A data management method and management system

Abstract

The present application relates to a data management method and management system, including directing all traffic to a virtual server in response to an abnormal signal obtained from a server, the abnormal signal including traffic abnormality, response abnormality, resource occupancy abnormality and network connection abnormality; requesting the cloud to clean the traffic once to obtain a cleaned traffic; cleaning the cleaned traffic twice locally to obtain a second cleaned traffic; sending the second cleaned traffic to a server, and cleaning the second cleaned traffic three times according to the feedback from the server to obtain a third cleaned traffic and sending the data of the third cleaned traffic request to the access end pointed to by the third cleaned traffic. The data management method and management system disclosed in the present application use a local traffic cleaning method to re-screen the traffic that has been cleaned by the cloud traffic to remove false accesses in the traffic, so that the server can provide data services for normal accesses.

Description

Technical Field

[0001] The present application relates to the technical field of data management, and in particular to a data management method and management system. Background Art

[0002] Data is one of the core assets of an enterprise. When this data is placed in the cloud or can be accessed through the cloud, the data is at risk of being attacked because the benefits of blackmailing an enterprise are far greater than the benefits of blackmailing an individual user.

[0003] The terminal devices of individual users are often used as springboards. In addition, as a large number of open terminals (monitoring equipment, data acquisition equipment, etc.) are added to the network, these open terminals also begin to become springboards for attacks. For example, the widely existing reflective DDoS attacks use open servers on the Internet to send a large number of requests to the target, thereby exhausting the resources of the target server and making it unable to provide services normally.

[0004] After being attacked, the company's server cannot provide normal services. In serious cases, the business cannot be carried out normally. An appropriate solution is to purchase traffic cleaning services, but traffic cleaning services require continuous payment, and there are still a certain amount of leakage. Summary of the invention

[0005] The present application provides a data management method and management system, which uses a local traffic cleaning method to re-screen traffic that has been cleaned by cloud traffic, so as to remove false accesses in the traffic, so that the server can provide data services for normal accesses.

[0006] The above-mentioned purpose of the present application is achieved through the following technical solutions:

[0007] In a first aspect, the present application provides a data management method, comprising:

[0008] In response to abnormal signals obtained from the server, all traffic is directed to the virtual server, and the abnormal signals include abnormal traffic, abnormal response, abnormal resource usage and abnormal network connection;

[0009] Request the cloud to clean the traffic and obtain the cleaned traffic;

[0010] Performing secondary cleaning on the primary cleaning flow locally to obtain secondary cleaning flow;

[0011] The secondary cleaning flow is sent to the server, and the secondary cleaning flow is cleaned three times according to the feedback of the server to obtain the three cleaning flow;

[0012] Send the data requested by the three cleaning flows to the access end pointed to by the three cleaning flows;

[0013] When requesting the cloud to clean the traffic, it also includes screening suspected normal traffic from all the traffic and importing the suspected normal traffic to the server;

[0014] When screening suspected normal traffic, the suspected normal traffic per unit time is 0.2-0.4 times the peak traffic per unit time.

[0015] In a possible implementation of the first aspect, after all traffic is directed to the virtual server, a blank data packet is fed back to the access end to which the traffic is directed. When the access end to which the traffic is directed cannot feed back a feedback data packet based on the blank data packet, the access end to which the traffic is directed is placed on a blacklist.

[0016] In a possible implementation manner of the first aspect, generating a feedback data packet based on a blank data packet includes:

[0017] Sequentially acquiring blank data packets in a time series and parsing the acquired blank data packets to obtain encrypted text included in the blank data packets;

[0018] Arrange the encrypted text in order to obtain the encrypted verification code. The order of the encrypted text is hidden in the encrypted text.

[0019] Input the encrypted verification code into a random number generator to generate a random verification code;

[0020] Generate a feedback data packet using a random verification code;

[0021] When sending a blank data packet, one of the blank data packets includes an instruction, and the instruction includes a parsing method for the blank data packet.

[0022] In a possible implementation of the first aspect, blank data packets including encrypted text and blank data packets not including encrypted text are randomly arranged in a sequential sequence;

[0023] The blank data packet also includes a transmission frequency limit. Every time a node is passed, the transmission frequency of the blank data packet is reduced by one;

[0024] When the number of transmissions of a blank data packet is zero, the blank data packet is lost;

[0025] The blank data packet also includes a time code and a quantity code. The time code is the generation time of the blank data packet, and the quantity code is the number of blank data packets used to obtain the encrypted text.

[0026] In a possible implementation manner of the first aspect, screening the suspected normal traffic includes:

[0027] After obtaining the three cleaning flows, a dead time is allocated to each of the three cleaning flows. During the dead time, no data is sent to the access end pointed to by the three cleaning flows.

[0028] The dead time counts the number of visits of each three cleaning flows;

[0029] The three cleaning flows with access times less than or equal to the set number are placed in the blacklist.

[0030] In a possible implementation manner of the first aspect, the method further includes:

[0031] Count the usage frequency of each data packet pointed to by the three-time cleaning traffic;

[0032] When the usage frequency of a data packet pointed to by a tertiary cleaning flow exceeds the allowed range within a unit time, the tertiary cleaning flow requesting the data packet is placed in a blacklist.

[0033] In a possible implementation manner of the first aspect, the method further includes:

[0034] The time series is divided into multiple time periods, and the number of three cleaning flows corresponding to each time period is the same or similar, and the three cleaning flows corresponding to each time period all point to the same data packet;

[0035] Dividing the data packet into a plurality of sub-data packets, wherein the plurality of sub-data packets are arranged in a sequential sequence;

[0036] Only one sub-packet is sent in each time period, and the sub-packets are sent in a sequential sequence;

[0037] Put the three-time cleaning traffic with no feedback into the blacklist;

[0038] In the process of continuously receiving three cleaning flows, firstly determine the time period corresponding to the time point when the three cleaning flows are received, and then send the sub-data packet corresponding to the time period;

[0039] Two adjacent sub-data packet sending processes, the first sub-data packet sending process is a formal sending process, and the second sub-data packet sending process is a supplementary sending process;

[0040] The time period division method of the formal sending process and the supplementary sending process associated with the formal sending process is the same.

[0041] In a second aspect, the present application provides a data management device, comprising:

[0042] An abnormality analysis unit, used to direct all traffic to the virtual server in response to abnormality signals obtained from the server, the abnormality signals including traffic abnormality, response abnormality, resource occupancy abnormality and network connection abnormality;

[0043] The first cleaning unit is used to request the cloud to clean the traffic once and obtain the cleaned traffic;

[0044] The second cleaning unit is used to perform a secondary cleaning on the primary cleaning flow locally to obtain a secondary cleaning flow;

[0045] The third cleaning unit is used to send the secondary cleaning flow to the server, and perform a third cleaning on the secondary cleaning flow according to the feedback of the server to obtain a third cleaning flow;

[0046] A feedback unit, used for sending data of the three cleaning flow requests to the access end to which the three cleaning flows are directed;

[0047] When requesting the cloud to clean the traffic, it also includes screening suspected normal traffic from all the traffic and importing the suspected normal traffic to the server;

[0048] When screening suspected normal traffic, the suspected normal traffic per unit time is 0.2-0.4 times the peak traffic per unit time.

[0049] In a third aspect, the present application provides a data management system, the system comprising:

[0050] one or more memories for storing instructions; and

[0051] One or more processors, used to call and run the instructions from the memory to execute the method as described in the first aspect and any possible implementation of the first aspect.

[0052] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium comprises:

[0053] Program, when the program is executed by a processor, the method described in the first aspect and any possible implementation of the first aspect is executed.

[0054] In a fifth aspect, the present application provides a computer program product, comprising program instructions. When the program instructions are executed by a computing device, the method described in the first aspect and any possible implementation of the first aspect is executed.

[0055] In a sixth aspect, the present application provides a chip system, which includes a processor for implementing the functions involved in the above aspects, for example, generating, receiving, sending, or processing the data and / or information involved in the above methods.

[0056] The chip system may be composed of chips, or may include chips and other discrete devices.

[0057] In a possible design, the chip system also includes a memory, which is used to store necessary program instructions and data. The processor and the memory can be decoupled and respectively set on different devices, connected by wired or wireless means, or the processor and the memory can also be coupled on the same device. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 It is a schematic flowchart of the steps of a data management method provided by this application.

[0059] Figure 2 This is a schematic diagram of a flow cleaning process provided by the present application.

[0060] Figure 3 This is a schematic diagram of the principle of obtaining an encrypted verification code provided by the present application.

[0061] Figure 4 This is a schematic diagram of the principle of dividing time periods provided by the present application. DETAILED DESCRIPTION

[0062] The technical solution in this application is further described in detail below in conjunction with the accompanying drawings.

[0063] This application discloses a data management method. In some examples, see Figure 1 The data management method disclosed in this application includes the following steps:

[0064] S101, in response to an abnormal signal obtained from the server, directing all traffic to the virtual server, the abnormal signal including traffic abnormality, response abnormality, resource occupancy abnormality and network connection abnormality;

[0065] S102, requesting the cloud to clean the traffic once, and obtaining cleaned traffic;

[0066] S103, performing secondary cleaning on the primary cleaning flow locally to obtain secondary cleaning flow;

[0067] S104, sending the secondary cleaning flow to the server, and performing a tertiary cleaning on the secondary cleaning flow according to feedback from the server to obtain a tertiary cleaning flow;

[0068] S105, sending the data of the three cleaning flow requests to the access end to which the three cleaning flows are directed;

[0069] When requesting the cloud to clean the traffic, it also includes screening suspected normal traffic from all the traffic and importing the suspected normal traffic to the server;

[0070] When screening suspected normal traffic, the suspected normal traffic per unit time is 0.2-0.4 times the peak traffic per unit time.

[0071] First of all, it should be explained that the data management method disclosed in this application is mainly used in the distribution stage of data management. The distribution here refers to sending the data stored in the server to the access end. This management method plays an important role in the current enterprise data management. The core reason is that enterprises have begun to break through data islands and make full use of the value of data, and data has begun to change from a static state to a circulating state.

[0072] The data management method disclosed in the present application is applied to a server to solve the data distribution problem in data management between an access terminal and a server.

[0073] In step S101 to step S105, when the server finds an abnormal signal, it will first direct all traffic to the virtual server. The virtual server can be regarded as a substitute for the server, or it can be explained that the virtual server is a clone of the server, but the stored data is all false data.

[0074] The reason for using a virtual server is to induce the attack to continue and provide samples for subsequent analysis.

[0075] In step S102, the cloud is requested to clean the traffic once to obtain cleaned traffic. The cleaning here is provided by the service provider. There are two modes of cleaning: sample and intelligent analysis. Sample refers to the characteristics of historical attacks, such as records of paths and operating habits. When the sample appears again, the false access associated with the sample is directly intercepted; intelligent analysis uses big data models to discover false access and then intercept the false access.

[0076] Of course, there will be a certain amount of false access residues after one cleaning, because there is a considerable amount of passive cleaning in one cleaning. When the form of false access is updated, some false accesses cannot be discovered. However, the residual amount is reduced to the processing capacity of the server. Therefore, after the second cleaning is performed locally, the second cleaning traffic is sent to the server, and then the second cleaning traffic is cleaned three times according to the feedback from the server to obtain the three cleaning traffic, such as Figure 2 shown.

[0077] At this point, basically all false accesses in the access can be intercepted. After the three cleanings are completed, the data requested by the three cleaning traffics are sent to the access end pointed to by the three cleaning traffics.

[0078] In some possible implementations, secondary cleaning is performed with the help of ACL rules.

[0079] It should be noted that when requesting the cloud to clean the traffic, it also includes screening out suspected normal traffic from all the traffic and importing the suspected normal traffic to the server. At this time, the suspected normal traffic in the traffic is imported into the server. Suspected normal traffic refers to the traffic that has been selected and is considered to be normal.

[0080] Because traffic includes normal traffic and abnormal traffic, and cleaning takes time. If all traffic is intercepted at this time, it will inevitably cause the interruption of all normal access. Therefore, it is necessary to import suspected normal traffic into the server to ensure that most normal access is carried out.

[0081] In addition, when screening suspected normal traffic, the suspected normal traffic per unit time is 0.2-0.4 times the peak traffic per unit time. This is because part of the computing power needs to be used to screen suspected normal traffic.

[0082] In some examples, after all traffic is directed to the virtual server, a blank data packet is fed back to the access end to which the traffic is directed. When the access end to which the traffic is directed cannot feed back a feedback data packet based on the blank data packet, the access end to which the traffic is directed is placed in a blacklist.

[0083] At this time, the server acts as a springboard. After the virtual server feeds back a blank data packet to the access end to which the traffic is directed, the access end to which the traffic is directed will generate a feedback data packet based on the blank data packet and then send it to the server. When the server detects the feedback data packet, it retains the traffic corresponding to the feedback data packet and then puts the access end without the feedback data packet into the blacklist.

[0084] At this time, temporary bandwidth expansion is needed to accommodate the sudden increase in traffic.

[0085] In some examples, the specific method of generating a feedback data packet based on a blank data packet is as follows:

[0086] S201, sequentially obtaining blank data packets in a time series and parsing the obtained blank data packets to obtain encrypted text included in the blank data packets;

[0087] S202, arranging the encrypted text in order to obtain an encrypted verification code, where the arrangement order of the encrypted text is hidden in the encrypted text;

[0088] S203, inputting the encrypted verification code into a random number generator to generate a random verification code;

[0089] S204, generating a feedback data packet using a random verification code;

[0090] When sending a blank data packet, one of the blank data packets includes an instruction, and the instruction includes a parsing method for the blank data packet.

[0091] See also Figure 3 In step S201 to step S204, the access end will sequentially obtain blank data packets in a time series and parse the obtained blank data packets to obtain the encrypted text included in the blank data packets, and then arrange the encrypted text in order to obtain the encrypted verification code.

[0092] The order of the encrypted text is hidden in the encrypted text. For example, if there are three groups of encrypted text, the order of the three groups will be fixed in the pre-set rules.

[0093] The encrypted verification code is input into the random number generator to generate a random verification code, and then the random verification code is used to generate a feedback data packet. Here, the server and the access end use the same random number generator. When the server and the access end input the same random number generator, the same output will be obtained.

[0094] When sending a blank data packet, one of the blank data packets includes an instruction, and the instruction includes a parsing method for the blank data packet. The parsing method here is equivalent to the encryption method. The parsing method for the blank data packet included in the instruction is a set of numbers, and the number corresponds to the number of the parsing method, so that the access end can quickly determine the parsing method.

[0095] As for the fake access end, there is the problem of using brute force cracking or being unable to crack the blank data packet. A receiving time can also be set here. Feedback data packets that exceed the receiving time will not be received, and then the traffic corresponding to the feedback data packet will be placed in the blacklist.

[0096] Furthermore, the following content is added:

[0097] The blank data packets including the encrypted text and the blank data packets not including the encrypted text are randomly arranged in the sequential sequence, in order to increase the randomness of the encrypted text.

[0098] The blank data packet also includes a transmission frequency limit. Each time the blank data packet passes through a node, the transmission frequency of the blank data packet is reduced once. The purpose is to limit the transmission range of the blank data packet, which can prevent the blank data packet from reaching the false access end to a certain extent.

[0099] Because the fake access point uses a springboard to implement the attack, when a blank data packet cannot reach the fake access point through the springboard, it means that a feedback data packet cannot be generated.

[0100] In this restriction, when the number of transmissions of a blank data packet reaches zero, the blank data packet will be automatically lost.

[0101] At the same time, the blank data packet also includes a time code and a quantity code. The time code is the generation time of the blank data packet, and the quantity code is the number of blank data packets used to obtain the encrypted text. In this way, when the blank data packets obtained do not meet the quantity requirements, the encryption verification code cannot be obtained.

[0102] For the access end, the access path is fixed, and generally there are only two situations: obtaining a sufficient number of blank data packets and failing to obtain blank data packets.

[0103] However, for the false access end, the false access path it distributes is not fixed, which results in a limited probability that the false access end obtains a sufficient number of blank data packets under the premise of limiting the propagation range of the blank data packets.

[0104] In some examples, the way to filter out suspected good traffic is:

[0105] S301, after obtaining three cleaning flows, allocating a dead time to each of the three cleaning flows, and not sending data to the access end pointed to by the three cleaning flows during the dead time;

[0106] S302, the stagnation time counts the number of visits of each three cleaning flows;

[0107] S303, placing three cleaning flows with access times less than or equal to the set number into a blacklist.

[0108] Specifically, the purpose of the dead time is to determine whether the three cleaning traffic is a real visit or a false visit. Generally speaking, when a false visit does not get feedback, it will be considered that the server has begun to be blocked. At this time, the attack is still mainly high frequency and quantity, and the number of visits is mostly once or a small number of times.

[0109] At this time, placing three cleaning flows with access times less than or equal to the set number into the blacklist can play an effective interception role, because for real access, a stable access frequency can be achieved by setting rules.

[0110] At the same time, the frequency of use restrictions have been added, as follows:

[0111] Count the usage frequency of each data packet pointed to by the three-time cleaning traffic;

[0112] When the usage frequency of a data packet pointed to by a tertiary cleaning flow exceeds the allowed range within a unit time, the tertiary cleaning flow requesting the data packet is placed in a blacklist.

[0113] It should be understood that during normal access, the frequency of data packet usage fluctuates within a range, that is, the allowed range. When the frequency of data packet usage exceeds the allowed range, it means that there are a large number of false accesses mixed in the access, because one of the operating methods of false access is to replace the IP address in the access with the IP address of the access end.

[0114] At this time, placing the three cleaning flows requesting the data packet into the blacklist can alleviate the pressure on the server to a great extent and avoid causing server overload and denial of service.

[0115] Of course, after the traffic returns to normal, it is necessary to pull this part of the three-time cleaning traffic from the blacklist, or pull the three-time cleaning traffic of normal access from the blacklist according to the processing results.

[0116] In addition, if the access involves protocol stack behavior, targeted processing is required. The specific methods are:

[0117] S401, dividing a time series into multiple time periods, wherein the number of three cleaning flows corresponding to each time period is the same or similar, and the three cleaning flows corresponding to each time period all point to the same data packet;

[0118] S402, dividing the data packet into a plurality of sub-data packets, and arranging the plurality of sub-data packets in a sequential sequence;

[0119] S403, only one sub-data packet is sent in each time period, and the sub-data packets are sent in a sequential sequence;

[0120] S404, placing the three cleaning flows without feedback into a blacklist;

[0121] In the process of continuously receiving three cleaning flows, firstly determine the time period corresponding to the time point when the three cleaning flows are received, and then send the sub-data packet corresponding to the time period;

[0122] Two adjacent sub-data packet sending processes, the first sub-data packet sending process is a formal sending process, and the second sub-data packet sending process is a supplementary sending process;

[0123] The time period division method of the formal sending process and the supplementary sending process associated with the formal sending process is the same.

[0124] The contents of step S401 to step S404 are divided into multiple time periods in a time series by a dynamic balancing method, and the number of three cleaning flows corresponding to each time period is the same or similar, such as Figure 4 As shown, the data packet is divided into multiple sub-data packets according to the time period, and then only one sub-data packet is sent in each time period.

[0125] This method can make the sending amount of each sub-data packet tend to be balanced.

[0126] When the amount of sub-packets sent is unbalanced, the number of access terminals that receive the sub-packets will be inconsistent. In this way, during the supplementary sending process, it is very easy for the access terminal to still not receive all the sub-packets after the supplementary sending process is completed. At the same time, it will also lead to an increase in invalid access caused by the access terminal continuously accessing the server.

[0127] After a formal sending process and a supplementary sending process are completed, the three cleaning flows without feedback will be placed in the blacklist. The reason for no feedback is that not all sub-data packets can be received. Of course, here, a formal sending process and a supplementary sending process can also be called a verification process, and the number of verification processes can be one or more.

[0128] The present application also provides a data management device, comprising:

[0129] An abnormality analysis unit, used to direct all traffic to the virtual server in response to abnormality signals obtained from the server, the abnormality signals including traffic abnormality, response abnormality, resource occupancy abnormality and network connection abnormality;

[0130] The first cleaning unit is used to request the cloud to clean the traffic once and obtain the cleaned traffic;

[0131] The second cleaning unit is used to perform a secondary cleaning on the primary cleaning flow locally to obtain a secondary cleaning flow;

[0132] The third cleaning unit is used to send the secondary cleaning flow to the server, and perform a third cleaning on the secondary cleaning flow according to the feedback of the server to obtain a third cleaning flow;

[0133] A feedback unit, used for sending data of the three cleaning flow requests to the access end to which the three cleaning flows are directed;

[0134] When requesting the cloud to clean the traffic, it also includes screening suspected normal traffic from all the traffic and importing the suspected normal traffic to the server;

[0135] When screening suspected normal traffic, the suspected normal traffic per unit time is 0.2-0.4 times the peak traffic per unit time.

[0136] Furthermore, after all traffic is directed to the virtual server, a blank data packet is fed back to the access end to which the traffic is directed. When the access end to which the traffic is directed cannot feed back a feedback data packet based on the blank data packet, the access end to which the traffic is directed is placed in a blacklist.

[0137] Furthermore, it also includes:

[0138] Sequentially acquiring blank data packets in a time series and parsing the acquired blank data packets to obtain encrypted text included in the blank data packets;

[0139] Arrange the encrypted text in order to obtain the encrypted verification code. The order of the encrypted text is hidden in the encrypted text.

[0140] Input the encrypted verification code into a random number generator to generate a random verification code;

[0141] Generate a feedback data packet using a random verification code;

[0142] When sending a blank data packet, one of the blank data packets includes an instruction, and the instruction includes a parsing method for the blank data packet.

[0143] Furthermore, it also includes:

[0144] The blank data packets of the encrypted text and the blank data packets not including the encrypted text are randomly arranged in the sequential sequence;

[0145] The blank data packet also includes a transmission frequency limit. Every time a node is passed, the transmission frequency of the blank data packet is reduced by one;

[0146] When the number of transmissions of a blank data packet is zero, the blank data packet is lost;

[0147] The blank data packet also includes a time code and a quantity code. The time code is the generation time of the blank data packet, and the quantity code is the number of blank data packets used to obtain the encrypted text.

[0148] Furthermore, it also includes:

[0149] A dead time allocation unit is used to allocate a dead time to each of the three cleaning flows after obtaining the three cleaning flows, and not to send data to the access end pointed to by the three cleaning flows during the dead time;

[0150] The first statistical unit is used to count the number of visits of each three cleaning flows during the dead time;

[0151] The first blacklist unit is used to put three cleaning flows with access times less than or equal to a set number of times into a blacklist.

[0152] Furthermore, it also includes:

[0153] The second statistical unit is used to count the usage frequency of each data packet pointed to by the three-time cleaning traffic;

[0154] The second blacklist unit is used to put the tertiary cleaning flow requesting the data packet into the blacklist when the usage frequency of the data packet pointed to by the tertiary cleaning flow exceeds the allowed range within a unit time.

[0155] Furthermore, it also includes:

[0156] The time period division unit is used to divide a time series into multiple time periods, the number of three cleaning flows corresponding to each time period is the same or similar, and the three cleaning flows corresponding to each time period all point to the same data packet;

[0157] A data packet division unit, used for dividing the data packet into a plurality of sub-data packets, wherein the plurality of sub-data packets are arranged in a sequential sequence;

[0158] A data packet sending unit, used for sending only one sub-data packet in each time period, and the sub-data packets are sent in a sequential sequence;

[0159] The third blacklist unit is used to put the tertiary cleaning traffic without feedback into the blacklist;

[0160] In the process of continuously receiving three cleaning flows, firstly determine the time period corresponding to the time point when the three cleaning flows are received, and then send the sub-data packet corresponding to the time period;

[0161] Two adjacent sub-data packet sending processes, the first sub-data packet sending process is a formal sending process, and the second sub-data packet sending process is a supplementary sending process;

[0162] The time period division method of the formal sending process and the supplementary sending process associated with the formal sending process is the same.

[0163] In one example, the unit in any of the above devices can be one or more integrated circuits configured to implement the above methods, such as: one or more application specific integrated circuits (ASICs), or, one or more digital signal processors (DSPs), or, one or more field programmable gate arrays (FPGAs), or a combination of at least two of these integrated circuit forms.

[0164] For another example, when the units in the device can be implemented in the form of a processing element scheduling program, the processing element can be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call a program. For another example, these units can be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0165] Various objects such as various messages / information / equipment / network elements / systems / devices / actions / operations / processes / concepts that may appear in this application are named. It can be understood that these specific names do not constitute a limitation on the relevant objects. The names assigned may change with factors such as scenarios, contexts or usage habits. The understanding of the technical meaning of the technical terms in this application should be mainly determined from the functions and technical effects embodied / executed in the technical scheme.

[0166] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0167] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0168] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0169] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0170] It should also be understood that in various embodiments of the present application, the first, second, etc. are only used to indicate that multiple objects are different. For example, the first time window and the second time window are only used to indicate different time windows. They should not have any impact on the time window itself, and the first, second, etc. mentioned above should not impose any limitations on the embodiments of the present application.

[0171] It should also be understood that in the various embodiments of the present application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their internal logical relationships.

[0172] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a computer-readable storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned computer-readable storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0173] The present application also provides a data management system, the system comprising:

[0174] one or more memories for storing instructions; and

[0175] One or more processors are used to call and run the instructions from the memory to execute the method as described above.

[0176] The present application also provides a computer program product, which includes instructions. When the instructions are executed, the terminal device and the network device perform operations of the terminal device and the network device corresponding to the above method.

[0177] The present application also provides a chip system, which includes a processor for implementing the functions involved in the above content, such as generating, receiving, sending, or processing the data and / or information involved in the above method.

[0178] The chip system may be composed of chips, or may include chips and other discrete devices.

[0179] The processor mentioned in any of the above places can be a CPU, a microprocessor, an ASIC, or one or more integrated circuits for executing programs for controlling the above-mentioned feedback information transmission method.

[0180] In a possible design, the chip system also includes a memory, which is used to store necessary program instructions and data. The processor and the memory can be decoupled and respectively set on different devices, connected by wire or wireless means to support the chip system to implement various functions in the above embodiments. Alternatively, the processor and the memory can also be coupled on the same device.

[0181] Optionally, the computer instructions are stored in a memory.

[0182] Optionally, the memory is a storage unit within the chip, such as a register, a cache, etc. The memory can also be a storage unit within the terminal located outside the chip, such as a ROM or other types of static storage devices that can store static information and instructions, RAM, etc.

[0183] It can be understood that the memory in the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories.

[0184] The non-volatile memory may be a ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), or a flash memory.

[0185] The volatile memory may be a RAM, which is used as an external cache. There are many different types of RAM, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct memory bus RAM.

[0186] The embodiments of this specific implementation method are all preferred embodiments of the present application, and are not intended to limit the protection scope of the present application. Therefore, all equivalent changes made based on the structure, shape, and principle of the present application should be included in the protection scope of the present application.

Claims

1. A data management method, It is characterized in that include: In response to abnormal signals obtained from the server, all traffic is directed to the virtual server, and the abnormal signals include abnormal traffic, abnormal response, abnormal resource usage and abnormal network connection; Request the cloud to clean the traffic and obtain the cleaned traffic; Performing secondary cleaning on the primary cleaning flow locally to obtain secondary cleaning flow; The secondary cleaning flow is sent to the server, and the secondary cleaning flow is cleaned three times according to the feedback of the server to obtain the three cleaning flow; Send the data requested by the three cleaning flows to the access end pointed to by the three cleaning flows; When requesting the cloud to clean the traffic, it also includes screening suspected normal traffic from all the traffic and importing the suspected normal traffic to the server; When screening suspected normal traffic, the suspected normal traffic per unit time is 0.2-0.4 times the peak traffic per unit time; After all traffic is directed to the virtual server, a blank data packet is fed back to the access end to which the traffic is directed. When the access end to which the traffic is directed cannot feed back a feedback data packet based on the blank data packet, the access end to which the traffic is directed is placed in a blacklist. The feedback data packet generated based on the blank data packet includes: Sequentially acquiring blank data packets in a time series and parsing the acquired blank data packets to obtain encrypted text included in the blank data packets; Arrange the encrypted text in order to obtain the encrypted verification code. The order of the encrypted text is hidden in the encrypted text. Input the encrypted verification code into a random number generator to generate a random verification code; Generate a feedback data packet using a random verification code; When sending a blank data packet, one of the blank data packets includes an instruction, and the instruction includes a parsing method for the blank data packet.

2. The data management method according to claim 1, It is characterized in that The blank data packets including the encrypted text and the blank data packets not including the encrypted text are randomly arranged in the sequential sequence; The blank data packet also includes a transmission frequency limit. Every time a node is passed, the transmission frequency of the blank data packet is reduced by one; When the number of transmissions of a blank data packet is zero, the blank data packet is lost; The blank data packet also includes a time code and a quantity code. The time code is the generation time of the blank data packet, and the quantity code is the number of blank data packets used to obtain the encrypted text.

3. The data management method according to claim 1, It is characterized in that Screening of suspected normal traffic includes: After obtaining the three cleaning flows, a dead time is allocated to each of the three cleaning flows. During the dead time, no data is sent to the access end pointed to by the three cleaning flows. The dead time counts the number of visits of each three cleaning flows; The three cleaning flows with access times less than or equal to the set number are placed in the blacklist.

4. The data management method according to claim 3, It is characterized in that Also includes: Count the usage frequency of each data packet pointed to by the three-time cleaning traffic; When the usage frequency of a data packet pointed to by a tertiary cleaning flow exceeds the allowed range within a unit time, the tertiary cleaning flow requesting the data packet is placed in a blacklist.

5. The data management method according to claim 1 or 4, It is characterized in that Also includes: The time series is divided into multiple time periods, and the number of three cleaning flows corresponding to each time period is the same or similar, and the three cleaning flows corresponding to each time period all point to the same data packet; Dividing the data packet into a plurality of sub-data packets, and arranging the plurality of sub-data packets in a sequential sequence; Only one sub-packet is sent in each time period, and the sub-packets are sent in a sequential sequence; Put the three-time cleaning traffic with no feedback into the blacklist; In the process of continuously receiving three cleaning flows, firstly determine the time period corresponding to the time point when the three cleaning flows are received, and then send the sub-data packet corresponding to the time period; In two adjacent sub-data packet sending processes, the first sub-data packet sending process is a formal sending process, and the second sub-data packet sending process is a supplementary sending process.

6. A data management device, It is characterized in that include: An abnormality analysis unit, used to direct all traffic to the virtual server in response to abnormality signals obtained from the server, the abnormality signals including traffic abnormality, response abnormality, resource occupancy abnormality and network connection abnormality; The first cleaning unit is used to request the cloud to clean the traffic once and obtain the cleaned traffic; The second cleaning unit is used to perform a secondary cleaning on the primary cleaning flow locally to obtain a secondary cleaning flow; The third cleaning unit is used to send the secondary cleaning flow to the server, and perform a third cleaning on the secondary cleaning flow according to the feedback of the server to obtain a third cleaning flow; A feedback unit, used for sending data of the three cleaning flow requests to the access end to which the three cleaning flows are directed; When requesting the cloud to clean the traffic, it also includes screening suspected normal traffic from all the traffic and importing the suspected normal traffic to the server; When screening suspected normal traffic, the suspected normal traffic per unit time is 0.2-0.4 times the peak traffic per unit time; After all traffic is directed to the virtual server, a blank data packet is fed back to the access end to which the traffic is directed. When the access end to which the traffic is directed cannot feed back a feedback data packet based on the blank data packet, the access end to which the traffic is directed is placed in a blacklist. The feedback data packet generated based on the blank data packet includes: Sequentially acquiring blank data packets in a time series and parsing the acquired blank data packets to obtain encrypted text included in the blank data packets; Arrange the encrypted text in order to obtain the encrypted verification code. The order of the encrypted text is hidden in the encrypted text. Input the encrypted verification code into a random number generator to generate a random verification code; Generate a feedback data packet using a random verification code; When sending a blank data packet, one of the blank data packets includes an instruction, and the instruction includes a parsing method for the blank data packet.

7. A data management system, It is characterized in that The system comprises: one or more memories for storing instructions; and One or more processors, configured to call and execute the instructions from the memory to perform the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, It is characterized in that The computer readable storage medium comprises: The program, when the program is executed by a processor, the method according to any one of claims 1 to 5 is executed.

Images