Capacitive DDoS attack dynamic defense system and method based on programmable switch

Abstract

The present invention provides a dynamic defense system and method for capacity-type DDoS attacks based on a programmable switch, and relates to the field of computer technology. The system includes a detection module for collecting network traffic information in real time, detecting whether an attack occurs in the current network or whether the attack type changes; a defense strategy control module for generating a new defense strategy based on the capacity-type DDoS attack set and the defense tasks in the deployed defense strategy, and converting the new defense strategy into a control statement of the programmable switch; a dynamic defense module for deploying the defense strategy based on the defense strategy control statement, and guiding the mixed traffic flowing through the programmable switch into different defense tasks to clean the attack traffic based on the deployed defense strategy. The present invention realizes efficient dynamic defense against capacity-type DDoS attacks, supports flexible strategy switching and dynamic resource management, and ensures network security and stability.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a capacity-based DDoS attack dynamic defense system and method based on a programmable switch. Background Art

[0002] With the rapid development and widespread popularity of the Internet, network security faces increasingly severe challenges. Among these challenges, Distributed Denial of Service (DDoS) attacks are particularly prominent because they are extremely destructive. Such attacks are not only large-scale, but also exhibit dynamic hybrid characteristics: attackers will mix multiple volumetric DDoS attacks at the same time and dynamically change the types of mixed attacks over time. To address this challenge, existing work has been committed to finding effective defense measures.

[0003] As a new type of network equipment, programmable switches provide new possibilities for developing efficient DDoS defense systems with their flexible programming features and high-performance hardware platforms. Programmable switches have many advantages: programmability, users can customize packet processing logic according to needs, thereby achieving more efficient network traffic control; flexibility, flexible packet processing logic updates by recompiling and running code in programmable switches without the need for hardware-level equipment upgrades or replacements; high bandwidth and low latency: programmable switches can process arriving packets within microseconds at line rates (≥3.3Tbps), suitable for high-performance network environments.

[0004] At present, there are still some limitations in the work on defending against dynamic hybrid capacity-based DDoS attacks based on programmable switches. (1) The on-chip storage space of programmable switches is limited, which limits the number and complexity of attack defense tasks that the defense system can deploy. Therefore, in the face of hybrid attacks, the defense system cannot deploy defense tasks for all attacks in the programmable switch, and can only selectively deploy defense tasks for the currently detected attacks. These defense tasks are the current defense strategies of the system. (2) When the existing defense system based on programmable switches faces dynamic hybrid attacks, that is, when the type of hybrid attacks changes, a new round of attack defense tasks (defense strategy switching) needs to be deployed. The defense strategy switching mode of existing work requires interrupting the programmable switch to compile and run the new defense solution code. During this process, the switch is offline and the defense system is in a defense window period, resulting in inefficient defense and even being maliciously exploited by attackers to bypass the defense system. (3) The existence of the defense window period may be maliciously exploited by attackers: frequent (in seconds) switching of the types of hybrid attacks continuously triggers the defense system window period, allowing attack traffic to bypass the defense system. At the same time, in distributed defense scenarios (such as ISP networks), the most important function of switches in ISP networks is basic network functions such as network traffic routing and forwarding. On this basis, other network traffic measurement tasks, network telemetry tasks, network attack defense tasks, etc. can also be deployed. However, the mode of defense strategy switching in existing work will cause the programmable switch to be offline (downtime), resulting in the interruption of the local ISP network, and all basic network functions and value-added network functions cannot work normally. Summary of the invention

[0005] To this end, an embodiment of the present invention provides a capacity-based DDoS attack dynamic defense system and method based on a programmable switch, which is used to solve the problem in the prior art that when implementing dynamic hybrid capacity-based DDoS attack defense based on a programmable switch, there are limited resources, defense strategy switching requires service interruption resulting in defense windows, and these windows may be maliciously exploited by attackers.

[0006] In order to solve the above problems, an embodiment of the present invention provides a capacity-based DDoS attack dynamic defense system based on a programmable switch, the system comprising:

[0007] The detection module is used to collect network traffic information in real time at a given time period in the programmable switch to detect whether an attack occurs in the current network or whether the attack type changes; if a volumetric DDoS attack is detected in the current network, the detected volumetric DDoS attack set is used as the output of the detection module;

[0008] A defense strategy control module is used to generate a new defense strategy based on the volumetric DDoS attack set output by the detection module and the defense tasks in the deployed defense strategy, and convert the new defense strategy into a control statement of the programmable switch as the output of the defense strategy control module;

[0009] The dynamic defense module is used to deploy defense strategies according to the defense strategy control statements output by the defense strategy control module, and guide the mixed traffic flowing through the programmable switch into different defense tasks to clean the attack traffic according to the deployed defense strategies.

[0010] Preferably, the system further comprises a user control module for allowing the user to add a new type of volumetric DDoS attack to the defense system through the user control module when the attack arrives.

[0011] Preferably, the detection module is used to collect network traffic information in real time at a given time period in the programmable switch to detect whether an attack occurs in the current network or whether the attack type changes; if a volumetric DDoS attack is detected in the current network, the detected volumetric DDoS attack set is used as the output of the detection module, specifically including:

[0012] Based on the Beaucoup data structure, the coupon quantity is set to the set quantity in the programmable switch;

[0013] Set a given time period, collect and analyze network traffic information in real time during each time period, regard the traffic corresponding to each attack as a flow, and each session in the flow as an element, and measure the cardinality of the network flow;

[0014] When the data packet arrives at the defense system, the programmable switch parses the header field of the data packet to obtain characteristic information, including a five-tuple, where the five-tuple includes source IP, destination IP, source port, destination port, and protocol number;

[0015] Match the attack detection task corresponding to the data packet according to the port where the data packet enters the switch, the protocol number field in the IP packet header / the source and destination port field in the transport layer packet, and the status information;

[0016] Update the Beaucoup of the matched attack detection task and set the indexed coupon to 1;

[0017] At the end of each detection cycle, the control plane reads all registers used by Beaucoup in the programmable switch and performs traffic information statistics; analyzes the Beaucoup of each attack. If all coupons in the Beaucoup of an attack are set to 1, the attack is considered to be occurring; the detected attack is sent as output to the defense strategy control module;

[0018] Set all registers used by Beaucoup in the programmable switch to 0 and start a new round of detection cycle.

[0019] Preferably, the defense strategy control module is used to generate a new defense strategy according to the volumetric DDoS attack set output by the detection module and the defense tasks in the deployed defense strategy, and convert the new defense strategy into a control statement of the programmable switch as the output of the defense strategy control module, specifically including:

[0020] The volumetric DDoS attack set detected by the detection module is used as the input of the defense strategy control module;

[0021] According to the input volumetric DDoS attack set, the defense tasks in the deployed defense strategy are searched, and the attack set for which no defense tasks are deployed in the current defense strategy is found, that is, the attack set of newly added attacks in the current defense strategy, and the attack set of stopped attacks in the current defense strategy;

[0022] For the attack set of newly added attacks in the current defense strategy: According to the attack information table, obtain the relevant information of each attack in the attack set, including the characteristics of the attack corresponding data packet, defense task ID, Sketch ID, defense plan, priority, and generate the defense task corresponding to the undeployed attack;

[0023] Allocate Sketch space for the newly generated defense task, perform dynamic memory allocation based on the number of Sketch rows required for each defense task, and output the offset of the defense task in each register array;

[0024] Convert each defense task into a defense strategy insertion control statement executed in the programmable switch;

[0025] For the set of attacks that have stopped attacking in the current defense strategy: find the defense strategy insertion control statement of each attack defense task in the defense strategy that has been deployed by the current dynamic defense module, and retract the defense tasks in the defense strategy;

[0026] Dynamically reclaim the Sketch used for defense tasks;

[0027] Convert each defense task into a defense policy deletion control statement executed in the programmable switch;

[0028] Integrate the defense strategy insertion control statement and the defense strategy deletion control statement, and output the defense strategy runtime reconfiguration control statement as the output of the defense strategy control module;

[0029] The newly generated defense tasks and the withdrawn defense tasks are updated in the defense strategy recorded in the defense strategy control module.

[0030] Preferably, in the defense strategy control module, dynamic memory allocation or memory reclaiming for the defense task specifically includes:

[0031] The defense strategy control module allocates or reclaims memory for defense tasks that need to use Sketch;

[0032] For defense tasks that require memory allocation: obtain the number of rows m of Sketch required for the defense tasks that require memory allocation, where 1≤m≤4;

[0033] Select the register array with the least number of usage of the general Sketch block from the four register arrays;

[0034] Each selected register array allocates a general Sketch block for the defense task and calculates the offset of the general Sketch block, i.e. the starting position, where the offset of the unselected register array is -1;

[0035] Update the usage of the four register arrays recorded in the defense strategy control module, mark the allocated general Sketch block as used, and store the Sketch ID of the defense task;

[0036] Output the offsets of 4 register arrays, where the offset of the unselected register array is -1;

[0037] For defense tasks that need to reclaim memory: In the defense strategy control module, traverse all common Sketch blocks in the four register arrays to find all common Sketch blocks used by the defense tasks that need to reclaim memory;

[0038] In the defense strategy control module, mark the found common Sketch blocks as unused;

[0039] Reset the register values ​​of the unused general Sketch corresponding positions in the programmable switch to 0;

[0040] Ends memory allocation or memory deallocation.

[0041] Preferably, the dynamic defense module is used to deploy the defense strategy according to the defense strategy control statement output by the defense strategy control module, specifically including:

[0042] receiving a defense policy control statement output by a defense policy control module, and performing runtime reconfiguration in a programmable switch;

[0043] Execute the table entry insertion or deletion control statement of the defense task matching table, so that the parsed data packet matches or does not match the defense task, and realizes the addition and withdrawal of the defense task;

[0044] Execute the entry insertion or deletion control statement of the matching offset table, so that the general Sketch block pointed to by the offset is allocated or reclaimed;

[0045] Execute the table entry insertion or deletion control statement of the matching register array table;

[0046] Execute the control statement for inserting or deleting items in the matching processing result table;

[0047] Complete the deployment of all defense tasks that need to be inserted or deleted included in the defense strategy.

[0048] Preferably, the method of guiding the mixed traffic flowing through the programmable switch into different defense tasks to clean the attack traffic according to the deployed defense strategy specifically includes:

[0049] Step S301: a data packet sent from an external network or a data packet sent from a protected server arrives at a programmable switch;

[0050] Step S302: the programmable switch parses the header information of the data packet according to the header of the custom data packet;

[0051] Step S303: Match the corresponding defense task in the defense task matching table according to the port number of the data packet entering the programmable switch, the protocol number / port number in the parsed data packet information, and the status information. When the defense task is successfully matched, metadata is obtained, and the corresponding defense scheme process is entered to execute S304, where the defense scheme includes a proxy defense scheme, a detection and current limiting defense scheme, and a one-to-one cache defense scheme; otherwise, execute step S309;

[0052] Step S304: If the defense task matched in step S303 belongs to the proxy defense solution, the metadata of the proxy defense solution is set according to the matched table item: defense task ID, Sketch ID, and parameter param when updating Sketch;

[0053] If the defense task matched in step S303 belongs to the detection and current limiting defense solution, the metadata of the detection and current limiting defense solution is set according to the matched table item: defense task ID, Sketch ID, and parameter param when updating Sketch;

[0054] If the defense task matched in step S303 belongs to the one-to-one cache defense solution, the metadata of the one-to-one cache defense solution is set according to the matched table entry: defense task ID, Sketch ID, and parameter param when updating Sketch;

[0055] Step S305: According to the set Sketch ID, query the offset matching table to obtain the position of the general Sketch block assigned to the defense task Sketch in the register array;

[0056] Step S306: Hash the five-tuple in the data packet, obtain the virtual index of the register that needs to be updated, and calculate the actual index, where the five-tuple includes the source IP, the destination IP, the source port, the destination port, and the protocol number;

[0057] Step S307: query the ALU operation used by the defense task Sketch according to the set Sketch ID;

[0058] Step S308: According to the set Sketch ID, query each register array whether a general Sketch block is allocated to the defense task Sketch, and update it;

[0059] Step S309: According to the defense task ID and the returned result, matching the operation to be performed on the data packet, including discarding, limiting, replying on behalf of, and forwarding;

[0060] Step S310: Execute the final operation.

[0061] Preferably, a proxy defense solution is used to clean the attack traffic, including:

[0062] Step S401: Match the parsed data packet to the defense task, metadata: the defense scheme value is 1, which belongs to the proxy defense scheme;

[0063] Step S402: according to the matched items in the defense task matching table, set the metadata of the proxy defense solution: defense task ID, Sketch ID;

[0064] Step S403: determine whether the data packet belongs to a SYN proxy or an ICMP proxy; if it belongs to a SYN proxy, the SYN proxy uses a Bloom Filter and executes step S404; otherwise, it belongs to an ICMP proxy and does not use Sketch, and executes step S409;

[0065] Step S404: determine whether the data packet is a SYN data packet of the first handshake of the TCP connection or an ACK data packet; if it is a SYN data packet, set the parameter param when updating Sketch in the metadata to 0, indicating a whitelist query, and execute step S407; otherwise, it is an ACK data packet, and execute step 405;

[0066] Step S405: determine whether the ACK data packet is a TCP connection third handshake data packet, if yes, execute step S406; otherwise, set the returned result as a forwarding flag, and execute step S410;

[0067] Step S406: Determine whether the ACK data packet of the third handshake of the TCP connection passes the Cookie verification. If so, set the parameter param when updating Sketch in the metadata to 1, representing the whitelist record, and execute step S407; otherwise, set the returned result to the discard flag and execute step S409;

[0068] Step S407: The SYN agent uses Bloom Filter to link the OR operation in the ALU operation to implement Bloom Filter;

[0069] Step S408: Get the register array used by the actual index and defense task, and update Sketch;

[0070] Step S409: Determine the subsequent operation based on the defense task ID and the return value of the updated Sketch, including reply, forward, and discard;

[0071] Step S410: Execute the final operation.

[0072] Preferably, a detection and flow limiting defense solution is used to clean the attack traffic, including:

[0073] Step S501: Match the parsed data packet to the defense task, metadata: the defense scheme value is 2, which belongs to the detection and current limiting defense scheme;

[0074] Step S502: according to the matched table items in the defense task matching table, set the metadata of the detection and current limiting defense scheme: defense task ID, Sketch ID;

[0075] Step S503: setting the parameter param in the metadata when updating Sketch to 1, which means that the number of data packets of the corresponding session increases by 1;

[0076] Step S504: The detection and current limiting defense solution uses Count-min Sketch to link the addition operation in the ALU operation to implement Count-min Sketch;

[0077] Step S505: Get the register array used by the actual index and defense task, and update Sketch;

[0078] Step S506: Determine the subsequent operation according to the defense task ID and the return value of the updated Sketch, including current limiting and forwarding;

[0079] Step S507: Execute the final operation.

[0080] Preferably, a one-to-one cache defense solution is used to clean the attack traffic, specifically including:

[0081] Step S601: Match the parsed data packet to the defense task, metadata: the defense scheme value is 4, which belongs to the one-to-one cache defense scheme;

[0082] Step S602: according to the matched table entry in the defense task matching table, set the metadata of the one-to-one cache defense solution: defense task ID, Sketch ID;

[0083] Step S603: Determine whether the data packet is a reply data packet entering from a port of the programmable switch connected to an external network or a request data packet entering from a port of the programmable switch connected to a protected server;

[0084] If the data packet is a reply data packet entering from the port of the programmable switch connected to the external network, the parameter param when updating the Sketch in the metadata is set to 1, indicating that the cache is reduced; the one-to-one cache defense solution uses the Counting Bloom Filter, links the subtraction operation in the ALU operation, implements the Counting Bloom Filter, performs cache lookup and reduces the cache;

[0085] If the data packet is a request data packet entering from the port of the programmable switch connected to the protected server, the parameter param when updating Sketch in the metadata is set to, which represents the increase of cache, where; the one-to-one cache defense solution uses Counting Bloom Filter, links the addition operation in the ALU operation, implements Counting Bloom Filter, and increases the cache;

[0086] Step S604: Get the register array used by the actual index and defense task, and update Sketch;

[0087] Step S605: Determine the subsequent operation, including discarding and forwarding, according to the defense task ID and the return value of the updated Sketch;

[0088] Step S606: Execute the final operation.

[0089] The embodiment of the present invention further provides a method for dynamic defense against capacity-based DDoS attacks based on a programmable switch. The method uses the above-mentioned dynamic defense system against capacity-based DDoS attacks based on a programmable switch, and specifically includes:

[0090] Step S1: The detection module collects network traffic information in real time at a given time period in the programmable switch to detect whether an attack occurs in the current network or whether the attack type changes; if a volumetric DDoS attack is detected in the current network, the detected volumetric DDoS attack set is used as the output of the detection module;

[0091] Step S2: The defense strategy control module generates a new defense strategy according to the volumetric DDoS attack set output by the detection module and the defense tasks in the deployed defense strategy, and converts the new defense strategy into a control statement of the programmable switch as the output of the defense strategy control module;

[0092] Step S3: The dynamic defense module deploys the defense strategy according to the defense strategy control statement output by the defense strategy control module, and guides the mixed traffic flowing through the programmable switch into different defense tasks to clean the attack traffic according to the deployed defense strategy.

[0093] Preferably, the method further comprises step S4: when a new type of volumetric DDoS attack comes, the user adds the attack to the defense system through the user control module.

[0094] It can be seen from the above technical solutions that the present invention has the following beneficial effects:

[0095] The embodiment of the present invention provides a dynamic defense system and method for capacity-based DDoS attacks based on programmable switches. Three defense schemes are designed for existing capacity-based attacks, which can cover a wide range of capacity-based DDoS attacks, and a dynamic memory allocation scheme based on a general data structure realizes dynamic memory allocation and recovery of attack defense tasks. On this basis, a new defense strategy switching mode is designed. In the face of dynamic hybrid attacks, defense strategy switching can be performed without interrupting the programmable switch, realizing runtime defense strategy reconfiguration. BRIEF DESCRIPTION OF THE DRAWINGS

[0096] In order to more clearly illustrate the implementation cases of the present invention or the technical solutions in the prior art, the following is a brief description of the drawings required for use in the embodiments. By referring to the drawings, the features and advantages of the present invention will be more clearly understood. The drawings are schematic and should not be understood as limiting the present invention in any way. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0097] Figure 1 A block diagram of a capacity-based DDoS attack dynamic defense system based on a programmable switch provided in an embodiment;

[0098] Figure 2 A flowchart of a defense strategy control module updating a defense strategy in an embodiment;

[0099] Figure 3 A flowchart of dynamically allocating or reclaiming memory for a defense task in an embodiment;

[0100] Figure 4 It is a flow chart of a dynamic defense module in an embodiment for deploying a defense strategy according to a defense strategy control statement output by a defense strategy control module;

[0101] Figure 5 It is a flow chart of the dynamic defense module in the embodiment guiding the mixed traffic flowing through the programmable switch into different defense tasks to clean the attack traffic according to the deployed defense strategy;

[0102] Figure 6 This is a flow chart of using a proxy defense solution to clean attack traffic in an embodiment;

[0103] Figure 7 This is a flow chart of using the detection and current limiting defense solution to clean attack traffic in the embodiment;

[0104] Figure 8 This is a flow chart of using a one-to-one cache defense solution to clean attack traffic in an embodiment;

[0105] Fig. 9 The present invention is a flowchart of a method for dynamic defense against capacity-based DDoS attacks based on a programmable switch provided in an embodiment. DETAILED DESCRIPTION

[0106] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Embodiment 1

[0107] In order to solve the problem that in the existing technology of implementing dynamic hybrid capacity-based DDoS attack defense based on programmable switches, there are limited resources, defense strategy switching requires service interruption, resulting in defense windows, and these windows may be maliciously exploited by attackers. Figure 1 As shown, an embodiment of the present invention proposes a capacity-based DDoS attack dynamic defense system based on a programmable switch, the system comprising:

[0108] The detection module is used to collect network traffic information in real time at a given time period in the programmable switch to detect whether an attack occurs in the current network or whether the attack type changes; if a volumetric DDoS attack is detected in the current network, the detected volumetric DDoS attack set is used as the output of the detection module;

[0109] A defense strategy control module is used to generate a new defense strategy based on the volumetric DDoS attack set output by the detection module and the defense tasks in the deployed defense strategy, and convert the new defense strategy into a control statement of the programmable switch as the output of the defense strategy control module;

[0110] The dynamic defense module is used to deploy defense strategies according to the defense strategy control statements output by the defense strategy control module, and guide the mixed traffic flowing through the programmable switch into different defense tasks to clean the attack traffic according to the deployed defense strategies.

[0111] From the above technical solutions, it can be seen that the present invention provides a dynamic defense system for capacity-based DDoS attacks based on programmable switches. Three defense schemes are designed for existing capacity-based attacks, which can cover a wide range of capacity-based DDoS attacks, and a dynamic memory allocation scheme based on a general data structure realizes dynamic memory allocation and recovery of attack defense tasks. On this basis, a new defense strategy switching mode is designed. In the face of dynamic hybrid attacks, defense strategy switching can be performed without interrupting the programmable switch, realizing runtime defense strategy reconfiguration.

[0112] The defense system of the present invention also includes a user control module, which is used to allow the user to add a new type of volumetric DDoS attack to the defense system through the user control module when the attack arrives, so that the defense system can subsequently defend against the attack.

[0113] The detection module in the defense system of the present invention is specifically implemented as follows:

[0114] Step 1: Based on the Beaucoup data structure, the present invention sets the number of coupons to 1000 in the programmable switch, that is, detects whether the cardinality of the traffic corresponding to each attack exceeds the threshold of 10000. If it exceeds, it is considered that the attack has occurred.

[0115] BeauCoup is a probabilistic data structure for detecting network traffic cardinality over-threshold, which is suitable for performing multiple different detection tasks in a memory-constrained environment. It is designed based on the "coupon collection" problem. The core idea is to allocate a certain number of "coupons" to each detection task, and map each data packet to different coupons through a random hash function, and gradually collect these coupons. When a detection task collects all the coupons, it is considered that the cardinality has been detected to have exceeded the threshold.

[0116] The data structure of BeauCoup mainly includes the following components: Coupon collector table: Each detection task defines a set of coupons and the corresponding collection probability, and uses a bit vector to store the coupon collection status of each detection task (0-not collected, 1-collected). Hash function: Through the hash function, the attributes of each data packet (such as IP address, five-tuple, etc.) are mapped to a specific coupon to determine whether to collect the coupon. Memory access restriction: Each detection task can only collect at most one coupon on each data packet. By sharing memory resources, BeauCoup can run multiple detection tasks at the same time and ensure that the memory access of each detection task does not exceed the hardware limit.

[0117] This structure effectively solves the performance bottleneck when multiple detection tasks are concurrent and memory resources are tight, and is suitable for real-time monitoring and detection of various abnormal behaviors in network devices.

[0118] Step 2: Set a given time period (e.g. 5 seconds), collect and analyze network traffic information in real time during each time period, regard the traffic corresponding to each attack as a flow, and each session in the flow (five-tuple in the data packet) as an element, and measure the cardinality of the network flow, that is, how many different sessions there are:

[0119] For example, in a UDP Flood attack, the UDP traffic is considered as a network flow, and the cardinality of sessions in the UDP flow is detected. In a SYN Flood attack, the TCP SYN traffic is considered as a network flow, and the cardinality of sessions in the TCP SYN flow is detected. In a DNS reflection amplification attack, the DNS reply traffic is considered as a network flow, and the cardinality of sessions in the DNS reply flow is detected.

[0120] Step 3: Parse the data packet: When the data packet reaches the defense system, the programmable switch parses the packet header field to obtain characteristic information such as the five-tuple (source IP, destination IP, source port, destination port, protocol number).

[0121] Step 4: Matching attack detection tasks: The detection module matches the attack detection task corresponding to the data packet according to the port where the data packet enters the switch, the protocol number field in the IP packet header / the source and destination port field in the transport layer packet, and the status information.

[0122] Step 5: Update the Beaucoup of the matched attack detection task and set the indexed coupon to 1.

[0123] Step 6: At the end of each detection cycle, the control plane reads all registers used by Beaucoup in the programmable switch and performs traffic information statistics; analyzes the Beaucoup of each attack; if all coupons in the Beaucoup of an attack are set to 1, the attack is considered to be occurring; the detected attack is sent as output to the defense strategy control module.

[0124] Step 7: Set all registers used by Beaucoup in the programmable switch to 0 and start a new round of detection.

[0125] The policy control module in the defense system of the present invention is specifically implemented as follows:

[0126] The defense strategy control module records the information of each defense task in the current defense strategy, as well as the usage of the four register arrays in the programmable switch that serve as general Sketches. When Sketch space needs to be allocated for a defense task, the defense strategy control module allocates it according to the usage of the general Sketch blocks in the four register arrays; updates the general Sketch blocks allocated in each register array to a used state, and records the Sketch ID of the allocated defense task; outputs the offset of the general Sketch blocks allocated in each register array. When it is necessary to reclaim a defense task, that is, to reclaim the allocated Sketch space, update the general Sketch blocks used by the defense task in each register array to an unused state; reset the register values ​​in the reclaimed general Sketch blocks in the programmable switch to 0.

[0127] The defense strategy control module stores an attack information table. The attack information table records the features of existing volumetric DDoS attacks in data packets, so as to match the corresponding defense tasks according to the features parsed in the data packets; at the same time, the existing defense tasks of volumetric DDoS attacks are classified: first, they are divided into two stages, the first stage is the defense of network layer and transport layer traffic, and the second stage is the defense of application layer traffic; secondly, each stage is further subdivided into three defense schemes (proxy, detection and flow limiting, one-to-one cache); fixed defense stages, defense task IDs, Sketch IDs, defense schemes and priorities are assigned to the existing defense tasks of volumetric DDoS attacks, so as to quickly identify the defense tasks matched by the data packets and the defense processes required.

[0128] When receiving the output from the detection module, the defense strategy control module needs to retract the defense tasks of the attacks that have ended (stopped) and generate the defense tasks of the newly appeared (added) attacks.

[0129] Specifically, the defense strategy control module of the embodiment of the present invention—the defense task generation operation for a newly appeared (added) attack is specifically implemented as follows:

[0130] Step 1: Receive input from the detection module: the set of attacks currently occurring.

[0131] Step 2: The defense strategy control module searches for the defense strategy that has been deployed by the current dynamic defense module, and finds out the attack set for which no defense task has been deployed in the current defense strategy.

[0132] Step 3: Generate defense tasks corresponding to undeployed attacks: According to the attack information table, obtain the characteristic information of these attacks in the data packets, and the defense task ID, Sketch ID, defense scheme, priority and other information, so that the data packets corresponding to these attacks can be matched to the corresponding defense tasks in the Match-Action Table of the programmable switch matching defense tasks.

[0133] Step 4: Allocate Sketch space for the newly generated defense task: According to the number of rows required by the defense task, select a register array with less usage of general Sketch blocks. Each register array outputs an offset, and the offset of the unselected register array is output as -1.

[0134] When the defense task uses 3 lines of Sketch, find 3 register arrays with the lowest memory usage (i.e., less general Sketch block usage) among the 4 register arrays for allocation, and allocate a general Sketch block to each register array as a line of the defense task Sketch;

[0135] When a defense task uses a 4-row Sketch, each of the 4 register arrays is assigned a general Sketch block as a row of the defense task Sketch.

[0136] Step 5: Output the offset of the defense task in each register array, that is, the starting position of the common Sketch block used by the defense task in each register array, as one of the metadata of the defense task, so that when the data packet matches the defense task, the actual index of the used memory in the register array can be obtained through the offset.

[0137] Step 6: Update the register usage stored in the defense strategy control module, mark the allocated general Sketch block as used, and store the Sketch ID of the defense task.

[0138] Step 7: Output defense strategy and insert control statements: Convert defense tasks and Sketch space allocation into control statements that can be executed in programmable switches. Some control statements are not required in some defense solutions and therefore do not need to be generated:

[0139] Generate a table entry insertion control statement for the Match-Action Table that matches the defense task: the characteristic information of the attack in the data packet is used as the key, and the defense task ID, Sketch ID, defense plan, and priority are used as parameters;

[0140] Generate a table entry insert control statement for obtaining the offset of the Match-Action Table: Sketch ID is used as the key and the offset is used as the parameter;

[0141] Generate a table entry insertion control statement for the Match-Action Table that identifies whether the defense task uses each register array: Sketch ID is used as the key, and no parameters are required;

[0142] Generate a table entry insertion control statement for the Match-Action Table for the subsequent processing operation of the matching data packet: the defense task ID and Sketch update result are used as keys, and no parameters are required.

[0143] Step 8: Update the newly generated defense task in the defense strategy recorded in the defense strategy control module.

[0144] The defense strategy control module of the embodiment of the present invention—the reclaiming operation of the defense task of the ended (stopped) attack is specifically implemented as follows:

[0145] Step 1: Receive input from the detection module: the set of attacks currently occurring.

[0146] Step 2: The defense strategy control module searches for the defense strategies that have been deployed by the current dynamic defense module and finds out the attack set that has stopped attacking in the current stage.

[0147] Step 3: Find the defense strategy insertion control statement of each attack defense task in the defense strategy deployed by the current dynamic defense module, and retract the defense task.

[0148] Step 4: Reclaim the Sketch space allocated by the defense task: clear the registers of the general Sketch block used by the defense task in the register array of the programmable switch, that is, set the values ​​to 0.

[0149] Step 5: Update the register array usage stored in the defense strategy control module and mark the reclaimed general Sketch block as unused.

[0150] Step 6: Output the defense task revocation control statement: According to the key in the insertion control statement of the defense task to be revoked in the defense strategy control statement stored in the defense strategy, generate the corresponding deletion control statement:

[0151] Generate a table entry deletion control statement for the Match-Action Table that matches the defense task;

[0152] Generate a table entry deletion control statement for obtaining the offset of the Match-Action Table;

[0153] Generate a table entry deletion control statement that identifies whether the defense task uses the Match-Action Table of each register array;

[0154] Generates a control statement for deleting entries in the Match-Action Table for subsequent processing operations on matching packets.

[0155] Step 7: Update the recovered defense task in the defense strategy recorded in the defense strategy control module.

[0156] As an optional specific implementation, the defense strategy control module is used to generate a new defense strategy based on the volumetric DDoS attack set output by the detection module and the defense tasks in the deployed defense strategy, and convert the new defense strategy into a control statement of the programmable switch as the output of the defense strategy control module, such as Figure 2 As shown, specifically including:

[0157] The volumetric DDoS attack set detected by the detection module is used as the input of the defense strategy control module;

[0158] According to the input volumetric DDoS attack set, the defense tasks in the deployed defense strategy are searched, and the attack set for which no defense tasks are deployed in the current defense strategy is found, that is, the attack set of newly added attacks in the current defense strategy, and the attack set of stopped attacks in the current defense strategy.

[0159] For the attack set of newly added attacks in the current defense strategy: According to the attack information table, obtain the relevant information of each attack in the attack set, including the characteristics of the corresponding data packet of the attack, defense task ID, Sketch ID, defense plan, priority and other information, and generate the defense task corresponding to the undeployed attack.

[0160] Among them, the characteristics of the packet corresponding to the attack can be obtained by parsing the packet, which is used to match the defense task of the attack to which the packet belongs, and perform the corresponding defense. A fixed defense task ID and Sketch ID are assigned to each attack defense task to identify the defense task and the Sketch used by the defense task. The defense scheme identifies which defense scheme the attack defense task belongs to (1-proxy, 2-detection and current limiting, 4-one-to-one cache), so that the corresponding defense process can be performed on the packet belonging to the defense task. Priority is used to match the defense task with the most harmful attack when the packet matches more than one defense task at the same time.

[0161] Allocate Sketch space for the newly generated defense task, perform dynamic memory allocation based on the number of Sketch rows required for each defense task, and output the offset of the defense task in each register array.

[0162] Each defense task is converted into a defense policy insertion control statement executed in the programmable switch.

[0163] The insert control statements specifically include:

[0164] Generate a table entry insertion control statement for the Match-Action Table that matches the defense task: the characteristic information of the attack in the data packet is used as the key, and the defense task ID, Sketch ID, and defense solution are used as parameters;

[0165] Generate a table entry insert control statement for obtaining the offset of the Match-Action Table: Sketch ID is used as the key and the offset is used as the parameter;

[0166] Generate a table entry insertion control statement for the Match-Action Table that identifies whether the defense task uses each register array: Sketch ID is used as the key, and no parameters are required;

[0167] Generate a table entry insertion control statement for the Match-Action Table for the subsequent processing operation of the matching data packet: the defense task ID and Sketch update result are used as keys, and no parameters are required.

[0168] For the attack set that has stopped attacking in the current defense strategy: find the defense strategy insertion control statement of each attack defense task in the defense strategy that has been deployed by the current dynamic defense module, and retract the defense task in the defense strategy.

[0169] Dynamically reclaim the Sketch used by the defense task.

[0170] Each defense task is converted into a defense policy deletion control statement executed in the programmable switch.

[0171] The deletion control statements specifically include:

[0172] Generate a table entry deletion control statement for the Match-Action Table that matches the defense task;

[0173] Generate a table entry deletion control statement for obtaining the offset of the Match-Action Table;

[0174] Generate a table entry deletion control statement that identifies whether the defense task uses the Match-Action Table of each register array;

[0175] Generates a control statement for deleting entries in the Match-Action Table for subsequent processing operations on matching packets.

[0176] The defense strategy insertion control statement and the defense strategy deletion control statement are integrated, and the defense strategy runtime reconfiguration control statement is output as the output of the defense strategy control module.

[0177] The newly generated defense tasks and the withdrawn defense tasks are updated in the defense strategy recorded in the defense strategy control module.

[0178] Furthermore, in the defense strategy control module, dynamic memory allocation or memory reclaiming is performed on the defense task, such as Figure 3 As shown, specifically including:

[0179] The defense strategy control module allocates or reclaims memory for defense tasks that need to use Sketch.

[0180] For defense tasks that require memory allocation: Get the number of Sketch rows m required for the defense task that requires memory allocation, where 1≤m≤4. Select the register array with the m least used general Sketch blocks from the four register arrays. Each selected register array allocates a general Sketch block to the defense task, and calculates the offset of the general Sketch block, that is, the starting position, where the offset of the unselected register array is -1. Update the usage of the four register arrays recorded in the defense strategy control module, mark the allocated general Sketch block as used, and store the Sketch ID of the defense task. Output the offsets of the four register arrays, where the offset of the unselected register array is -1.

[0181] For defense tasks that require memory reclaim: In the defense strategy control module, traverse all general Sketch blocks in the four register arrays to find all general Sketch blocks used by the defense task that requires memory reclaim. In the defense strategy control module, mark the found general Sketch blocks as unused. Reset the register value of the unused general Sketch corresponding position in the programmable switch to 0;

[0182] Ends memory allocation or memory deallocation.

[0183] The dynamic defense module in the defense system of the present invention specifically includes three defense schemes and a dynamic memory allocation scheme based on a general Sketch data structure.

[0184] The three defense schemes provided by the dynamic defense module of the embodiment of the present invention include: proxy, detection and current limiting, and one-to-one cache. The three defense schemes can cover a wide range of capacity DDoS attacks; existing DDoS attacks have been allocated to three defense schemes according to their attack traffic characteristics, and different attack defense tasks can be matched according to data packet characteristics. For example: the SYN data packet in the TCP data packet matches the SYN Flood attack defense task, and the proxy defense scheme is used; the UDP data packet matches the UDP Flood attack defense task, and the detection and current limiting defense scheme is used; the DNS reply data packet matches the DNS reflection amplification attack defense task, and the one-to-one cache defense scheme is used.

[0185] When a new type of volumetric DDoS attack occurs, the traffic characteristics of the attack can be analyzed and assigned to a suitable defense plan. The packet characteristics of the attack can be stored so that the defense task of the attack can be matched by parsing the packet. After the new attack is stored in the defense system, when the attack is detected, the defense system can deploy the defense task of the attack.

[0186] Furthermore, the specific implementation of the proxy defense solution among the three defense solutions is as follows:

[0187] (1) TCP proxy: When receiving the SYN packet of the first handshake of TCP establishing a connection in the external network, it searches the whitelist (Bloom Filter) to determine whether the SYN packet of the session is allowed to pass.

[0188] (2) TCP proxy: If the SYN packet is allowed to pass, it will be forwarded along the original path, allowing it to establish a connection with the protected server.

[0189] (3) TCP proxy: If the connection is not allowed, it performs a second handshake on behalf of the protected server and sends a SYN-ACK packet in reply.

[0190] Change the IP protocol header fields of the received SYN data packet: swap the source IP destination IP, source port destination port, and update the checksum and other related fields;

[0191] Change the TCP protocol header fields of the received SYN data packet: set the SYN field and ACK field to 1, set the seq field to store the cookie, and the ack field equals the SYN data packet seq field plus one;

[0192] Hash the five-tuple of the session (source IP, destination IP, source port, destination port, protocol number) and set it as the value of the seq field in the SYN-ACK packet.

[0193] (4) TCP proxy: After receiving the ACK data packet in TCP communication, determine whether it belongs to the third handshake data packet of the TCP connection. If not, forward it along the original path; otherwise, perform Cookie verification.

[0194] Hash the five-tuple of the session (source IP, destination IP, source port, destination port, protocol number) and perform cookie verification: determine whether the hash value plus one is equal to the ack field of the ACK data packet.

[0195] (5) If the verification is successful, the session is stored in the whitelist and a RST packet is replied to disconnect the fake TCP connection, allowing the client to re-initiate a connection request to formally establish a connection with the protected server.

[0196] Change the IP protocol header fields of the received ACK data packet: swap the source IP destination IP, source port destination port, and update the checksum and other related fields;

[0197] Change the TCP protocol header fields of the received ACK data packet: set the SYN field and ACK field to 0, and the RST field to 1; the seq field is equal to the ack field in the ACK data packet.

[0198] (6) ICMP proxy: When receiving an ICMP ECHO Request packet from the external network, it replies with an ICMO ECHO Reply packet on behalf of the protected server.

[0199] Change the IP protocol header fields of the received ICMP ECHO Request data packet: swap the source IP destination IP, source port destination port, and update the checksum and other related fields;

[0200] Change the ICMP protocol header fields of the received ICMP ECHO Request data packet: set the type field to 0 and the code field to 0.

[0201] Furthermore, the specific implementation methods of the detection and current limiting defense solutions among the three defense solutions are as follows:

[0202] (1) Use the Count-min Sketch data structure to record traffic information and regard the five-tuple in the data packet as a session.

[0203] (2) When a data packet arrives, the Sketch counter is updated according to the five-tuple of the data packet: the corresponding counter value is increased by one, and the updated result is returned.

[0204] (3) When the returned update result is below the threshold, the data packet is allowed to pass.

[0205] (4) When the returned update result is greater than or equal to the threshold, the data packets of the session corresponding to the data packets are limited: the data packets of the session are not allowed to pass in the current defense cycle.

[0206] Furthermore, the specific implementation of the one-to-one cache defense solution among the three defense solutions is as follows:

[0207] (1) Use the Counting Bloom Filter data structure to record traffic information and regard the five-tuple (source IP, destination IP, source port, destination port, protocol number) in the data packet as a session.

[0208] (2) When the protected server actively sends out an external request data packet, such as a DNS query, it is recorded: the five-tuple of the data packet is cached in Sketch, and the value of the counter is increased by a certain value, that is, the corresponding number of reply data packets are allowed to pass.

[0209] (3) When a reply data packet is sent from the external network, such as a DNS reply, the Sketch is checked to see if there is a cache record of the session. If not, the data packet is not allowed to pass and is discarded.

[0210] (4) If there is a cache record for the session, allow the data packet to pass and update the cache at the same time: update the Sketch and reduce the value of the corresponding counter by one, indicating that a reply data packet has passed.

[0211] The dynamic memory allocation solution based on the general Sketch data structure provided by the dynamic defense module of the embodiment of the present invention is specifically implemented as follows:

[0212] 1. The specific implementation of dynamic memory allocation designed for dynamic memory allocation is as follows:

[0213] Since the size and ownership of the registers (memory) of the programmable switch are fixed after compilation, and dynamic defense solution deployment requires dynamic memory allocation, the memory required by the defense system is applied for as a general Sketch data structure during compilation without binding it to a specific defense task. Then, an offset is used to specify the memory location used by each deployed defense task to achieve dynamic memory allocation.

[0214] (1) Apply for 4 lengths It is a register array, each register is 16 bits in size, and is a 4-line general Sketch data structure.

[0215] (2) Set the general Sketch block size to , that is, each register array can be divided into 8 general Sketch blocks.

[0216] (3) When deploying a defense task, the defense strategy control module selects m register arrays and allocates general Sketch blocks to them according to the number of rows m (0≤m≤4) of the defense task Sketch.

[0217] (4) When a data packet matches a defense task, the position of the defense task’s Sketch in each register array will be obtained based on the defense task’s metadata: offset, where the offset of the unselected register array is -1.

[0218] The offset of the jth general Sketch block of the i-th register array is:

[0219] Formula (1)

[0220] In the formula, Indicates the i-th offset, 1≤i≤4, 1≤j≤8.

[0221] 2. The specific implementation of ALU operations designed for dynamic memory allocation is as follows:

[0222] Since the Sketch data structures required by the defense schemes corresponding to different defense tasks are different, a general Sketch data structure is designed: only the Sketch data structure is designed, but it is not bound to the ALU operation, so as to achieve dynamic memory allocation and efficient memory utilization.

[0223] (1) Split the counter array in the Sketch data structure into a register array and an ALU operation. Linking the two together can implement a dedicated Sketch and apply for a register array with a register size of 16 bits in the programmable switch.

[0224] (2) Three ALU operations are set up, corresponding to the different data structures required by the three defense schemes:

[0225] Addition operation: Increase the register value by the value of the given parameter;

[0226] Subtraction operation: reduce the register value by the value of the given parameter;

[0227] OR operation: OR the register with the parameter and update the register to 1.

[0228] (3) Defense solution - Proxy: Bloom Filter needs to link the general Sketch to the OR operation in the ALU operation to update the bit in the register to 1.

[0229] (4) Defense solution - detection and current limiting: The Count-min Sketch needs to link the general Sketch to the addition operation in the ALU operation to achieve the register increment by one each time it is updated.

[0230] (5) Defense solution - one-to-one cache: Counting Bloom Filter needs to link the general Sketch to the addition and subtraction operations in the ALU operation, so that the register increases the given value when the cache is recorded and decreases by one when the cache is updated.

[0231] Furthermore, the dynamic defense module in the defense system of the present invention is specifically implemented as follows:

[0232] Due to the limitation of programmable switches: each Match-Action Table can only be used once, and a match can only match one table entry, that is, only one defense task can be matched. However, a data packet may require both transport layer defense and application layer defense. For example, a DNS data packet may require both the application layer DNS reflection amplification attack defense task and the UDP defense task.

[0233] Therefore, the dynamic defense module is divided into two stages: the first stage defends the network layer and transport layer traffic, and the second stage defends the application layer traffic. The data packet enters the first stage first and then the second stage. The data packet processing flow of the two stages is the same. The difference is that when matching the defense task, the first stage uses the port number and protocol number of the data packet entering the programmable switch for matching, and the second stage uses the port number of the data packet entering the programmable switch and the source and destination port number of the data packet for matching.

[0234] (1) The defense strategy control module generates a new defense strategy based on the attack set detected by the detection module and the currently deployed defense strategy, converts it into control statements of the programmable switch and deploys it in the dynamic defense module. The dynamic defense module uses the Match-Action Table to match defense tasks and other information.

[0235] (2) Parsing data packets: When a data packet arrives at the defense system, the programmable switch parses the header field of the data packet to obtain characteristic information such as the five-tuple.

[0236] (3) Matching defense tasks: The dynamic defense module matches the defense task corresponding to the data packet based on the port number through which the data packet enters the programmable switch, the protocol number field in the IP packet header / the source and destination port field in the transport layer message, and the status information.

[0237] (4) Obtaining metadata related to defense tasks: If a defense task is matched, obtain metadata related to the defense task: task ID, Sketch ID, defense scheme to which the defense task belongs (1-proxy, 2-detection and current limiting, 4-one-to-one cache), priority, and offset. If no defense task is matched, forward the request along the original path.

[0238] (5) Calculate four virtual indexes: Hash the five-tuple information to obtain the virtual index of the data packet in Sketch:

[0239] Formula (2)

[0240] in, represents the virtual index calculated by the i-th hash function; Indicates the packet information, including source IP, destination IP, source port, and destination port; Represents a hash function.

[0241] (6) Get 4 actual indexes: virtual index + offset, and get the register index that needs to be updated for the data packet:

[0242] Formula (3)

[0243] in, Indicates the i-th offset; Represents the i-th actual index.

[0244] (7) General Sketch link ALU operation: Match the corresponding ALU operation according to the Sketch ID of the defense task matched by the data packet.

[0245] (8) Update the Sketch of the defense task: For the four register arrays, match the Sketch ID of the defense task matched by the data packet to see whether the Sketch uses the register array. If a match is found, it means it is used. Update the corresponding register in the register array according to the actual index.

[0246] (9) Operation determination (discard, reply, limit, forward): Determine the processing operation that needs to be performed on the data packet based on the Sketch update result and the defense plan to which the defense task belongs:

[0247] Defense solution - Proxy: Reply on behalf of the protected server, modify the data packet, reply on behalf of the protected server; or drop / forward the data packet;

[0248] Defense solution - detection and current limiting: current limiting or forwarding;

[0249] Defense solution - one-to-one cache: forward or discard.

[0250] As an optional specific implementation method, the dynamic defense module is used to deploy defense strategies according to the defense strategy control statements output by the defense strategy control module, such as Figure 4 As shown, specifically including:

[0251] Step 1: Receive the defense policy control statement output by the defense policy control module, and perform runtime reconfiguration in the programmable switch, that is, deploy the defense policy control statement output by the defense policy control module in the programmable switch.

[0252] Step 2: Execute the table entry insertion or deletion control statement of the defense task matching table, so that the parsed data packet matches or does not match the defense task, and realizes the addition and withdrawal of defense tasks. Each defense task has this table control statement.

[0253] Step 3: Execute the table entry insertion or deletion control statement matching the offset table, so that the general Sketch block pointed to by the offset is allocated or reclaimed. Each task that needs to use Sketch defense has this table control statement.

[0254] Step 4: Execute the table entry insertion or deletion control statement of the matching register array table. Each task that needs to use Sketch defense has this table control statement.

[0255] Step 5: Execute the table entry insertion or deletion control statement of the matching processing result table to complete the deployment of all defense tasks that need to be inserted or deleted included in the defense strategy. Each defense task has this table control statement.

[0256] As an optional specific implementation method, the dynamic defense module guides the mixed traffic flowing through the programmable switch into different defense tasks to clean the attack traffic according to the deployed defense strategy, such as Figure 5 As shown, specifically including:

[0257] Step S301: A data packet sent from an external network or a data packet sent from a protected server arrives at a programmable switch.

[0258] Step S302: The programmable switch parses the header information of the data packet according to the header of the custom data packet, and what is parsed is the original information of the data packet.

[0259] Because programmable switches are protocol-independent, you need to customize the data type of the data packet header. The customized data types of the headers here are: Ethernet Header, Ethernet frame header, IPv4 Header, IPv4 data packet header, ICMP Header, ICMP data packet header, L4Port Header, transport layer UDP / TCP port number field, UDP Header, UDP data packet header, TCP Header, TCP header.

[0260] Step S303: According to the port number of the data packet entering the programmable switch, the protocol number / port number in the parsed data packet information, and the status information, the corresponding defense task is matched in the defense task matching table. When the defense task is successfully matched, the metadata is obtained, and the corresponding defense plan process is entered to execute S304, where the defense plan includes a proxy defense plan, a detection and current limiting defense plan, and a one-to-one cache defense plan; otherwise, step S309 is executed.

[0261] For example: UDP data packets from the external network will match the UDP Flood defense task, which belongs to the detection and current limiting defense solution; the SYN or ACK status of TCP data packets from the external network will match the SYN Flood defense task, which belongs to the proxy defense solution; DNS response status data packets with a source port of 53 in the external network, or DNS query status data packets with a destination port of 53 in the internal network, will match DNS reflection amplification attacks, which belong to the one-to-one cache defense solution.

[0262] Step S304: If the defense task matched in step S303 belongs to the proxy defense scheme, the metadata of the proxy defense scheme is set according to the matched table item: defense task ID, Sketch ID, parameter param when updating Sketch; ICMP proxy does not use Sketch; SYN proxy uses Bloom Filter, and when the TCP data packet is the SYN data packet of the first handshake of the TCP connection, the parameter is set to 0 (representing whitelist query), and when it is the ACK data packet of the third handshake, the parameter is set to 1 (representing whitelist record).

[0263] If the defense task matched in step S303 belongs to the detection and current limiting defense solution, the metadata of the detection and current limiting defense solution is set according to the matched table item: defense task ID, Sketch ID, parameter param when updating Sketch; wherein the parameter is set to 1 (representing that the number of data packets of the corresponding session increases by 1).

[0264] If the defense task matched in step S303 belongs to a one-to-one cache defense scheme, the metadata of the one-to-one cache defense scheme is set according to the matched table entry: defense task ID, Sketch ID, and parameter param when updating Sketch. When the data packet is a reply data packet entering from the port of the programmable switch connected to the external network, the parameter is set to 1 (representing cache reduction); when the data packet is a request data packet entering from the port of the programmable switch connected to the protected server, the parameter is set to (representing cache increase).

[0265] Step S305: According to the set Sketch ID, query the offset matching table to obtain the position of the general Sketch block assigned to the defense task Sketch in the register array.

[0266] Step S306: Hash the five-tuple in the data packet, obtain the virtual index of the register that needs to be updated, and calculate the actual index, where the five-tuple includes source IP, destination IP, source port, destination port, and protocol number.

[0267] Step S307: According to the set Sketch ID, query the ALU operation used by the defense task Sketch. The SYN proxy uses the OR operation to implement the Bloom Filter; the detection and current limiting scheme uses the addition operation to implement the Count-minSketch; the one-to-one cache scheme uses the addition operation and the subtraction operation to implement the Counting Bloom Filter.

[0268] Step S308: According to the set Sketch ID, query each register array whether a general Sketch block is allocated to the defense task Sketch, and update it.

[0269] Specifically, when each register array is updated, the value of the updated register before or after the update will be returned, and the minimum value of all returned update results will be taken as the defense task Sketch return result.

[0270] In Bloom Filter, the updated value of the updated register will be returned. When querying: when the return result is 0, it means the query failed and does not exist; when the return result is 1, it means the query was successful. When recording: the return result is 1, which means the recording was successful.

[0271] In the Count-min Sketch, the updated value of the updated register is returned. The minimum value in the returned result of each register array is the number of packets of the session in this defense cycle.

[0272] In the Counting Bloom Filter, the value of the updated register before the update is returned to distinguish whether the register value is 0 before the update or after the update. For the external reply data packet, when the return result is 0, it means there is no corresponding cache record; otherwise, it means there is a cache record.

[0273] Step S309: According to the defense task ID and the returned result, the operation to be performed on the data packet is matched, including discarding, limiting, replying on behalf of, and forwarding.

[0274] Specifically, the ICMP proxy does not need to update the Sketch, but directly executes the proxy reply operation to reply to the ICMP ECHORequest data packet.

[0275] The SYN packet of the first handshake of the TCP connection in the SYN proxy queries the Bloom Filter. When the return result is 0, the proxy reply operation in S510 is executed to reply the SYN-ACK packet of the second handshake; when the return result is 1, the forwarding operation in S510 is executed to forward the SYN packet to the protected server; if the Cookie verification of the ACK packet of the third handshake passes, the Bloom Filter is updated to record it, and the return result is 1. The proxy reply operation in S510 is executed to reply the RST packet to disconnect the fake TCP connection.

[0276] During detection and flow control, when the returned result is greater than the threshold, it means that the number of data packets sent by the session to which the data packet belongs in this defense cycle is too large, and it is a suspicious session. The flow control operation in S510 is executed to limit the data packets sent by the session in this defense cycle; otherwise, the forwarding operation in S510 is executed to allow the data packet to pass.

[0277] In a one-to-one cache, when a data packet is a reply data packet entering from a port of the programmable switch connected to an external network, a return value of 0 indicates that there is no cache record, and a discard operation in S510 is executed; otherwise, a forwarding operation in S510 is executed to allow the data packet to pass.

[0278] The data packets that do not match the defense task are forwarded by default: the returned result is set to the forwarding flag when the metadata is initialized, indicating that the data packet is allowed to pass.

[0279] Step S310: Execute the final operation. Specifically, the discard operation, i.e. discard the data packet, and do not perform subsequent operations. The flow limiting operation, i.e. limit the number of data packets of the corresponding session in this defense cycle, and do not allow too much traffic to be sent. The reply operation, i.e. reply on behalf of the server, such as replying the SYN-ACK data packet of the second handshake of the TCP connection and the RST data packet of the reset TCP connection in the SYN proxy, and replying the ICMP ECHO Request data packet in the ICMP proxy. The forwarding operation, i.e. forwarding according to the source IP address in the data packet.

[0280] As an optional specific implementation method, a proxy defense solution is used to clean the attack traffic, such as Figure 6 As shown, specifically including:

[0281] Step S401: Match the parsed data packet to the defense task, metadata: the defense scheme value is 1, which belongs to the proxy defense scheme.

[0282] Step S402: According to the matched entries in the defense task matching table, metadata of the proxy defense solution is set: defense task ID, Sketch ID.

[0283] Step S403: determine whether the data packet belongs to the SYN proxy or the ICMP proxy; if it belongs to the SYN proxy, the SYN proxy uses the Bloom Filter and executes step S404; otherwise, it belongs to the ICMP proxy and does not use Sketch, and executes step S409.

[0284] Step S404: Determine whether the data packet belongs to a SYN data packet of the first handshake of the TCP connection or an ACK data packet; if it is a SYN data packet, set the parameter param when updating Sketch in the metadata to 0, representing a whitelist query, and execute step S407; otherwise, it is an ACK data packet, and execute step 405.

[0285] Step S405: determine whether the ACK data packet is a TCP connection third handshake data packet, if yes, execute step S406; otherwise, set the returned result as a forwarding flag, and execute step S410.

[0286] Step S406: Determine whether the ACK data packet of the third handshake of the TCP connection passes the Cookie verification. If so, set the parameter param when updating Sketch in the metadata to 1, representing the whitelist record, and execute step S407; otherwise, set the returned result to the discard flag and execute step S409.

[0287] Step S407: The SYN agent uses Bloom Filter to link the OR operation in the ALU operation to implement Bloom Filter.

[0288] Step S408: Get the register array used by the actual index and defense task, and update Sketch.

[0289] Step S409: Determine the subsequent operation based on the defense task ID and the return value of the updated Sketch, including reply, forwarding, and discarding.

[0290] Specifically, when the data packet in the SYN proxy is the SYN data packet of the first handshake of the TCP connection: when the return value is 0, the proxy reply operation in step S409 is executed to reply the SYN-ACK data packet of the second handshake; when the return value is 1, the forwarding operation in step S409 is executed.

[0291] When the ACK packet in the SYN proxy is the ACK packet of the third handshake of the TCP connection, the Cookie verification passes, and the return result of the updated Sketch is 1, the proxy reply operation in step S409 is executed, and the RST packet is replied to reset the TCP connection; if the verification fails and the return result is a discard flag, the discard operation in step S409 is executed; otherwise, the ACK packet does not belong to the third handshake packet, and the return result defaults to a forwarding flag, then the forwarding operation in step S409 is executed.

[0292] In the ICMP proxy, the proxy reply in step S409 is executed to reply the ICMP ECHO Request data packet.

[0293] Step S410: Execute the final operation. Specifically, the discard operation, i.e. discard the data packet and do not perform subsequent operations. The reply operation, i.e. reply on behalf of the server: the SYN proxy replies on behalf of the SYN-ACK data packet of the second handshake of the TCP connection and the RST data packet of the reset TCP connection, and the ICMP proxy replies on behalf of the ICMP ECHO Request data packet. The forwarding operation, i.e. forwarding according to the source IP address in the data packet.

[0294] As an optional specific implementation method, a detection and flow limiting defense solution is used to clean the attack traffic, such as Figure 7 As shown, specifically including:

[0295] Step S501: Match the parsed data packet to the defense task. Metadata: The defense scheme value is 2, which belongs to the detection and current limiting defense scheme.

[0296] Step S502: According to the matched table items in the defense task matching table, metadata of the detection and current limiting defense scheme is set: defense task ID, Sketch ID.

[0297] Step S503: setting the parameter param in the metadata when updating Sketch to 1, which means that the number of data packets of the corresponding session increases by 1.

[0298] Step S504: The detection and current limiting defense solution uses Count-min Sketch to link the addition operation in the ALU operation to implement Count-min Sketch.

[0299] Step S505: Get the register array used by the actual index and defense task, and update Sketch.

[0300] Step S506: Determine the subsequent operation according to the defense task ID and the return value of the updated Sketch, including flow limiting and forwarding. Specifically, if the return value exceeds the threshold, the flow limiting operation in step S507 is executed to limit the number of data packets sent by the session in this defense cycle; otherwise, the forwarding operation in step S507 is executed.

[0301] Step S507: Execute the final operation. Specifically, the flow limiting operation is to limit the number of packets of the corresponding session in the current defense cycle, and not allow too much traffic to be sent. The forwarding operation is to forward according to the source IP address in the packet.

[0302] As an optional specific implementation method, a one-to-one cache defense solution is used to clean the attack traffic, such as Figure 8 As shown, specifically including:

[0303] Step S601: Match the parsed data packet to the defense task. Metadata: the defense scheme value is 4, which belongs to a one-to-one cache defense scheme.

[0304] Step S602: According to the matched entries in the defense task matching table, metadata of the one-to-one cache defense solution is set: defense task ID, Sketch ID.

[0305] Step S603: Determine whether the data packet is a reply data packet entering from a port of the programmable switch connected to an external network or a request data packet entering from a port of the programmable switch connected to a protected server;

[0306] If the data packet is a reply data packet entering from the port of the programmable switch connected to the external network, the parameter param when updating the Sketch in the metadata is set to 1, indicating that the cache is reduced; the one-to-one cache defense solution uses the Counting Bloom Filter, links the subtraction operation in the ALU operation, implements the Counting Bloom Filter, performs cache lookup and reduces the cache;

[0307] If the data packet is a request data packet entering from the port of the programmable switch connected to the protected server, the parameter param when updating the Sketch in the metadata is set to n, representing the increase of cache, where n≥1; the one-to-one cache defense solution uses Counting Bloom Filter, links the addition operation in the ALU operation, implements Counting BloomFilter, and increases the cache.

[0308] Step S604: Get the register array used by the actual index and defense task, and update Sketch.

[0309] Step S605: According to the defense task ID and the return value of the updated Sketch, determine the subsequent operations, including discarding and forwarding; specifically, in the one-to-one cache defense scheme, when the data packet is a reply data packet entering from the port of the programmable switch connected to the external network, a return value of 0 indicates that there is no cache record, and the discard operation in step S606 is executed; otherwise, the forwarding operation in step S606 is executed to allow the data packet to pass.

[0310] Step S606: Execute the final operation. Specifically, the discard operation, i.e. discard the data packet and do not perform subsequent operations. The forwarding operation, i.e. forward according to the source IP address in the data packet. Embodiment 2

[0311] like Fig. 9 As shown, the present invention provides a capacity-based DDoS attack dynamic defense system based on a programmable switch, which is used to implement the capacity-based DDoS attack dynamic defense method based on a programmable switch of the above-mentioned embodiment 1, and specifically includes:

[0312] Step S1: The detection module collects network traffic information in real time at a given time period in the programmable switch to detect whether an attack occurs in the current network or whether the attack type changes; if a volumetric DDoS attack is detected in the current network, the detected volumetric DDoS attack set is used as the output of the detection module;

[0313] Step S2: The defense strategy control module generates a new defense strategy according to the volumetric DDoS attack set output by the detection module and the defense tasks in the deployed defense strategy, and converts the new defense strategy into a control statement of the programmable switch as the output of the defense strategy control module;

[0314] Step S3: The dynamic defense module deploys the defense strategy according to the defense strategy control statement output by the defense strategy control module, and guides the mixed traffic flowing through the programmable switch into different defense tasks to clean the attack traffic according to the deployed defense strategy.

[0315] In addition, the present invention also includes step S4: when a new type of volumetric DDoS attack comes, the user adds the attack to the defense system through the user control module, so that the defense system can defend against the attack later.

[0316] The present embodiment is a method for dynamic defense against capacity-based DDoS attacks based on a programmable switch, which utilizes the aforementioned dynamic defense against capacity-based DDoS attacks based on a programmable switch. Therefore, the specific implementation method of the method for dynamic defense against capacity-based DDoS attacks based on a programmable switch can be found in the implementation example of the dynamic defense against capacity-based DDoS attacks based on a programmable switch above. In order to avoid redundancy, it will not be repeated here.

[0317] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0318] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0319] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0320] Obviously, the above embodiments are merely examples for clear explanation and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived from them are still within the protection scope of the invention.

Claims

1. A dynamic defense system for capacity-based DDoS attacks based on programmable switches, characterized in that: include: The detection module is used to collect network traffic information in real time at a given time period in the programmable switch to detect whether an attack occurs on the current network or whether the type of attack changes; If a volumetric DDoS attack is detected in the current network, the detected volumetric DDoS attack set is used as the output of the detection module; The defense strategy control module is used to generate a new defense strategy based on the volumetric DDoS attack set output by the detection module and the defense tasks in the deployed defense strategy, and convert the new defense strategy into a control statement of the programmable switch as the output of the defense strategy control module, which specifically includes: The volumetric DDoS attack set detected by the detection module is used as the input of the defense strategy control module; According to the input volumetric DDoS attack set, the defense tasks in the deployed defense strategy are searched, and the attack set for which no defense tasks are deployed in the current defense strategy is found, that is, the attack set of newly added attacks in the current defense strategy, and the attack set of stopped attacks in the current defense strategy; For the attack set of newly added attacks in the current defense strategy: According to the attack information table, obtain the relevant information of each attack in the attack set, including the characteristics of the attack corresponding data packet, defense task ID, Sketch ID, defense plan, priority, and generate the defense task corresponding to the undeployed attack; Allocate Sketch space for the newly generated defense task, perform dynamic memory allocation based on the number of Sketch rows required for each defense task, and output the offset of the defense task in each register array; Convert each defense task into a defense strategy insertion control statement executed in the programmable switch; For the set of attacks that have stopped attacking in the current defense strategy: find the defense strategy insertion control statement of each attack defense task in the defense strategy that has been deployed by the current dynamic defense module, and retract the defense tasks in the defense strategy; Dynamically reclaim the Sketch used for defense tasks; Convert each defense task into a defense policy deletion control statement executed in the programmable switch; Integrate the defense strategy insertion control statement and the defense strategy deletion control statement, and output the defense strategy runtime reconfiguration control statement as the output of the defense strategy control module; The newly generated defense tasks and the withdrawn defense tasks are updated in the defense strategy recorded in the defense strategy control module; In the defense strategy control module, dynamic memory allocation or memory recovery is performed on defense tasks, including: The defense strategy control module allocates or reclaims memory for defense tasks that need to use Sketch; For defense tasks that require memory allocation: obtain the number of Sketch rows m required for the defense task that requires memory allocation, where 1≤m≤4; select the register array with the m least number of general Sketch blocks used from the four register arrays; each selected register array allocates a general Sketch block to the defense task, and calculates the offset of the general Sketch block, that is, the starting position, where the offset of the unselected register array is -1; update the usage of the four register arrays recorded in the defense strategy control module, mark the allocated general Sketch block as used, and store the Sketch ID of the defense task; output the offsets of the four register arrays, where the offset of the unselected register array is -1; For defense tasks that need to reclaim memory: in the defense strategy control module, traverse all general Sketch blocks in the four register arrays to find all general Sketch blocks used by the defense tasks that need to reclaim memory; in the defense strategy control module, mark the found general Sketch blocks as unused; reset the register values ​​of the unused general Sketch corresponding positions in the programmable switch to 0; End memory allocation or memory deallocation; The dynamic defense module is used to deploy defense strategies according to the defense strategy control statements output by the defense strategy control module, and guide the mixed traffic flowing through the programmable switch into different defense tasks to clean the attack traffic according to the deployed defense strategies; The dynamic defense module is used to deploy defense strategies according to the defense strategy control statements output by the defense strategy control module, specifically including: receiving the defense policy control statement output by the defense policy control module, and performing runtime reconfiguration in the programmable switch; Execute the table entry insertion or deletion control statement of the defense task matching table, so that the parsed data packet matches or does not match the defense task, and realizes the addition and withdrawal of the defense task; Execute the entry insertion or deletion control statement of the matching offset table, so that the general Sketch block pointed to by the offset is allocated or reclaimed; Execute the table entry insertion or deletion control statement of the matching register array table; Execute the control statement for inserting or deleting items in the matching processing result table; Complete the deployment of all defense tasks that need to be inserted or deleted included in the defense strategy; According to the deployed defense strategy, the mixed traffic flowing through the programmable switch is guided into different defense tasks to clean the attack traffic, including: Step S301: a data packet sent from an external network or a data packet sent from a protected server arrives at a programmable switch; Step S302: the programmable switch parses the header information of the data packet according to the header of the custom data packet; Step S303: Match the corresponding defense task in the defense task matching table according to the port number of the data packet entering the programmable switch, the protocol number / port number in the parsed data packet information, and the status information. When the defense task is successfully matched, metadata is obtained, and the corresponding defense scheme process is entered to execute S304, where the defense scheme includes a proxy defense scheme, a detection and current limiting defense scheme, and a one-to-one cache defense scheme; otherwise, execute step S309; Step S304: If the defense task matched in step S303 belongs to the proxy defense solution, the metadata of the proxy defense solution is set according to the matched table item: defense task ID, Sketch ID, and parameter param when updating Sketch; If the defense task matched in step S303 belongs to the detection and current limiting defense solution, the metadata of the detection and current limiting defense solution is set according to the matched table item: defense task ID, Sketch ID, and parameter param when updating Sketch; If the defense task matched in step S303 belongs to the one-to-one cache defense solution, the metadata of the one-to-one cache defense solution is set according to the matched table entry: defense task ID, Sketch ID, and parameter param when updating Sketch; Step S305: According to the set Sketch ID, query the offset matching table to obtain the position of the general Sketch block assigned to the defense task Sketch in the register array; Step S306: Hash the five-tuple in the data packet, obtain the virtual index of the register that needs to be updated, and calculate the actual index, where the five-tuple includes the source IP, the destination IP, the source port, the destination port, and the protocol number; Step S307: query the ALU operation used by the defense task Sketch according to the set Sketch ID; Step S308: According to the set Sketch ID, query each register array whether a general Sketch block is allocated to the defense task Sketch, and update it; Step S309: According to the defense task ID and the returned result, matching the operation to be performed on the data packet, including discarding, limiting, replying on behalf of, and forwarding; Step S310: Execute the final operation; The proxy defense solution cleans the attack traffic, including: Step S401: Match the parsed data packet to the defense task, metadata: the defense scheme value is 1, which belongs to the proxy defense scheme; Step S402: according to the matched items in the defense task matching table, set the metadata of the proxy defense solution: defense task ID, Sketch ID; Step S403: determine whether the data packet belongs to a SYN proxy or an ICMP proxy; if it belongs to a SYN proxy, the SYN proxy uses a Bloom Filter and executes step S404; otherwise, it belongs to an ICMP proxy and does not use Sketch, and executes step S409; Step S404: determine whether the data packet is a SYN data packet of the first handshake of the TCP connection or an ACK data packet; if it is a SYN data packet, set the parameter param when updating Sketch in the metadata to 0, indicating a whitelist query, and execute step S407; otherwise, it is an ACK data packet, and execute step 405; Step S405: determine whether the ACK data packet is a TCP connection third handshake data packet, if yes, execute step S406; otherwise, set the returned result as a forwarding flag, and execute step S410; Step S406: Determine whether the ACK data packet of the third handshake of the TCP connection passes the Cookie verification. If so, set the parameter param when updating Sketch in the metadata to 1, representing the whitelist record, and execute step S407; otherwise, set the returned result to the discard flag and execute step S409; Step S407: The SYN agent uses Bloom Filter to link the OR operation in the ALU operation to implement Bloom Filter; Step S408: Get the register array used by the actual index and defense task, and update Sketch; Step S409: Determine the subsequent operation based on the defense task ID and the return value of the updated Sketch, including reply, forward, and discard; Step S410: Execute the final operation; Among them, the detection and flow limiting defense solution is used to clean the attack traffic, including: Step S501: Match the parsed data packet to the defense task, metadata: the defense scheme value is 2, which belongs to the detection and current limiting defense scheme; Step S502: according to the matched table items in the defense task matching table, set the metadata of the detection and current limiting defense scheme: defense task ID, Sketch ID; Step S503: setting the parameter param in the metadata when updating Sketch to 1, which means that the number of data packets of the corresponding session increases by 1; Step S504: The detection and current limiting defense solution uses Count-min Sketch to link the addition operation in the ALU operation to implement Count-min Sketch; Step S505: Get the register array used by the actual index and defense task, and update Sketch; Step S506: Determine the subsequent operation according to the defense task ID and the return value of the updated Sketch, including current limiting and forwarding; Step S507: Execute the final operation; A one-to-one cache defense solution is used to clean attack traffic, including: Step S601: Match the parsed data packet to the defense task, metadata: the defense scheme value is 4, which belongs to the one-to-one cache defense scheme; Step S602: according to the matched table entry in the defense task matching table, set the metadata of the one-to-one cache defense solution: defense task ID, Sketch ID; Step S603: Determine whether the data packet is a reply data packet entering from a port of the programmable switch connected to an external network or a request data packet entering from a port of the programmable switch connected to a protected server; If the data packet is a reply data packet entering from the port of the programmable switch connected to the external network, the parameter param when updating the Sketch in the metadata is set to 1, indicating cache reduction; the one-to-one cache defense solution uses Counting Bloom Filter, links the subtraction operation in the ALU operation, implements Counting Bloom Filter, performs cache lookup and cache reduction; If the data packet is a request data packet entering from the port of the programmable switch connected to the protected server, the parameter param when updating the Sketch in the metadata is set to n, which represents the increase of cache, where n≥1; the one-to-one cache defense solution uses Counting Bloom Filter, links the addition operation in the ALU operation, implements Counting Bloom Filter, and increases the cache; Step S604: Get the register array used by the actual index and defense task, and update Sketch; Step S605: Determine the subsequent operation, including discarding and forwarding, according to the defense task ID and the return value of the updated Sketch; Step S606: Execute the final operation.

2. The capacity-based DDoS attack dynamic defense system based on a programmable switch according to claim 1 is characterized in that: The system further comprises a user control module, which is used for allowing the user to add a new type of volumetric DDoS attack to the defense system through the user control module when the attack arrives.

3. The capacity-based DDoS attack dynamic defense system based on a programmable switch according to claim 1 is characterized in that: The detection module is used to collect network traffic information in real time in a programmable switch at a given time period to detect whether an attack occurs in the current network or whether the type of attack changes; If a volumetric DDoS attack is detected in the current network, the detected volumetric DDoS attack set is used as the output of the detection module, including: Based on the Beaucoup data structure, the coupon quantity is set to the set quantity in the programmable switch; Set a given time period, collect and analyze network traffic information in real time during each time period, regard the traffic corresponding to each attack as a flow, and each session in the flow as an element, and measure the cardinality of the network flow; When the data packet arrives at the defense system, the programmable switch parses the header field of the data packet to obtain characteristic information, including a five-tuple, where the five-tuple includes source IP, destination IP, source port, destination port, and protocol number; Match the attack detection task corresponding to the data packet according to the port where the data packet enters the switch, the protocol number field in the IP packet header / the source and destination port field in the transport layer packet, and the status information; Update the Beaucoup of the matched attack detection task and set the indexed coupon to 1; At the end of each detection cycle, the control plane reads all registers used by Beaucoup in the programmable switch and performs traffic information statistics; analyzes the Beaucoup of each attack. If all coupons in the Beaucoup of an attack are set to 1, the attack is considered to be occurring; the detected attack is sent as output to the defense strategy control module; Set all registers used by Beaucoup in the programmable switch to 0 and start a new round of detection cycle.

4. A dynamic defense method for capacity-based DDoS attacks based on programmable switches, characterized in that: The method uses the capacity-based DDoS attack dynamic defense system based on a programmable switch according to any one of claims 1 to 3, and specifically includes: Step S1: The detection module collects network traffic information in real time at a given time period in the programmable switch to detect whether an attack occurs in the current network or whether the attack type changes; if a volumetric DDoS attack is detected in the current network, the detected volumetric DDoS attack set is used as the output of the detection module; Step S2: The defense strategy control module generates a new defense strategy according to the volumetric DDoS attack set output by the detection module and the defense tasks in the deployed defense strategy, and converts the new defense strategy into a control statement of the programmable switch as the output of the defense strategy control module; Step S3: The dynamic defense module deploys the defense strategy according to the defense strategy control statement output by the defense strategy control module, and guides the mixed traffic flowing through the programmable switch into different defense tasks to clean the attack traffic according to the deployed defense strategy.

5. The method for dynamic defense against volumetric DDoS attacks based on a programmable switch according to claim 4, characterized in that: The method further comprises step S4: when a new type of volumetric DDoS attack comes, the user adds the attack to the defense system through the user control module.

Images