A network packet monitoring method and system based on VPP

Abstract

The application provides a network message monitoring method and system based on VPP, which comprises the following steps: implanting an abnormal monitoring code for a service node in a VPP system, obtaining a first abnormal message through the abnormal monitoring code; obtaining a second abnormal message matched with an ACL monitoring rule through an ACL node; forwarding the first abnormal message and the second abnormal message to a kernel protocol stack through a message monitoring server; analyzing the first abnormal message and the second abnormal message by the kernel protocol stack to obtain an analysis result; and controlling a network system corresponding to the first abnormal message and the second abnormal message through the analysis result. The method and system can automatically complete the monitoring of network messages, eliminate manual packet analysis, accurately analyze the interested message in the case of large flow, and improve the system security.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of network communication, and particularly relates to a network message monitoring method and system based on VPP. BACKGROUND

[0002] With the rapid advancement of digital transformation, the network has become the core of business, government and personal life. However, behind this digital convenience also brings increasingly complex and serious security risks, forcing network products to face unprecedented challenges in security protection.

[0003] First, network products are constantly threatened by network attacks from around the world. Malicious actors use vulnerabilities, malware and carefully designed social engineering attacks, constantly evolving and innovating, making network attacks increasingly difficult to prevent. Among them, distributed denial of service (DDoS) attacks, malware spread and phishing have become frequent threats. These attacks can lead to data breaches, service disruptions and even violations of personal privacy, causing serious impact on business and society.

[0004] Second, with the widespread use of cloud computing and virtualization technology, network security risks have further escalated. The flexibility of virtualization brings efficient resource utilization and deployment to enterprises, however, the lack of resource isolation in virtualized environments also makes it possible for attackers to use side-channel attacks and other methods to cross virtual machine boundaries, further compromising the security of the entire system, which poses higher security requirements for cloud service providers and users, and needs to establish stricter isolation and monitoring mechanisms to resist potential threats.

[0005] In addition, due to its extensive nature, network products have a large number of network devices, which further increases the possibility of network anomaly packets caused by human error. In a complex network environment, abnormal data packets may occur, such as packet length inconsistency with actual packet length, sequence number disorder, checksum anomaly, etc. The transmission of these abnormal packets may affect the normal operation of the network, and even cause service anomalies, if the software robustness of the network device is insufficient, it may not be able to effectively handle and correct these abnormalities, thus causing business interruption and loss.

[0006] At the same time, with the rapid development of cloud computing, big data and Internet of Things technologies, data traffic in the network is increasing, and the demand for high-performance network processing capacity is becoming increasingly urgent. In this context, VPP has become an ideal solution to meet the demand for high-performance networks due to its excellent data packet processing performance and low latency, and more and more manufacturers have developed a series of high-performance network products based on VPP as a basic platform to meet the needs of modern networks.

[0007] However, VPP still has some security protection problems in some specific fields, such as network attack detection, network exception message detection and the like, the means of VPP is relatively less, and the currently used method is to open packet capture and analyze problems manually, which is not only time-consuming but also difficult to analyze comprehensively, and due to the huge network traffic, it is also difficult to capture the network message that needs to be analyzed in a short time and within the range of resources allowed, so it is difficult to effectively identify and respond to external network attacks and the transmission of abnormal messages caused by human errors. SUMMARY

[0008] In view of the above deficiencies of the prior art, the purpose of the application is to provide a network message monitoring method and system based on VPP.

[0009] The first aspect of the application provides a network message monitoring method based on VPP, comprising:

[0010] S1: implanting an exception monitoring code for a service node in a VPP system, and obtaining a first exception message through the exception monitoring code;

[0011] S2: obtaining a second exception message matched with an ACL monitoring rule through an ACL node screening;

[0012] S3: forwarding the first exception message and the second exception message to a kernel protocol stack through a message monitoring service end;

[0013] S4: analyzing the first exception message and the second exception message by the kernel protocol stack to obtain an analysis result;

[0014] S5: controlling the network system corresponding to the first exception message and the second exception message through the analysis result.

[0015] According to the network message monitoring method based on VPP provided by the application, the service node in step S1 includes a DPDK node, an ETH node, an IP node, a TCP node and a UDP node.

[0016] According to the network message monitoring method based on VPP provided by the application, the exception condition of the exception message in step S1 includes that the IP message length is inconsistent with the actual length and TTL exception.

[0017] According to the network message monitoring method based on VPP provided by the application, step S2 further comprises:

[0018] S21: the ACL node receives other messages except the first exception message sent by the service node;

[0019] S22: the ACL node performs ACL monitoring rule matching on the other message, when the other message does not match the ACL monitoring rule, step S23 is performed, and when the other message matches the ACL monitoring rule, step S24 is performed;

[0020] S23: returning the other message not matching the ACL monitoring rule to the original service node for processing;

[0021] S24: marking the other message matching the ACL monitoring rule as a second abnormal message.

[0022] According to the network message monitoring method based on VPP provided by the application, step S3 further comprises:

[0023] S31: marking the first abnormal message and the second abnormal message with a forwarding tag;

[0024] S32: forwarding the first abnormal message with the forwarding tag from the service node to the message monitoring server through the VPP PUNT mechanism, and forwarding the second abnormal message with the forwarding tag from the ACL node to the message monitoring server through the VPP PUNT mechanism;

[0025] S33: forwarding the first abnormal message and the second abnormal message with the forwarding tag from the message monitoring server to the kernel protocol stack through the VPP PUNT mechanism.

[0026] According to the network message monitoring method based on VPP provided by the application, the forwarding tag in step S31 is vpp-monitor-punt.

[0027] According to the network message monitoring method based on VPP provided by the application, the kernel protocol stack in step S3 is a LINUX kernel protocol stack.

[0028] According to the network message monitoring method based on VPP provided by the application, the analysis result in step S4 comprises abnormal message source, abnormal message destination and abnormal message reason.

[0029] According to the network message monitoring method based on VPP provided by the application, the management and control on the network system corresponding to the first abnormal message and the second abnormal message in step S5 comprises abnormal message tracing and network message ban.

[0030] The second aspect of the application further provides a network message monitoring system based on VPP, which is used to execute the network message monitoring method based on VPP as described in any one of the above aspects, and comprises:

[0031] The monitoring module is used for monitoring the first abnormal message through an abnormal monitoring code of the business node, and is also used for screening a second abnormal message that matches an ACL monitoring rule through the ACL node;

[0032] The forwarding module is established based on a VPP PUNT mechanism, and is used for forwarding the first abnormal message and the second abnormal message obtained by the monitoring module to a kernel protocol stack through a message monitoring server;

[0033] The analysis module is established based on a LINUX kernel, and is used for analyzing the first abnormal message and the second abnormal message to obtain an analysis result;

[0034] The interaction module is used for displaying the analysis result obtained by the analysis module to a user end, and receiving network system management and control of the first abnormal message and the second abnormal message by the user through the analysis result.

[0035] The present application has the following advantages:

[0036] The network message monitoring method and system based on VPP provided by the present application can develop a VPP MONITOR PUNT node to open a network message communication channel between VPP and LINUX through VPP PUNT technology, so that message analysis can be processed by a LINUX application program, and the pressure on VPP can be reduced.

[0037] The network message monitoring method and system based on VPP provided by the present application can enrich the message monitoring method of VPP, automatically complete the monitoring of network messages, eliminate manual packet analysis, accurately analyze interested messages in the case of large flow, and timely discover and handle network security problems and network health problems. BRIEF DESCRIPTION OF DRAWINGS

[0038] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the principles of the application. In the drawings:

[0039] Fig. 1 A flow chart of a network packet monitoring method based on VPP provided by an embodiment of the application;

[0040] Fig. 2 A structural diagram of a network packet monitoring system based on VPP provided by an embodiment of the application.

[0041] Reference signs:

[0042] 100, monitoring module; 200, forwarding module; 300, analysis module; 400, interaction module. DETAILED DESCRIPTION

[0043] In order to enable persons skilled in the art to better understand the technical solutions in the embodiments of the application, the technical solutions of the application will be described clearly and completely below with reference to the drawings. Obviously, the described embodiments are only some of the embodiments of the application, rather than all the embodiments of the application. It should be understood that these descriptions are only exemplary, and are not intended to limit the scope of the application. Based on the embodiments of the application, all other embodiments obtained by those of ordinary skill in the art without creative work should fall within the scope of protection of the application.

[0044] In addition, in the following description, the description of well-known structures and techniques is omitted to avoid unnecessary confusion of the concepts disclosed in the application.

[0045] In the description of the present application, it should be pointed out that, unless otherwise explicitly specified and limited, the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer" and the like indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, which is only for the convenience of describing the present application and simplifying the description, and does not indicate or imply that the indicated device or element must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation on the present application. In addition, the terms "first", "second", "third" are only for descriptive purposes and cannot be understood as indicating or implying relative importance. The terms "mounting", "connecting", "connecting" should be broadly understood, for example, it can be fixedly connected, or it can be detachably connected, or integrally connected; it can be mechanically connected, or it can be electrically connected; it can be directly connected, or it can be indirectly connected through an intermediate medium, or it can be the communication between two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0046] The exemplary embodiments will be described in detail hereinbelow, examples of which are shown in the accompanying drawings. In the following description, the same numbers refer to the same or similar elements throughout the several drawings. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they only represent examples of methods and systems consistent with some aspects of the present application, as detailed in the appended claims.

[0047] In order to better understand the present application, the technical terms mentioned in the present application are explained below.

[0048] VPP (Vector Packet Processing) is an open-source high-performance network data plane processing software, which runs in multiple Linux user spaces, mainly including x86, ARM and Power architectures, aiming to provide flexible and high-performance network packet processing solutions for various network applications and scenarios.

[0049] VPP PUNT is a packet processing mechanism of VPP, which is used to forward specific types of packets from the data plane (Forwarding Plane) to the control plane (Control Plane) for more detailed analysis, processing or decision-making.

[0050] VPP ACL (Access Control List) is a network security function used to control the flow of network packets in the data plane, thereby implementing access control and security policy enforcement. ACL is usually used to filter and limit network traffic to protect the network from unauthorized access, malicious behavior and security threats.

[0051] The application is described below in conjunction with Figs. 1-2 The embodiments of the application are described below.

[0052] As Fig. 1 shown, the first aspect of the application provides a network packet monitoring method based on VPP, comprising:

[0053] S1: implanting an abnormality monitoring code in a service node in a VPP system, and obtaining a first abnormal packet through the abnormality monitoring code;

[0054] In step S1, the service node includes a DPDK node, an ETH node, an IP node, a TCP node and a UDP node.

[0055] In step S1, the service node includes a DPDK node, an ETH node, an IP node, a TCP node and a UDP node.

[0056] In step S1, the abnormality of the abnormal packet includes an inconsistency between an IP packet length and an actual length, and a TTL abnormality.

[0057] After the network packet enters the VPP from the network card taken over by the VPP, it will first pass through the early nodes such as DPDK, and then pass through the ETH, IP, TCP or UDP nodes. In step S1, the network abnormal packet monitoring code is first implanted in these nodes, such as the inconsistency between the IP packet length and the actual length, the TTL abnormality, etc. If the network packet abnormality is monitored, it will reach the forwarding processing in step S3.

[0058] S2: obtaining a second abnormal packet matched with an ACL monitoring rule through an ACL node screening;

[0059] In step S2, it further comprises:

[0060] S21: the ACL node receives other packets sent by the service node in addition to the first abnormal packet;

[0061] S22: the ACL node performs ACL monitoring rule matching on the other packets, and when the other packets do not match the ACL monitoring rule, it executes step S23, and when the other packets match the ACL monitoring rule, it executes step S24;

[0062] S23: returning the other packets not matched with the ACL monitoring rule to the original service node for processing;

[0063] S24: marking other packets matching the ACL monitoring rule as second abnormal packets.

[0064] For normal network packets processed by the service node in step S1, the ACL related node of the VPP is reached, and if an ACL rule related to the monitoring packet is added at this time, matching is performed, and if the matching is unsuccessful, the original node of the VPP is returned to continue processing.

[0065] S3: forwarding the first abnormal packet and the second abnormal packet to the kernel protocol stack through the packet monitoring service end;

[0066] In the step S3, the kernel protocol stack is a LINUX kernel protocol stack.

[0067] In the step S3, the kernel protocol stack is a LINUX kernel protocol stack.

[0068] S31: marking the first abnormal packet and the second abnormal packet with a forwarding tag;

[0069] In the step S31, the forwarding tag is vpp-monitor-punt.

[0070] S32: forwarding the first abnormal packet with the forwarding tag from the service node to the packet monitoring service end through the VPP PUNT mechanism, and forwarding the second abnormal packet with the forwarding tag from the ACL node to the packet monitoring service end through the VPP PUNT mechanism;

[0071] S33: forwarding the first abnormal packet and the second abnormal packet with the forwarding tag from the packet monitoring service end to the kernel protocol stack through the VPP PUNT mechanism.

[0072] If the network packet meets the abnormal packet monitoring requirement or matches the ACL related packet monitoring rule, it will be marked with a PUNT tag, which is vpp-monitor-punt, and then sent to the PUNT scheduling node of the VPP. The PUNT scheduling node of the VPP will perform PUNT scheduling according to the PUNT tag marked in advance, and finally send the network packet to the developed vpp-monitor-punt node, and then send the network packet to the LINUX kernel protocol stack by the vpp-monitor-punt node.

[0073] S4: analyzing the first abnormal packet and the second abnormal packet by the kernel protocol stack to obtain an analysis result;

[0074] The LINUX kernel protocol stack supports stack tracking function, when an exception occurs, the function call sequence causing the exception can be obtained, which helps to locate the problem, and the LINUX kernel protocol stack also provides various debugging tools, such as gdb, strace and the like, which can help developers to deeply analyze the exception message and kernel behavior, in addition, the kernel supports network packet capture function, through tools such as tcpdump, wireshark and the like, the data packets flowing through the kernel protocol stack can be captured, the LINUX kernel records various log information in the protocol stack processing process, including normal processing flow and abnormal situation, so in step S4, the analysis of the exception message is performed through the LINUX kernel protocol stack.

[0075] The analysis result in step S4 includes the source of the exception message, the destination of the exception message, and the exception reason of the exception message.

[0076] After step S3, the LINUX network message monitoring program receives and analyzes the network message from the VPP, such as arranging the source, destination, and exception reason of the message.

[0077] S5: Controlling the network system corresponding to the first exception message and the second exception message according to the analysis result.

[0078] The control of the network system corresponding to the first exception message and the second exception message in step S5 includes exception message tracing and network message blocking.

[0079] Further, after obtaining the analysis result, the LINUX network message monitoring program reports the analysis result of the network message to the network message monitoring webpage end, and presents the final result to the user, and the user can make relevant operations on the network system according to the analysis result of the webpage end, such as network message blocking and exception packet tracing.

[0080] As shown in Fig. 2 The second aspect of the present application also provides a network message monitoring system based on VPP, which is used to execute the network message monitoring method based on VPP, and includes:

[0081] The monitoring module 100 is used for monitoring the first exception message by implanting the exception monitoring code of the service node, and is also used for screening the second exception message matched with the ACL monitoring rule through the ACL node;

[0082] The forwarding module 200 is established based on the VPP PUNT mechanism, and is used for forwarding the first exception message and the second exception message obtained by the monitoring module 100 to the kernel protocol stack through the message monitoring server;

[0083] An analysis module 300 is established based on a LINUX kernel, used for analyzing the first and second abnormal packets to obtain an analysis result;

[0084] An interaction module 400 is used for displaying the analysis result obtained by the analysis module 300 to a user end, and receiving the management and control of the network system corresponding to the first and second abnormal packets by the user through the analysis result.

[0085] The application provides a network packet monitoring system based on VPP, which is realized by combining PUNT and ACL technologies of VPP, and the system architecture is composed of VPP, a network card (NIC), a LINUX system, a network packet monitoring server (PACKET MONITOR), a network packet monitoring webpage (PACKET MONITOR WEB) and the like.

[0086] The specific working process is as follows: the network card is taken over by VPP, the network packet enters the system from the network card, and is processed by the related NODE nodes (IP NODE and ACL NODE) of VPP through the network card, the system is realized based on the above monitoring module by developing the VPP monitoring abnormal packet code or the ACL technology provided by VPP, the network packet needing to be monitored is filtered out, the monitored network packet is sent to the LINUX kernel protocol stack through the developed VPP MONITOR PUNT node and the PUNT technology of VPP through the forwarding module, the network packet monitoring program of the system receives and analyzes the network packet from VPP through the analysis module, the analysis result is sent to the network packet monitoring webpage by the network packet monitoring program of the system and is presented through the interaction module, and the user can perform relevant operations according to the presented data, such as the source, quantity and abnormal point of the network packet, for example, blocking the attack source, locating the source of the abnormal packet and the like.

[0087] The application provides a network packet monitoring method and system based on VPP, which is realized by combining PUNT and ACL technologies of VPP, and the main process steps of the technical scheme are as follows: a VPP MONITOR PUNT node is developed to process the monitored packet, network abnormal packet monitoring codes are developed in each NODE node, for example, the IP node is used for monitoring the IP packet length, TTL and other abnormal packets, if an abnormality is found, the packet is PUNTed to the VPP MONITOR PUNT node, based on the VPP ACL technology, the packet needing to be monitored is filtered out and is PUNTed to the VPP MONITOR PUNT node, based on the VPP PUNT technology, the monitored network packet is sent to the LINUX kernel protocol stack, a network packet monitoring system based on LINUX is developed to receive and analyze the network packet transmitted from VPP, and the analysis result is uploaded to the webpage by the network packet monitoring program and is presented.

[0088] Based on the implementation of the above method and system, the packet monitoring method of the VPP can be enriched, the monitoring of network packets can be automatically completed, manual packet capture analysis is avoided, interested packets can be accurately analyzed in the case of large flow, and network security problems and network health problems can be timely discovered and timely handled.

[0089] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present application, but not to limit them. Although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those skilled in the art that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application. Any changes or replacements easily thought of by those skilled in the art within the technical scope disclosed by the present application should be covered within the protection scope of the present application.

Claims

1. A method for monitoring network packets based on VPP, characterized in that, The method comprises the following steps: S1: implanting an abnormality monitoring code for a service node in a VPP system, and obtaining a first abnormal message through the abnormality monitoring code; S2: obtaining a second abnormal message matched with an ACL monitoring rule through an ACL node screening; Wherein, step S2 further comprises: S21: the ACL node receives other messages sent by the service node except the first abnormal message; S22: the ACL node performs ACL monitoring rule matching on the other messages, and when the other messages do not match the ACL monitoring rule, step S23 is executed, and when the other messages match the ACL monitoring rule, step S24 is executed; S23: returning the other messages not matching the ACL monitoring rule to the original service node for processing; S24: marking the other messages matching the ACL monitoring rule as the second abnormal message; S3: forwarding the first abnormal message and the second abnormal message to a kernel protocol stack through a message monitoring service end; Wherein, step S3 further comprises: S31: marking the first abnormal message and the second abnormal message as vpp-monitor-punt; S32: forwarding the first abnormal message with a forwarding tag from the service node to the message monitoring service end through a VPP PUNT mechanism, and forwarding the second abnormal message with a forwarding tag from the ACL node to the message monitoring service end through the VPP PUNT mechanism; S33: forwarding the first abnormal message and the second abnormal message with the forwarding tag from the message monitoring service end to the kernel protocol stack through the VPP PUNT mechanism; S4: the kernel protocol stack analyzes the first abnormal message and the second abnormal message to obtain an analysis result; S5: controlling the network system corresponding to the first abnormal message and the second abnormal message through the analysis result.

2. The VPP-based network packet monitoring method according to claim 1, characterized in that, The service node in step S1 comprises a DPDK node, an ETH node, an IP node, a TCP node and a UDP node.

3. The VPP-based network packet monitoring method according to claim 1, characterized in that, The abnormal situation of the abnormal message in step S1 comprises that the IP message length is inconsistent with the actual length and TTL is abnormal.

4. The VPP-based network packet monitoring method according to claim 1, characterized in that, The kernel protocol stack in step S3 is a LINUX kernel protocol stack.

5. The VPP-based network packet monitoring method according to claim 1, characterized in that, The analysis result in step S4 comprises an abnormal message source, an abnormal message destination and an abnormal message abnormal reason.

6. The VPP-based network packet monitoring method according to claim 1, characterized in that, The control of the network system corresponding to the first abnormal message and the second abnormal message in step S5 comprises abnormal message tracing and network message ban.

7. A VPP-based network packet monitoring system for performing a VPP-based network packet monitoring method according to any one of claims 1 to 6, characterized in that, The method comprises the following steps: A monitoring module is used to monitor a first abnormal message through an abnormality monitoring code implanted in a service node, and is also used to screen a second abnormal message matched with an ACL monitoring rule through an ACL node; A forwarding module is established based on a VPP PUNT mechanism, and is used to forward the first abnormal message and the second abnormal message obtained by the monitoring module to a kernel protocol stack through a message monitoring service end; An analysis module is established based on a LINUX kernel, and is used to analyze the first abnormal message and the second abnormal message to obtain an analysis result; An interaction module is configured to display the analysis result obtained by the analysis module to a user terminal and receive the control of the network system corresponding to the first abnormal packet and the second abnormal packet by the user through the analysis result.

Images