stored thereon that, when executed by a processor, implements the method described above.

[0021] According to the real-time policy-based traffic processing method and system of this application, real-time access traffic from an external network is obtained through a router; a real-time attack detection policy is updated based on snapshot information of the real-time access traffic, the real-time attack detection policy including a destination IP self-learning table; attack detection is performed on the real-time access traffic based on the real-time attack detection policy; when the real-time access traffic is attack traffic, a real-time attack protection policy is generated, the real-time protection policy including a current alarm table; and the traffic in the router is cleaned according to the real-time attack protection policy. This method enables the formulation of a separate attack detection policy for each accessed destination IP, making the attack detection policy more closely aligned with the actual situation of the target network, providing accurate detection policy data support for the detection equipment in the traffic cleaning system, and enabling the traffic cleaning system to function better.

[0022] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this application. Attached Figure Description

[0023] The above and other objects, features, and advantages of this application will become more apparent from the detailed description of exemplary embodiments with reference to the accompanying drawings. The drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0024] Figure 1 This is a schematic diagram illustrating a traffic processing system based on a real-time policy, according to an exemplary embodiment.

[0025] Figure 2 This is a flowchart illustrating a traffic processing method based on a real-time policy, according to an exemplary embodiment.

[0026] Figure 3 This is a flowchart illustrating a traffic processing method based on a real-time policy, according to another exemplary embodiment.

[0027] Figure 4 This is a schematic diagram illustrating a traffic processing method based on a real-time policy according to an exemplary embodiment.

[0028] Figure 5 This is a flowchart illustrating a traffic processing method based on a real-time policy, according to another exemplary embodiment.

[0029] Figure 6 This is a block diagram illustrating an electronic device according to an exemplary embodiment.

[0030] Figure 7 This is a block diagram illustrating a computer-readable medium according to an exemplary embodiment. Detailed Implementation

[0031] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, they are provided so that this application will be thorough and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted.

[0032] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0033] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0034] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0035] It should be understood that although the terms first, second, third, etc., may be used herein to describe various components, these components should not be limited by these terms. These terms are used to distinguish one component from another. Therefore, the first component discussed below may be referred to as the second component without departing from the teachings of this application. As used herein, the term "and / or" includes all combinations of any one and more of the associated listed items.

[0036] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of exemplary embodiments, and the modules or processes in the drawings are not necessarily essential for implementing this application, and therefore cannot be used to limit the scope of protection of this application.

[0037] The technical abbreviations used in this application are explained as follows:

[0038] DOS (Denial of Service): Denial-of-service attack;

[0039] DDoS (Distributed Denial of Service): A distributed denial-of-service attack.

[0040] IDC (Internet Data Center): Internet Data Center.

[0041] The applicant found that existing technologies rely excessively on initial thresholds during the initial learning phase of attack detection strategies. When the initial threshold is low compared to the actual network traffic volume, it is easy to misclassify normal access traffic as attack traffic, thus missing some characteristics of normal access traffic; when the initial threshold is high compared to the actual network traffic volume, it is easy to misclassify attack traffic as normal access traffic, resulting in the learning of incorrect attack detection thresholds.

[0042] After investigation, the applicant found that existing technologies do not consider network traffic fluctuations over time when learning peak normal access traffic. In reality, peak traffic to the target network fluctuates over time, and using a weighted average of peak traffic as the attack detection threshold can easily misclassify normal access traffic during peak periods as attack traffic. Existing technologies do not consider that different IPs within the target network play different business roles; multiple business IPs applying the same attack detection strategy can lead to false positives and false negatives. The attack detection strategies learned by existing technologies only include traffic size thresholds, resulting in a single attack detection basis and insufficient analysis of the protocol composition of normal access traffic, trends in the number of source IPs, and the distribution characteristics of source IPs. The target network profile learned by existing technologies differs somewhat from reality.

[0043] To address the problems existing in the prior art, this application proposes a traffic processing method based on real-time policies. In this application, the attack detection policy formulation method, based on learning the target network traffic, does not rely on the initial value of the detection threshold, fully considers the fluctuation of traffic peaks over time, and formulates target network profiles from multiple perspectives. At the same time, this application considers that different destination IPs in the target network play different business roles, and formulates a separate user profile for each accessed destination IP, so that the learned attack detection threshold is more in line with the actual situation of the target network, providing accurate detection policy data support for the detection equipment in the traffic scrubbing system, and enabling the traffic scrubbing system to play a better role.

[0044] The content of this application will be described in detail below with the aid of specific embodiments.

[0045] Figure 1 This is a schematic diagram illustrating a real-time policy-based traffic processing system according to an exemplary embodiment. Figure 1As shown, the system architecture may include a router (RT1), a traffic inspection device (Probe), a unified management platform (UMC), a traffic scrubbing device (Guard), a switch (SW), an internal router (RT2), host devices HostA, HostB, and HostC, an external network, an internal core network, and a third-party analysis platform.

[0046] The traffic scrubbing system consists of a traffic detection device (Probe), a unified management platform (UMC), a traffic scrubbing device (Guard), and a switch (SW).

[0047] In this application, a router is used to acquire real-time access traffic from an external network;

[0048] A traffic detection device is used to perform attack detection on the real-time access traffic based on a real-time attack detection strategy, the real-time attack detection strategy including a destination IP self-learning table; and to send snapshot information of the real-time access traffic to a management platform;

[0049] The management platform is used to update the destination IP self-learning table in real time based on the snapshot information; and to generate a real-time attack protection strategy when the real-time access traffic is attack traffic.

[0050] Traffic scrubbing equipment is used to scrub the traffic in the router according to the real-time attack protection strategy.

[0051] The switch is used to redirect traffic from the router to the traffic scrubbing device based on the real-time attack protection strategy, and to inject the scrubbed traffic back into the router.

[0052] In a practical application scenario, a traffic scrubbing system can scrub attack traffic by being deployed in a side-by-side without changing the original network topology. It has the advantages of not causing a single point of failure, being easy to expand, and being easier to deploy.

[0053] The traffic scrubbing system is connected to the router (RT1). The traffic detection device is connected to the unified management platform through a switch. The unified management platform is connected to the traffic scrubbing device through a switch. The traffic detection device is used to detect the traffic flowing through the router and feed it back to the unified management platform. The unified management platform is used to store traffic information and maintain attack detection policies.

[0054] Continue as Figure 1As shown, suppose there is traffic that is about to access host A via the Internet. The traffic first passes through router RT1. At the same time, the traffic inspection device (Probe) receives and inspects the mirrored or split traffic from router RT1 on port eth1_0, and sends the traffic information in the traffic to the unified management platform (UMC) through switch (SW).

[0055] When the detection device determines that the traffic is attack traffic based on the attack detection policy, it sends an alarm message to the unified management platform (UMC). Upon receiving the alarm message, the UMC sends a protection policy specifying which type of attack traffic to clean to the traffic scrubbing device (Guard) via the switch (SW) and eth2_27 port. The traffic scrubbing device (Guard) interacts with the router (RT1). Upon receiving the protection policy, it performs attack traffic scrubbing on router "RT1". Specifically, the traffic scrubbing system redirects the traffic requiring protection from router (RT1) to the traffic scrubbing device (Guard) via eth2_0 port for protection and scrubbing, and injects the cleaned legitimate traffic back into router (RT1) via eth2_1 port, while simultaneously reporting the scrubbing log to the unified management platform (UMC). Thus, the attack traffic is intercepted and recorded by the traffic scrubbing system as it passes through router (RT1), and the attacked device A is not actually affected.

[0056] It should be noted that the eth1_0 port of the aforementioned traffic detection device (Probe) can also receive NetFlow / NetStream / nFlow flow log information and send the information to a third-party analysis platform via the eth1_2 port. In fact, any traffic characteristic information that can distinguish attack traffic can be used as input information for the eth1_0 port, and this application does not impose any restrictions on this.

[0057] According to the real-time policy-based traffic processing system of this application, real-time access traffic from an external network is obtained through a router; a real-time attack detection policy is updated based on snapshot information of the real-time access traffic, the real-time attack detection policy including a destination IP self-learning table; attack detection is performed on the real-time access traffic based on the real-time attack detection policy; when the real-time access traffic is attack traffic, a real-time attack protection policy is generated, the real-time protection policy including a current alarm table; and the traffic in the router is cleaned according to the real-time attack protection policy. This method enables the formulation of a separate attack detection policy for each accessed destination IP, making the attack detection policy more closely aligned with the actual situation of the target network, providing accurate detection policy data support for the detection equipment in the traffic cleaning system, and enabling the traffic cleaning system to function better.

[0058] Figure 2 This is a flowchart illustrating a traffic processing method based on a real-time policy according to an exemplary embodiment. The traffic processing method 20 based on a real-time policy includes at least steps S202 to S208.

[0059] like Figure 2 As shown in S202, the router obtains real-time access traffic from the external network.

[0060] In S204, the real-time attack detection policy is updated based on the snapshot information of the real-time access traffic. The real-time attack detection policy includes a destination IP self-learning table.

[0061] In one embodiment, the traffic detection device acquires real-time access traffic through mirroring or traffic splitting; the traffic detection device sends snapshot information of the real-time access traffic to the management platform; the management platform updates the destination IP self-learning table based on the snapshot information; and generates a real-time attack detection strategy based on the destination IP self-learning table.

[0062] The unified management platform receiver receives real-time traffic snapshot information sent by the detection device. The detection device sends target network traffic snapshots periodically. When the monitoring period is sufficiently short, the traffic snapshots sent by the detection device can be considered real-time. Real-time traffic snapshot information includes access time, source IP address, destination IP address, source port, destination port, protocol, and traffic volume.

[0063] In S206, attack detection is performed on the real-time access traffic based on a real-time attack detection strategy. The traffic detection device performs attack detection on the real-time access traffic based on the real-time attack detection strategy.

[0064] For example, based on the destination IP, the traffic peak size threshold, protocol ratio threshold, source IP number threshold, and source IP source distribution threshold can be obtained from the destination IP threshold self-learning table. The destination IP self-learning threshold table is a container with the destination IP as the key, and this container is updated continuously within a self-learning cycle, as detailed below. Next, the characteristics of the traffic snapshot information (traffic size, protocol ratio, source IP number, and source IP source distribution) are compared with the corresponding characteristic thresholds. If all characteristics reach or exceed the threshold, the traffic is considered attack traffic; otherwise, it is considered normal access traffic.

[0065] In step S208, when the real-time access traffic is attack traffic, a real-time attack protection policy is generated, which includes a current alarm table. When the real-time access traffic is attack traffic, the traffic detection device sends alarm information to the management platform; the management platform updates the current alarm table based on the destination IP self-learning table and traffic snapshots; and generates the real-time attack protection policy based on the current alarm table.

[0066] In S210, the traffic in the router is cleaned according to the real-time attack protection policy. The switch can redirect the traffic in the router to the traffic cleaning device based on the real-time attack protection policy; the traffic cleaning device cleans the traffic; and the switch injects the cleaned traffic back into the router.

[0067] According to the real-time policy-based traffic processing method of this application, real-time access traffic from an external network is obtained through a router; a real-time attack detection policy is updated based on snapshot information of the real-time access traffic, the real-time attack detection policy including a destination IP self-learning table; attack detection is performed on the real-time access traffic based on the real-time attack detection policy; when the real-time access traffic is attack traffic, a real-time attack protection policy is generated, the real-time protection policy including a current alarm table; and the traffic in the router is cleaned according to the real-time attack protection policy. This method enables the formulation of a separate attack detection policy for each accessed destination IP, making the attack detection policy more closely aligned with the actual situation of the target network, providing accurate detection policy data support for the detection equipment in the traffic cleaning system, and enabling the traffic cleaning system to function better.

[0068] The traffic processing method based on real-time policies in this application analyzes real-time network snapshot information and enables the unified management platform to formulate attack detection policies that are not dependent on initial thresholds through continuous iteration.

[0069] The traffic processing method based on real-time policies proposed in this application solves the problem of inaccurate traffic size threshold setting in the attack detection strategy of the unified management platform, and eliminates the risk that the traffic scrubbing system will misjudge some normal access traffic as an attack.

[0070] The traffic processing method based on real-time policies in this application fully considers the different business roles played by different IPs in the target network and creates a separate user profile for each accessed destination IP, reducing the risk of false positives and false negatives in attack detection.

[0071] The traffic processing method based on real-time policies proposed in this application solves the problem of the single feature of existing detection strategies. It adds detection strategy features such as protocol ratio, number of source IPs, and source IP tracing distribution, providing a method for a unified management platform to formulate more accurate attack detection strategies.

[0072] It should be clearly understood that this application describes how specific examples are formed and used, but the principles of this application are not limited to any details of these examples. Rather, based on the teachings of the disclosure of this application, these principles can be applied to many other embodiments.

[0073] Figure 3This is a flowchart illustrating a traffic processing method based on a real-time policy, according to another exemplary embodiment. Figure 3 The process shown in step 30 is... Figure 2 The flowchart shown includes a detailed description of S204, "Update the real-time attack detection strategy based on the snapshot information of the real-time access traffic, wherein the real-time attack detection strategy includes a destination IP self-learning table".

[0074] like Figure 3 As shown in S302, the traffic detection device obtains real-time access traffic through mirroring or traffic splitting.

[0075] In S304, the traffic detection device sends a snapshot of the real-time access traffic to the management platform.

[0076] In S306, the management platform updates the destination IP self-learning table based on the snapshot information. A destination IP self-learning table can be established based on the traffic characteristics of each attacked destination IP; the destination IP self-learning table is updated periodically. Relevant traffic information can be acquired within a preset time period; based on this relevant information, the traffic peak size threshold table, traffic protocol ratio threshold table, source IP number threshold table, and source IP tracing threshold table in the destination IP self-learning table are updated.

[0077] More specifically, the management platform can create an access characteristic table, also known as a destination IP self-learning threshold table, for each accessed destination IP. This table records the characteristics of traffic accessing different destination IPs, including traffic size, protocol ratio, number of source IPs, and source IP tracing distribution. The destination IP self-learning threshold table is updated at fixed time intervals. After learning is complete, the cache space is cleared, waiting for the next learning cycle to continue learning the cached characteristic data of the new cycle.

[0078] like Figure 4 As shown, the traffic size field update can be the weighted average of the current period's learning threshold and the previous period's threshold. The current period's learning threshold can be the average plus standard deviation of the peak traffic volume of this destination IP at different time points in the cache. The calculation methods for other characteristic thresholds of this destination IP can be the same as the above-described method for calculating the peak traffic volume threshold, and will not be repeated here.

[0079] The traffic protocol ratio field is updated to the weighted average of the current period learning threshold and the previous period threshold. The current period learning threshold is the average plus standard deviation of the proportion of different protocols accessed by the destination IP at different time points in the cache.

[0080] The source IP number segment is updated to the weighted average of the current period learning threshold and the previous period threshold. The current period learning threshold is the average plus standard deviation of the number of source IPs accessing the destination IP at different time points in the cache.

[0081] Among them, the source IP tracing distribution field is updated to the weighted average of the current period learning threshold and the previous period threshold. The current period learning threshold is the mean plus standard deviation of the geographical distribution of the source IP tracing of the destination IP accessed at different time points in the cache.

[0082] In the embodiments of this application, through iterative learning cycles, the target IP self-learning threshold table ultimately reflects the accurate user profile of each accessed target IP in the target network. When traffic accessing a certain target IP repeatedly does not match the iterated user profile, the traffic is determined to be attack traffic.

[0083] In S308, a real-time attack detection strategy is generated based on the target IP self-learning table.

[0084] As mentioned above, in existing technologies, the attack detection strategies are maintained on a unified management platform. These strategies primarily include traffic size thresholds. Network administrators first set an initial attack detection traffic size threshold based on actual usage. The unified management platform then continuously learns about the target network traffic based on this initial threshold and real-time network traffic snapshots sent by the detection devices. This generates an attack detection traffic size threshold that matches the target network and distributes it to the detection devices in the traffic scrubbing system, providing detection strategy support for attack detection. Although in related technologies, the unified management platform derives the attack detection alarm threshold by calculating a weighted average of normal traffic peaks, the existing attack detection strategy formulation methods cannot meet the actual needs of real-world application scenarios due to the shortcomings of the prior art described above.

[0085] This application's real-time policy-based traffic processing method iteratively develops attack detection traffic size thresholds that are independent of initial thresholds. It considers the fluctuations in peak traffic over time in real-world networks to formulate traffic size thresholds that align with actual conditions. New features for detection strategies, such as protocol ratio, number of source IPs, and source IP tracing distribution, provide a unified management platform with more precise attack detection strategies. A unique user profile is created for each destination IP in the target network.

[0086] Figure 5 This is a flowchart illustrating a traffic processing method based on a real-time policy, according to another exemplary embodiment. Figure 5 The process shown in step 50 is... Figure 2 The process shown includes a detailed description of S208, "When the real-time access traffic is attack traffic, generate a real-time attack protection policy, the real-time protection policy including the current alarm table".

[0087] like Figure 5 As shown in S502, when the real-time access traffic is attack traffic, the traffic detection device sends an alarm message to the management platform.

[0088] In S504, the management platform updates the current alarm table based on the destination IP self-learning table and traffic snapshots. For example, a container can be created using the currently attacked destination IP as the key; the container stores the currently attacked destination IP and its corresponding attack start time, attack end time, current status, and hit count; the current alarm table is updated based on the destination IP self-learning table and traffic snapshots.

[0089] In a practical embodiment, the current alarm table is a container with the destination IP as the key, which stores the target IP in the target network that is being attacked and the corresponding information of the attack, such as the attack start time, attack end time, current status and number of hits.

[0090] If the destination IP of the traffic snapshot information exists in the current alarm table, then the hit count of the corresponding alarm in the current alarm table is updated according to the judgment result of the previous step that it is attack traffic. If the feature information of the traffic does not exist in the current alarm table and it is attack traffic, then the feature information of the traffic is inserted into the current alarm table and the hit count field is initialized to one.

[0091] The hit count field is used to determine whether to add or age a record in the current alarm table. If a record in the current alarm table undergoes consecutive status changes exceeding a status threshold, then that record will be added or aged. For example, if a record in the current alarm table is currently in an attack state, and if that record is in a non-attack state for a consecutive status threshold period, then that record will be aged out and deleted from the current alarm table.

[0092] The current alarm table can be initially empty and is updated using the destination IP threshold and traffic snapshot logs from the detection devices, which are learned by the unified management platform. The current alarm table can also be updated and aged based on detection alarms sent by the detection devices. For example, in a traffic-based monitoring method, when traffic reaches or exceeds the server's security baseline (which is equivalent to a preset traffic threshold), the traffic detection device determines that the traffic is an attack targeting the server to be protected and generates a detection alarm, which is then sent to the unified management platform.

[0093] The unified management platform can synchronize the current alarm table based on alarm information. The traffic detection device can also detect attack traffic based on methods such as Deep Packet Inspection (DPI) or Deep / Dynamic Flow Inspection (DFI). In practice, the actual detection method used by the traffic detection device can be determined according to the specific circumstances, and will not be elaborated upon here.

[0094] If the traffic is determined to be attack traffic, the traffic snapshot information will not be used as the target data for single IP threshold calculation, and the data will be returned to the receiver to continue receiving traffic snapshot logs from the detection device. If the traffic is determined to be normal access traffic, the traffic snapshot information will be updated in the single IP threshold calculation cache (including peak traffic size, traffic protocol ratio, number of source IPs, and source IP tracing), and the threshold self-learning will be used to learn the characteristics of normal access traffic.

[0095] In S506, the real-time attack protection strategy is generated based on the current alarm table.

[0096] Those skilled in the art will understand that all or part of the steps of the above embodiments are implemented as a computer program executed by a CPU. When the computer program is executed by the CPU, it performs the functions defined by the method provided in this application. The program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disk.

[0097] Furthermore, it should be noted that the above figures are merely illustrative representations of the processes included in the method according to exemplary embodiments of this application, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0098] Figure 6 This is a block diagram illustrating an electronic device according to an exemplary embodiment.

[0099] The following reference Figure 6 To describe an electronic device 600 according to this embodiment of the present application. Figure 6 The electronic device 600 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0100] like Figure 6 As shown, the electronic device 600 is presented in the form of a general-purpose computing device. The components of the electronic device 600 may include, but are not limited to: at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different system components (including storage unit 620 and processing unit 610), a display unit 640, etc.

[0101] The storage unit stores program code that can be executed by the processing unit 610, causing the processing unit 610 to perform the steps described in this specification according to various exemplary embodiments of this application. For example, the processing unit 610 can perform actions such as... Figure 2 , Figure 3 , Figure 5 The steps are shown in the figure.

[0102] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 6201 and / or a cache storage unit 6202, and may further include a read-only memory unit (ROM) 6203.

[0103] The storage unit 620 may also include a program / utility 6204 having a set (at least one) program module 6205, such program module 6205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0104] Bus 630 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0105] Electronic device 600 can also communicate with one or more external devices 600' (e.g., keyboard, pointing device, Bluetooth device, etc.), enabling users to communicate with devices that interact with electronic device 600, and / or any device that allows electronic device 600 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 650. Furthermore, electronic device 600 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 660. Network adapter 660 can communicate with other modules of electronic device 600 via bus 630. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0106] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software, or by combining software with necessary hardware. Therefore, as... Figure 7 As shown, the technical solution according to the embodiments of this application can be embodied in the form of a software product. The software product can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, mobile hard drive, etc.) or on a network, and includes several instructions to cause a computing device (such as a personal computer, server, or network device, etc.) to execute the above-described method according to the embodiments of this application.

[0107] The software product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0108] The computer-readable storage medium may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0109] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0110] The aforementioned computer-readable medium carries one or more programs that, when executed by a device, cause the computer-readable medium to perform the following functions: a router acquires real-time access traffic from an external network; updates a real-time attack detection policy based on snapshot information of the real-time access traffic, the real-time attack detection policy including a destination IP self-learning table; performs attack detection on the real-time access traffic based on the real-time attack detection policy; when the real-time access traffic is attack traffic, generates a real-time attack protection policy, the real-time protection policy including a current alarm table; and cleans the traffic in the router according to the real-time attack protection policy.

[0111] Those skilled in the art will understand that the above modules can be distributed in the device as described in the embodiments, or they can be modified accordingly and placed in one or more devices that are unique to this embodiment. The modules in the above embodiments can be combined into one module, or they can be further divided into multiple sub-modules.

[0112] Through the description of the above embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this application.

[0113] Exemplary embodiments of this application have been specifically shown and described above. It should be understood that this application is not limited to the detailed structures, arrangements, or implementation methods described herein; rather, this application is intended to cover various modifications and equivalent arrangements contained within the spirit and scope of the appended claims.

Claims

1. A traffic processing method based on real-time strategies, characterized in that, include: The router obtains real-time access traffic from the external network; The real-time attack detection strategy is updated based on the snapshot information of the real-time access traffic. The real-time attack detection strategy includes a target IP self-learning table, which includes: the traffic detection device obtains real-time access traffic through mirroring or traffic splitting; the traffic detection device sends the snapshot information of the real-time access traffic to the management platform; the management platform updates the target IP self-learning table based on the snapshot information; and generates a real-time attack detection strategy based on the target IP self-learning table. The management platform updates the target IP self-learning table based on the snapshot information by: establishing a target IP self-learning table based on the traffic characteristics of each attacked target IP; obtaining relevant traffic information within a preset time period; and updating the traffic peak size threshold table, traffic protocol ratio threshold table, source IP number threshold table, and source IP tracing threshold table in the target IP self-learning table based on the relevant information. The real-time access traffic is attacked based on a real-time attack detection strategy. When the real-time access traffic is attack traffic, a real-time attack protection policy is generated, and the real-time protection policy includes the current alarm table; The traffic in the router is cleaned according to the real-time attack protection strategy.

2. The flow processing method as described in claim 1, characterized in that, Attack detection is performed on the real-time access traffic based on a real-time attack detection strategy, including: The traffic detection device performs attack detection on the real-time access traffic based on a real-time attack detection strategy.

3. The traffic processing method as described in claim 1, characterized in that, When the real-time access traffic is attack traffic, a real-time attack protection strategy is generated, including: When the real-time access traffic is identified as attack traffic, the traffic detection device sends an alarm message to the management platform. The management platform updates the current alarm table based on the destination IP self-learning table and traffic snapshots; The real-time attack protection strategy is generated based on the current alert table.

4. The flow processing method as described in claim 3, characterized in that, The management platform updates the current alarm table based on the destination IP self-learning table and traffic snapshots, including: Create a container using the currently attacked target IP as the key; The container stores the target IP currently under attack, along with its corresponding attack start time, attack end time, current status, and number of hits. Update the current alarm table based on the destination IP self-learning table and traffic snapshots.

5. The flow processing method as described in claim 1, characterized in that, The traffic in the router is cleaned according to the real-time attack protection strategy, including: The switch redirects traffic from the router to the traffic scrubbing device based on the real-time attack protection strategy. The flow cleaning equipment cleans the flow; The switch feeds the cleaned traffic back to the router.

6. A traffic processing system based on real-time strategies, characterized in that, include: Routers are used to capture real-time access traffic from external networks; A traffic detection device is used to update a real-time attack detection strategy based on snapshot information of the real-time access traffic. The real-time attack detection strategy includes a target IP self-learning table. The process includes: the traffic detection device acquiring real-time access traffic through mirroring or traffic splitting; the traffic detection device sending snapshot information of the real-time access traffic to a management platform; the management platform updating the target IP self-learning table based on the snapshot information; generating a real-time attack detection strategy based on the target IP self-learning table; and performing attack detection on the real-time access traffic based on the real-time attack detection strategy. The real-time attack detection strategy includes a target IP self-learning table, and the snapshot information of the real-time access traffic is sent to the management platform. The management platform updating the target IP self-learning table based on the snapshot information includes: establishing a target IP self-learning table based on the traffic characteristics of each attacked target IP; acquiring relevant traffic information within a preset time period; and updating the traffic peak size threshold table, traffic protocol ratio threshold table, source IP number threshold table, and source IP tracing threshold table in the target IP self-learning table based on the relevant information. The management platform is used to update the destination IP self-learning table in real time based on the snapshot information; and to generate a real-time attack protection strategy when the real-time access traffic is attack traffic. Traffic scrubbing equipment is used to scrub the traffic in the router according to the real-time attack protection strategy.

7. The flow processing system as described in claim 6, characterized in that, Also includes: A switch is used to redirect traffic from the router to a traffic scrubbing device based on the real-time attack protection strategy. The cleaned traffic is then fed back into the router.

Images