Method and device for scheduling attack traffic, electronic equipment and storage medium

Abstract

The invention relates to the technical field of network security, in particular to a method and device for scheduling attack traffic, electronic equipment and a storage medium. The method comprises the following steps: iteratively executing the following set operations every a first set period: dividing a plurality of nodes into a plurality of communities according to network flow information transmitted between every two nodes currently having a communication link, each community comprising at least one node, and each node being a device in the autonomous domain network; if it is determined that the target node in the autonomous domain network is subjected to the abnormal traffic attack, executing a set operation to update the plurality of divided communities to obtain a plurality of newly divided communities; and determining a target community where the target node is located from the plurality of newly divided communities, and carrying out network flow limitation on at least one node in the target community. According to the invention, when the autonomous domain network is attacked, the network traffic can be effectively scheduled, and the influence of abnormal traffic attack on the autonomous domain network is reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, electronic device and storage medium for scheduling attack traffic. Background Art

[0002] At present, network devices in autonomous system (AS) networks may be attacked by abnormal traffic due to their low security performance. For example, Internet of Things (IoT) devices are relatively weak in processing resources and memory resources, and manufacturers often focus on realizing the functions that the device itself should have when manufacturing IoT devices, while ignoring the security attributes of the device, which makes IoT devices vulnerable to abnormal traffic attacks.

[0003] The above-mentioned abnormal traffic attacks are represented by distributed denial of service (DDoS) attacks. Attackers can easily control a large number of zombie hosts and use automated scripts to launch attacks on many targets including IoT devices within the autonomous domain network. Therefore, security protection measures against abnormal traffic attacks are imminent.

[0004] In related technologies, security protection measures against abnormal traffic attacks often focus on sharing and intercepting abnormal addresses, which refer to the network addresses used to launch attacks. They cannot effectively schedule network traffic to reduce the impact of abnormal traffic attacks on autonomous domain networks. Summary of the invention

[0005] The embodiments of the present application provide a method, device, electronic device and storage medium for scheduling attack traffic, which are used to effectively schedule network traffic when an autonomous domain network is attacked, so as to reduce the impact of abnormal traffic attacks on the autonomous domain network.

[0006] In a first aspect, an embodiment of the present application provides a method for scheduling attack traffic, including:

[0007] During normal operation of multiple nodes in the autonomous domain network, the following setting operation is iteratively performed every first setting period: dividing the multiple nodes into multiple communities according to network traffic information transmitted between every two nodes with a current communication link; wherein each community includes at least one node, and each node is a device in the autonomous domain network;

[0008] If it is determined that the target node in the autonomous domain network is attacked by abnormal traffic, the setting operation is performed to update the divided multiple communities to obtain multiple newly divided communities;

[0009] A target community where the target node is located is determined from the multiple newly divided communities, and network traffic is restricted for at least one node in the target community.

[0010] Optionally, the network traffic information includes bandwidth occupancy rate, and the network traffic information transmitted between every two nodes having a communication link is obtained in the following manner:

[0011] Detecting the amount of network data transmitted between every two nodes having a communication link among the plurality of nodes within a set time period before a current moment;

[0012] The bandwidth occupancy rate of the communication link between every two nodes is determined according to the amount of network data transmitted between every two nodes and the maximum bandwidth of the communication link.

[0013] Optionally, dividing the plurality of nodes into a plurality of communities according to network traffic information transmitted between every two nodes having a current communication link includes:

[0014] Determine the degree of each node according to the bandwidth occupancy rate of the communication link between every two nodes, wherein the degree represents the sum of the bandwidth occupancy rates of the communication links between each node and other nodes;

[0015] Obtaining a total bandwidth occupancy rate of all communication links between the plurality of nodes according to the bandwidth occupancy rate of the communication link between every two nodes;

[0016] According to the bandwidth occupancy rate of the communication link between every two nodes, the degree of each node and the total bandwidth occupancy rate, the multiple nodes are divided into multiple communities in combination with a set division method.

[0017] Optionally, dividing the plurality of nodes into a plurality of communities according to the bandwidth occupancy of the communication link between every two nodes, the degree of each node and the total bandwidth occupancy in combination with a set division method includes:

[0018] For the multiple communities into which the multiple nodes have been divided, a set operation is performed based on the bandwidth occupancy rate of the communication link between every two nodes, the degree of each node, the total bandwidth occupancy rate, and the indicator function of every two nodes to obtain a modularity; wherein, when the two nodes are in the same community, the indicator function of the two nodes is a first value, and when the two nodes are not in the same community, the indicator function of the two nodes is a second value, and the modularity represents the difference between the density of connections within the community and random connections;

[0019] Repeat the iterative execution of the following node movement operation until no node movement increases the modularity:

[0020] Traversing each node, trying to move the node to the community where all adjacent nodes are located, and for each movement method, re-determining the modularity to obtain an updated modularity;

[0021] For each node, a moving mode that increases the updated modularity the most is selected from a plurality of moving modes. If the updated modularity corresponding to the plurality of moving modes does not increase, the node is abandoned from being moved.

[0022] Optionally, after limiting the network traffic of at least one node in the target community, the method further includes:

[0023] For the newly divided multiple communities, iteratively perform the setting operation every second setting period; wherein the second setting period is smaller than the first setting period;

[0024] If it is determined according to the latest divided multiple communities that the target community where the target node is located has changed, network traffic restriction is performed on at least one node in the changed target community.

[0025] Optionally, limiting the network traffic of at least one node in the target community includes:

[0026] According to a preset routing adjustment strategy, the routing path of the network traffic flowing through each node in the target community is switched to a corresponding node in another community among the multiple newly divided communities.

[0027] Optionally, after limiting the network traffic of at least one node in the target community, the method further includes:

[0028] After processing the abnormal traffic attack on the target node, restoring the routing path of at least one node in the target community and the routing paths of the corresponding nodes in the other communities according to a preset routing restoration strategy; and

[0029] Record the attack information of the abnormal traffic attack suffered by the target node; wherein the attack information includes at least one of the following: node information of the target node, abnormal traffic information, attack type, attack duration, and attack intensity.

[0030] In a second aspect, an embodiment of the present application provides a device for scheduling attack traffic, including:

[0031] A first division unit is configured to iteratively perform the following setting operation every first set period during the normal operation of multiple nodes in the autonomous domain network: dividing the multiple nodes into multiple communities according to network traffic information transmitted between every two nodes with a current communication link; wherein each community includes at least one node, and each node is a device in the autonomous domain network;

[0032] A second division unit is configured to execute the setting operation if it is determined that the target node in the autonomous domain network is attacked by abnormal traffic, update the divided multiple communities, and obtain multiple newly divided communities;

[0033] The scheduling unit is used to determine the target community where the target node is located from the multiple newly divided communities, and to restrict the network traffic of at least one node in the target community.

[0034] Optionally, the network traffic information includes bandwidth occupancy, and the device further includes a detection unit, configured to:

[0035] Detecting the amount of network data transmitted between every two nodes having a communication link among the plurality of nodes within a set time period before a current moment;

[0036] The bandwidth occupancy rate of the communication link between every two nodes is determined according to the amount of network data transmitted between every two nodes and the maximum bandwidth of the communication link.

[0037] Optionally, the first dividing unit is specifically used to:

[0038] Determine the degree of each node according to the bandwidth occupancy rate of the communication link between every two nodes, wherein the degree represents the sum of the bandwidth occupancy rates of the communication links between each node and other nodes;

[0039] Obtaining a total bandwidth occupancy rate of all communication links between the plurality of nodes according to the bandwidth occupancy rate of the communication link between every two nodes;

[0040] According to the bandwidth occupancy rate of the communication link between every two nodes, the degree of each node and the total bandwidth occupancy rate, the multiple nodes are divided into multiple communities in combination with a set division method.

[0041] Optionally, when the plurality of nodes are divided into a plurality of communities according to the bandwidth occupancy rate of the communication link between every two nodes, the degree of each node, and the total bandwidth occupancy rate, in combination with a set division method, the first division unit is specifically used to:

[0042] For the multiple communities into which the multiple nodes have been divided, a set operation is performed based on the bandwidth occupancy rate of the communication link between every two nodes, the degree of each node, the total bandwidth occupancy rate, and the indicator function of every two nodes to obtain a modularity; wherein, when the two nodes are in the same community, the indicator function of the two nodes is a first value, and when the two nodes are not in the same community, the indicator function of the two nodes is a second value, and the modularity represents the difference between the density of connections within the community and random connections;

[0043] Repeat the iterative execution of the following node movement operation until no node movement increases the modularity:

[0044] Traversing each node, trying to move the node to the community where all adjacent nodes are located, and for each movement method, re-determining the modularity to obtain an updated modularity;

[0045] For each node, a moving mode that increases the updated modularity the most is selected from a plurality of moving modes. If the updated modularity corresponding to the plurality of moving modes does not increase, the node is abandoned from being moved.

[0046] Optionally, the device further comprises:

[0047] A third division unit, configured to iteratively perform the setting operation on the newly divided multiple communities every second setting period; wherein the second setting period is smaller than the first setting period;

[0048] The scheduling unit is further configured to restrict network traffic of at least one node in the changed target community if it is determined that the target community where the target node is located has changed according to the multiple communities divided most recently.

[0049] Optionally, the scheduling unit is specifically used for:

[0050] According to a preset routing adjustment strategy, the routing path of the network traffic flowing through each node in the target community is switched to a corresponding node in another community among the multiple newly divided communities.

[0051] Optionally, the device further comprises:

[0052] A recovery unit, configured to recover the routing path of at least one node in the target community and the routing paths of the corresponding nodes in the other communities according to a preset routing recovery strategy after processing the abnormal traffic attack on the target node;

[0053] A recording unit is used to record the attack information of the abnormal traffic attack on the target node; wherein the attack information includes at least one of the following: node information of the target node, abnormal traffic information, attack type, attack duration, and attack intensity.

[0054] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of any one of the above-mentioned methods for scheduling attack traffic.

[0055] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which includes a computer program. When the computer program is run on an electronic device, the computer program is used to enable the electronic device to perform any step of the above-mentioned method for scheduling attack traffic.

[0056] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program, and the computer program is stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the electronic device performs any step of the above-mentioned method for scheduling attack traffic.

[0057] The above solution of the present application has at least the following beneficial effects:

[0058] The embodiment of the present application provides a method, device, electronic device and storage medium for scheduling attack traffic. During the normal operation of multiple nodes in an autonomous domain network, the following operations are performed periodically and iteratively: multiple nodes are divided according to the network traffic information transmitted between every two nodes where there is currently a communication link, and multiple communities are obtained; in the process of periodically iterating the above operations, if it is determined that the target node in the autonomous domain network is attacked by abnormal traffic, even if the division time point has not been reached, the current multiple communities are immediately divided again to obtain multiple newly divided communities; the target community where the target node is located is determined from the multiple newly divided communities, and the network traffic is restricted for at least one node in the target community. In this way, the communication link between nodes and nodes in the autonomous domain network is abstracted into an undirected graph, and multiple nodes are dynamically and reasonably divided based on the network traffic information transmitted between nodes, and then when the target node is attacked by abnormal traffic, the community where the target node is located is restricted by network traffic. Therefore, when the autonomous domain network is attacked, the embodiment of the present application can effectively schedule the network traffic to reduce the impact of abnormal traffic attacks on the autonomous domain network.

[0059] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0061] Figure 1 A schematic diagram of a DDoS attack autonomous domain network in an embodiment of the present application;

[0062] Figure 2 A flowchart of a method for scheduling attack traffic in an embodiment of the present application;

[0063] Figure 3 A schematic diagram of bandwidth occupancy between nodes in an embodiment of the present application;

[0064] Figure 4 It is an overall logic diagram of a method for scheduling attack traffic in an embodiment of the present application;

[0065] Figure 5 A schematic diagram of the structure of a device for scheduling attack traffic in an embodiment of the present application;

[0066] Figure 6 The present invention is a schematic diagram of the structure of an electronic device to which the present invention is applied. DETAILED DESCRIPTION

[0067] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.

[0068] The following is an introduction to some concepts involved in the embodiments of the present application.

[0069] DDoS (Distributed denial of service): A distributed denial of service attack occurs when multiple attackers in different locations simultaneously attack one or more targets, or when an attacker controls multiple machines in different locations and uses them to attack the victim simultaneously.

[0070] Autonomous domain: In the Internet, the combination of all Internet Protocol (IP) networks and routers under the jurisdiction of one or more entities, which implement a common routing policy for the Internet; where the entity can be an Internet service provider, educational institution, enterprise, government agency, etc.

[0071] Community Detection: Community detection is a research field in graph theory that aims to segment a network graph into multiple communities so that nodes within the same community have more connections than nodes across communities.

[0072] Leiden Algorithm: A community detection algorithm on large relational networks. It calculates the relationship between nodes and edges between communities to ensure the validity of the connections within the community and achieve community separation.

[0073] The following is a brief introduction to the design concept of the embodiments of the present application.

[0074] At present, network devices in autonomous domain networks may be attacked by abnormal traffic due to their low security performance. For example, IoT devices are relatively weak in processing resources and memory resources, and manufacturers often focus on realizing the functions that the device itself should have when manufacturing IoT devices, while ignoring the security attributes of the device, which makes IoT devices vulnerable to abnormal traffic attacks.

[0075] The above abnormal traffic attacks are represented by distributed denial of service (DDoS) attacks, such as Figure 1 As shown in the figure, attackers can easily control a large number of zombie hosts and use automated scripts to launch attacks on many targets including IoT devices within the autonomous domain network. Therefore, security protection measures against abnormal traffic attacks are imminent.

[0076] In the related technologies, security protection measures against abnormal traffic attacks often focus on the sharing and interception of abnormal addresses, which refer to the network addresses used to launch attacks. In terms of traffic scheduling, it is generally carried out by means of Border Gateway Protocol (BGP) routing traction or Anycast. Anycast is a network technology that allows data packets to be sent to the nearest of multiple destinations, but there is almost no traffic scheduling solution that can perform adaptive dynamic adjustment. Therefore, when the autonomous domain network is attacked, the network traffic cannot be effectively scheduled to reduce the impact of abnormal traffic attacks on the autonomous domain network.

[0077] In view of this, the embodiment of the present application provides a method, device, electronic device and storage medium for scheduling attack traffic. During the normal operation of multiple nodes in an autonomous domain network, the following operations are performed periodically and iteratively: multiple nodes are divided according to the network traffic information currently transmitted between every two nodes to obtain multiple communities; in the process of periodically and iteratively performing the above operations, if it is determined that the target node in the autonomous domain network is attacked by abnormal traffic, even if the division time point has not been reached, the current multiple communities are immediately divided again to obtain multiple newly divided communities; the target community where the target node is located is determined from the multiple newly divided communities, and the network traffic is restricted for at least one node in the target community. In this way, the communication links between nodes in the autonomous domain network are abstracted into an undirected graph, and multiple nodes are dynamically and reasonably divided based on the network traffic information transmitted between nodes, and then when the target node is attacked by abnormal traffic, the network traffic of the community where the target node is located is restricted. Therefore, the embodiment of the present application can effectively schedule the network traffic when the autonomous domain network is attacked to reduce the impact of abnormal traffic attacks on the autonomous domain network.

[0078] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0079] See also Figure 2 As shown, it is an implementation flow chart of a method for scheduling attack traffic provided by an embodiment of the present application. The method can be executed by a network controller in an autonomous domain network. The network controller can be a device or software platform for managing and controlling network devices (such as gateways, routers, etc.), that is, it can be a hardware device or software running on a server. The specific implementation process of the method includes the following S21-S23:

[0080] S21. During normal operation of multiple nodes in the autonomous domain network, the following setting operation is iterated every first setting period: based on network traffic information transmitted between every two nodes with a current communication link, the multiple nodes are divided into multiple communities, each community includes at least one node, and each node is any device in the autonomous domain network.

[0081] The devices in the autonomous network include network devices such as routers, switches, and gateways, as well as terminal devices, servers, and security devices. Any device in the autonomous network is regarded as a node, and there are communication links between nodes.

[0082] Considering that abnormal traffic attacks usually achieve the purpose of paralyzing the network by sending high-frequency burst attack traffic, multiple nodes are divided into multiple communities according to the network traffic information transmitted between every two nodes in the multiple nodes. The network traffic information transmitted between every two nodes can reflect the connection density between the two nodes. Specifically, in order to reasonably divide multiple nodes into communities, a community detection algorithm, such as the Leiden algorithm, can be used to periodically iterate the community division of multiple nodes so that each node in each community has a high degree of density.

[0083] In an optional implementation, the network traffic information may include bandwidth occupancy rate. In this case, the network traffic information transmitted between every two nodes in which a communication link currently exists may be obtained in the following manner:

[0084] The amount of network data transmitted between every two nodes having a communication link among multiple nodes within a set time period before the current moment is detected; and the bandwidth occupancy rate of the communication link between every two nodes is determined according to the amount of network data transmitted between every two nodes and the maximum bandwidth of the communication link.

[0085] The set duration can be set as needed. For two nodes with a communication link, the amount of network data transmitted by the two nodes within the set duration divided by the maximum bandwidth of the communication link is equal to the bandwidth occupancy rate of the communication link between the two nodes, such as shown in the following formula (1):

[0086]

[0087] Among them, R ij is the amount of network data transmitted between nodes i and j with a communication link in the current first set period, and B ij is the maximum bandwidth of the communication link between node i and node j.

[0088] In the following embodiment, the community detection algorithm is taken as the Leiden algorithm as an example to introduce the division process of multiple nodes.

[0089] In an optional implementation, the above S21 divides the multiple nodes into multiple communities according to the network traffic information transmitted between every two nodes having a communication link, and may include the following steps A1-A3:

[0090] A1. Determine the degree of each node according to the bandwidth occupancy of the communication link between every two nodes. The degree represents the sum of the bandwidth occupancy of the communication link between each node and other nodes.

[0091] Among them, a node may have a communication link with one or more other nodes, and the degree of the node is equal to the sum of the bandwidth occupancy of the communication links between the node and all other nodes. For example, for node R1, assuming that there is a communication link between R1 and nodes R2 and R3, the bandwidth occupancy between R1 and R2 is 0.2, and the bandwidth occupancy between R1 and R3 is 0.4, then the degree of node R1 is equal to 0.2+0.4=0.6, and so on, calculate the degree of each node.

[0092] A2. According to the bandwidth occupancy rate of the communication link between every two nodes, the total bandwidth occupancy rate of all communication links between multiple nodes is obtained.

[0093] The bandwidth occupancy rates of all communication links between multiple nodes may be directly summed to obtain the total bandwidth occupancy rate of all communication links between multiple nodes. Figure 3 As shown, the multiple nodes include: R1, R2, R3, R4, R5, and R6. The bandwidth occupancy between R1 and R2 is 0.2, the bandwidth occupancy between R1 and R3 is 0.4, the bandwidth occupancy between R2 and R4 is 0.5, the bandwidth occupancy between R3 and R4 is 0.8, the bandwidth occupancy between R3 and R5 is 0.1, the bandwidth occupancy between R5 and R6 is 0.1, and the bandwidth occupancy between R4 and R6 is 0.3. Then, the total bandwidth occupancy of all communication links = 0.2 + 0.4 + 0.5 + 0.8 + 0.1 + 0.1 + 0.3 = 2.4.

[0094] A3. According to the bandwidth occupancy rate of the communication link between every two nodes, the degree of each node and the total bandwidth occupancy rate, multiple nodes are divided into multiple communities in combination with the set division method.

[0095] Specifically, the setting division method can be implemented on the basis of the Leiden algorithm, and the setting division method is introduced below.

[0096] In an optional implementation, the above step A3 may include the following steps a1-a2:

[0097] a1. For multiple communities divided by multiple nodes, set operations are performed based on the bandwidth occupancy of the communication link between every two nodes, the degree of each node, the total bandwidth occupancy, and the indicator function of every two nodes to obtain modularity; wherein, when two nodes are in the same community, the indicator function of the two nodes is a first value, and when the two nodes are not in the same community, the indicator function of the two nodes is a second value. The modularity represents the difference between the density of connections within the community and random connections.

[0098] When the multiple nodes are divided for the first time, it can be assumed that each node is a separate community, that is, the multiple divided communities each contain a node.

[0099] The above setting operation can be set as needed, and the first value and the second value can also be set as needed, for example, the first value is 1 and the second value is 0. Exemplarily, the setting budget is shown in the following formula (2):

[0100]

[0101] Among them, A ij represents the bandwidth occupancy of the communication link between any two nodes i and j, ki and kj represent the degrees of any two nodes i and j, and m represents the total bandwidth occupancy of all communication links between multiple nodes. i , c j ) is the indicator function of two nodes. When node i and node j are in the same community, the value is 1, otherwise it is 0. Q represents modularity, which is usually a value between -1 and 1. It represents the difference between the density of connections within the community and random connections.

[0102] a2. Repeat the following node movement operations a21-a22 until no node movement increases the modularity:

[0103] a21. Traverse each node and try to move the node to the community where all adjacent nodes are located. For each movement method, redetermine the modularity and obtain the updated modularity.

[0104] Among them, the neighboring nodes of each node refer to the nodes connected to the node, that is, there is a communication link between each node and the neighboring nodes. For each node, when trying to move the node to the community where a neighboring node is located, the indicator function between the node and the neighboring node changes, and the above formula (2) can be used to re-determine the modularity.

[0105] a22. For each node, select the moving mode that increases the updated modularity the most from multiple moving modes. If the updated modularity corresponding to multiple moving modes does not increase, abandon the moving node.

[0106] In the embodiment of the present application, based on the Leiden algorithm and combined with the bandwidth occupancy of the communication links between multiple nodes in the autonomous domain network, multiple nodes can be reasonably divided so that the connection density in each community after the division is high.

[0107] S22: If it is determined that the target node in the autonomous domain network is attacked by abnormal traffic, a setting operation is performed to update the divided multiple communities to obtain multiple newly divided communities.

[0108] Specifically, in the process of periodically iterating the execution of the above-mentioned setting operations, within each first setting period, it can be determined whether the autonomous domain network is attacked by abnormal traffic. If it is determined that the target node in the autonomous domain network is attacked by abnormal traffic, the above-mentioned setting operations will be executed immediately regardless of whether the periodic execution time point is reached, so as to update the multiple divided communities according to the network traffic information transmitted between every two nodes in the current network.

[0109] S23: Determine a target community where the target node is located from the multiple newly divided communities, and restrict network traffic on at least one node in the target community.

[0110] Among them, the network traffic that needs to be transmitted by at least one node in the target community can be diverted to nodes in other communities, and the subsequent sending of network traffic to at least one node in the target community can be restricted, thereby achieving network traffic redirection, isolation and flow limiting measures to reduce the impact of traffic attacks.

[0111] It should be noted that the target node attacked by abnormal traffic may be one node or multiple nodes. When there are multiple nodes, network traffic restrictions may be imposed on the target communities corresponding to the multiple nodes. In addition, during the process of restricting network traffic on at least one node in the target community, it may be detected that other nodes are also attacked by abnormal traffic. In this case, the above S22-S23 may be repeatedly executed.

[0112] In an optional implementation, when network traffic is restricted for at least one node in the target community, the routing path of the network traffic flowing through each node in the target community can be switched to a corresponding node in another community among the newly divided multiple communities according to a preset routing adjustment strategy.

[0113] Among them, the preset routing adjustment strategy can be set according to the actual situation. For example, when node R1 is attacked by abnormal traffic, the routing paths of R1 and nodes R2 and R3 belonging to the same community as R1 will be switched, specifically to nodes R4, R5, and R6 in another community.

[0114] In the embodiment of the present application, during the normal operation of multiple nodes in the autonomous domain network, multiple nodes are divided periodically and iteratively according to the network traffic information transmitted between every two nodes, and multiple communities are obtained each time; when it is detected that the target node in the autonomous domain network is attacked by abnormal traffic, even if the division time point has not been reached, the current multiple communities are immediately divided again to obtain multiple newly divided communities; the target community where the target node is located is determined from the multiple newly divided communities, and the network traffic is restricted for at least one node in the target community. In this way, the communication links between nodes in the autonomous domain network are abstracted into an undirected graph, and multiple nodes are dynamically and reasonably divided based on the network traffic information transmitted between nodes, and then when the target node is attacked by abnormal traffic, the network traffic of the community where the target node is located is restricted. Therefore, the embodiment of the present application can effectively schedule the network traffic when the autonomous domain network is attacked to reduce the impact of abnormal traffic attacks on the autonomous domain network.

[0115] In some embodiments, after network traffic restriction is performed on at least one node in the target community, the setting operation can be iteratively performed every second setting period for multiple newly divided communities, and the second setting period is smaller than the first setting period; if it is determined that the target community where the target node is located has changed based on the multiple newly divided communities, network traffic restriction is performed on at least one node in the changed target community.

[0116] Among them, considering that when the target node is attacked by abnormal traffic, the network traffic in the autonomous domain network will fluctuate greatly, therefore, after the network traffic of at least one node in the target community is restricted, the above setting operation is iteratively performed using a second set period, that is, a division frequency higher than the division frequency when the network is operating normally is used to continuously iteratively divide multiple nodes. If it is determined that the target community where the target node is located has changed based on the latest divided multiple communities, the network traffic of at least one node in the changed target community can be restricted, and the specific restriction process is similar to the above S23.

[0117] In some embodiments, after restricting the network traffic of at least one node in the target community, after processing the abnormal traffic attack on the target node, the routing path of at least one node in the target community and the routing paths of corresponding nodes in other communities can be restored according to a preset routing recovery strategy.

[0118] Among them, the preset routing recovery strategy can be pre-set according to the specific situation, for example, the routing path of at least one node in the target community is restored to an initial state, which can be the routing path before the target node is attacked by abnormal traffic, or the routing path during initialization.

[0119] More specifically, when the initial state is the routing path at the time of initialization, different time periods may correspond to different initial states, and the different time periods may be different time periods of a day, or different time periods within a set time period, without limitation. After processing the abnormal traffic attack on the target node, the routing path of at least one node in the target community is restored to the initial state corresponding to the current time period. At the same time, the routing paths of other affected communities are also restored to the initial state.

[0120] Optionally, when the target community contains multiple nodes, the routing paths of the multiple nodes in the target community are restored in turn according to the recovery priorities of the multiple nodes in the target community; wherein the recovery priority of each node can be determined according to the node type or the type of business performed by the node. For example, if a node is a core node, or the business type performed by the node is a core business, a higher recovery priority can be assigned to prioritize the restoration of normal operation of the core node or core business.

[0121] Furthermore, the attack information of the abnormal traffic attack on the target node can also be recorded; wherein the attack information includes at least one of the following: node information of the target node, abnormal traffic information, attack type, attack duration, and attack intensity.

[0122] The abnormal traffic information may specifically be the distribution characteristics of the abnormal traffic, etc. Specifically, by recording the attack information of this abnormal traffic attack, the pattern characteristics of the abnormal traffic attack can be analyzed to improve the preset defense strategy, thereby reducing the impact of the abnormal traffic attack on the autonomous domain network.

[0123] Combine the following Figure 4 The overall logic of the method for scheduling attack traffic according to an embodiment of the present application is exemplarily introduced.

[0124] like Figure 4 As shown, taking the abnormal traffic attack as a DDOS attack and using the Leiden algorithm to divide the community as an example, the method for scheduling attack traffic in the embodiment of the present application includes the following steps:

[0125] S401: Detect the network status of the autonomous domain network.

[0126] Specifically, each communication link in the autonomous domain network is detected, and the network data volume on each communication link is periodically sampled.

[0127] S402: Determine key values ​​according to the network situation and obtain an adjacency matrix.

[0128] Specifically, according to the network data volume and maximum bandwidth of each communication link, the bandwidth occupancy rate of the communication link between every two nodes is calculated to obtain the key value and form an adjacency matrix.

[0129] The adjacency matrix can be expressed as A in the above embodiment: ij , A ij It represents the bandwidth occupancy of the communication link between any two nodes i and j.

[0130] S403: According to a set fixed period, iteratively execute the Leiden algorithm to update the community division within the autonomous domain network.

[0131] The fixed period is the first set period in the above embodiment. The calculation formula of the Leiden algorithm is the above formula (2), that is, based on the adjacency matrix A ij , the total bandwidth occupancy rate m of all communication links between multiple nodes, the degrees ki and kj of any two nodes i and j, and the indicator function δ(c i , c j ), calculate the modularity Q.

[0132] Assume that the adjacency matrix A can be obtained from S402 ij , as shown in the following formula (3):

[0133]

[0134] A 12 =A 21 =0.2, A 13 =A 31 =0.4, A 24 =A 42 =0.5, A 34 =A 43 =0.8, A 35 =A 53 =0.1, A 56 =A 65 =0.1, A 46 =A 64 =0.3.

[0135] Based on this, the degree of each node can be obtained, as shown in the following formulas (4) to (9):

[0136] k1=A 12 +A 13 =0.2+0.4=0.6 (4)

[0137] k2=A 21 +A 24 =0.2+0.5=0.8 (5)

[0138] k3=A 31 +A 34 +A 35 =0.4+0.8+0.1=1.3 (6)

[0139] k4=A 42 +A 43 +A 46 =0.5+0.8+0.3=1.6 (7)

[0140] k5=A 53 +A 56 =0.1+0.1=0.2 (8)

[0141] k6=A 64 +A 65 =0.3+0.1=0.4 (9)

[0142] The total bandwidth occupancy rate m of all communication links between multiple nodes can be calculated by the following formula (10):

[0143]

[0144] In addition, the bandwidth occupancy rates of all communication links between multiple nodes may be directly summed to obtain m.

[0145] If it is the first time to divide multiple nodes into communities, then δ(c i ,c j ) is 0 for any two nodes i and j. If multiple nodes have been divided into communities, we can take δ(c i ,c j ), that is, nodes i and j are in the same communityδ(c i ,c j ) is 1 if the value is true, otherwise it is 0.

[0146] For each node, try to move it to the community where all adjacent nodes are located, then recalculate the Q value for each possible movement method generated, select the movement method that can increase the Q value the most, and if no movement method can increase the Q value, do not move the node. Repeat the above process until the Q value cannot be increased no matter how it is moved.

[0147] S404: Determine whether a DDoS attack occurs. If not, return to S401; if yes, continue to execute S405.

[0148] Specifically, the DDoS attack detection result is obtained from other functional units (such as the detection unit) to determine whether a DDoS attack occurs.

[0149] S405: Immediately execute the Leiden algorithm to update the community division within the autonomous domain network.

[0150] S406: According to the updated community division result, the routing strategy of the autonomous domain network is adjusted in a targeted manner.

[0151] Specifically, the target community to be attacked is determined, and according to the preset routing adjustment strategy, the routing path of the network traffic flowing through each node in the target community is switched to the corresponding node in other communities.

[0152] Assume that the community division results are community A: R1, R2, community B: R3, R4, community C: R5, R6. If R4 is currently under DDoS attack, the community B where node R4 is located will be isolated for traffic. First, reduce the abnormal traffic flowing to R4. Since R4 and R3 are in the same community, if community B is immediately isolated, it may cause network interruption. Therefore, the abnormal traffic flowing to R4 should be filtered and redirected to node R3 as much as possible, which can disperse the abnormal traffic and prevent R4 from being overloaded. Then, adjust the routing strategies of community A, community C, and community B, and transfer the network traffic passing through community B to community A and community C. If network traffic must be sent to the community, it should be sent through R3 instead of directly to R4.

[0153] S407: Restore the routing policy of the autonomous domain network and record the attack information of this DDoS attack.

[0154] Among them, the routing path of each node in the target community and the routing paths of corresponding nodes in other communities can be restored according to the preset recovery strategy. The preset routing recovery strategy can be set according to the specific situation. For example, the routing path of each node in the target community is restored to the initial state, and at the same time, the routing paths of other communities are also restored to the initial state. By recording the attack information of this DDoS attack, preparations can be made for subsequent attack defense strategy updates.

[0155] A method for scheduling attack traffic provided by an embodiment of the present application can cope with abnormal traffic attacks (such as DDOS attacks) in the existing Internet, so that the defender can dynamically, adaptively, and more fine-grainedly schedule abnormal traffic and normal traffic. Specifically, the embodiment of the present application uses the Leiden algorithm to iteratively update the community division results regularly through the detected network traffic information, and automatically redirects, isolates, and limits the traffic of the target community attacked by abnormal traffic according to the updated community division results, thereby reducing the harm and impact of abnormal traffic attacks, and also buying time for subsequent defense to ensure the service availability of users; and after the autonomous domain network responds to the abnormal traffic attack in a timely manner, it quickly recovers according to the preset routing recovery strategy, and records the attack information in a timely manner, so as to prepare for the subsequent update of the attack defense strategy, and improve the integrity and robustness of this solution.

[0156] Based on the same inventive concept, an embodiment of the present application also provides a device for scheduling attack traffic. The principle of solving the problem by the device is similar to the method of the above embodiment. Therefore, the implementation of the device can refer to the implementation of the above method, and the repeated parts will not be repeated.

[0157] like Figure 5 As shown, it is a schematic diagram of the structure of the device 500 for scheduling attack traffic, which may include:

[0158] The first division unit 501 is used to iteratively perform the following setting operation every first set period during the normal operation of multiple nodes in the autonomous domain network: divide the multiple nodes into multiple communities according to the network traffic information transmitted between every two nodes with a current communication link; each community includes at least one node, and each node is any device in the autonomous domain network;

[0159] The second division unit 502 is used to perform a setting operation to update the divided multiple communities to obtain multiple newly divided communities if it is determined that the target node in the autonomous domain network is attacked by abnormal traffic;

[0160] The scheduling unit 503 is configured to determine a target community where a target node is located from the multiple newly divided communities, and to restrict network traffic of at least one node in the target community.

[0161] Optionally, the network traffic information includes bandwidth occupancy, and the device further includes a detection unit, which is used to:

[0162] Detecting the amount of network data transmitted between every two nodes having a communication link among the plurality of nodes within a set time period before a current moment;

[0163] The bandwidth occupancy rate of the communication link between every two nodes is determined according to the amount of network data transmitted between every two nodes and the maximum bandwidth of the communication link.

[0164] Optionally, the first dividing unit 501 is specifically configured to:

[0165] Determine the degree of each node according to the bandwidth occupancy of the communication link between every two nodes, where the degree represents the sum of the bandwidth occupancy of the communication link between each node and other nodes;

[0166] According to the bandwidth occupancy rate of the communication link between every two nodes, the total bandwidth occupancy rate of all communication links between multiple nodes is obtained;

[0167] According to the bandwidth occupancy of the communication link between every two nodes, the degree of each node and the total bandwidth occupancy, multiple nodes are divided into multiple communities in combination with the set division method.

[0168] Optionally, when dividing a plurality of nodes into a plurality of communities according to the bandwidth occupancy rate of the communication link between every two nodes, the degree of each node, and the total bandwidth occupancy rate, in combination with a set division method, the first division unit 501 is specifically used to:

[0169] For multiple communities divided by multiple nodes, set operations are performed based on the bandwidth occupancy rate of the communication link between every two nodes, the degree of each node, the total bandwidth occupancy rate, and the indicator function of every two nodes to obtain the modularity; wherein, when two nodes are in the same community, the indicator function of the two nodes is the first value, and when the two nodes are not in the same community, the indicator function of the two nodes is the second value, and the modularity represents the difference between the density of connections within the community and random connections;

[0170] Repeat the following node movement operation iteratively until no node movement increases the modularity:

[0171] Traverse each node and try to move the node to the community where all adjacent nodes are located. For each movement method, redetermine the modularity and obtain the updated modularity.

[0172] For each node, a moving method that increases the updated modularity the most is selected from multiple moving methods. If the updated modularity corresponding to multiple moving methods does not increase, the moving node is abandoned.

[0173] Optionally, the device further comprises:

[0174] A third division unit is used to iteratively perform a setting operation on the newly divided multiple communities every second setting period; wherein the second setting period is smaller than the first setting period;

[0175] The scheduling unit is further configured to restrict the network traffic of at least one node in the changed target community if it is determined that the target community where the target node is located has changed according to the multiple communities divided most recently.

[0176] Optionally, the scheduling unit 503 is specifically configured to:

[0177] According to the preset routing adjustment strategy, the routing path of the network traffic flowing through each node in the target community is switched to the corresponding node in other communities among the newly divided multiple communities.

[0178] Optionally, the device further comprises:

[0179] A recovery unit, configured to recover the routing path of at least one node in the target community and the routing paths of corresponding nodes in other communities according to a preset routing recovery strategy after processing the abnormal traffic attack on the target node;

[0180] The recording unit is used to record the attack information of the abnormal traffic attack on the target node; wherein the attack information includes at least one of the following: node information of the target node, abnormal traffic information, attack type, attack duration, and attack intensity.

[0181] For the convenience of description, the above parts are divided into modules (or units) according to their functions and described separately. Of course, when implementing this application, the functions of each module (or unit) can be implemented in the same or multiple software or hardware.

[0182] After introducing the method and apparatus for scheduling attack traffic according to an exemplary embodiment of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0183] Based on the same inventive concept as the above method embodiment, an electronic device is also provided in the embodiment of the present application. In one embodiment, the electronic device may be a server or a terminal device. In this embodiment, the structure of the electronic device may be as follows: Figure 6 As shown, it includes a memory 601 , a communication module 603 and one or more processors 602 .

[0184] The memory 601 is used to store computer programs executed by the processor 602. The memory 601 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and programs required for running the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0185] The memory 601 may be a volatile memory, such as a random-access memory (RAM); the memory 601 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 601 may be any other medium that can be used to carry or store a desired computer program in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 601 may be a combination of the above memories.

[0186] The processor 602 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 602 is configured to implement the above method for scheduling attack traffic when calling the computer program stored in the memory 601 .

[0187] The communication module 603 is used to communicate with terminal devices and other servers.

[0188] The specific connection medium between the memory 601, the communication module 603 and the processor 602 is not limited in the embodiment of the present application. Figure 6 In the embodiment, the memory 601 and the processor 602 are connected via a bus 604. The bus 604 is connected to the processor 602 via a bus 604. Figure 6 The connections between the other components are only for illustration and are not intended to be limiting. The bus 604 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Figure 6 The diagram shows that only one thick line is used, but this does not mean that there is only one bus or only one type of bus.

[0189] The embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed on an electronic device, the computer program is used to enable the electronic device to execute the method for scheduling attack traffic in the above embodiment, such as Figure 2 shown.

[0190] The computer-readable storage medium in the above embodiments can be any available medium or data storage device that can be accessed by the processor in the device, including but not limited to magnetic storage such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc., optical storage such as CDs, DVDs, BDs, HVDs, etc., and semiconductor storage such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drives (SSDs), etc.

[0191] In some possible implementations, various aspects of the method for scheduling attack traffic provided in the embodiments of the present application may also be implemented in the form of a program product, which includes a computer program. When the program product is run on an electronic device, the computer program is used to enable the electronic device to execute the steps of the method for scheduling attack traffic according to various exemplary embodiments of the present application described above in this specification. For example, the electronic device may execute the following steps: Figure 2 Follow the steps shown in .

[0192] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0193] The program product of the embodiment of the present application may adopt a portable compact disk read-only memory (CD-ROM) and include a computer program, and can be run on an electronic device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which can be used by or in combination with a command execution system, apparatus, or device.

[0194] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, apparatus, or device.

[0195] The computer program embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0196] The computer program for performing the operation of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and also conventional procedural programming languages ​​such as "C" language or similar programming languages. The computer program can be executed entirely on the user electronic device, partially on the user electronic device, as a separate software package, partially on the user electronic device and partially on a remote electronic device, or entirely on a remote electronic device or server. In the case of a remote electronic device, the remote electronic device can be connected to the user electronic device through any type of network including a local area network (LAN) or a wide area network (WAN), or can be connected to an external electronic device (for example, using an Internet service provider to connect through the Internet).

[0197] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0198] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0199] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain a computer-usable computer program.

[0200] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program commands. These computer program commands can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the commands executed by the processor of the computer or other programmable data processing device generate commands for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0201] These computer program commands may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the commands stored in the computer readable memory produce an article of manufacture comprising a command device, the command device implementing the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0202] These computer program commands can also be loaded onto a computer or other programmable data processing device so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the commands executed on the computer or other programmable device provide the instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0203] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0204] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for scheduling attack traffic, characterized in that: include: During normal operation of multiple nodes in the autonomous domain network, the following setting operation is iteratively performed every first setting period: according to network traffic information transmitted between every two nodes with a current communication link, the multiple nodes are divided into multiple communities, each community includes at least one node, and each node is a device in the autonomous domain network; If it is determined that the target node in the autonomous domain network is attacked by abnormal traffic, the setting operation is performed to update the divided multiple communities to obtain newly divided multiple communities; A target community where the target node is located is determined from the multiple newly divided communities, and network traffic is restricted for at least one node in the target community.

2. The method according to claim 1, characterized in that The network traffic information includes bandwidth occupancy rate, and the network traffic information transmitted between every two nodes having a communication link is obtained by: Detecting the amount of network data transmitted between every two nodes having a communication link among the plurality of nodes within a set time period before a current moment; The bandwidth occupancy rate of the communication link between every two nodes is determined according to the amount of network data transmitted between every two nodes and the maximum bandwidth of the communication link.

3. The method according to claim 2, characterized in that The dividing the plurality of nodes into a plurality of communities according to the network traffic information transmitted between every two nodes having a communication link currently includes: Determine the degree of each node according to the bandwidth occupancy rate of the communication link between every two nodes, wherein the degree represents the sum of the bandwidth occupancy rates of the communication links between each node and other nodes; Obtaining a total bandwidth occupancy rate of all communication links between the plurality of nodes according to the bandwidth occupancy rate of the communication link between every two nodes; According to the bandwidth occupancy rate of the communication link between every two nodes, the degree of each node and the total bandwidth occupancy rate, the multiple nodes are divided into multiple communities in combination with a set division method.

4. The method according to claim 3, characterized in that The dividing the plurality of nodes into a plurality of communities according to the bandwidth occupancy rate of the communication link between every two nodes, the degree of each node and the total bandwidth occupancy rate in combination with a set division method comprises: For the multiple communities into which the multiple nodes have been divided, a set operation is performed based on the bandwidth occupancy rate of the communication link between every two nodes, the degree of each node, the total bandwidth occupancy rate, and the indicator function of every two nodes to obtain a modularity; wherein, when the two nodes are in the same community, the indicator function of the two nodes is a first value, and when the two nodes are not in the same community, the indicator function of the two nodes is a second value, and the modularity represents the difference between the density of connections within the community and random connections; Repeat the iterative execution of the following node movement operation until no node movement increases the modularity: Traversing each node, trying to move the node to the community where all adjacent nodes are located, and for each movement method, re-determining the modularity to obtain an updated modularity; For each node, a moving mode that increases the updated modularity the most is selected from a plurality of moving modes. If the updated modularity corresponding to the plurality of moving modes does not increase, the node is abandoned from being moved.

5. The method according to claim 1, characterized in that After limiting the network traffic of at least one node in the target community, the method further includes: For the newly divided multiple communities, iteratively perform the setting operation every second setting period; wherein the second setting period is smaller than the first setting period; If it is determined according to the latest divided multiple communities that the target community where the target node is located has changed, network traffic restriction is performed on at least one node in the changed target community.

6. The method according to any one of claims 1 to 5, characterized in that: The limiting the network traffic of at least one node in the target community includes: According to a preset routing adjustment strategy, the routing path of the network traffic flowing through each node in the target community is switched to a corresponding node in another community among the multiple newly divided communities.

7. The method according to claim 6, characterized in that After limiting the network traffic of at least one node in the target community, the method further includes: After processing the abnormal traffic attack on the target node, restoring the routing path of at least one node in the target community and the routing paths of the corresponding nodes in the other communities according to a preset routing restoration strategy; and Record the attack information of the abnormal traffic attack suffered by the target node; wherein the attack information includes at least one of the following: node information of the target node, abnormal traffic information, attack type, attack duration, and attack intensity.

8. A device for scheduling attack traffic, characterized in that: include: A first division unit is configured to iteratively perform the following setting operation every first set period during the normal operation of multiple nodes in the autonomous domain network: dividing the multiple nodes into multiple communities according to network traffic information transmitted between every two nodes with a current communication link; wherein each community includes at least one node, and each node is a device in the autonomous domain network; A second division unit is configured to execute the setting operation if it is determined that the target node in the autonomous domain network is attacked by abnormal traffic, update the divided multiple communities, and obtain multiple newly divided communities; The scheduling unit is used to determine the target community where the target node is located from the multiple newly divided communities, and to restrict the network traffic of at least one node in the target community.

9. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of any one of the methods of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: It includes a computer program. When the computer program is run on an electronic device, the computer program is used to enable the electronic device to execute the steps of any method described in claims 1 to 7.

Images