Anti-attack method and device for multi-core CPU switch and storage medium
By obtaining CPU utilization and message queue number, combined with speed limit and recovery strategies, the problem of unqualified packet processing in multi-core CPU switches is solved, and effective attack prevention is achieved on multi-core CPU switches to ensure that the switch handles services normally.
Patent Information
- Application Number
- CN202411346592.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-26
- Publication Date
- 2024-12-13
AI Technical Summary
In a multi-core CPU switch environment, it is difficult to effectively process protocol messages based on the average CPU utilization rate alone, resulting in some packet discarding and protocol oscillation, and the existing technology cannot effectively initiate the anti-attack strategy.
By obtaining the CPU utilization rate and the number of message queues for processing protocol message tasks, and combining the preset threshold to determine whether to perform speed limit processing, it is divided into port-level speed limit and global speed limit, and speed limit is restored when the CPU utilization rate decreases, ensuring that The switch handles services normally.
Effectively limit and constrain the packet processing of multi-core CPU switches, avoid packet discarding and protocol oscillation, and improve the switch's processing capability for normal services.
Smart Images
Figure CN119135423A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to an anti-attack method, device and storage medium for a multi-core CPU switch, and belongs to the technical field of anti-attack for CPU switches. Background Art
[0002] The switch sends protocol packets to the CPU through the switching chip. However, there may be a large number of malicious attack packets in the network, which causes the CPU to be busy and interrupts normal business processing.
[0003] In the case of a switch using a single-core CPU, when the CPU utilization is high, the CPU attack defense policy can be used to limit and constrain the packets sent to the CPU, so that the number of packets sent to the CPU per unit time is limited within a certain range, thereby ensuring that the CPU can process normal services.
[0004] The switches currently in use are multi-core CPU switches. Average utilization is often used to calculate CPU utilization. When the average CPU utilization is not high, several threads that process protocol messages may not be able to handle all the messages, resulting in some messages being discarded, which in turn causes protocol oscillation. Therefore, the anti-attack strategy cannot be started simply by judging the CPU utilization. Summary of the invention
[0005] The purpose of the present invention is to overcome the deficiencies in the prior art and provide an anti-attack method, device and storage medium for a multi-core CPU switch to limit and constrain the messages of the multi-core CPU switch and ensure the normal business processing of the switch.
[0006] To achieve the above object, the present invention is implemented by adopting the following technical solutions: In a first aspect, the present invention provides an anti-attack method for a multi-core CPU switch, comprising: Get CPU utilization and the number of message queues for processing protocol message tasks; The system determines whether to limit the rate based on the preset high CPU utilization threshold and the message queue status. If the CPU utilization exceeds the preset high CPU utilization threshold or the message queue for processing protocol message tasks is congested, the protocol message is limited in rate. The speed limit processing includes: first performing port level speed limit, and then performing global speed limit.
[0007] Furthermore, the CPU utilization is obtained by starting a CPU utilization monitoring thread through a multi-core CPU switch.
[0008] Furthermore, for a Linux system, the CPU utilization is calculated through CPU time allocation information in the file / proc / stat.
[0009] Furthermore, the high threshold of CPU utilization is 90%.
[0010] Furthermore, the method of first performing port-level speed limiting and then performing global speed limiting includes: First, perform port-level rate limiting, that is, rate limiting protocol packets on the port that are greater than 100 pps; If the port-level rate limit fails to reduce the CPU utilization to 60% or the message queue for processing protocol message tasks is still congested, global rate limit is performed. That is, the rate limit value of protocol messages is changed to the preset rate limit ratio of the default rate limit, and the rate is continuously limited according to the preset rate limit ratio until the CPU utilization drops to 60% or the message queue for processing protocol message tasks is not congested.
[0011] Furthermore, the speed limit ratio is 0.9.
[0012] Furthermore, it also includes restoring the speed limit, including: Determine whether to restore the speed limit based on the preset low CPU utilization threshold and the message queue status of the protocol message processing task; If the CPU utilization is lower than the preset CPU utilization low threshold and the message queue for processing protocol message tasks is not congested, the rate limit value of the protocol message being processed by the speed limit is changed to the preset recovery rate limit ratio of the default rate limit, and the rate limit is continuously restored according to the preset recovery rate limit ratio until the CPU utilization rises to 60%.
[0013] Furthermore, the low CPU utilization threshold is 50%, and the recovery speed limit ratio is 1.1.
[0014] In a second aspect, the present invention further provides an anti-attack device for a multi-core CPU switch, comprising: A memory for storing instructions; The processor is used to execute the instruction so that the device performs operations to implement the anti-attack method for the multi-core CPU switch as described in any one of the above items.
[0015] In a third aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is processed and executed, the anti-attack method for a multi-core CPU switch as described in any one of the above items is implemented.
[0016] Compared with the prior art, the present invention has the following beneficial effects: The present invention adds the message queue status of the protocol message processing task as a judgment basis, which effectively solves the problem that the thread processing the protocol message cannot handle it only by the average CPU utilization rate, and divides the anti-attack strategy into two levels, the first is the port level speed limit, and the second is the global speed limit, so as to limit and constrain the messages of the multi-core CPU switch and ensure the normal business processing of the switch. BRIEF DESCRIPTION OF THE DRAWINGS
[0017] Figure 1 This is a schematic diagram of the attack defense process of a single-core CPU switch; Figure 2 A schematic diagram of creating a thread-based message queue for a multi-core CPU switch in an embodiment of the present invention; Figure 3 The figure is a schematic diagram of the anti-attack process of a multi-core CPU switch in an embodiment of the present invention. DETAILED DESCRIPTION
[0018] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the protection scope of the present invention. Example 1
[0019] like Figure 1 As shown, Figure 1 The following is a flowchart of attack defense for a single-core CPU switch, including the following steps: S110: When there may be a large number of malicious attack messages in the network, causing the CPU service to be busy, causing the normal service to be interrupted.
[0020] S120, the single-core CPU switch starts the anti-attack policy to limit the messages sent to the CPU.
[0021] S130: After limiting the number of messages sent to the CPU, the CPU occupancy rate is reduced, and the CPU is free to process normal services.
[0022] like Figure 2 As shown, Figure 2 A schematic diagram of creating a thread-based message queue for a multi-core CPU switch. When the average CPU utilization is not high, several threads that process protocol messages cannot handle all the messages, resulting in the discard of some messages, which causes protocol oscillation. The speed cannot be limited simply by the CPU utilization judgment method. Therefore, this embodiment adds a message queue congestion judgment for the task of processing protocol messages, such as Figure 3 As shown, the anti-attack method for a multi-core CPU switch provided in this embodiment includes the following steps: S300. In the case of a multi-core CPU switch, CPU utilization usually refers to average utilization. When CPU utilization is not high, several threads processing protocol messages may not be able to handle all messages, resulting in some messages being discarded. Therefore, in addition to obtaining CPU utilization, the number of message queues for processing protocol message tasks should also be obtained.
[0023] In some embodiments, the CPU utilization can be obtained by starting a CPU utilization monitoring thread through a multi-core CPU switch. For a Linux system, the CPU utilization is calculated through the CPU time allocation information in the file / proc / stat.
[0024] S310: Determine whether speed limiting is required based on the preset high CPU utilization threshold and the message queue status. Specifically: When the average CPU utilization exceeds the high threshold, it indicates that the CPU utilization of all cores is high. At this time, there are a large number of attack messages, and rate limiting is required. In this embodiment, the high threshold of CPU utilization is 90%.
[0025] When the average CPU utilization is not high, one or several cores may not be able to handle all the packets, which may cause some packets to be discarded. In this case, the message queue of the packet sending and receiving task is congested to determine whether it is congested. If so, the message rate is limited.
[0026] S320: When the CPU utilization rate is higher than 90% or the number of message queues for processing protocol message tasks is congested, rate limiting processing is started. The rate limiting processing first starts the port-level rate limiting, that is, rate limiting processing is performed on protocol messages on the port that are greater than 100 pps.
[0027] S330. After completing the port-level speed limit, the CPU utilization and the number of message queues for processing protocol message tasks are judged again according to the preset CPU utilization threshold and message queue status. If the CPU utilization drops to 60% and the number of message queues for processing protocol message tasks is not congested, the operation is terminated, otherwise proceed to the next step.
[0028] S340-S360, perform global speed limit, that is, according to the priority and message type statistics of the sent messages, change the speed limit value of a large number of a class or accumulated messages to the preset speed limit ratio value of the default speed limit, and continue to limit the speed according to the preset speed limit ratio until the CPU utilization rate drops to 60% or the message queue for processing the protocol message task is not congested. In this embodiment, the speed limit ratio is 0.9.
[0029] S370. According to the preset low threshold of CPU utilization and the message queue status, determine whether it is necessary to restore the speed limit processing. In this embodiment, the threshold is 50%. If the CPU utilization is lower than 50% and the message queue is not congested, proceed to the next step.
[0030] S380, restore the speed limit process, change the speed limit value of the protocol message to the preset recovery speed limit ratio value of the default speed limit, and continue to restore the speed limit according to the preset recovery speed limit ratio until the CPU utilization rate rises to 60%. In this embodiment, the recovery speed limit ratio is 1.1, and the operation ends here. Example 2
[0031] Based on Example 1, this embodiment provides an anti-attack device for a multi-core CPU switch, including: Memory, used to store instructions.
[0032] The processor is used to execute the instruction so that the device performs operations to implement the anti-attack method for the multi-core CPU switch as described in Example 1. Example 3
[0033] Based on Example 1, this embodiment provides a computer-readable storage medium on which a computer program is stored. When the computer program is processed and executed, the anti-attack method for the multi-core CPU switch as described in Example 1 is implemented.
[0034] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.
Claims
1. A method for preventing attacks on a multi-core CPU switch. It is characterized in that include: Get CPU utilization and the number of message queues for processing protocol message tasks; The system determines whether to limit the rate based on the preset high CPU utilization threshold and the message queue status. If the CPU utilization exceeds the preset high CPU utilization threshold or the message queue for processing protocol message tasks is congested, the protocol message is limited in rate. The speed limit processing includes: first performing port level speed limit, and then performing global speed limit.
2. The anti-attack method for a multi-core CPU switch according to claim 1, It is characterized in that The CPU utilization is obtained by starting a CPU utilization monitoring thread through a multi-core CPU switch.
3. The anti-attack method for a multi-core CPU switch according to claim 1, It is characterized in that For a Linux system, the CPU utilization is calculated by using the CPU time allocation information in the file / proc / stat.
4. The anti-attack method for a multi-core CPU switch according to claim 1, It is characterized in that The high CPU utilization threshold is 90%.
5. The anti-attack method for a multi-core CPU switch according to claim 1, It is characterized in that The port-level speed limit is first performed, and then the global speed limit is performed, including: First, perform port-level rate limiting, that is, rate limiting protocol packets on the port that are greater than 100 pps; If the port-level speed limit fails to reduce the CPU utilization to 60% or the message queue for processing protocol messages is still congested, global speed limit is implemented. That is, the sent messages are counted according to priority and message type, and the speed limit value of one or more types of messages with a large number is changed to the preset speed limit ratio value of the default speed limit. The speed limit is continuously implemented according to the preset speed limit ratio until the CPU utilization drops to 60% or the message queue for processing protocol messages is not congested.
6. The anti-attack method for a multi-core CPU switch according to claim 5, It is characterized in that The speed limit ratio is 0.
9.
7. The anti-attack method for a multi-core CPU switch according to claim 1, It is characterized in that It also includes the recovery of speed limit processing, including: Determine whether to restore the speed limit based on the preset low CPU utilization threshold and the message queue status of the protocol message processing task; If the CPU utilization is lower than the preset CPU utilization low threshold and the message queue for processing protocol message tasks is not congested, the rate limit value of the protocol message being processed by the speed limit is changed to the preset recovery rate limit ratio of the default rate limit, and the rate limit is continuously restored according to the preset recovery rate limit ratio until the CPU utilization rises to 60%.
8. The anti-attack method for a multi-core CPU switch according to claim 7, It is characterized in that The low CPU utilization threshold is 50%, and the recovery speed limit ratio is 1.
1. 9.An anti-attack device for multi-core CPU switches, It is characterized in that include: A memory for storing instructions; The processor is used to execute the instruction so that the device performs the operation of implementing the anti-attack method of the multi-core CPU switch according to any one of claims 1 to 8.
10. A computer-readable storage medium having a computer program stored thereon, It is characterized in that When the computer program is processed and executed, the anti-attack method for a multi-core CPU switch as described in any one of claims 1 to 8 is implemented.