Method and device for identifying attack target of content delivery network, equipment and medium

Abstract

The invention relates to the technical field of content delivery networks, and discloses a method, device and equipment for identifying a content delivery network attack target and a medium, and the method comprises the steps: combining a plurality of network nodes into a plurality of node combinations in a combination manner; the node combination comprises at least one network node; distributing at least one service domain name to at least part of the node combinations, and generating a scheduling group for performing service scheduling; obtaining multiple pieces of attack traffic, and determining at least one target network node attacked by the multiple pieces of attack traffic; screening out attacked service domain names from the service domain names corresponding to the target scheduling group; the target scheduling group is a scheduling group to which the at least one target network node belongs. According to the method and the device, the attacked service domain name can be deduced through the attacked node combination by utilizing the scheduling capability of the CDN, attack load analysis is not needed, and the implementation mode is simple.

Description

Technical Field

[0001] The present disclosure relates to the technical field of content distribution networks, and in particular to a method, apparatus, device and medium for identifying attack targets of content distribution networks. Background Art

[0002] DDoS attack (Distributed Denial-of-Service Attack) is a distributed denial-of-service attack commonly used by hackers. It controls a large number of puppet computers to initiate requests to the target system, causing the target system to be paralyzed because it cannot withstand the number of requests.

[0003] With the continuous development of network technology, the scale and frequency of network attacks, including DDoS attacks, are increasing. The network security issues faced by CDN (Content Delivery Network) systems are becoming increasingly severe. It is particularly important to identify the targets of network attacks.

[0004] The most common measure currently is to analyze the characteristics of the attack payload and find the attacked business target. However, this processing method is inefficient and may be difficult to accurately find the attack target in the CDN scenario. Summary of the invention

[0005] In view of this, the present disclosure provides a method, apparatus, device and medium for identifying a content distribution network attack target, so as to identify the attack target of a network attack.

[0006] In a first aspect, the present disclosure provides a method for identifying a content distribution network attack target, comprising:

[0007] In a combined manner, a plurality of network nodes are combined into a plurality of node combinations; the node combination includes at least one of the network nodes;

[0008] Allocating at least one service domain name to at least part of the node combination to generate a scheduling group for performing service scheduling;

[0009] Acquire multiple attack flows, and determine at least one target network node attacked by the multiple attack flows;

[0010] The attacked business domain name is screened out from the business domain names corresponding to the target scheduling group; the target scheduling group is the scheduling group to which the at least one target network node belongs.

[0011] In a second aspect, the present disclosure provides a device for identifying a content distribution network attack target, comprising:

[0012] A combination module, used for combining a plurality of network nodes into a plurality of node combinations in a combined manner; the node combination includes at least one of the network nodes;

[0013] A scheduling module, used to allocate at least one service domain name to at least part of the node combination, and generate a scheduling group for performing service scheduling;

[0014] A determination module, used to obtain multiple attack flows and determine at least one target network node attacked by the multiple attack flows;

[0015] The identification module is used to filter out the attacked business domain name from the business domain names corresponding to the target scheduling group; the target scheduling group is the scheduling group to which the at least one target network node belongs.

[0016] In a third aspect, the present disclosure provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method for identifying content distribution network attack targets of the above-mentioned first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0017] In a fourth aspect, the present disclosure provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to cause a computer to execute the method for identifying a content distribution network attack target of the first aspect or any corresponding embodiment thereof.

[0018] The present invention forms multiple node combinations in a combined manner, and uses the node combinations assigned with business domain names as scheduling groups, and uses these scheduling groups to achieve business isolation; when performing business scheduling based on the scheduling groups, the attack traffic attacking a certain business domain name can be directed to the network nodes in the corresponding scheduling group, so that based on the attacked network nodes, the attacked business domain name can be inferred, without the need to perform attack load analysis, and the implementation method is simple. In addition, a large number of scheduling groups can be generated using a small number of network nodes, which not only expands the available business scheduling combinations, but also reduces the use cost of the original attack business discovery. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the specific embodiments of the present disclosure or the technical solutions in the related technologies, the drawings required for use in the specific embodiments or the related technical descriptions will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1 is a flowchart of a method for identifying a content distribution network attack target according to an embodiment of the present disclosure;

[0021] Figure 2 is a schematic diagram of generating a scheduling group according to an embodiment of the present disclosure;

[0022] Figure 3 is a flowchart of another method for identifying a content distribution network attack target according to an embodiment of the present disclosure;

[0023] Figure 4 is another schematic diagram of generating a scheduling group according to an embodiment of the present disclosure;

[0024] Figure 5 is a schematic diagram of a process for identifying an attack target according to an embodiment of the present disclosure;

[0025] Figure 6 is a schematic diagram of determining a correspondence between a network node and a domain name according to an embodiment of the present disclosure;

[0026] Figure 7 is another schematic diagram of determining the correspondence between network nodes and domain names according to an embodiment of the present disclosure;

[0027] Figure 8 is a schematic diagram of the implementation principle of the attack service identification system according to an embodiment of the present disclosure;

[0028] Fig. 9 is a structural block diagram of an apparatus for identifying a content distribution network attack target according to an embodiment of the present disclosure;

[0029] Fig.10 It is a schematic diagram of the hardware structure of the computer device of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0031] Content Delivery Network (CDN) is an Internet network service that can distribute various resources to end customers faster, more reliably and at a lower cost through the server closest to each end customer based on file caching, network optimization and other technologies. Among them, the scheduling system is responsible for selecting the best access node for each end customer.

[0032] For traditional CDN architecture and systems, the same node is generally reused by multiple services (domain names) for cost and maintainability reasons. For example, if a CDN system maintains the website content of e-commerce website A, news website B, and video streaming website C, these services can be reused on the same node to reduce costs.

[0033] When suffering from a DDoS layer 4 attack, such as SYN (Synchronize) Flood and ACK (Acknowledge) Flood attacks, since the attack payload generally does not contain business information such as domain names, even if the attack payload is analyzed, it is difficult to find the attack target, and it is difficult to take targeted measures.

[0034] If you need to accurately locate the attack target, you need to allocate nodes for each business separately. When the number of businesses increases, the number of nodes also needs to be increased accordingly, resulting in higher costs.

[0035] The method for identifying the attack target of a content distribution network provided in this embodiment realizes the isolation of services through a plurality of different node combinations, and uses the node combination as a scheduling group for the corresponding service. By utilizing the scheduling capability of the CDN network, the attacked service domain name can be inferred through the attacked node combination, without the need for attack load analysis, and the implementation is simple.

[0036] According to an embodiment of the present disclosure, a method embodiment for identifying a content distribution network attack target is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0037] In this embodiment, a method for identifying a content distribution network attack target is provided, which can be applied to an attack service identification system of a CDN network. The attack service identification system can be deployed in a node of the CDN network. Figure 1 is a flow chart of a method for identifying a content distribution network attack target according to an embodiment of the present disclosure. Figure 1 As shown, the process includes the following steps.

[0038] Step S101, combining multiple network nodes into multiple node combinations in a combined manner; the node combination includes at least one network node.

[0039] In this embodiment, combination refers to taking out a specified number of elements from a given number of elements, without considering the order of the elements. For multiple network nodes in the CND network, a preset number of network nodes can be taken out to form a corresponding node combination, and the node combination includes a preset number of network nodes. The preset number is greater than or equal to 1. Generally, the node combination includes multiple network nodes, that is, the preset number is greater than or equal to 2.

[0040] Among them, different node combinations can be formed by taking out different network nodes from multiple network nodes, that is, the number of node combinations is also multiple; generally, the number of node combinations is greater than the number of network nodes.

[0041] For example, if n network nodes need to be combined, each node combination plan allocates an equal number of network nodes, and each node combination includes m network nodes (m < n), that is, m network nodes are taken out from n network nodes to form a node combination, then the number of node combinations is:

[0042] For example, if each node combination includes 6 network nodes, that is, m=6, the number of node combinations that can be generated for different numbers of network nodes can be specifically shown in Table 1 below.

[0043] Table 1

[0044] Number of network nodes 15 16 17 18 19 20 21 22 23 Number of node combinations 5005 8008 12376 18564 27132 38760 54264 74613 100947

[0045] As shown in Table 1 above, if n=15, 5005 node combinations can be generated based on 15 network nodes, and the number of node combinations is much larger than the number of network nodes.

[0046] Step S102: Allocate at least one service domain name to at least part of the node combination to generate a scheduling group for performing service scheduling.

[0047] In this embodiment, the CDN network can provide multiple services, each of which corresponds to a corresponding domain name, namely, a service domain name; users can request corresponding service content by accessing the service domain name. Each service domain name is assigned to a corresponding node combination, so as to utilize the network nodes in the node combination to implement corresponding service scheduling; for the convenience of distinguishing descriptions, the node combination to which the service domain name is assigned is called a scheduling group, and service scheduling is subsequently performed based on the scheduling group.

[0048] Each network node has an IP address, and the node combination assigned with the business domain name is regarded as a scheduling group, that is, one or more IP addresses are assigned to the business domain name corresponding to the scheduling group. Based on these scheduling groups, the scheduling system can determine which IP addresses can be resolved for each business domain name.

[0049] Figure 2 A schematic diagram of generating a scheduling group is shown. Figure 2 As shown, if there are three network nodes, and the IP addresses of the three network nodes are 1.1.1.1, 2.2.2.2, and 3.3.3.3 respectively; if every two network nodes form a node combination, three node combinations can be generated, such as Figure 2 As shown, node combination A, node combination B and node combination C can be generated.

[0050] If there are three services, and the service domain names of the three services are a.com, b.com, and c.com respectively, the three service domain names can be assigned to three node combinations respectively, thereby generating corresponding scheduling groups, namely, scheduling group 1, scheduling group 2, and scheduling group 3. Figure 2 As shown, the business domain name a.com is assigned to node combination A to form scheduling group 1. It can be understood that the network nodes corresponding to scheduling group 1 are the same as the network nodes corresponding to node combination A, and both include network nodes with IP addresses of 1.1.1.1 and 2.2.2.2. When a user accesses the business domain name a.com, the scheduling system can resolve the business domain name a.com to 1.1.1.1 or 2.2.2.2 based on scheduling group 1 for user access and business scheduling.

[0051] In this embodiment, when generating a scheduling group, a business domain name may be allocated to a part of the node combinations; for example, if the number of business domain names is less than the number of node combinations, only a part of the node combinations need to be allocated business domain names to determine the scheduling group corresponding to each business domain name. Alternatively, one or more business domain names may be allocated to all node combinations, which may be determined based on actual needs.

[0052] Step S103, obtaining multiple attack flows, and determining at least one target network node attacked by the multiple attack flows.

[0053] In this embodiment, multiple attack flows within a period of time may be obtained; for example, access flows within a period of time may be identified to identify normal flows and attack flows therein.

[0054] Each attack flow corresponds to an attacked network node. For ease of description, the attacked network node is called the target network node. Multiple attack flows may attack the same network node or multiple network nodes, that is, the number of target network nodes may be one or more.

[0055] Step S104, filtering out the attacked service domain names from the service domain names corresponding to the target scheduling group; the target scheduling group is a scheduling group to which at least one target network node belongs.

[0056] In this embodiment, for the target network nodes attacked by the attack traffic, these target network nodes belong to the corresponding scheduling group. For the convenience of description, the scheduling group to which these target network nodes belong is called the target scheduling group. If there are multiple target network nodes, the target scheduling group is the scheduling group to which multiple target network nodes belong together; in this case, a unique target scheduling group may be determined based on multiple target network nodes.

[0057] Furthermore, since the target dispatch group corresponds to a business domain name, it can be determined that among the business domain names corresponding to the target dispatch group, there is an attacked business domain name, so the attacked business domain name can be screened out. For example, if the target dispatch group corresponds to a unique business domain name, it can be determined that the unique business domain name is the currently attacked business domain name.

[0058] by Figure 2 Taking the dispatch group shown as an example, if the network nodes attacked by multiple attack flows include network nodes with IP addresses 1.1.1.1 and 2.2.2.2, these two network nodes are both target network nodes. Since these two target network nodes belong to dispatch group 1, dispatch group 1 is the target dispatch group, which corresponds to the only business domain name a.com, so it can be determined that the attacked business domain name is a.com.

[0059] Among them, as mentioned above, in general, the number of node combinations will be greater than the number of network nodes, that is, the number of scheduling groups will be greater than the number of network nodes. Therefore, using a small number of network nodes, the scheduling groups corresponding to more services can be determined, and the attacked services can be located at a low cost. As shown in Table 1 above, if there are 15 network nodes, they are combined into 5005 node combinations. If there are 5005 services currently, the service domain name of each service can be assigned to the corresponding node combination, thereby generating 5005 scheduling groups; if it is subsequently determined that a scheduling group is attacked based on multiple attack traffic, the service domain name corresponding to the scheduling group is the attacked service domain name; therefore, based on 15 network nodes, the attacked service domain name can be easily and conveniently determined from the 5005 service domain names.

[0060] After the attacked business domain name is determined, the attacked business domain name can be protected. For example, the attacked business domain name can be banned, or the attacked business domain name can be migrated to a high-defense node.

[0061] The method for identifying the attack target of the content distribution network provided in this embodiment forms multiple node combinations in a combined manner, and uses the node combinations assigned with business domain names as scheduling groups, and uses these scheduling groups to achieve business isolation; when performing business scheduling based on the scheduling group, the attack traffic attacking a certain business domain name can be directed to the network nodes in the corresponding scheduling group, so that based on the attacked network nodes, the attacked business domain name can be inferred, without the need to perform attack load analysis, and the implementation method is simple. In addition, a large number of scheduling groups can be generated using a small number of network nodes, which not only expands the available business scheduling combinations, but also reduces the use cost of the original attack business discovery.

[0062] In this embodiment, another method for identifying a content distribution network attack target is provided, which can be applied to an attack service identification system of a CDN network. The attack service identification system can be deployed in a node of the CDN network. Figure 3 is a flow chart of a method for identifying a content distribution network attack target according to an embodiment of the present disclosure. Figure 3 As shown, the process includes the following steps.

[0063] Step S301, combining multiple network nodes into multiple node combinations in a combined manner; the node combination includes at least one network node.

[0064] For details, please see Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0065] Step S302: Allocate at least one service domain name to at least part of the node combination to generate a scheduling group for performing service scheduling.

[0066] In this embodiment, the node combination assigned with the business domain name is used as the scheduling group. If the scheduling group corresponds to a displaced business domain name, after determining the attacked target scheduling group, the attacked business domain name can be accurately determined. Therefore, ideally, the business domain name and the scheduling group are one-to-one corresponding.

[0067] For example, the above step S302 "assigning at least one business domain name to at least some node combinations" may include: when the number of business domain names is less than or equal to the number of node combinations, assigning unique business domain names to at least some node combinations.

[0068] In this embodiment, if the number of business domain names is less than or equal to the number of node combinations, a one-to-one correspondence between the business domain names and the node combinations can be achieved. The business domain names are assigned to unique node combinations, and each node combination is only assigned a unique business domain name. This can make the generated scheduling group and the business domain name have a one-to-one correspondence. The subsequent scheduling group based on multiple attack traffic attacks can quickly and accurately determine the attacked domain name.

[0069] In addition, if the number of business domain names is greater than the number of node combinations, at least some of the node combinations are assigned multiple business domain names, that is, at least some scheduling groups correspond to multiple business domain names; when it is determined based on multiple attack traffic that the attacked scheduling group corresponds to multiple business domain names, there may be domain names that have not been attacked among these business domain names, so it is difficult to accurately determine which business domain names are the attacked business domain names.

[0070] Figure 4 Another schematic diagram of generating a scheduling group is shown. Figure 2 Similarly, three node combinations are generated based on three network nodes: node combination A, node combination B, and node combination C. However, due to the existence of five business domain names, namely a.com, b.com, c.com, d.com, and e.com, some business domain names will be assigned to the same node combination. Figure 4 As shown, scheduling group 2 corresponds to business domain names b.com and c.com, and scheduling group 3 corresponds to business domain names d.com and e.com.

[0071] If the attacker attacks the business domain name b.com, based on the collected attack traffic, it can be determined that the network nodes with IP addresses 1.1.1.1 and 3.3.3.3 are attacked, so it can be determined that dispatch group 2 is the target dispatch group. However, dispatch group 2 corresponds to business domain name b.com and business domain name c.com, so it is not possible to accurately determine which business domain name is attacked, or whether both business domain names are attacked.

[0072] In order to accurately determine the attacked business domain name, in this embodiment, an adjustable weight is set for the business domain name, and the business domain name is allocated based on the weight to generate a suitable scheduling group. Specifically, the above step S302 "allocating at least one business domain name to at least part of the node combination" includes the following steps S3021 to S3022.

[0073] Step S3021, determine the current weight of the business domain name.

[0074] In this embodiment, each business domain name is provided with a corresponding weight, and when the business domain name needs to be allocated to generate a scheduling group, the weight of the business domain name at the current moment, that is, the current weight, can be determined. For example, initially, the weights of the various business domain names may be the same.

[0075] Optionally, the above step S302 "allocating at least one business domain name to at least part of the node combination" may include: when a scheduling update instruction is obtained, reallocating at least one business domain name to at least part of the node combination; and / or, periodically reallocating at least one business domain name to at least part of the node combination.

[0076] In this embodiment, the user can specify the time when the scheduling group needs to be re-divided. For example, when maintenance is required, the scheduling update instruction can be manually triggered. When the scheduling update instruction is obtained, the scheduling group can be regenerated, that is, the current weight of the business domain name at this time is determined, and the subsequent process is executed. Alternatively, the process of re-dividing the scheduling group can be triggered regularly, for example, the scheduling group is periodically re-divided every day or hour.

[0077] It can be understood that if the number of business domain names is less than or equal to the number of node combinations, the attacked business domain name can be accurately determined after the target scheduling group is determined, so there is no need to set weights for the business domain names. If the number of business domain names is greater than the number of node combinations, it is necessary to set weights for the business domain names, and after the scheduling group needs to be generated, the process of steps S3021 to S3022 is performed.

[0078] Step S3022: allocate the business domain name to the corresponding node combination according to the current weight of the business domain name; wherein, the greater the weight of the business domain name allocated to the node combination, the smaller the number of business domain names allocated to the node combination.

[0079] In this embodiment, when assigning a business domain name to a corresponding node combination, the current weight of the business domain name is referenced; wherein, the greater the weight of the business domain name assigned to a certain node combination, the smaller the number of business domain names assigned to the node combination, making it more likely that the node combination will not assign other business domain names. Therefore, by adjusting the weight of the business domain name, the number of business domain names corresponding to the same scheduling group can be reduced, and a certain scheduling group can correspond to a unique business domain name as much as possible, so that the unique attacked business domain name can be identified later.

[0080] Among them, the weight of the business domain name can be adaptively adjusted based on the situation that the business domain name is attacked. For example, if a business domain name is suspected of being attacked, the weight of the business domain name can be increased. See the relevant description of the subsequent step S304 for details.

[0081] In some optional implementations, the above step S3022 "allocating the business domain name to the corresponding node combination according to the current weight of the business domain name" includes the following steps A1 to A2.

[0082] Step A1, determining the quota of the business domain name according to the current weight of the business domain name; there is a positive correlation between the quota of the business domain name and the current weight of the business domain name.

[0083] Step A2: allocate the business domain names to corresponding node combinations according to the quotas of the business domain names; the sum of the quotas of the business domain names allocated to the node combinations shall not exceed the preset quotas of the node combinations themselves.

[0084] In this embodiment, in order to determine whether a certain business domain name can be allocated to a certain node combination, corresponding indicators, namely quotas, are set for both the business domain name and the node combination. A suitable quota, namely a preset quota, is preset for each node combination; for example, the preset quotas of each node combination are the same.

[0085] For each business domain name, its quota is related to its weight, and there is a positive correlation between the quota of the business domain name and the current weight of the business domain name, that is, the greater the current weight of the business domain name, the greater the corresponding quota. For example, there is a positive proportional relationship between the quota of the business domain name and the current weight of the business domain name.

[0086] Furthermore, the sum of the quotas of all business domain names is equal to the sum of the preset quotas of all node combinations. After determining the quota of the business domain name based on the current weight of each business domain name, the sum of the quotas of all business domain names can be determined, and the preset quota of each node combination can be determined based on the sum of the quotas of the business domain names; or, after the node combination is replaced, the preset quota of each node combination can be determined, and the sum of the preset quotas of all node combinations can be calculated, and then the quota of each business domain name can be calculated based on the sum of the preset quotas of the node combination and the weight of the business domain name.

[0087] When the quota of the business domain name is used to allocate the business domain name, it is necessary to ensure that the sum of the quotas of the business domain names allocated to a certain node combination does not exceed the preset quota of the node combination itself.

[0088] In this embodiment, quotas are used to allocate business domain names so that business domain names with larger weights (i.e., larger quotas) can occupy the preset quota of a certain node combination as much as possible, thereby no longer allocating other business domain names to the node combination, making it easier to accurately determine whether the business domain name with larger weights is the attacked business domain name in the subsequent process.

[0089] Optionally, the above step A2 "allocating the business domain names to corresponding node combinations according to the quota of the business domain names" may include: performing allocation operations on each business domain name in turn according to the arrangement order of the multiple business domain names until all the business domain names are traversed.

[0090] In this embodiment, the arrangement order of multiple business domain names can be determined. For example, the above step A2 "allocating business domain names to corresponding node combinations according to the quota of business domain names" can also include: shuffling multiple business domain names to determine the arrangement order of multiple business domain names. Shuffle processing can make the generated scheduling group irregular, preventing attackers from taking advantage of scheduling rules to increase the difficulty of determining attack targets.

[0091] After determining the arrangement order of multiple business domain names, the allocation operation can be performed on each business domain name in turn according to the arrangement order to allocate the business domain name to the corresponding node combination until all business domain names are traversed, that is, until all business domain names are allocated to the corresponding node combination to generate the corresponding scheduling group.

[0092] The above allocation operation specifically includes the following steps A21 to A24.

[0093] Step A21, determining whether the quota of the service domain name is greater than the remaining quota of the current node combination; the current node combination is a node combination whose preset quota is not fully occupied.

[0094] Step A22: when the quota of the service domain name is not greater than the remaining quota of the current node combination, the service domain name is allocated to the current node combination.

[0095] Step A23, when the quota of the business domain name is greater than the remaining quota of the current node combination, continue to determine whether the quota of the business domain name is greater than the remaining quota of the next node combination, until a node combination whose remaining quota is not greater than the quota of the business domain name is determined, and allocate the business domain name to the node combination whose remaining quota is not greater than the quota of the business domain name.

[0096] Step A24: If there is no node combination whose remaining quota is not greater than the quota of the business domain name, the quota of the business domain name is split to allocate the business domain name to multiple node combinations.

[0097] In this embodiment, when allocating a certain business domain name, a node combination whose preset quota is not fully occupied can be determined, that is, the current node combination; for example, the node combination also has a certain order, and the business domain name can be allocated to it in sequence according to the order of the node combination. It can be understood that the current node combination whose preset quota is not fully occupied has a corresponding remaining quota. For example, if the preset quota of a certain node combination is 3, if a business domain name with a quota of 1 is previously allocated to it, the remaining quota of the node combination is 3-1=2.

[0098] If the quota of the business domain name to be allocated is less than or equal to the remaining quota of the current node combination, it means that allocating the business domain name to the current node combination will not cause the current node combination to exceed the quota, so the business domain name can be allocated to the current node combination; accordingly, the remaining quota of the current node combination will be reduced until it is 0.

[0099] On the contrary, if the quota of the business domain name to be allocated is greater than the remaining quota of the current node combination, the business domain name cannot be allocated to the current node combination, so it is compared with the next current node at this time, that is, it is determined whether the quota of the business domain name is greater than the remaining quota of the next node combination. Similarly, if the quota of the business domain name is less than or equal to the remaining quota of the next node combination, the business domain name is allocated to the next node combination; if the quota of the business domain name is greater than the remaining quota of the next node combination, it is compared with the remaining quota of other node domain names until a node combination is found whose remaining quota is not greater than the quota of the business domain name.

[0100] In addition, if for a certain business domain name, there is currently no node combination whose remaining quota is not greater than the quota of the business domain name, that is, the remaining quotas of all node combinations are less than the quota of the business domain name, then the quota of the business domain name is split, so that the business domain name is allocated to multiple node combinations. It can be understood that the quota of the business domain name can be divided according to the size of the remaining quota of each node combination, so that the partial quota divided from the business domain name is the same as the remaining quota of the node combination, so that the quota of the node combination can be fully occupied.

[0101] by Figure 4 For example, if the weight ratio of the five business domain names a.com, b.com, c.com, d.com, and e.com is 2:1:1:1:1, and the preset quotas of the three node combinations are all 2, that is, the total quota is 6; therefore, the quotas of the five business domain names can be set to 2, 1, 1, 1, 1 respectively. If the business domain name a.com is allocated in the order of a.com, b.com, c.com, d.com, and e.com, after the business domain name a.com is allocated to the first node combination A, the node combination A is already full, so the business domain name b.com needs to be allocated to the second node combination B, and so on. Figure 4 The three dispatch groups are shown.

[0102] Alternatively, if the allocation is performed in the order of b.com, a.com, c.com, d.com, and e.com, the business domain name b.com is first allocated to the first node combination A; when the business domain name a.com is allocated later, since the remaining quota of node combination A is 2-1=1, but the remaining quota of the next node combination B is 2, the business domain name a.com is allocated to node combination B; when the business domain name c.com is allocated later, the business domain name c.com is allocated to the first node combination A. Similarly, the business domain names d.com and e.com are both allocated to node combination C.

[0103] In addition, when a business domain name is assigned to multiple node combinations, if all network nodes in the scheduling group to which the business domain name is assigned are subsequently attacked, it can be basically determined that the business attacked by the attacker is the business domain name, that is, the attacked business domain name can also be accurately determined.

[0104] In this embodiment, by judging the size relationship between the quota of the business domain name and the remaining quota of the node combination, it is possible to simply and quickly determine to which node combination the business domain name is allocated; in addition, by splitting the quota of the business domain name, it is ensured that the quota of the business domain name is correctly allocated, and it is also helpful to accurately locate the business domain name when attacked.

[0105] Step S303: Acquire multiple attack flows and determine at least one target network node attacked by the multiple attack flows.

[0106] For details, please see Figure 1 Step S103 of the illustrated embodiment will not be described in detail here.

[0107] In this embodiment, since the same network node may be divided into different node combinations, that is, may be divided into different scheduling groups, if only one target network node is determined, the target network node may belong to multiple target scheduling groups, so that a large number of attacked business domain names may be determined based on the target network node, and it is difficult to accurately determine which specific business domain name is attacked. Therefore, if the multiple attack traffics obtained are not sufficient to filter out the attacked business domain name, for example, multiple attack traffics attack the same target network node, then continue to collect attack traffic until the attacked business domain name can be accurately determined, or the attack ends.

[0108] Figure 5 A schematic diagram of the process of identifying attack targets is shown in FIG. Figure 5 As shown in the figure, when some IP addresses are detected to be attacked, the corresponding attack traffic can be collected; if the edge security node can clean these attack traffic, these attack traffic can be split or combined. For example, the attack traffic can be split or combined from the time domain or other perspectives to distinguish different types of attacks. The subsequent attack target positioning based on the same type of attack traffic can avoid the mutual influence of multiple attacks. If the edge security node cannot clean these attack traffic, the corresponding business domain name can be dispatched to the high-defense node or sandbox, and the resources and data in the network can be protected from illegal attacks and access through high-level protection measures. In addition, for the business domain name dispatched to the high-defense node, the total traffic can also be split or combined.

[0109] Based on the attack traffic obtained after splitting / combining, the distribution of the attacked IP addresses can be determined, based on which the attack target can be identified as much as possible, that is, the attacked business domain name can be identified. If the attack target can be identified, for example, the target scheduling group corresponds to a unique business domain name, the weight of the business domain name can be appropriately increased; if the attack target cannot be identified at present, continue to collect attack traffic until the attack target is identified. In addition, if the attack target is still not identified after the attack ends, the method provided in this embodiment can also narrow the scope of the attacked target, that is, suspicious business domain names can be identified, and then the weights of these suspicious business domain names can be temporarily increased.

[0110] Step S304: when the target scheduling group corresponds to multiple service domain names, increase the weight of the service domain name corresponding to the target scheduling group.

[0111] In this embodiment, after the above step S303 "determining at least one target network node attacked by multiple attack traffic", it can be determined whether the target scheduling group corresponds to multiple business domain names. If the target scheduling group corresponds to one business domain name, then the business domain name can be used as the attacked business domain name.

[0112] If the target dispatching group corresponds to multiple business domain names, it means that it is difficult to accurately determine the attacked business domain name based on the target dispatching group. Therefore, by increasing the weight of the business domain name corresponding to the target dispatching group, when the dispatching group is regenerated subsequently, the business domain name corresponding to the target dispatching group is more likely to be assigned to a unique dispatching group. Then, after the new target dispatching group is re-determined based on the subsequent attack traffic, the business domain name uniquely corresponding to the new target dispatching group is the attacked business domain name, thereby achieving accurate positioning of the attack target.

[0113] Among them, if the target scheduling group corresponds to a business domain name, the weight of the business domain name can be kept unchanged, or the weight of the business domain name can be increased to avoid the subsequent increase in the weight of other business domain names, which will cause the weight of the business domain name to decrease relatively, affecting the accuracy of subsequent positioning of the attack target.

[0114] Optionally, the above step S304 “increase the weight of the business domain name corresponding to the target scheduling group when the target scheduling group corresponds to multiple business domain names” includes steps B1 and B2.

[0115] Step B1: when the target scheduling group corresponds to multiple service domain names, the service domain name corresponding to the target scheduling group is used as a candidate service domain name, and the weights of the multiple candidate service domain names are temporarily increased.

[0116] Step B2: when the attacked business domain name is screened out from the multiple candidate business domain names, the weights of other candidate business domain names except the attacked business domain name among the multiple candidate business domain names are reduced.

[0117] In this embodiment, if the target dispatching group corresponds to multiple business domain names, the weights of these business domain names can be temporarily increased. Wherein, for the convenience of description, the business domain names corresponding to the target dispatching group are referred to as candidate business domain names, that is, the weights of these candidate business domain names are temporarily increased. After subsequent processing, such as subsequent regeneration of the dispatching group, and positioning the target dispatching group based on the attack traffic, the attacked business domain name among multiple candidate business domain names is accurately determined, then the weight of the attacked business domain name can be kept unchanged (or its weight is increased), and the weights of other candidate business domain names other than the attacked business domain name can be reduced, so as to avoid the next time the dispatching group is regenerated, the candidate business domain names that have not been attacked are also separately assigned to a dispatching group, affecting the subsequent process of positioning the attack target.

[0118] Step S305, filtering out the attacked business domain names from the business domain names corresponding to the target scheduling group; the target scheduling group is a scheduling group to which at least one target network node belongs.

[0119] For details, please see Figure 1 Step S104 of the illustrated embodiment will not be described in detail here.

[0120] The method for identifying the attack target of a content distribution network provided in this embodiment allocates the business domain name to the corresponding node combination according to the current weight of the business domain name, and increases the weight of the business domain name suspected of being attacked, so that the business domain name suspected of being attacked can be allocated to a unique node combination, and then the attacked business domain name can be accurately determined, thereby achieving precise positioning of the attack target.

[0121] In some optional embodiments, the method further includes step C1.

[0122] Step C1, determining a domain name set corresponding to the network node according to the scheduling group to which the network node belongs and the corresponding service domain name; the domain name set includes at least one service domain name.

[0123] Furthermore, the above step S305 of "screening out the attacked business domain name from the business domain names corresponding to the target scheduling group" includes the following step D1.

[0124] Step D1, when there are multiple target network nodes, determine the intersection of domain name sets of the multiple target network nodes; and filter out the attacked business domain name from the business domain names in the intersection.

[0125] In this embodiment, after determining the target network node to be attacked, the corresponding target scheduling group can be determined based on the scheduling group to which these target network nodes belong, and then the attacked business domain name can be identified. However, since there are many scheduling groups and a business domain name may be assigned to multiple scheduling groups, this embodiment identifies the attacked business domain name based on the domain name relationship mounted by each network node.

[0126] Specifically, for each network node, the scheduling group to which it belongs can be determined, and the service domain name corresponding to the scheduling group can be determined; in general, a network node can belong to multiple scheduling groups, that is, multiple scheduling groups include the network node, so the network node can correspond to multiple service domain names; in this embodiment, all service domain names corresponding to the network node are generated into a corresponding set, that is, a domain name set, and the domain name set of the network node can represent the corresponding relationship between the network node and the domain name. Correspondingly, each determined target network node also corresponds to a domain name set.

[0127] If multiple target network nodes are determined based on the attack traffic, the intersection of the domain name sets of these target network nodes can be determined, and the business domain name in the intersection can be used as the business domain name corresponding to the target scheduling group. Therefore, based on the business domain name of the intersection, the attacked business domain name can be determined. For example, if there is only one business domain name in the intersection, then the business domain name is the attacked business domain name.

[0128] Figure 6 A schematic diagram of determining the correspondence between network nodes and domain names is shown, and Figure 6 is based on Figure 2 The corresponding relationship between the network nodes and domain names determined by the scheduling group shown in FIG. Figure 6 As shown, the network node with IP address 1.1.1.1 belongs to scheduling group 1 and scheduling group 2, and the business domain names of scheduling group 1 and scheduling group 2 are a.com and b.com respectively. Therefore, the network node with IP address 1.1.1.1 has a corresponding relationship with the business domain names a.com and b.com, that is, the domain name set of the network node includes the business domain name a.com and the business domain name b.com, and the domain name set can be expressed as {a.com, b.com}. Similarly, the domain name set of the network nodes with IP addresses 2.2.2.2 and 3.3.3.3 can also be determined.

[0129] Figure 7 Another schematic diagram of determining the correspondence between network nodes and domain names is shown, and Figure 7 is based on Figure 4 The corresponding relationship between the network nodes and domain names determined by the scheduling group shown in FIG. Figure 7As shown, the network node with an IP address of 1.1.1.1 belongs to scheduling group 1 and scheduling group 2, and the business domain name of scheduling group 1 is a.com, and the business domain names of scheduling group 2 include b.com and c.com. Therefore, the network node with an IP address of 1.1.1.1 has a corresponding relationship with the business domain names a.com, b.com, and c.com, that is, the domain name set of the network node includes the business domain name a.com, the business domain name b.com, and the business domain name c.com. Similarly, the domain name set of the network nodes with IP addresses of 2.2.2.2 and 3.3.3.3 can also be determined.

[0130] by Figure 6 Taking the example shown, if the IP addresses of the target network nodes currently under attack are 1.1.1.1 and 2.2.2.2, the intersection of the domain name sets of the two target network nodes can be calculated, {a.com, b.com} ∩ {a.com, c.com} = a.com, that is, the intersection includes the business domain name a.com, so it can be determined that the business domain name a.com is the attacked business domain name.

[0131] In addition, if a business domain name is assigned to multiple scheduling groups, and based on the attack traffic, it is known that the network nodes in the multiple scheduling groups are all attacked, then based on the domain name set of these attacked network nodes, it can be determined that their intersection only contains the business domain name, that is, at this time, the attacked business domain name can also be uniquely determined.

[0132] The method for identifying a content distribution network attack target provided in this embodiment can be applied to an attack service identification system. Figure 8 The following is a schematic diagram showing the implementation principle of the attack business identification system. Figure 8 As shown in the figure, the attack business identification system can be divided into three parts: scheduling management, attack perception and attack identification.

[0133] The scheduling management function is used to divide the scheduling groups and maintain the relationship between IP-mounted domain names, that is, to maintain the domain name set corresponding to each network node. The scheduling groups set up can include shared scheduling groups corresponding to multiple business domain names, independent scheduling groups used by a single business domain name, and high-defense scheduling groups with high protection levels, etc., which can be determined based on actual business needs.

[0134] The attack perception function is used to perceive attack events and identify attack traffic through the trend and distribution information of packet volume, traffic volume, and request volume.

[0135] The attack identification function can clean the attack traffic to split / combine the attack traffic and identify the attack target based on the IP address attacked by the attack traffic. In addition, the weights corresponding to each business domain name can be updated and adjusted so that the scheduling management function can update the scheduling group.

[0136] Furthermore, the attack service identification system can provide a scheduling label to the scheduling system, where the scheduling label indicates the service domain name corresponding to each scheduling group and the IP addresses of the included network nodes, so that the scheduling system performs domain name scheduling based on the scheduling label.

[0137] The attack service identification system provided in this embodiment can be applied to a multi-tenant CDN system. Through scheduling relationships and strategies, it can quickly and directly discover the attacked service targets without based on attack load analysis. Moreover, the scheduling group generated based on the combination of multiple network nodes expands the available service scheduling combinations, reduces the cost of using the original attack service discovery, and can automatically discover the attacked services at a low cost, thereby implementing targeted protection and disposal strategies.

[0138] In this embodiment, a device for identifying a target of a content distribution network attack is also provided, and the device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" may be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0139] This embodiment provides a device for identifying a content distribution network attack target, such as Fig. 9 As shown, including:

[0140] A combining module 901 is used to combine a plurality of network nodes into a plurality of node combinations in a combined manner; the node combination includes at least one of the network nodes;

[0141] A scheduling module 902, configured to allocate at least one service domain name to at least part of the node combination, and generate a scheduling group for performing service scheduling;

[0142] A determination module 903 is used to obtain multiple attack flows and determine at least one target network node attacked by the multiple attack flows;

[0143] The identification module 904 is used to filter out the attacked business domain names from the business domain names corresponding to the target scheduling group; the target scheduling group is the scheduling group to which the at least one target network node belongs.

[0144] In some optional implementations, the scheduling module 902 allocates at least one service domain name to at least part of the node combination, including:

[0145] Determine the current weight of the business domain name;

[0146] According to the current weight of the business domain name, the business domain name is allocated to the corresponding node combination; wherein, the greater the weight of the business domain name allocated to the node combination, the smaller the number of business domain names allocated to the node combination;

[0147] After determining at least one target network node attacked by the plurality of attack flows, the method further includes:

[0148] In the case that the target scheduling group corresponds to multiple service domain names, the weight of the service domain name corresponding to the target scheduling group is increased.

[0149] In some optional implementations, the scheduling module 902 allocates the business domain name to a corresponding node combination according to the current weight of the business domain name, including:

[0150] Determine the quota of the business domain name according to the current weight of the business domain name; there is a positive correlation between the quota of the business domain name and the current weight of the business domain name;

[0151] According to the quota of the business domain name, the business domain name is allocated to the corresponding node combination; the sum of the quotas of the business domain names allocated to the node combination shall not exceed the preset quota of the node combination itself.

[0152] In some optional implementations, the scheduling module 902 allocates the business domain name to a corresponding node combination according to the quota of the business domain name, including:

[0153] According to the arrangement order of the plurality of business domain names, the allocation operation is performed on each of the business domain names in turn until all the business domain names are traversed;

[0154] The allocation operation includes:

[0155] Determine whether the quota of the business domain name is greater than the remaining quota of the current node combination; the current node combination is a node combination whose preset quota is not fully occupied;

[0156] When the quota of the service domain name is not greater than the remaining quota of the current node combination, allocating the service domain name to the current node combination;

[0157] In the case where the quota of the business domain name is greater than the remaining quota of the current node combination, continue to determine whether the quota of the business domain name is greater than the remaining quota of the next node combination, until a node combination whose remaining quota is not greater than the quota of the business domain name is determined, and allocate the business domain name to the node combination whose remaining quota is not greater than the quota of the business domain name;

[0158] In the case that there is no node combination whose remaining quota is not greater than the quota of the business domain name, the quota of the business domain name is split to allocate the business domain name to multiple node combinations.

[0159] In some optional implementations, the scheduling module 902 allocates the business domain name to a corresponding node combination according to the quota of the business domain name, and further includes:

[0160] The plurality of service domain names are processed in random order to determine an arrangement order of the plurality of service domain names.

[0161] In some optional implementations, when the target scheduling group corresponds to multiple business domain names, the scheduling module 902 increases the weight of the business domain name corresponding to the target scheduling group, including:

[0162] In the case that the target scheduling group corresponds to multiple business domain names, the business domain name corresponding to the target scheduling group is used as a candidate business domain name, and the weights of the multiple candidate business domain names are temporarily increased;

[0163] When the attacked business domain name is screened out from the plurality of candidate business domain names, the weights of other candidate business domain names except the attacked business domain name among the plurality of candidate business domain names are reduced.

[0164] In some optional implementations, the scheduling module 902 allocates at least one service domain name to at least part of the node combination, including:

[0165] When a scheduling update instruction is obtained, reallocate at least one service domain name for at least part of the node combination;

[0166] And / or, periodically reallocating at least one service domain name for at least part of the node combinations.

[0167] In some optional implementations, the scheduling module 902 allocates at least one service domain name to at least part of the node combination, including:

[0168] In a case where the number of the service domain names is less than or equal to the number of the node combinations, unique service domain names are allocated to at least part of the node combinations.

[0169] In some optional implementations, the determination module 903 is further used to: determine a domain name set corresponding to the network node according to the scheduling group to which the network node belongs and the corresponding service domain name; the domain name set includes at least one service domain name;

[0170] The identification module 904 filters out the attacked business domain name from the business domain name corresponding to the target scheduling group, including:

[0171] In the case that there are multiple target network nodes, an intersection of domain name sets of the multiple target network nodes is determined; and the attacked business domain name is screened out from the business domain names of the intersection.

[0172] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0173] The device for identifying content distribution network attack targets in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, including a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0174] The present disclosure also provides a computer device having the above Fig. 9 An apparatus for identifying a target of a content distribution network attack is shown.

[0175] See also Fig.10 , Fig.10 is a schematic diagram of a computer device provided by an optional embodiment of the present disclosure, such as Fig.10 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Fig.10 A processor 10 is taken as an example.

[0176] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0177] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0178] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0179] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0180] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0181] The embodiments of the present disclosure also provide a computer-readable storage medium. The above-mentioned method according to the embodiments of the present disclosure can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium and downloaded through a network, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0182] A part of the present disclosure may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present disclosure through the operation of the computer. Those skilled in the art should understand that the existence of computer program instructions in computer-readable media includes, but is not limited to, source files, executable files, installation package files, etc., and accordingly, the way in which computer program instructions are executed by a computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to the computer.

[0183] Although the embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for identifying attack targets in a content distribution network, It is characterized in that The method comprises: In a combined manner, a plurality of network nodes are combined into a plurality of node combinations; the node combination includes at least one of the network nodes; Allocating at least one service domain name to at least part of the node combination to generate a scheduling group for performing service scheduling; Acquire multiple attack flows, and determine at least one target network node attacked by the multiple attack flows; The attacked business domain name is screened out from the business domain names corresponding to the target scheduling group; the target scheduling group is the scheduling group to which the at least one target network node belongs.

2. The method according to claim 1, It is characterized in that The allocating at least one service domain name to at least part of the node combination comprises: Determine the current weight of the business domain name; According to the current weight of the business domain name, the business domain name is allocated to the corresponding node combination; wherein, the greater the weight of the business domain name allocated to the node combination, the smaller the number of business domain names allocated to the node combination; After determining at least one target network node attacked by the plurality of attack flows, the method further includes: In the case that the target scheduling group corresponds to multiple service domain names, the weight of the service domain name corresponding to the target scheduling group is increased.

3. The method according to claim 2, It is characterized in that The allocating the business domain name to a corresponding node combination according to the current weight of the business domain name includes: Determine the quota of the business domain name according to the current weight of the business domain name; there is a positive correlation between the quota of the business domain name and the current weight of the business domain name; According to the quota of the business domain name, the business domain name is allocated to the corresponding node combination; the sum of the quotas of the business domain names allocated to the node combination shall not exceed the preset quota of the node combination itself.

4. The method according to claim 3, It is characterized in that The allocating the business domain name to a corresponding node combination according to the quota of the business domain name includes: According to the arrangement order of the multiple business domain names, the allocation operation is performed on each of the business domain names in turn until all the business domain names are traversed; The allocation operation includes: Determine whether the quota of the business domain name is greater than the remaining quota of the current node combination; the current node combination is a node combination whose preset quota is not fully occupied; When the quota of the service domain name is not greater than the remaining quota of the current node combination, allocating the service domain name to the current node combination; In the case where the quota of the business domain name is greater than the remaining quota of the current node combination, continue to determine whether the quota of the business domain name is greater than the remaining quota of the next node combination, until a node combination whose remaining quota is not greater than the quota of the business domain name is determined, and allocate the business domain name to the node combination whose remaining quota is not greater than the quota of the business domain name; In the case that there is no node combination whose remaining quota is not greater than the quota of the business domain name, the quota of the business domain name is split to allocate the business domain name to multiple node combinations.

5. The method according to claim 4, It is characterized in that The allocating the business domain name to a corresponding node combination according to the quota of the business domain name also includes: The plurality of service domain names are processed in random order to determine an arrangement order of the plurality of service domain names.

6. The method according to claim 2, It is characterized in that In the case where the target scheduling group corresponds to multiple business domain names, increasing the weight of the business domain name corresponding to the target scheduling group includes: In the case that the target scheduling group corresponds to multiple business domain names, the business domain name corresponding to the target scheduling group is used as a candidate business domain name, and the weights of the multiple candidate business domain names are temporarily increased; When the attacked business domain name is screened out from the plurality of candidate business domain names, the weights of other candidate business domain names except the attacked business domain name among the plurality of candidate business domain names are reduced.

7. The method according to claim 2, It is characterized in that The allocating at least one service domain name to at least part of the node combination comprises: When a scheduling update instruction is obtained, reallocate at least one service domain name for at least part of the node combination; And / or, periodically reallocating at least one service domain name for at least part of the node combinations.

8. The method according to claim 1, It is characterized in that The allocating at least one service domain name to at least part of the node combination comprises: In a case where the number of the service domain names is less than or equal to the number of the node combinations, unique service domain names are allocated to at least part of the node combinations.

9. The method according to any one of claims 1 to 8, It is characterized in that Also includes: Determine a domain name set corresponding to the network node according to the scheduling group to which the network node belongs and the corresponding service domain name; The domain name set includes at least one business domain name; The step of screening out the attacked business domain name from the business domain names corresponding to the target scheduling group includes: In the case where there are multiple target network nodes, determining an intersection of domain name sets of the multiple target network nodes; The attacked business domain name is filtered out from the business domain names in the intersection.

10. A device for identifying a target of a content distribution network attack, It is characterized in that The device comprises: A combination module, used for combining a plurality of network nodes into a plurality of node combinations in a combined manner; the node combination includes at least one of the network nodes; A scheduling module, used to allocate at least one service domain name to at least part of the node combination, and generate a scheduling group for performing service scheduling; A determination module, used to obtain multiple attack flows and determine at least one target network node attacked by the multiple attack flows; The identification module is used to filter out the attacked business domain name from the business domain names corresponding to the target scheduling group; the target scheduling group is the scheduling group to which the at least one target network node belongs.

11. A computer device, It is characterized in that include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method for identifying a content distribution network attack target according to any one of claims 1 to 9 by executing the computer instructions.

12. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method for identifying a content distribution network attack target according to any one of claims 1 to 9.

Images