IP data packet filtering method, device and medium

Abstract

The present disclosure provides an IP data packet filtering method, device, and medium, relating to the field of network security technology. The method comprises: obtaining a current key security requirement and a security response component corresponding to each current key security requirement; obtaining a first key feature of a first IP data packet and a first current key security requirement that matches the first key feature; selecting the shortest security path for the first IP data packet, wherein the shortest security path includes the first security response component corresponding to the first current key security requirement; and performing a filtering operation on the first IP data packet by the first security response component in the shortest security path. The present disclosure improves the flexibility, applicability, and accuracy of IP data packet filtering by matching the key features of the IP data packet with the current key security requirement, selecting the shortest security path to transmit and filter the IP data packet, and performing a filtering operation on the first IP data packet by a suitable security response component in the shortest security path.

Description

Technical Field

[0001] The present disclosure relates at least to the field of network security technology, and in particular to an IP data packet filtering method, an IP data packet filtering device, and a computer-readable storage medium. Background Art

[0002] The currently widely used IP (Internet Protocol) packet filtering method filters and further processes and manages IP packets transmitted from the network through pre-defined rules. By analyzing and detecting the application layer information in the data packets, a more accurate network security status is obtained, thereby providing more accurate filtering results to ensure the safe and stable operation of the network.

[0003] Existing technical solutions have largely achieved the availability and security of IP packet filtering, but there are still many technical defects, including at least the following prominent aspects: traditional IP packet filtering methods are often based on static filtering rules, lack flexibility, and are not suitable for complex network topologies; traditional rule-based filtering methods are often targeted at individual security threats and cannot fully respond to ever-changing network security attack methods; traditional IP packet filtering technology also has the problem of high false positives and missed negatives, which may lead to the loss of legitimate data or the passage of illegal data, affecting the quality and accuracy of network packet filtering. Summary of the Invention

[0004] The technical problem to be solved by the present disclosure is to address the above-mentioned deficiencies and provide an IP data packet filtering method, an IP data packet filtering device and a computer-readable storage medium to solve the problem of how to improve the flexibility, applicability and accuracy of IP data packet filtering.

[0005] In a first aspect, the present disclosure provides a method for filtering Internet Protocol (IP) data packets, the method comprising:

[0006] Obtain current key security requirements and the security response components corresponding to each current key security requirement;

[0007] Obtaining a first key feature of a first IP data packet and a first current key security requirement matching the first key feature;

[0008] Selecting a shortest secure path for the first IP data packet, where the shortest secure path includes a first security response component corresponding to the first current critical security requirement;

[0009] A first security response component in the shortest security path performs a filtering operation on the first IP data packet.

[0010] Furthermore, the current key security requirements and the security response components corresponding to each current key security requirement are obtained, specifically including the following by the software-defined network SDN controller:

[0011] receiving a plurality of current key security requirements defined by a network administrator, the current key security requirements including a second security event obtained according to a second IP data packet and a first type of a second network node processing the second security event;

[0012] The current network topology is obtained, a first network node of the first type corresponding to each current key security requirement in the current network topology is obtained, and a data filtering rule for processing the corresponding second security event is configured for the first network node.

[0013] Furthermore, obtaining a first key feature of the first IP data packet and a first current key security requirement matching the first key feature specifically includes, by a software-defined network (SDN) controller:

[0014] Extracting first attribute information and a first key field of the first IP data packet, converting the first attribute information and the first key field into a first vector, and inputting the first vector into a pre-trained traffic analysis model to obtain a first security event that may be caused by the first IP data packet;

[0015] Calculate the similarity between the first security event and the second security event, obtain the second security event combination with the minimum similarity of each first security event, calculate the relative entropy of the combination of the first security event and the second security event, and in response to the relative entropy being less than a set threshold, obtain the first current key security requirement combination corresponding to the second event combination.

[0016] Furthermore, extracting the first attribute information and the first key field of the first IP data packet specifically includes:

[0017] Extracting first attribute information of the first IP data packet including packet size, transmission protocol type, transmission source address, and transmission destination address;

[0018] Use a recurrent neural network text analysis model and / or a convolutional neural network image recognition model to analyze whether the first IP data packet contains a specified first key field.

[0019] Furthermore, after obtaining the first security event that may be caused by the first IP data packet, the method further includes, by the software-defined network (SDN) controller:

[0020] Inputting the first vector into a pre-trained traffic classifier to obtain a first risk level of a first security event that may be caused by the first IP data packet;

[0021] The first IP data packet is encrypted, and an attribute tag including the first security event and the first risk level is added to the encrypted first IP data packet.

[0022] Furthermore, selecting the shortest secure path for the first IP data packet, where the shortest secure path includes a first security response component corresponding to the first current critical security requirement, specifically includes, by the software-defined network SDN controller:

[0023] In the current network topology, the transmission source address and the transmission destination address of the first IP data packet are determined, and the shortest secure path between the transmission source address and the transmission destination address is selected, where the shortest secure path includes a first network node of the first type corresponding to each first current critical security requirement.

[0024] Furthermore, the first security response component in the shortest security path performs a filtering operation on the first IP data packet, specifically including:

[0025] After the first security response component in the shortest security path determines that it needs to perform a filtering operation on the first IP data packet based on the attribute label, it decrypts the first IP data packet and processes the first IP data packet using its own data filtering rules.

[0026] In a second aspect, the present disclosure provides an Internet Protocol (IP) data packet filtering device, the device comprising:

[0027] A first acquisition module is used to obtain current key security requirements and security response components corresponding to each current key security requirement;

[0028] a second acquisition module, connected to the first acquisition module, configured to acquire a first key feature of the first IP data packet and a first current key security requirement matching the first key feature;

[0029] a path selection module, connected to the second acquisition module, configured to select a shortest secure path for the first IP data packet, the shortest secure path including a first security response component corresponding to the first current critical security requirement;

[0030] The data filtering module is connected to the path selection module and is used to perform a filtering operation on the first IP data packet by the first security response component in the shortest security path.

[0031] Furthermore, the device comprises:

[0032] A software defined network (SDN) controller, wherein the first acquisition module, the second acquisition module, and the path selection module are arranged in the SDN controller;

[0033] The network node is connected to the SDN controller, the security response component is selected and obtained from the network node, and the data filtering module is set in the security response component.

[0034] In a third aspect, the present disclosure provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the Internet Protocol (IP) data packet filtering method as described above is implemented.

[0035] The present disclosure provides an IP data packet filtering method, an IP data packet filtering device, and a computer-readable storage medium. By matching the key features of the IP data packet with the current key security requirements, the shortest security path is selected to perform the transmission and filtering of the IP data packet. The appropriate security response component in the shortest security path performs the filtering operation on the first IP data packet. The IP filtering rules can be dynamically updated to cope with changing network security attacks, IP data packets can be filtered more accurately, and the flexibility, applicability, and accuracy of IP data packet filtering can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 is a flow chart of an IP data packet filtering method according to an embodiment of the present disclosure;

[0037] Figure 2 It is a structural diagram of an IP data packet filtering device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0038] In order to enable those skilled in the art to better understand the technical solutions of the present disclosure, the embodiments of the present disclosure will be described in further detail below with reference to the accompanying drawings.

[0039] It should be understood that the specific embodiments and drawings described herein are only used to explain the present disclosure rather than to limit the present disclosure.

[0040] It can be understood that, in the absence of conflict, the various embodiments and features in the embodiments of the present disclosure can be combined with each other.

[0041] It will be understood that, for the convenience of description, the drawings of the present disclosure only show parts related to the present disclosure, while parts irrelevant to the present disclosure are not shown in the drawings.

[0042] It can be understood that each unit and module involved in the embodiments of the present disclosure may correspond to only one physical structure, or may be composed of multiple physical structures, or multiple units and modules may be integrated into one physical structure.

[0043] It will be understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of the present disclosure may occur in an order different from that marked in the drawings.

[0044] It is understood that the flowcharts and block diagrams of the present disclosure illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to the various embodiments of the present disclosure. Each box in the flowchart or block diagram may represent a unit, module, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented by a hardware-based system that implements the specified functions, or by a combination of hardware and computer instructions.

[0045] It can be understood that the units and modules involved in the embodiments of the present disclosure can be implemented by software or hardware, for example, the units and modules can be located in a processor.

[0046] Example 1:

[0047] like Figure 1 As shown, the present disclosure provides an Internet Protocol (IP) data packet filtering method, the method comprising:

[0048] S1. Obtain the current key security requirements and the security response components corresponding to each current key security requirement;

[0049] S2. Obtain a first key feature of the first IP data packet and a first current key security requirement matching the first key feature;

[0050] S3. Selecting the shortest secure path for the first IP data packet, where the shortest secure path includes a first security response component corresponding to the first current critical security requirement;

[0051] S4. The first security response component in the shortest security path performs a filtering operation on the first IP data packet.

[0052] In this embodiment, by matching the key features of the IP data packet with the current key security requirements, the shortest security path is selected to perform the transmission and filtering of the IP data packet, and the appropriate security response component in the shortest security path performs the filtering operation on the first IP data packet. The IP filtering rules can be dynamically updated to respond to changing network security attacks, filter IP data packets more accurately, and improve the flexibility, applicability and accuracy of IP data packet filtering.

[0053] Specifically, the current key security requirements are first defined. A corresponding trigger-response component is selected for each key security requirement. All trigger-response components are connected to form a rule chain with the shortest path. The rule chain is then tested, and rule chains that pass the test are converted into corresponding policy rule combinations. Key security requirements refer to the operational processes corresponding to events directly related to security at each network node in the current network topology. Response components refer to the network resources required to execute the corresponding key security requirements. The IP packet filtering method of this embodiment utilizes security policy automation and orchestration technology to control the flow of IP packets by running policy rules on network devices. Policy rules are automatically configured based on different targets. Different target attributes and statuses result in different matching policy rules, enabling more intelligent IP packet filtering management. Through centralized orchestration management, multiple policy rules are combined into a reasonable and coordinated security policy. Security policies include physical security policies, access control policies, information encryption policies, security management policies, and more. Appropriate policy rules and combinations are automatically selected based on specific security situations, making network security protection more comprehensive and efficient. For example, when abnormal traffic is detected, automated orchestration can immediately classify the traffic as malicious based on pre-set security policy rules, and implement a series of targeted protection measures for this traffic to improve the security and protection capabilities of the network.

[0054] The device corresponding to the method is as follows Figure 2 As shown, the apparatus includes a first acquisition module 1 for executing step S1, a second acquisition module 2 for executing step S2, a path selection module 3 for executing step S3, and a data filtering module 4 for executing step S4. Steps S1, S2, and S3 are executed by a software-defined network (SDN) controller, and step S4 is executed by a security response component. The security response component is a portion of a network node. Specifically, the apparatus includes: a software-defined network (SDN) controller, wherein the first acquisition module 1, the second acquisition module 2, and the path selection module 3 are disposed in the SDN controller; a network node connected to the SDN controller, which is selected and obtained from the network node by the security response component; and a data filtering module 4 is disposed in the security response component.

[0055] In one embodiment, S1, obtaining current key security requirements and security response components corresponding to each current key security requirement, specifically includes, by a software-defined network (SDN) controller:

[0056] receiving a plurality of current key security requirements defined by a network administrator, the current key security requirements including a second security event obtained according to a second IP data packet and a first type of a second network node processing the second security event;

[0057] The current network topology is obtained, a first network node of the first type corresponding to each current key security requirement in the current network topology is obtained, and a data filtering rule for processing the corresponding second security event is configured for the first network node.

[0058] In this embodiment, a new IP filtering method is proposed. By using a centralized controller to program and manage IP filtering rules for multiple network devices, IP packet filtering can be performed more conveniently in both small-scale and large-scale network environments, thereby improving its work efficiency. Defensive vulnerability mining technology is also utilized to provide more comprehensive and accurate network security protection information. By analyzing continuous network events, threatening behavior patterns are identified, and based on this, IP packets are selectively filtered, further improving network data security and the accuracy of IP packet filtering. In addition, using threat intelligence from a distributed network security resource sharing platform, through deep packet inspection, fuzzy logic, and API (Application Programming Interface) security policy technology, IP packet filtering can be performed within a unified and efficient security protection system, forming a more efficient, accurate, secure, and reliable IP packet filtering method.

[0059] Specifically, the implementation of the IP packet filtering method includes the following steps: a. Data preprocessing and feature extraction: Through deep packet inspection and application layer protocol parsing, key features that affect the security of the data packets are extracted from the data packets; b. Establishing a big data traffic analysis model: Analyzing and learning a large number of data packets, forming filtering rules, detecting abnormal traffic, predicting threat behavior, and forming an evaluation result; c. Filtering decision-making: For packets entering the network, the decision on whether to allow them to pass is made based on the evaluation results of the big data traffic analysis model; d. Establishing a real-time vulnerability and threat intelligence monitoring module to regularly obtain the latest vulnerability and threat information and use this information to update the IP packet filtering rules; e. Establishing a distributed network security resource sharing model to share threat intelligence and security rules with other organizations and networks. By constructing an IP packet filtering method, through data preprocessing and feature extraction, establishing a big data traffic analysis model, making filtering decisions, establishing a real-time vulnerability and threat intelligence monitoring module, and establishing a distributed network security resource sharing model, it is possible to accurately and efficiently extract useful information from a large amount of network data flows. Based on this information, IP filtering rules are further optimized and updated, achieving the management of large-scale network data flows and improving the efficiency and accuracy of network packet filtering.

[0060] The filtering decision step is based on SDN (Software Defined Network) technology, which dynamically adjusts network policies to adapt to varying network requirements. Through the SDN controller, network administrators can configure and adjust filtering rules in real time within the data plane based on real-time application needs and policy requirements. For example, for specific applications or services, filtering rules can be dynamically added or removed based on the packet's source IP address or destination port, enabling more granular network traffic control. This ability to dynamically adjust network policies makes IP packet filtering more flexible and adaptable, better meeting increasingly complex network security needs. Furthermore, SDN technology provides centralized monitoring and analysis capabilities for IP packet filtering. Through the SDN controller, network administrators can monitor network traffic in real time and analyze and process the collected data. This allows network administrators to gain a more comprehensive understanding of network traffic trends and behavior patterns and adjust filtering decisions accordingly. For example, they can detect and isolate abnormal traffic, identify potential security threats, and promptly update filtering rules to address them. These threats can be identified based on historical traffic risk data or shared traffic risk data from a shared platform. By leveraging historical experience in addressing these threats, network nodes with the appropriate processing capabilities can be selected to filter traffic.

[0061] In one embodiment, S2, obtaining a first key feature of the first IP data packet and a first current key security requirement matching the first key feature, specifically includes, by a software-defined network (SDN) controller:

[0062] Extracting first attribute information and a first key field of the first IP data packet, converting the first attribute information and the first key field into a first vector, and inputting the first vector into a pre-trained traffic analysis model to obtain a first security event that may be caused by the first IP data packet;

[0063] Calculate the similarity between the first security event and the second security event, obtain the second security event combination with the minimum similarity of each first security event, calculate the relative entropy of the combination of the first security event and the second security event, and in response to the relative entropy being less than a set threshold, obtain the first current key security requirement combination corresponding to the second event combination.

[0064] In this embodiment, the data preprocessing and feature extraction steps clean and normalize the raw data by removing noise, addressing missing values, and resolving data imbalances, eliminating invalid or redundant data to facilitate better feature extraction. When establishing stricter access policies, the results of feature extraction are used to define access rules and decision-making models. The extracted features are trained and optimized using machine learning algorithms to automatically evaluate and verify the legitimacy of IP packets. For example, the source IP address and transport protocol can be used to determine whether a packet should be allowed, prohibited, or require further verification. Feature extraction not only considers the characteristics of individual packets but also incorporates contextual information for comprehensive evaluation and decision-making. For example, the packet's communication history, the user or device's behavior patterns, and the security level of the network it resides on can be considered. This allows for a more comprehensive assessment of the risk and compliance of a packet and the implementation of appropriate access policies, such as allow, deny, or quarantine.

[0065] Specifically, dynamically updating IP filtering rules includes: extracting IP filtering rules from the database, replacing IP filtering rules, and modifying existing IP filtering rules. The centralized controller extracts the traffic characteristics of the data, establishes a traffic characteristic matrix, and calculates the relative entropy between the IP filtering rules being executed and the traffic characteristic matrix. The formula is P represents the IP filtering rule, and Q represents the traffic feature matrix. If the relative entropy exceeds the set threshold, it is determined that the IP filtering rule needs to be updated. The eigenvector of the traffic feature matrix is ​​then used to search the database. If an IP filtering rule that is linearly correlated with the eigenvector is retrieved, the retrieved IP filtering rule is used to replace it. Otherwise, the existing IP filtering rule is modified to make it linearly correlated with the eigenvector. The linear correlation and relative entropy between the traffic feature vector and the IP filtering rule are calculated. Specifically, the similarity of the security events corresponding to the two can be calculated. That is, when the security events corresponding to the two are the same or similar, the two are linearly correlated, and the relative entropy between the two combinations is small.

[0066] In one embodiment, extracting the first attribute information and the first key field of the first IP data packet specifically includes:

[0067] Extracting first attribute information of the first IP data packet including packet size, transmission protocol type, transmission source address, and transmission destination address;

[0068] Use a recurrent neural network text analysis model and / or a convolutional neural network image recognition model to analyze whether the first IP data packet contains a specified first key field.

[0069] In this embodiment, the big data traffic analysis model identifies potential threat behavior patterns by collecting and analyzing massive data traffic in the network. These behavior patterns may include abnormal traffic characteristics, malware characteristics, attack patterns, etc. By analyzing these patterns, the model can learn the laws and characteristics of threat behaviors (security events). The filtering rules are dynamically updated and adjusted based on these network behavior analysis results. The filtering rules can more accurately identify and filter out IP data packets that meet specific threat behavior patterns. By performing network behavior analysis, the filtering rules can also distinguish between normal and abnormal network traffic, identify IP data packets that violate normal behavior patterns, and intercept potential threats. For example, if the model finds that a certain IP address has sent a large number of abnormal requests in a short period of time, it may be a sign of a distributed denial of service attack. The filtering rules can block or restrict these data packets from specific IP addresses to strengthen the security protection of the network.

[0070] Specifically, the big data traffic analysis model deeply analyzes and detects the content of data packets at the network level. It is based on DPI (Deep Packet Inspection) technology to identify and filter complex application layer protocols, malicious codes and attacks, and perform corresponding operations based on the identification results. The specific construction process includes: assuming that n data packets are received in time T and are recorded as {P1, P2, ..., Pn}, each data packet Pi contains l fields and is recorded as {F1, F2, ..., Fl}; given the original data of data packet P, define a feature extraction function G so that: G(P) = (x1, x2, ..., xk), these features represent various attributes of the main data packets including packet size, transmission protocol type, transmission source and destination address; through recurrent neural network Network text analysis and convolutional neural network image recognition technology are used to analyze the content of the data packet. Combined with the classifier, it is predicted whether the data packet contains illegal information and whether the data packet contains illegal or illegal content. Each data packet Pi is represented as a vector (V1, V2, ..., Vl), and a model F is constructed to predict the behavior of each packet. A training set is set, containing m labeled data packets. This training set is represented as {(x1, y1), (x2, y2), ..., (xm, ym)}, where xi is the feature vector of the i-th packet and yi is the corresponding label. Based on this training set, the model F is trained by the ridge regression optimization method with the objective function: min J(F)=1 / 2m∑(i=1to m)(F(xi)-yi)^2+λ / 2m∑(j=1to n)Fj^2, where the first term is the sum of squares of prediction errors, the second term is the regularization term, and λ is a parameter that controls the strength of regularization. The accuracy of the result is maximized by optimizing an objective function J(F). A classifier is constructed to classify real-time traffic, and the feature vector is input into the classifier through the following mathematical relationship: g(x)=w^T x+b. If g(x)>0, the packet belongs to the normal traffic class; if g(x)<0, the packet belongs to the malicious traffic class, where x is the feature vector of the packet, and w and b are the weights and biases of the classifier. When the DPI system monitors the packet in real time, it calculates the feature vector of the packet and inputs it into the trained classifier. It takes corresponding actions based on the classifier's prediction results to obtain the decision D: D=F(V1,V2,...,Vl). After the model is established and trained, it is applied to each data packet from different application layer protocols to predict the behavior, and then corresponding operations are performed based on the prediction results to achieve fine-grained data packet filtering and more precise control.Since filtering rules can be actively updated, adaptive adjustments to network data traffic can be achieved, thereby improving filtering accuracy. Because the attributes of abnormal request data under actual working conditions change very quickly, if existing filtering methods are used, misjudgments often occur. By using a DPI model combined with a neural network, data packets can be detected with high precision.

[0071] In one embodiment, after obtaining the first security event that may be triggered by the first IP data packet, the method further includes, by a software-defined network (SDN) controller:

[0072] Inputting the first vector into a pre-trained traffic classifier to obtain a first risk level of a first security event that may be caused by the first IP data packet;

[0073] The first IP data packet is encrypted, and an attribute tag including the first security event and the first risk level is added to the encrypted first IP data packet.

[0074] In this embodiment, the step of establishing a real-time vulnerability and threat intelligence monitoring module utilizes attribute-based encryption technology. By tagging data packets with attributes, only packets that meet specific attribute conditions (such as traffic attributes, fine-grained attributes, and source address risk level attributes) can be decrypted or passed. This effectively controls data access without leaking data content, improving network security. By combining access control with encryption, hackers cannot bypass this access control mechanism even if they use encryption technology to launch attacks, thus protecting network security. Required attribute tags can be quickly adjusted and updated based on real-time vulnerability and threat intelligence. For example, when abnormal traffic is detected in the network, administrators can dynamically adjust the attribute tags and corresponding access control rules based on the traffic attribute characteristics, thereby protecting network security. Furthermore, good interoperability can be achieved between multiple network devices. Since it does not inherently involve any data content, it can be applied to a variety of different network application scenarios, making network access control more precise and reasonable in different scenarios.

[0075] Specifically, when an abnormality occurs in a traffic attribute, a risk level is added to the attribute label, the corresponding attribute label is changed, and the corresponding access control rule is selected according to the attribute label, such as selecting the corresponding access control rule according to the risk level. When performing attribute filtering, all attributes can be clustered and grouped, and each group can be assigned a corresponding multidimensional weight value. The key attribute dimension set in the current state can be extracted, and the key attribute dimension set can be combined using multidimensional weights. The corresponding attributes are combined according to the combination of multidimensional weights to obtain the target attribute combination. Multidimensional weights include data accuracy weights, traffic deviation weights, data quality weights, data content weights, data security weights, etc. The target attribute combination can summarize all the key features of the current data information. Generating attribute labels by combining the target attributes can ensure the filtering effect.

[0076] In one embodiment, S3, selecting the shortest secure path for the first IP data packet, where the shortest secure path includes a first security response component corresponding to the first current critical security requirement, specifically includes, by a software-defined network (SDN) controller:

[0077] In the current network topology, the transmission source address and the transmission destination address of the first IP data packet are determined, and the shortest secure path between the transmission source address and the transmission destination address is selected, where the shortest secure path includes a first network node of the first type corresponding to each first current critical security requirement.

[0078] In this embodiment, the filtering decision-making step involves programming and managing IP filtering rules for multiple network devices through a centralized controller. SDN centrally manages network decisions through a centralized controller, enabling programming and control of network devices. The controller can determine the current network topology based on real-time needs and dynamically update filtering rules, thereby more accurately filtering IP packets. For example, different filtering rules can be set to allow or deny certain types of packets, or adjusted based on network traffic load to improve network efficiency and security. The centralized controller can also dynamically update IP filtering rules based on real-time needs, enabling more flexible network management. For example, when a security threat is detected, filtering rules can be immediately updated to restrict the relevant traffic, thereby protecting the network. This dynamic updating of filtering rules can significantly enhance network security. Furthermore, using a centralized controller to implement IP packet filtering provides enhanced monitoring and analysis capabilities. The controller can collect network traffic data, monitor network traffic in real time, and provide powerful analysis capabilities to identify abnormal traffic and security threats. It can also generate real-time feedback and update filtering rules for all network devices. When a security anomaly occurs, all devices can be immediately controlled, making the network more secure and stable.

[0079] In one embodiment, S4, the first security response component in the shortest security path performs a filtering operation on the first IP data packet, specifically including:

[0080] After the first security response component in the shortest security path determines that it needs to perform a filtering operation on the first IP data packet based on the attribute label, it decrypts the first IP data packet and processes the first IP data packet using its own data filtering rules.

[0081] In the present embodiment, the IP packet filtering method utilizes prime number key distribution and prime number random number generation technology to encrypt and protect IP data packet, by prime number key distribution technology, the communication node in the network can safely generate and distribute a random secret key, be used for encrypting and decrypting IP data packet, can effectively improve the data security of IP data packet, prevent the tampering and theft of data packet.If certain node needs to encrypt or decrypt, then generate or obtain key, the node in the shortest secure path judges whether itself needs to perform filtering operation to the first IP data packet according to the attribute label, and the network node of non-first security response component then does not process the first IP data packet.

[0082] Example 2:

[0083] like Figure 2 As shown, the present disclosure provides an Internet Protocol (IP) data packet filtering device, the device comprising:

[0084] The first acquisition module 1 is used to obtain the current key security requirements and the security response components corresponding to each current key security requirement;

[0085] A second acquisition module 2, connected to the first acquisition module 1, is used to obtain a first key feature of the first IP data packet and a first current key security requirement matching the first key feature;

[0086] a path selection module 3, connected to the second acquisition module 2, configured to select the shortest secure path for the first IP data packet, the shortest secure path including the first security response component corresponding to the first current critical security requirement;

[0087] The data filtering module 4 is connected to the path selection module 3 and is configured to perform a filtering operation on the first IP data packet by the first security response component in the shortest security path.

[0088] In one embodiment, the device comprises:

[0089] A software defined network SDN controller, wherein the first acquisition module 1, the second acquisition module 2 and the path selection module 3 are arranged in the SDN controller;

[0090] The network node is connected to the SDN controller, the security response component is selected and obtained from the network node, and the data filtering module 4 is set in the security response component.

[0091] In one embodiment, the first acquisition module 1 specifically includes:

[0092] a receiving unit, configured to receive a plurality of current key security requirements defined by a network administrator, the current key security requirements including a second security event obtained according to a second IP data packet and a first type of a second network node processing the second security event;

[0093] The configuration unit is connected to the receiving unit and is used to obtain the current network topology structure, obtain the first network node of the first type corresponding to each current key security requirement in the current network topology structure, and configure the first network node to process data filtering rules corresponding to the second security event.

[0094] In one embodiment, the second acquisition module 2 specifically includes:

[0095] an extraction and analysis unit, configured to extract first attribute information and a first key field of the first IP data packet, convert the first attribute information and the first key field into a first vector, and input the first vector into a pre-trained traffic analysis model to obtain a first security event that may be caused by the first IP data packet;

[0096] The calculation and combination unit is connected to the extraction and analysis unit, and is used to calculate the similarity between the first security event and the second security event, obtain the second security event combination with the minimum similarity of each first security event, calculate the relative entropy of the combination of the first security event and the second security event, and in response to the relative entropy being less than a set threshold, obtain the first current key security requirement combination corresponding to the second event combination.

[0097] In one embodiment, the extraction and analysis unit specifically includes:

[0098] A first extraction subunit is used to extract first attribute information of the first IP data packet including packet size, transmission protocol type, transmission source address, and transmission destination address;

[0099] The second extraction subunit is used to use a recurrent neural network text analysis model and / or a convolutional neural network image recognition model to analyze whether the first IP data packet contains a specified first key field.

[0100] In one embodiment, the second acquisition module 2 further includes:

[0101] a classification unit, configured to input the first vector into a pre-trained traffic classifier to obtain a first risk level of a first security event that may be caused by the first IP data packet;

[0102] The encryption labeling unit is connected to the classification unit and is used to encrypt the first IP data packet and add an attribute label including the first security event and the first risk level to the encrypted first IP data packet.

[0103] In one embodiment, the path selection module 3 specifically includes:

[0104] A positioning unit, configured to determine a transmission source address and a transmission destination address of the first IP data packet in a current network topology;

[0105] The selection unit is connected to the positioning unit and is used to select the shortest security path between the transmission source address and the transmission destination address, where the shortest security path includes a first network node of the first type corresponding to each first current critical security requirement.

[0106] In one embodiment, the data filtering module 4 specifically includes a first security response component in the shortest security path:

[0107] a determining unit, configured to determine, based on the attribute tag, that it needs to perform a filtering operation on the first IP data packet;

[0108] The filtering unit is connected to the determining unit and is used to decrypt the first IP data packet and process the first IP data packet using its own data filtering rules.

[0109] Example 3:

[0110] Embodiment 3 of the present disclosure provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the Internet Protocol IP data packet filtering method as described in Embodiment 1 or the Internet Protocol IP data packet filtering device as described in Embodiment 2 is implemented.

[0111] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0112] In addition, the present disclosure may also provide a computer device, including a memory and a processor, wherein a computer program is stored in the memory. When the processor runs the computer program stored in the memory, the processor executes the Internet Protocol IP data packet filtering method as described in Example 1. The computer device may be the Internet Protocol IP data packet filtering device as described in Example 2.

[0113] The memory is connected to the processor, the memory may be a flash memory, a read-only memory or other memory, and the processor may be a central processing unit or a single-chip microcomputer.

[0114] Embodiments 1-3 of the present disclosure provide an IP data packet filtering method, an IP data packet filtering device, and a computer-readable storage medium. By matching the key features of the IP data packet with the current key security requirements, the shortest security path is selected to perform the transmission and filtering of the IP data packet. The appropriate security response component in the shortest security path performs the filtering operation on the first IP data packet. The IP filtering rules can be dynamically updated to respond to changing network security attacks, filter IP data packets more accurately, and improve the flexibility, applicability, and accuracy of IP data packet filtering.

[0115] It is understood that the above embodiments are merely exemplary embodiments for illustrating the principles of the present disclosure, and the present disclosure is not limited thereto. Those skilled in the art may make various modifications and improvements without departing from the spirit and substance of the present disclosure, and such modifications and improvements are also considered to be within the scope of protection of the present disclosure.

Claims

1. A method for filtering Internet Protocol (IP) data packets, characterized in that: The method comprises: Obtain current key security requirements and the security response components corresponding to each current key security requirement; Obtaining a first key feature of a first IP data packet and a first current key security requirement matching the first key feature; Selecting a shortest secure path for the first IP data packet, where the shortest secure path includes a first security response component corresponding to the first current critical security requirement; A first security response component in the shortest security path performs a filtering operation on the first IP data packet.

2. The method according to claim 1, characterized in that Obtain the current key security requirements and the security response components corresponding to each current key security requirement, specifically including the following by the software-defined network (SDN) controller: receiving a plurality of current key security requirements defined by a network administrator, the current key security requirements including a second security event obtained according to a second IP data packet and a first type of a second network node processing the second security event; The current network topology is obtained, a first network node of the first type corresponding to each current key security requirement in the current network topology is obtained, and a data filtering rule for processing the corresponding second security event is configured for the first network node.

3. The method according to claim 2, characterized in that Obtaining a first key feature of a first IP data packet and a first current key security requirement matching the first key feature, specifically including, by a software-defined network (SDN) controller: Extracting first attribute information and a first key field of the first IP data packet, converting the first attribute information and the first key field into a first vector, and inputting the first vector into a pre-trained traffic analysis model to obtain a first security event that may be caused by the first IP data packet; Calculate the similarity between the first security event and the second security event, obtain the second security event combination with the minimum similarity of each first security event, calculate the relative entropy of the combination of the first security event and the second security event, and in response to the relative entropy being less than a set threshold, obtain the first current key security requirement combination corresponding to the second event combination.

4. The method according to claim 3, characterized in that Extracting the first attribute information and the first key field of the first IP data packet specifically includes: Extracting first attribute information of the first IP data packet including packet size, transmission protocol type, transmission source address, and transmission destination address; Use a recurrent neural network text analysis model and / or a convolutional neural network image recognition model to analyze whether the first IP data packet contains a specified first key field.

5. The method according to claim 3, characterized in that After obtaining a first security event that may be triggered by the first IP data packet, the method further includes, by a software-defined network (SDN) controller: Inputting the first vector into a pre-trained traffic classifier to obtain a first risk level of a first security event that may be caused by the first IP data packet; The first IP data packet is encrypted, and an attribute tag including the first security event and the first risk level is added to the encrypted first IP data packet.

6. The method according to claim 2, characterized in that Selecting a shortest secure path for the first IP data packet, where the shortest secure path includes a first security response component corresponding to the first current critical security requirement, specifically including, by a software-defined network (SDN) controller: In the current network topology, the transmission source address and the transmission destination address of the first IP data packet are determined, and the shortest secure path between the transmission source address and the transmission destination address is selected, where the shortest secure path includes a first network node of the first type corresponding to each first current critical security requirement.

7. The method according to claim 5, characterized in that The first security response component in the shortest security path performs a filtering operation on the first IP data packet, specifically including: After the first security response component in the shortest security path determines that it needs to perform a filtering operation on the first IP data packet based on the attribute label, it decrypts the first IP data packet and processes the first IP data packet using its own data filtering rules.

8. An Internet Protocol (IP) data packet filtering device, characterized in that: The device comprises: A first acquisition module is used to obtain current key security requirements and security response components corresponding to each current key security requirement; a second acquisition module, connected to the first acquisition module, configured to acquire a first key feature of the first IP data packet and a first current key security requirement matching the first key feature; a path selection module, connected to the second acquisition module, configured to select a shortest secure path for the first IP data packet, the shortest secure path including a first security response component corresponding to the first current critical security requirement; The data filtering module is connected to the path selection module and is used to perform a filtering operation on the first IP data packet by the first security response component in the shortest security path.

9. The device according to claim 8, characterized in that The device comprises: A software defined network (SDN) controller, wherein the first acquisition module, the second acquisition module, and the path selection module are arranged in the SDN controller; The network node is connected to the SDN controller, the security response component is selected and obtained from the network node, and the data filtering module is set in the security response component.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for filtering Internet Protocol (IP) data packets according to any one of claims 1 to 7 is implemented.

Images