Network traffic adjustment method and apparatus, electronic device, and storage medium

Abstract

The application relates to the technical field of network security, in particular to a network traffic adjustment method and device, electronic equipment and a storage medium; in the application, communication link information between each two autonomous domains existing in a communication link in a network system is detected; when community division conditions are met, the autonomous domains in the network system are subjected to community division processing based on the communication link information, and at least one community network is obtained; wherein each community network comprises at least one autonomous domain; when an abnormal autonomous domain exists in the network system, a target community network associated with the abnormal autonomous domain is subjected to network traffic adjustment; wherein the abnormal autonomous domain is an autonomous domain subjected to abnormal traffic attack in the network system. The application can adaptively and dynamically perform network traffic adjustment on the autonomous domain subjected to attack in the network system, effectively adjust the network traffic, improve the security of defense control, and reduce the influence of abnormal traffic attack.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of network security, and particularly relate to a network traffic adjustment method and device, electronic equipment and storage medium. BACKGROUND

[0002] With the rapid development of Internet of Things (IoT), the number of various IoT devices is also growing rapidly, and the demand for IoT in various industries is not decreasing but increasing. Due to the lack of computing and memory resources of IoT devices, IoT device manufacturers often pay more attention to the basic functions of IoT devices when manufacturing IoT devices, and it is difficult to guarantee the security properties of IoT devices. This makes it easy for attackers to take advantage of the weak security properties of IoT devices, and attackers can use vulnerabilities, penetration, and control to form a large number of Botnets to launch abnormal traffic attacks. Therefore, in order to ensure network security, security protection measures against abnormal traffic attacks are imminent.

[0003] In related technologies, the defense and control measures for abnormal traffic attacks between different autonomous systems (AS) often focus on sharing and intercepting abnormal addresses, which are network addresses used to launch attacks, and using Border Gateway Protocol (BGP) routing traction to schedule network traffic of abnormal addresses. Obviously, in related technologies, network traffic cannot be adaptively and dynamically adjusted effectively.

[0004] In summary, how to achieve adaptive and dynamic network traffic adjustment to improve the security of defense and control and reduce the impact of abnormal traffic attacks is a technical problem to be solved at present. SUMMARY

[0005] Embodiments of the present application provide a network traffic adjustment method and device, electronic equipment and storage medium to achieve adaptive and dynamic network traffic adjustment to improve the security of defense and control and reduce the impact of abnormal traffic attacks.

[0006] In a first aspect, the embodiments of the present application provide a network traffic adjustment method, which comprises:

[0007] detecting communication link information between each two autonomous systems existing communication links in a network system;

[0008] when the community division condition is met, performing community division processing on the autonomous systems in the network system based on the communication link information to obtain at least one community network; wherein each community network includes at least one autonomous system;

[0009] When an abnormal autonomous domain exists in the network system, adjusting network traffic of a target community network associated with the abnormal autonomous domain; wherein the abnormal autonomous domain is an autonomous domain attacked by abnormal traffic in the network system.

[0010] Optionally, the community division condition comprises:

[0011] Arriving at a specified community division time; or

[0012] Detecting that abnormal traffic attack exists in the network system.

[0013] Optionally, the communication link information comprises at least one of a target bandwidth occupancy rate and a link connection establishment frequency; wherein:

[0014] The target bandwidth occupancy rate is obtained by: detecting network data volume generated by each communication transmission between two autonomous domains having a communication link in a detection analysis period, and determining a sub-bandwidth occupancy rate associated with each communication transmission between the two autonomous domains according to the network data volume generated by each communication transmission and a maximum bandwidth of the communication link, performing weighted summation on all sub-bandwidth occupancy rates, and taking an average bandwidth occupancy rate obtained by the weighted summation as the target bandwidth occupancy rate;

[0015] The link connection establishment frequency is obtained by: detecting connection data volume of link connections established when a communication session is performed between two autonomous domains having a communication link in a detection analysis period, and determining the link connection establishment frequency according to the connection data volume and a set time length.

[0016] Optionally, if the communication link information comprises the target bandwidth occupancy rate and the link connection establishment frequency, performing community division processing on the autonomous domains in the network system based on the communication link information, comprising:

[0017] For each autonomous domain in the network system, respectively performing: determining a comprehensive load of at least one communication link associated with the autonomous domain according to a target bandwidth occupancy rate and a link connection establishment frequency corresponding to the at least one communication link, and determining a degree of the autonomous domain according to the comprehensive load of the at least one communication link; the degree represents a sum of comprehensive loads of all communication links associated with the corresponding autonomous domain.

[0018] Determining a total load of the network system according to the comprehensive load of each communication link in the network system;

[0019] Performing community division processing on the autonomous domains in the network system according to the comprehensive load of each communication link, the degree of each autonomous domain, and the total load, in combination with a set division method.

[0020] Optionally, the community division processing of the autonomous domains in the network system is performed according to the comprehensive load of each communication link, the degree of each autonomous domain, and the total load, in combination with a set division method, including:

[0021] For the plurality of community networks that have been divided by the network system, a modularity is obtained by performing a set operation based on the comprehensive load of the communication link between each two autonomous domains, the degree of each autonomous domain, the total load, and an indicator function of each two autonomous domains; when the two autonomous domains are in the same community network, the indicator function of the two autonomous domains is a first value, and when the two autonomous domains are not in the same community network, the indicator function of the two autonomous domains is a second value, and the modularity represents the difference between the intensive degree of connection within the community network and the random connection.

[0022] The following autonomous domain moving operation is repeatedly iteratively performed until no autonomous domain moving increases the modularity:

[0023] Each autonomous domain is traversed, and the autonomous domain is tried to be moved to the community network in which all adjacent autonomous domains are located, and for each moving manner, the modularity is re-determined to obtain an updated modularity.

[0024] For each autonomous domain, a moving manner that increases the updated modularity the most is selected from a plurality of moving manners, and if the updated modularity corresponding to the plurality of moving manners is not increased, the autonomous domain is abandoned.

[0025] Optionally, the network traffic adjustment of the target community network associated with the abnormal autonomous domain includes:

[0026] According to a preset network adjustment strategy, the target community network is subjected to traffic isolation, and the network traffic of the target community network is scheduled to other community networks.

[0027] Optionally, after the network traffic adjustment of the target community network associated with the abnormal autonomous domain, the method further includes:

[0028] According to a preset network recovery strategy, the communication link of at least one autonomous domain in the target community network and the communication link of the corresponding autonomous domain of other community networks are recovered; and

[0029] Attack information of the abnormal traffic attack suffered by the abnormal autonomous domain is recorded; wherein the attack information includes at least one of the following: autonomous domain information of the abnormal autonomous domain, abnormal traffic information, attack type, attack duration, and attack intensity.

[0030] In a second aspect, an embodiment of the present application further provides a network traffic adjustment device, the device comprising:

[0031] A detection unit is configured to detect communication link information between each two autonomous domains having a communication link in a network system.

[0032] a division unit configured to perform community division processing on the autonomous domains in the network system based on the communication link information when a community division condition is met, to obtain at least one community network; each community network includes at least one autonomous domain;

[0033] an adjustment unit configured to perform network traffic adjustment on a target community network associated with an abnormal autonomous domain when the abnormal autonomous domain exists in the network system; the abnormal autonomous domain is an autonomous domain subjected to abnormal traffic attack in the network system.

[0034] Optionally, the community division condition includes:

[0035] reaching a specified community division time; or

[0036] detecting that there is an abnormal traffic attack in the network system.

[0037] Optionally, the communication link information includes at least one of a target bandwidth occupancy rate and a link connection establishment frequency; wherein:

[0038] The target bandwidth occupancy rate is obtained by: detecting the network data volume generated by each communication transmission between two autonomous domains with a communication link within an analysis period, and determining the sub-bandwidth occupancy rate associated with each communication transmission between the two autonomous domains according to the network data volume generated by each communication transmission and the maximum bandwidth of the communication link, weighting and summing all sub-bandwidth occupancy rates, and taking the average bandwidth occupancy rate obtained by weighting and summing as the target bandwidth occupancy rate.

[0039] The link connection establishment frequency is obtained by: detecting the connection data volume of link connections established when a communication session is performed between two autonomous domains with a communication link within an analysis period, and determining the link connection establishment frequency according to the connection data volume and a set time length.

[0040] Optionally, if the communication link information includes the target bandwidth occupancy rate and the link connection establishment frequency, the division unit is specifically configured to:

[0041] For each autonomous domain in the network system, respectively perform: determining the comprehensive load of at least one communication link associated with the autonomous domain according to the target bandwidth occupancy rate and the link connection establishment frequency corresponding to the at least one communication link, and determining the degree of the autonomous domain according to the comprehensive load of the at least one communication link; the degree represents the sum of the comprehensive loads of all communication links associated with the corresponding autonomous domain.

[0042] determining the total load of the network system according to the comprehensive load of each communication link in the network system;

[0043] According to the comprehensive load of each communication link, the degree of each autonomous domain, and the total load, and in combination with a setting division method, community division processing is performed on the autonomous domains in the network system.

[0044] Optionally, the division unit is specifically configured to:

[0045] For the plurality of community networks that have been divided by the network system, a setting operation is performed based on the comprehensive load of the communication link between each two autonomous domains, the degree of each autonomous domain, the total load, and an indicator function of each two autonomous domains, to obtain a modularity; when the two autonomous domains are in the same community network, the indicator function of the two autonomous domains is a first value, and when the two autonomous domains are not in the same community network, the indicator function of the two autonomous domains is a second value, and the modularity represents the difference between the intensive degree of connection within the community network and the random connection.

[0046] The following autonomous domain moving operation is repeatedly iteratively performed until no autonomous domain moving increases the modularity:

[0047] Each autonomous domain is traversed, and the autonomous domain is tried to be moved to the community network in which all adjacent autonomous domains are located, for each moving manner, the modularity is re-determined, and an updated modularity is obtained.

[0048] For each autonomous domain, a moving manner that increases the updated modularity the most is selected from a plurality of moving manners, and if the updated modularity corresponding to the plurality of moving manners is not increased, the autonomous domain is abandoned.

[0049] Optionally, the adjustment unit is specifically configured to:

[0050] According to a preset network adjustment strategy, the target community network is subjected to traffic isolation, and the network traffic of the target community network is scheduled to other community networks.

[0051] Optionally, the apparatus further includes:

[0052] A recovery unit is configured to perform recovery on the communication link of at least one autonomous domain in the target community network and the communication link of the corresponding autonomous domain in the other community network according to a preset network recovery strategy; and

[0053] A recording unit is configured to record attack information of the abnormal traffic attack on the abnormal autonomous domain; the attack information includes at least one of the following: autonomous domain information of the abnormal autonomous domain, abnormal traffic information, attack type, attack duration, and attack intensity.

[0054] In a third aspect, an electronic device is provided, including a memory and a processor, wherein the memory is configured to store a computer program, and the processor is configured to execute the computer program to implement the steps of the network traffic adjustment method provided in the embodiments of the present application.

[0055] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement steps of the network traffic adjustment method provided by the embodiment of the present application.

[0056] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program stored in a computer readable storage medium. When a processor of an electronic device reads the computer program from the computer readable storage medium, the processor executes the computer program, so that the electronic device performs steps of the network traffic adjustment method provided by the embodiment of the present application.

[0057] The above-mentioned scheme of the present application has at least the following beneficial effects:

[0058] The network traffic adjustment method, device, electronic device and storage medium provided by the embodiment of the present application are related to the network security technical field. In the embodiment of the present application, first, the communication link information between each two autonomous domains existing communication link in the network system is detected. Then, when the community division condition is met, the autonomous domains in the network system are processed by community division based on the communication link information, and at least one community network is obtained. Each community network includes at least one autonomous domain. In the community division processing, the communication link between the autonomous domains in the network system and the autonomous domains is abstracted into an undirected graph. Based on the communication link information between each two autonomous domains existing communication link, the multiple autonomous domains are dynamically and reasonably divided, and the accuracy of the division processing is ensured. Finally, when the abnormal autonomous domain existing in the network system due to abnormal traffic attack is determined, the target community network associated with the abnormal autonomous domain is adjusted in network traffic. In this way, when the autonomous domain is attacked, the network traffic of the target community network associated with the autonomous domain can be effectively adjusted.

[0059] Therefore, in the embodiment of the present application, when a certain autonomous domain of the network system is attacked by abnormal traffic, adaptive dynamic network traffic adjustment is realized based on the community division processing result, the security of defense control is improved, and the influence of abnormal traffic attack is reduced.

[0060] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent to those skilled in the art from the description, or can be learned by practice of the present application. The objects and other advantages of the present application will be realized and achieved by means of the instrumentalities particularly pointed out in the written description and claims hereof as well as the appended drawings. BRIEF DESCRIPTION OF DRAWINGS

[0061] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description only some of the embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0062] Figure 1 A scene schematic diagram of the DDoS attack for multiple autonomous domains provided by the embodiment of the present application;

[0063] Figure 2 An implementation flowchart of the network traffic adjustment method provided by the embodiment of the present application;

[0064] Figure 3 A schematic diagram of the bandwidth occupancy rate between nodes provided by the embodiment of the present application;

[0065] Figure 4 A whole logic schematic diagram of the method for scheduling attack traffic provided by the embodiment of the present application;

[0066] Figure 5 A component structure schematic diagram of the network traffic adjustment device provided by the embodiment of the present application;

[0067] Figure 6 A component structure schematic diagram of the electronic device provided by the embodiment of the present application. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical solutions and advantages of the present application more clear, the following will combine the drawings to further describe the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0069] The following explains some terms in the embodiments of the present application, so as to facilitate the understanding of those skilled in the art.

[0070] Internet of Things (IoT): that is, the Internet of everything connected, is the extension and expansion of the Internet network, realizes the interconnection of people, machines and things at any time and any place.

[0071] Botnet: a common attack method in DDoS, refers to one or more means of spreading, a large number of hosts infected with bot program virus, and thus a one-to-many control network formed between the controller and the infected host. Attackers spread bot programs through various channels to infect a large number of hosts on the Internet, and the infected hosts will receive instructions from the attacker through a control channel to form a botnet.

[0072] Distributed denial of service (DDoS) attack: refers to multiple attackers at different locations simultaneously attacking one or several targets, or an attacker controlling multiple machines at different locations and using these machines to attack the victim simultaneously.

[0073] Autonomous system (AS): in the Internet, a combination of all Internet Protocol (IP) networks and routers under the jurisdiction of one or more entities, which perform common routing policies on the Internet; wherein the entity can be an Internet service provider, an educational institution, an enterprise, a government agency, etc.

[0074] Border Gateway Protocol (BGP): a routing protocol for autonomous systems running on Transmission Control Protocol (TCP). It is the only protocol used to handle networks as large as the Internet, and the only protocol that can properly handle multiple connections between unrelated routing domains. The main function of the BGP system is to exchange network reachability information with other BGP systems. Network reachability information includes listed autonomous domain information. Autonomous domain information effectively constructs the topology of AS interconnection and eliminates routing loops, and policy decisions can be made at the AS level.

[0075] Community network detection: a research field in graph theory, aiming to divide a network graph into multiple community networks; in the embodiments of the present application, community network detection is used to divide multiple autonomous systems in a network system into multiple community networks, so that the autonomous systems within the same community network have more connections than the autonomous systems across community networks.

[0076] Louvain algorithm: an efficient community network detection method commonly used to identify community network structures in large-scale networks. It is based on the optimization of modularity and can quickly find high-quality community division in the network.

[0077] The word "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any implementation described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other implementations.

[0078] The terms "first", "second", etc. are used herein only to describe different instances, and cannot be construed to refer to relative importance or imply the number of technical features indicated. Thus, the features defined with "first", "second" can explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, the meaning of "a plurality of" is two or more, unless otherwise specified.

[0079] It should be noted that the terms "include" and "have" and their variants as involved in the documents of the present application are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device containing a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0080] The design idea of the embodiments of the present application is briefly introduced as follows:

[0081] With the rapid development of Internet of Things (IoT), the number of various Internet of Things devices is also growing rapidly, and the demand for Internet of Things in various industries is not decreasing but increasing. Due to the lack of computing processing resources and memory resources of Internet of Things devices, Internet of Things device manufacturers often pay more attention to the basic functions of Internet of Things devices when manufacturing Internet of Things devices, and it is difficult to guarantee the security properties of Internet of Things devices. This makes it easy for attackers to take advantage of it, and attackers can use the weak security properties of Internet of Things devices to exploit, penetrate, and control vulnerabilities to form a large number of Botnet to launch abnormal traffic attacks.

[0082] The above abnormal traffic attack is represented by Distributed Denial of Service (DDoS) attack. In DDoS attack, attackers can easily control a large number of controlled autonomous domains and use automated scripts to attack many targets in various networks including Internet of Things, such as attacking Internet of Things devices in Internet of Things. Therefore, security protection measures against abnormal traffic attacks are imminent.

[0083] In the related art, the defense and control measures for abnormal traffic attacks between different autonomous systems (AS) often focus on the sharing and interception of abnormal addresses, which are network addresses used to initiate attacks, and the scheduling of network traffic of abnormal addresses by using the Border Gateway Protocol (BGP) route traction method. Obviously, there is no adaptive and dynamic traffic scheduling scheme, and obviously, there is no adaptive and dynamic network traffic adjustment scheme in the related art. Therefore, when an autonomous system in a network system is attacked, the network traffic of the autonomous system cannot be adaptively and dynamically adjusted effectively to improve the security of defense and control and reduce the impact of abnormal traffic attacks.

[0084] Therefore, the embodiments of the present application provide a network traffic adjustment method and device, electronic equipment and storage medium, relating to the technical field of network security; in the embodiments of the present application:

[0085] First, the communication link information between each two autonomous systems existing communication link in the network system is detected;

[0086] Then, when the community division condition is met, the communication link information is used to perform community division processing on the autonomous systems in the network system, and at least one community network is obtained, each community network including at least one autonomous system. In the community division processing, the communication links between the autonomous systems in the network system and the autonomous systems are abstracted into an undirected graph. Based on the communication link information between each two autonomous systems existing communication link, the multiple autonomous systems are dynamically and reasonably divided, and the accuracy of the division processing is ensured;

[0087] Finally, when an abnormal autonomous system existing in the network system due to abnormal traffic attacks is determined, the target community network associated with the abnormal autonomous system is adjusted. In this way, when an autonomous system is attacked, the network traffic of the target community network associated with the autonomous system can be effectively adjusted.

[0088] Therefore, in the embodiments of the present application, when an autonomous system in a network system is attacked by abnormal traffic, adaptive and dynamic network traffic adjustment is realized based on the community division processing result, the security of defense and control is improved, and the impact of abnormal traffic attacks is reduced.

[0089] Reference Figure 1A scenario schematic diagram for a DDoS attack on multiple autonomous domains is provided in the embodiments of the present application. In this scenario, when an attacker sends DDoS attack traffic to attack a certain autonomous domain, the defender needs to divide the autonomous domains into communities according to the communication link information between the autonomous domains, and then according to the division result, the network traffic of the attacked autonomous domain is pulled, and the routing is adjusted in time, so as to reduce the influence of abnormal traffic attack.

[0090] To better understand the technical solutions provided by the embodiments of the present application, the application scenarios to which the technical solutions provided by the embodiments of the present application are applied are briefly introduced below. It should be noted that the application scenarios described below are only used to illustrate the embodiments of the present application and are not limiting. In specific implementation, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0091] The preferred embodiments of the present application are described below in conjunction with the accompanying drawings of the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application, and the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0092] Referring to Figure 2 , Figure 2 An implementation flowchart of a network traffic adjustment method provided by the embodiments of the present application is provided. The method can be executed by a controller in a network system. The controller can be a device or a software platform for managing and controlling network devices (such as gateways, routers, etc.). That is, it can be a hardware device or software running on a server. The specific implementation flow of the method includes the following S21-S23:

[0093] S21, detecting the communication link information between each two autonomous domains with a communication link in the network system.

[0094] Optionally, the communication link information can be detected in real time, periodically or at a fixed time.

[0095] Considering that abnormal traffic attack can be achieved by at least one of the following ways: sending a large number of connection establishment requests to exhaust the processing resources of the victim, and congesting the network bandwidth by sending high burst attack traffic. Therefore, the communication link information in the embodiments of the present application includes at least one of the following: target bandwidth occupancy rate, link connection establishment frequency.

[0096] The target bandwidth occupation rate is obtained by detecting the network data volume generated by each communication transmission between the two autonomous domains with the communication link in the analysis period, and determining the sub-bandwidth occupation rate associated with each communication transmission between the two autonomous domains according to the network data volume generated by each communication transmission and the maximum bandwidth of the communication link, weighting and summing all the sub-bandwidth occupation rates, and taking the average bandwidth occupation rate obtained by the weighted sum as the target bandwidth occupation rate; that is, the target bandwidth occupation rate is the average bandwidth occupation rate between the two autonomous domains in the set time length.

[0097] The link connection establishment frequency is obtained by detecting the connection data volume of the link connection established when the communication session is performed between the two autonomous domains with the communication link in the analysis period, and determining the link connection establishment frequency according to the connection data volume and the set time length.

[0098] S22, when the community division condition is met, performing community division processing on the autonomous domains in the network system based on the communication link information to obtain at least one community network; wherein each community network includes at least one autonomous domain.

[0099] Considering that the network system is usually attacked by abnormal traffic, and the network system attacked by abnormal traffic will be in a paralyzed state, which cannot guarantee the security of data transmission between multiple autonomous domains. Therefore, in the embodiments of the present application, the multiple autonomous domains in the network system are detected for community; specifically, the topology structure and communication link information between the multiple autonomous domains in the network system are statistically analyzed to quickly and accurately perform community division processing on the multiple autonomous domains in the network system, and then provide a network traffic adjustment strategy for the network system, reduce the image of abnormal traffic attack, and also balance the network pressure and guarantee the availability of the services provided by the network system.

[0100] In order to reasonably divide the multiple autonomous domains into communities, a community detection algorithm such as Louvain algorithm can be used to divide the multiple autonomous domains into communities, so that each autonomous domain in each community network has a high degree of closeness.

[0101] In order to reduce the workload of community division processing, reduce the processing pressure, and at the same time guarantee the accuracy of community division processing, the embodiments of the present application also provide a community division condition; wherein the community division condition includes but is not limited to:

[0102] Condition 1, reaching a specified community division time; wherein the specified community division time can be a pre-set division time or a division period; for example, a division period is pre-set, and the multiple autonomous domains are periodically iterated to be divided into communities, so that each autonomous domain in each community network has a high degree of closeness; it should be noted that the periodic iteration division usually occurs in the case of normal operation of the network system;

[0103] Condition 2, detecting that there is an abnormal traffic attack in the network system; that is, when it is determined that one or more autonomous domains in the network system are subjected to an abnormal traffic attack, the plurality of autonomous domains perform community division.

[0104] It should be noted that the above conditions 1 and 2 can exist at the same time. Specifically, taking a specified community division time as a division period as an example, in the periodic iteration of the community division processing, in each division period, it can be judged whether the network system is subjected to an abnormal traffic attack. If it is determined that one or more autonomous domains in the network system are subjected to an abnormal traffic attack, the community division processing operation will be immediately performed regardless of whether it is the periodic execution time point, so as to update the plurality of community networks that have been divided according to the communication link information between each two autonomous domains in the current network.

[0105] In the following embodiment, the community network detection algorithm is taken as the Ruwan algorithm as an example to introduce the division process of the plurality of autonomous domains.

[0106] In an optional implementation, the community division processing of the autonomous domains in the network system based on the communication link information in S21 can include the following steps A1-A4:

[0107] A1, for each autonomous domain in the network system, respectively perform: according to the target bandwidth occupation rate and the link connection establishment frequency corresponding to at least one communication link associated with the autonomous domain, respectively determine the comprehensive load of the at least one communication link; the comprehensive load represents the congestion degree of the communication link.

[0108] For example, based on the implementation mode of the following formula (1), the comprehensive load of the communication link A ij corresponding to the target bandwidth occupation rate and the link connection establishment frequency is determined: ij

[0109] A ij =α×F ij +β×B ij (1)

[0110] Wherein, F ij is the connection establishment frequency between autonomous domain i and autonomous domain j in the analysis period, B ij is the average bandwidth occupation rate, and α and β are adjustment coefficients for balancing the influence degree of the two factors, which can be defined by the network sensitivity.

[0111] A2, according to the comprehensive load of at least one communication link associated with the autonomous domain, determine the degree of the autonomous domain; the degree represents the sum of the comprehensive load of all communication links associated with the corresponding autonomous domain.

[0112] ​In this system, an autonomous system (AS) may have communication links with one or more other ASs. The degree of an AS is equal to the sum of the loads of the communication links between the AS and all other ASs. For example, for AS1, assuming that AS1 has communication links with AS2 and AS4, and the sum of the loads between AS1 and AS4 is 50 and 30 respectively, then the degree of AS1 is 50 + 30 = 80. This pattern continues to determine the degree of each AS.

[0113] A3. Determine the total load of the network system based on the combined load of each communication link in the network system.

[0114] One approach is to directly sum the combined loads of all communication links between multiple autonomous systems to obtain the total load of all communication links between multiple autonomous systems, which is also the total load of the network system.

[0115] For example, such as Figure 3 As shown, the multiple autonomous systems include: AS1, AS2, AS3, AS4, AS5, and AS6. The combined load between AS1 and AS2 is 50, the combined load between AS1 and AS4 is 30, the combined load between AS2 and AS3 is 40, the combined load between AS2 and AS5 is 60, the combined load between AS3 and AS6 is 20, the combined load between AS4 and AS5 is 80, and the combined load between AS5 and AS6 is 70. Therefore, the total load of all communication links = 50 + 30 + 40 + 60 + 20 + 80 + 70 = 350.

[0116] A4. Based on the overall load of each communication link, the degree of each autonomous system, and the total load, and in conjunction with the set partitioning method, perform community partitioning processing on the autonomous systems in the network system.

[0117] Specifically, the partitioning method can be implemented based on the Ruwan algorithm. The partitioning method is described below.

[0118] In an optional implementation, step A4 above may include the following steps a1-a2:

[0119] a1. For multiple community networks that have been divided in the network system, the modularity is obtained by setting the comprehensive load of the communication link between every two autonomous systems, the degree of each autonomous system, the total load, and the indicator function of every two autonomous systems. Among them, when the two autonomous systems are in the same community network, the indicator function of the two autonomous systems is the first value, and when the two autonomous systems are not in the same community network, the indicator function of the two autonomous systems is the second value. The modularity represents the difference between the density of connections within the community network and random connections.

[0120] In the first division of the plurality of autonomous domains, each autonomous domain can be assumed to be a separate community network, i.e., the plurality of divided community networks each contain an autonomous domain.

[0121] The setting operation can be set as needed, and the first value and the second value can also be set as needed, for example, the first value is 1 and the second value is 0. Exemplarily, the setting operation is as shown in the following formula (2):

[0122]

[0123] wherein A ij represents the comprehensive load of the communication link between any two autonomous domains i and j, ki and kj represent the degrees of any two autonomous domains i and j, and m represents the total load of all communication links between the plurality of autonomous domains. δ(ci, cj) i , c j ) is an indicator function of two autonomous domains, which is 1 when the autonomous domain i and the autonomous domain j are in the same community network, and 0 otherwise, and Q represents the modularity, which is usually a value between -1 and 1, indicating the difference between the connection density in the community network and the random connection.

[0124] a2, repeatedly perform the following autonomous domain moving operations a21-a22 until no autonomous domain moving increases the modularity:

[0125] a21, traverse each autonomous domain, try to move the autonomous domain to the community network in which all adjacent autonomous domains are located, and for each moving mode, re-determine the modularity to obtain an updated modularity.

[0126] wherein the adjacent autonomous domain of each autonomous domain refers to the autonomous domain connected to the autonomous domain, i.e., there is a communication link between each autonomous domain and the adjacent autonomous domain. For each autonomous domain, when trying to move the autonomous domain to the community network in which an adjacent autonomous domain is located, the indicator function of the autonomous domain and the adjacent autonomous domain changes, and the modularity can be re-determined by using the above formula (2).

[0127] a22, for each autonomous domain, select the moving mode that increases the updated modularity the most from a plurality of moving modes, and if the updated modularity corresponding to the plurality of moving modes is not increased, give up moving the autonomous domain.

[0128] In the embodiments of the present application, based on the Louvain algorithm, in combination with the target bandwidth occupation rate and the link connection establishment frequency of the communication links between the plurality of autonomous domains in the autonomous domain network, the plurality of autonomous domains can be reasonably divided, so that the connection density in each community network after division is high, and further decision assistance is provided for network traffic adjustment.

[0129] S23, when determining that there is an abnormal autonomous domain in the network system, adjusting network traffic of a target community network associated with the abnormal autonomous domain; wherein the abnormal autonomous domain is an autonomous domain attacked by abnormal traffic in the network system.

[0130] Wherein, the network traffic required to be transmitted by at least one autonomous domain in the target community network can be transferred to autonomous domains in other community networks, or the network traffic of the abnormal autonomous domain in the target community network can be transferred to normal autonomous domains in the target community network, while limiting subsequent sending of network traffic to at least one autonomous domain in the target community network, so as to realize network traffic redirection, isolation and flow limiting measures, thereby reducing the impact of traffic attacks and reducing the impact on service availability.

[0131] It should be noted that the abnormal autonomous domain attacked by abnormal traffic can be one autonomous domain or multiple autonomous domains, and when there are multiple autonomous domains, the target community network corresponding to each autonomous domain can be adjusted. In addition, during the network traffic adjustment of at least one autonomous domain in the target community network, it can be detected that other autonomous domains are also attacked by abnormal traffic, and at this time, the above S22-S23 can be repeatedly executed.

[0132] In an optional embodiment, when adjusting the network traffic of at least one autonomous domain in the target community network, the network traffic of the target community network can be isolated according to a preset network adjustment strategy, and the network traffic of the target community network can be scheduled to other community networks; wherein, the network traffic of the target community network is scheduled to other community networks by switching the routing path of the network traffic flowing through each autonomous domain in the target community network to the corresponding autonomous domain in other community networks in the plurality of community networks obtained after community division processing.

[0133] Wherein, the preset routing adjustment strategy can be set according to actual conditions, for example, when the autonomous domain AS1 is attacked by abnormal traffic, the routing paths of AS1 and the autonomous domain AS2 belonging to the same community network as AS1 will be switched, and specifically can be switched to the autonomous domains AS4 and AS5 in another community network.

[0134] In the embodiments of the present application, firstly, communication link information between each two autonomous domains existing communication link in the network system is detected; then when the community division condition is met, the autonomous domains in the network system are processed for community division based on the communication link information, at least one community network is obtained, each community network includes at least one autonomous domain, in the community division processing, the communication link between the autonomous domains in the network system and the autonomous domains is abstracted into an undirected graph, based on the communication link information between each two autonomous domains existing communication link, the multiple autonomous domains are dynamically and reasonably divided, and the accuracy of the division processing is ensured; finally, when an abnormal autonomous domain existing abnormal traffic attack in the network system is determined, the target community network associated with the abnormal autonomous domain is adjusted for network traffic, so that the network traffic of the target community network associated with the autonomous domain under attack can be effectively adjusted. Therefore, in the embodiments of the present application, when a certain autonomous domain in the network system is attacked by abnormal traffic, adaptive dynamic network traffic adjustment is realized based on the community division processing result, the security of defense control is improved, and the influence of abnormal traffic attack is reduced.

[0135] In some embodiments, after the target community network is adjusted for network traffic, the community division processing can be iteratively performed for the multiple community networks after the community division processing every set period, the set period is less than the above division period; if it is determined that the target community network in which the abnormal autonomous domain is located changes according to the multiple community networks after the latest division, at least one autonomous domain in the changed target community network is adjusted for network traffic.

[0136] Among them, considering that when the abnormal autonomous domain is attacked by abnormal traffic, the network traffic in the autonomous domain network will fluctuate greatly, therefore, after at least one autonomous domain in the target community network is adjusted for network traffic, the above community division processing is iteratively performed with a new set period, that is, a division frequency higher than that when the network is normally running is used to continuously divide the multiple autonomous domains. If it is determined that the target community network in which the abnormal autonomous domain is located changes according to the multiple community networks after the latest division, at least one autonomous domain in the changed target community network can be adjusted for network traffic, and the specific limiting process is similar to S23.

[0137] In some embodiments, after at least one autonomous domain in the target community network is adjusted for network traffic, the routing path of at least one autonomous domain in the target community network and the routing path of the corresponding autonomous domain of the other community network are recovered according to a preset routing recovery strategy.

[0138] The preset routing recovery strategy can be preset according to specific conditions, for example, the routing path of at least one autonomous domain in the target community network is recovered to an initial state, which can be the routing path before the abnormal autonomous domain is attacked by abnormal traffic, or the routing path at the initialization time.

[0139] More specifically, when the initial state is the routing path at the initialization time, different time periods can correspond to different initial states, which can be different time periods in a day or different time periods in a set time period, and no limitation is made. After adjusting the network traffic of at least one autonomous domain in the target community network, the routing path of at least one autonomous domain in the target community network is recovered to the initial state corresponding to the current time period. At the same time, the routing path of the affected other community network is also recovered to the initial state.

[0140] Optionally, when the target community network includes multiple autonomous domains, the routing paths of the multiple autonomous domains in the target community network are recovered in sequence according to the recovery priorities of the multiple autonomous domains in the target community network; wherein the recovery priority of each autonomous domain can be determined according to the autonomous domain type or the business type executed by the autonomous domain, for example, a certain autonomous domain is a core autonomous domain, or the business type executed by the autonomous domain is a core business, which can be given a higher recovery priority to preferentially recover the normal operation of the core autonomous domain or the core business.

[0141] Further, the attack information of the abnormal traffic attack suffered by the abnormal autonomous domain can also be recorded; wherein the attack information includes at least one of the following: autonomous domain information of the abnormal autonomous domain, abnormal traffic information, attack type, attack duration, attack intensity.

[0142] Specifically, the abnormal traffic information can be the distribution characteristics of abnormal traffic, etc. Specifically, by recording the attack information of this abnormal traffic attack, the mode characteristics of the abnormal traffic attack can be analyzed, which facilitates the improvement of the preset defense strategy, thereby reducing the influence of the abnormal traffic attack on the autonomous domain network.

[0143] In the embodiments of the present application, during the process of jointly recovering the network and updating the communication link of multiple autonomous domains, the community network structure needs to be constantly adjusted, and the traffic needs to be dispatched, forwarded and intercepted in time. In this way, the effect of dispersing and dredging abnormal traffic attacks by multiple autonomous domains is formed. At the same time, the attack information is recorded in time, the disposal strategy knowledge base is enriched, the potential attack is prepared for the future, and the integrity and robustness of the network traffic adjustment are improved.

[0144] The network traffic adjustment method of the embodiments of the present application will be described below. Figure 4 The overall logic of the network traffic adjustment method of the embodiments of the present application will be described by way of example.

[0145] AsFigure 4 As shown, taking an abnormal traffic attack as a DDoS attack and using the Ruwan algorithm for community partitioning as an example, the network traffic adjustment method in this application embodiment includes the following steps:

[0146] S401: Detects communication link information between autonomous systems in a network system.

[0147] Specifically, the communication links between autonomous systems in the network system are detected, and the target bandwidth utilization and link connection establishment frequency on each communication link in the network system are periodically sampled.

[0148] S402: Determine key values ​​based on communication link information to obtain the adjacency matrix.

[0149] Specifically, based on the target bandwidth utilization and link connection establishment frequency of each link, the comprehensive load between every two autonomous systems is calculated to obtain key values ​​and form an adjacency matrix; that is, the comprehensive load is the key value, and the adjacency matrix is ​​constructed based on all key values.

[0150] Each element in the adjacency matrix A can be represented as A in the above embodiment. ij A ij This represents the combined load of the communication link between any two autonomous systems i and j.

[0151] S403: Determine whether the community division processing cycle has been reached. If yes, proceed to step S404; otherwise, proceed to step S405.

[0152] S404: Execute the Ruwan algorithm to update the community network partitioning within the network system.

[0153] The calculation formula for the Ruwan algorithm is the above formula (2), which is based on the adjacency matrix A, the total load m of all communication links between multiple autonomous systems, the degrees ki and kj of any two autonomous systems i and j, and the indicator function δ(c i c j ), calculate the modularity Q.

[0154] by Figure 3 Based on this, the adjacency matrix A can be obtained from S402, as shown in the following equation (3):

[0155]

[0156] That is, A 12 =A 21 =50, A 23 =A 32 =40, A 14 =A 41 =30, A 25 =A52 = 60, A 36 = A 63 = 20, A 45 = A 54 = 80, A 56 = A 65 = 70.

[0157] Based on this, the degree of each autonomous domain can be obtained, as shown in the following equations (4)-(9):

[0158] k1= A 12 + A 14 = 50 + 30 = 80 (4)

[0159] k2= A 21 + A 23 + A 25 = 50 + 40 + 60 = 150 (5)

[0160] k3= A 32 + A 36 = 40 + 20 = 60 (6)

[0161] k4= A 41 + A 45 = 30 + 80 = 110 (7)

[0162] k5= A 52 + A 54 + A 56 = 60 + 80 + 70 = 210 (8)

[0163] k6= A 63 + A 65 = 20 + 70 = 90 (9)

[0164] The total load m of all communication links between the plurality of autonomous domains can be calculated by the following equation (10):

[0165]

[0166] In addition, the comprehensive load of all communication links between the plurality of autonomous domains can also be directly summed to obtain m.

[0167] If it is the first time to perform community division on the plurality of autonomous domains, δ(c i , c j ) is 0 for any two autonomous domains i and j. If the community division has been performed on the plurality of autonomous domains, the specific value of δ(c i , c j ) can be taken according to the relationship of the community networks in which the two autonomous domains i and j are located, that is, autonomous domain i and autonomous domain j are in the same community network δ(ci c j ) is 1, otherwise 0.

[0168] For each autonomous domain, try to move the autonomous domain to the community network where all the adjacent autonomous domains are located, then for each possible moving method resulting therefrom, recalculate the Q value, select the moving method that can increase the Q value the most, if no moving method can increase the Q value, do not move the autonomous domain. Repeat the above process until no matter how to move, the Q value cannot be increased.

[0169] S405: judge whether a DDoS attack occurs, if not, return to S401, if yes, continue to execute S406.

[0170] Specifically, obtain the DDoS attack detection result from other functional units (such as a detection unit) to judge whether a DDoS attack occurs.

[0171] S406: immediately execute the Louvain algorithm to update the community network division in the network system.

[0172] S407: according to the updated community division result, adjust the routing strategy of the network system in a targeted manner.

[0173] Specifically, determine the target community network under attack, perform traffic isolation on the target community network according to a preset network adjustment strategy, schedule the network traffic of the target community network to other community networks, and schedule the network traffic of the abnormal autonomous domain in the target community network to the normal autonomous domain in the target community network.

[0174] Suppose the community division result is community network A: AS1, AS2, community network B: AS3, AS6, and community network C: AS4, AS5, and the detection part informs the defense party that AS4 is currently under DDoS attack. Since AS4 and AS5 are in the same community network and are very closely connected, the defense measures of this community network should be strengthened, especially the protection of the attacked autonomous domain AS4. It is necessary to limit the network traffic from other community networks to this community network, especially the large-flow connection, that is, to perform traffic isolation on the community network C; schedule the network traffic of the community network C to other community networks, and at the same time within the community network C, ensure that AS5 can take over part of the service or traffic when AS4 is attacked to reduce the pressure on AS4.

[0175] In some embodiments, after determining that a DDoS attack occurs, the Louvain algorithm is not immediately executed, but the routing strategy of the network system is adjusted in a targeted manner based on the current community division result.

[0176] S408: The multiple autonomous domains in the joint network system restore the updated communication link, and record attack information of the DDoS attack.

[0177] According to the preset recovery strategy, the routing path of each autonomous domain in the target community network and the routing path of the corresponding autonomous domain in the other community network can be recovered. The preset routing recovery strategy can be set according to specific conditions, for example, the routing path of each autonomous domain in the target community network is restored to the initial state, and the routing path of the other community network is also restored to the initial state. By recording the attack information of the current DDoS attack, the subsequent attack defense strategy update can be prepared.

[0178] The network traffic adjustment method provided by the embodiments of the present application can cope with abnormal traffic attacks (such as DDoS attacks) in the existing Internet, so that the defense party can dynamically, adaptively, and more finely schedule abnormal traffic and normal traffic. Specifically, the embodiments of the present application periodically update the community division result by using the Louvain algorithm according to the detected communication link information, automatically perform traffic redirection, isolation, and flow limiting measures on the target community network attacked by abnormal traffic according to the updated community division result, and timely feedback and recovery according to the communication link information after the attack, so as to realize the defense and mitigation of abnormal traffic attacks, reduce the harm and influence of abnormal traffic attacks, and also gain time for subsequent defense, guarantee the service availability of users; and after the autonomous domain network responds to the abnormal traffic attack in time, the preset routing recovery strategy is used for fast recovery, and the attack information is recorded in time, so as to prepare for the subsequent attack defense strategy update, and improve the integrity and robustness of the present application.

[0179] Based on the same inventive concept, the embodiments of the present application also provide a network traffic adjustment device. The principle of solving the problem of the device is similar to the method of the above-mentioned embodiments, so the implementation of the device can be referred to the implementation of the above-mentioned method, and the repeated parts will not be described here.

[0180] Referring to Figure 5 , Figure 5 FIG. 5 is a structural schematic diagram of a network traffic adjustment device 500. The network traffic adjustment device 500 can include:

[0181] A detection unit 501 is configured to detect communication link information between each two autonomous domains having a communication link in a network system.

[0182] A division unit 502 is configured to perform community division processing on autonomous domains in the network system based on the communication link information when a community division condition is met, to obtain at least one community network; each community network includes at least one autonomous domain.

[0183] The adjusting unit 503 is configured to determine the target community network associated with the abnormal autonomous domain and adjust the network flow of the target community network when the abnormal autonomous domain exists in the network system; wherein, the abnormal autonomous domain is an autonomous domain attacked by abnormal flow in the network system.

[0184] Optionally, the community division condition comprises:

[0185] reaching a specified community division time; or

[0186] detecting that there is an abnormal flow attack in the network system.

[0187] Optionally, the communication link information comprises at least one of a target bandwidth occupancy rate and a link connection establishment frequency; wherein:

[0188] The target bandwidth occupancy rate is obtained by detecting the network data volume generated by each communication transmission between the two autonomous domains with the communication link in the detection analysis period, and determining the sub-bandwidth occupancy rate associated with each communication transmission between the two autonomous domains according to the network data volume generated by each communication transmission and the maximum bandwidth of the communication link, performing weighted summation on all sub-bandwidth occupancy rates, and taking the average bandwidth occupancy rate obtained by the weighted summation as the target bandwidth occupancy rate.

[0189] The link connection establishment frequency is obtained by detecting the connection data volume of the link connection established when the communication session is performed between the two autonomous domains with the communication link in the detection analysis period, and determining the link connection establishment frequency according to the connection data volume and the set time length.

[0190] Optionally, if the communication link information comprises the target bandwidth occupancy rate and the link connection establishment frequency, the dividing unit 502 is specifically configured to:

[0191] for each autonomous domain in the network system, respectively performing: determining the comprehensive load of at least one communication link associated with the autonomous domain according to the target bandwidth occupancy rate and the link connection establishment frequency corresponding to the at least one communication link, and determining the degree of the autonomous domain according to the comprehensive load of the at least one communication link; the degree represents the sum of the comprehensive loads of all communication links associated with the corresponding autonomous domain;

[0192] determining the total load of the network system according to the comprehensive load of each communication link in the network system;

[0193] performing community division processing on the autonomous domains in the network system according to the comprehensive load of each communication link, the degree of each autonomous domain, and the total load, in combination with a set division method.

[0194] Optionally, the dividing unit 502 is specifically configured to:

[0195] The modularity is obtained by performing a setting operation based on a comprehensive load of a communication link between each two autonomous domains, a degree of each autonomous domain, a total load, and an indicator function of each two autonomous domains; wherein the indicator function of each two autonomous domains is a first value when the two autonomous domains are in the same community network, and the indicator function of each two autonomous domains is a second value when the two autonomous domains are not in the same community network, and the modularity represents a difference between a dense degree of connection within the community network and a random connection;

[0196] The following autonomous domain moving operation is repeatedly iteratively performed until no autonomous domain moving increases the modularity:

[0197] Each autonomous domain is traversed to attempt to move the autonomous domain to a community network in which all adjacent autonomous domains are located, and for each moving manner, the modularity is re-determined to obtain an updated modularity.

[0198] For each autonomous domain, a moving manner that increases the updated modularity most is selected from a plurality of moving manners, and if the updated modularity corresponding to the plurality of moving manners is not increased, the autonomous domain is abandoned.

[0199] Optionally, the adjusting unit 503 is specifically configured to:

[0200] According to a preset network adjusting strategy, the network traffic of the target community network is isolated, and the network traffic of the target community network is scheduled to other community networks.

[0201] Optionally, the apparatus further includes:

[0202] A restoring unit is configured to perform, according to a preset network restoring strategy, recovery on a communication link of at least one autonomous domain in the target community network and a communication link of a corresponding autonomous domain in other community networks; and

[0203] A recording unit is configured to record attack information of an abnormal traffic attack on the abnormal autonomous domain; wherein the attack information includes at least one of the following: autonomous domain information of the abnormal autonomous domain, abnormal traffic information, an attack type, an attack duration, and an attack intensity.

[0204] For the convenience of description, each part is described as a module (or unit) according to a function. Of course, the functions of the modules (or units) can be implemented in the same or multiple software or hardware in the implementation of the present application.

[0205] After introducing the method and apparatus for network traffic adjustment of the example embodiment of the present application, next, an electronic device according to another example embodiment of the present application is introduced.

[0206] Based on the same inventive concept as the method embodiments described above, the electronic device in the embodiments of the present application is also provided. In an embodiment, the electronic device can be a server or a terminal device. In this embodiment, the structure of the electronic device can be as shown in Figure 6 , which includes a memory 601, a communication module 603, and one or more processors 602.

[0207] The memory 601 is used to store computer programs executed by the processor 602. The memory 601 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system and programs required for running instant messaging functions, etc.; and the data storage area can store various instant messaging information and operation instruction sets, etc.

[0208] The memory 601 can be a volatile memory such as a random-access memory (RAM); the memory 601 can also be a non-volatile memory such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 601 can be any other medium capable of carrying or storing desired computer programs in the form of instructions or data structures and capable of being accessed by a computer, but is not limited thereto. The memory 601 can be a combination of the above memories.

[0209] The processor 602 can include one or more central processing units (CPUs) or digital processing units, etc. The processor 602 is used to call the computer programs stored in the memory 601 to implement the method of adjusting network traffic described above.

[0210] The communication module 603 is used to communicate with terminal devices and other servers.

[0211] The specific connection medium between the memory 601, the communication module 603 and the processor 602 in the embodiments of the present application is not limited. In the embodiments of the present application, the memory 601 and the processor 602 are connected through a bus 604, and the bus 604 is described as a thick line in Figure 6 , and the connection mode between other components is only schematically described and is not limited. The bus 604 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Figure 6 only one thick line is used to describe, but it does not mean that there is only one bus or only one type of bus. Figure 6

[0212] ​The embodiment of the present application provides a computer readable storage medium, and the computer readable storage medium stores a computer program. When the computer program runs on an electronic device, the computer program is used for enabling the electronic device to execute the network traffic adjustment method of the above-described embodiment, such as Figure 2 .

[0213] The computer readable storage medium in the above-described embodiment can be any available medium or data storage device that the processor in the device can access, including but not limited to a magnetic memory such as a floppy disk, a hard disk, a magnetic tape, a magneto-optical disk (MO) and the like, an optical memory such as a CD, a DVD, a BD, a HVD and the like, and a semiconductor memory such as a ROM, an EPROM, an EEPROM, a nonvolatile memory (NAND FLASH), a solid state disk (SSD) and the like.

[0214] In some possible implementation manners, various aspects of the network traffic adjustment method provided by the embodiment of the present application can also be implemented in the form of a program product, which includes a computer program. When the program product runs on an electronic device, the computer program is used for enabling the electronic device to execute the steps in the network traffic adjustment method according to various exemplary embodiments of the present application described in the specification, for example, the electronic device can execute the steps as shown in Figure 2 .

[0215] The program product can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium may, for example, be but is not limited to an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination of the above. More specific examples (non-exhaustive list) of the readable storage medium include an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0216] The program product of the embodiment of the present application can adopt a portable compact disk read-only memory (CD-ROM) and include a computer program, and can run on an electronic device. However, the program product of the present application is not limited to this. In the present document, the readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with a command execution system, device or apparatus.

[0217] A readable signal medium can include a computer program readable computer program code, data signals, or any other medium that can be read by a computer. Examples of a readable signal medium include a computer program readable computer program code, data signals, or any other medium that can be read by a computer.

[0218] The computer program code product can be transmitted by any medium including but not limited to wireless, wired, optical fiber cable, RF, etc., or any suitable combination of the above.

[0219] The computer program for performing the operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++, etc., or conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer program can execute entirely on the user's electronic device, partly on the user's electronic device, as a stand-alone software package, partly on the user's electronic device and partly on a remote electronic device or entirely on the remote electronic device or server. In the latter scenario, the remote electronic device can be connected to the user's electronic device through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external electronic device (for example, through the Internet using an Internet Service Provider).

[0220] It should be noted that although several units or sub-units of the apparatus are mentioned in the above detailed description, the division into such units or sub-units is only illustrative and not mandatory. In practice, the features and functions of two or more units described above can be embodied in one unit according to the embodiments of the present application. Conversely, the features and functions of one unit described above can be further divided into several units.

[0221] Furthermore, although the operations of the method(s) of the present application are described in a particular, sequential order for convenient presentation, it should be appreciated that the operations can be performed in another order. Additionally, or alternatively, certain operations can be performed concurrently. Further, certain operations can be omitted or replaced with alternative operations.

[0222] Those skilled in the art will appreciate that embodiments of the present application can be readily used as software, hardware, or a combination of software and hardware. In one embodiment, the present application can be implemented as a computer program product, which can include a computer readable storage medium having stored computer program commands. The computer program commands can be used to cause a computer to carry out a method according to the embodiments of the present application.

[0223] The embodiments of methods, devices (systems), and computer program products of the present application can be described below with reference to flowchart illustrations and / or block diagrams of the flowchart and / or block diagrams of the methods, apparatuses (systems) and computer program products according to embodiments of the present application. It will be understood that each flow and / or block of the flowchart and / or block diagrams, and combinations of flows and / or blocks in the flowchart and / or block diagrams, can be implemented by computer program commands. These computer program commands can be provided to a processor of a general purpose computer, a special purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions, which are executed via the processor of the computer or other programmable data processing apparatus, generate a means for implementing the functions specified in the flowchart and / or block diagrams of the flowchart and / or block diagrams of the methods, apparatuses (systems) and computer program products according to the embodiments of the present application. Figure 1 one or more flows and / or blocks Figure 1 means for carrying out the functions specified in the flowchart and / or block diagrams of the flowchart and / or block diagrams of the methods, apparatuses (systems) and computer program products according to the embodiments of the present application.

[0224] These computer program commands can also be stored in a computer readable storage medium that can direct the computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer readable storage medium produce a product including an instruction device that implements the functions specified in the flowchart and / or block diagrams of the flowchart and / or block diagrams of the methods, apparatuses (systems) and computer program products according to the embodiments of the present application. Figure 1 one or more flows and / or blocks Figure 1 means for carrying out the functions specified in the flowchart and / or block diagrams of the flowchart and / or block diagrams of the methods, apparatuses (systems) and computer program products according to the embodiments of the present application.

[0225] These computer program commands can also be loaded to the computer or other programmable data processing apparatus, so that a series of operation steps are performed on the computer or other programmable data processing apparatus to produce a computer implemented process, so that the instructions executed on the computer or other programmable data processing apparatus provide a means for implementing the functions specified in the flowchart and / or block diagrams of the flowchart and / or block diagrams of the methods, apparatuses (systems) and computer program products according to the embodiments of the present application. Figure 1 one or more flows and / or blocks Figure 1 means for carrying out the functions specified in the flowchart and / or block diagrams of the flowchart and / or block diagrams of the methods, apparatuses (systems) and computer program products according to the embodiments of the present application.

[0226] Although the preferred embodiments of the present application have been described, those skilled in the art who understand the basic inventive concept after getting to know the present application can make additional changes and modifications to the embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0227] Obviously, many modifications and variations of the present application are possible in light of the above teachings. It is, therefore, to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A method for adjusting network traffic, characterized in that, The method includes: Detect communication link information between every two autonomous systems in the network system where communication links exist; When the community division conditions are met, based on the communication link information, the Ruwan algorithm is used to perform community division processing on the autonomous domains in the network system to obtain at least one community network; wherein, each community network includes at least one of the autonomous domains; When an abnormal autonomous domain is identified in the network system, network traffic adjustment is performed on the target community network associated with the abnormal autonomous domain; wherein, the abnormal autonomous domain is an autonomous domain in the network system that is subjected to abnormal traffic attacks; The communication link information includes at least one of the following: target bandwidth utilization rate and link connection establishment frequency; wherein: The target bandwidth utilization rate is obtained by: detecting the amount of network data generated by each communication transmission between two autonomous systems with a communication link during the detection and analysis period; determining the sub-bandwidth utilization rate associated with each communication transmission between the two autonomous systems based on the amount of network data generated by each communication transmission and the maximum bandwidth of the communication link; weighting and summing all the sub-bandwidth utilization rates; and taking the average bandwidth utilization rate obtained by the weighted summation as the target bandwidth utilization rate. The link connection establishment frequency is obtained by: during the detection and analysis period, when two autonomous systems with communication links conduct a communication session, the amount of connection data establishing the link connection is measured, and the link connection establishment frequency is determined based on the amount of connection data and the set duration.

2. The method as described in claim 1, characterized in that, The criteria for community division include: Arrive at the designated community demarcation time; or An abnormal traffic attack was detected in the network system.

3. The method as described in claim 1, characterized in that, If the communication link information includes: the target bandwidth utilization rate and the link connection establishment frequency, the process of dividing autonomous systems into communities based on the communication link information includes: For each autonomous system in the network system, the following steps are performed: Based on the target bandwidth utilization rate and the link connection establishment frequency corresponding to at least one communication link associated with the autonomous system, the overall load of the at least one communication link is determined, and based on the overall load of the at least one communication link, the degree of the autonomous system is determined; the degree represents the sum of the overall loads of all communication links associated with the corresponding autonomous system. The total load of the network system is determined based on the combined load of each communication link in the network system. Based on the overall load of each communication link, the degree of each autonomous system, and the total load, and in conjunction with the set partitioning method, the autonomous systems in the network system are divided into communities.

4. The method as described in claim 3, characterized in that, The process of dividing autonomous systems into communities based on the overall load of each communication link, the degree of each autonomous system, and the total load, combined with a defined partitioning method, includes: For the multiple community networks that have been divided in the network system, the modularity is obtained by setting calculations based on the comprehensive load of the communication link between every two autonomous systems, the degree of each autonomous system, the total load, and the indicator function of every two autonomous systems. Among them, when the two autonomous systems are in the same community network, the indicator function of the two autonomous systems is a first value, and when the two autonomous systems are not in the same community network, the indicator function of the two autonomous systems is a second value. The modularity represents the difference between the density of connections within the community network and random connections. Repeatedly perform the following autonomous system move operation until no more autonomous system moves increase the modularity: Traverse each autonomous system and attempt to move the autonomous system to the community network of all neighboring autonomous systems. For each movement method, redetermine the modularity to obtain the updated modularity. For each autonomous system, select the movement method that increases the updated modularity the most from multiple movement methods. If the updated modularity does not increase for any of the multiple movement methods, then abandon the movement of the autonomous system.

5. The method as described in claim 1, characterized in that, The network traffic adjustment for the target community network associated with the abnormal autonomous region includes: According to the preset network adjustment strategy, traffic isolation is performed on the target community network, and network traffic of the target community network is scheduled to other community networks.

6. The method according to any one of claims 1 to 5, characterized in that, After adjusting the network traffic of the target community network associated with the abnormal autonomous region, the process further includes: According to a preset network recovery strategy, the communication links of at least one autonomous system (AS) in the target community network and the corresponding ASs in other community networks are restored; and Record the attack information of the abnormal traffic attack suffered by the abnormal autonomous domain; wherein the attack information includes at least one of the following: autonomous domain information of the abnormal autonomous domain, abnormal traffic information, attack type, attack duration, and attack intensity.

7. A network traffic adjustment device, characterized in that, The device includes: The detection unit is used to detect communication link information between every two autonomous systems in the network system. A partitioning unit is used to perform community partitioning processing on the autonomous domains in the network system based on the communication link information and using the Ruwan algorithm when the community partitioning conditions are met, to obtain at least one community network; wherein each community network includes at least one of the autonomous domains. An adjustment unit is used to adjust the network traffic of a target community network associated with an abnormal autonomous domain when it is determined that an abnormal autonomous domain exists in the network system; wherein, the abnormal autonomous domain is an autonomous domain in the network system that is subjected to abnormal traffic attacks; The communication link information includes at least one of the following: target bandwidth utilization rate and link connection establishment frequency; wherein: The target bandwidth utilization rate is obtained by: detecting the amount of network data generated by each communication transmission between two autonomous systems with a communication link during the detection and analysis period; determining the sub-bandwidth utilization rate associated with each communication transmission between the two autonomous systems based on the amount of network data generated by each communication transmission and the maximum bandwidth of the communication link; weighting and summing all the sub-bandwidth utilization rates; and taking the average bandwidth utilization rate obtained by the weighted summation as the target bandwidth utilization rate. The link connection establishment frequency is obtained by: during the detection and analysis period, when two autonomous systems with communication links conduct a communication session, the amount of connection data establishing the link connection is measured, and the link connection establishment frequency is determined based on the amount of connection data and the set duration.

8. An electronic device, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program that, when executed by the processor, causes the processor to perform the steps of any of the methods described in claims 1 to 6.

9. A computer-readable storage medium, characterized in that, It includes a computer program that, when run on an electronic device, causes the electronic device to perform the steps of any of the methods described in claims 1 to 6.

Images