Anti-DDoS strategy deployment method of cloud native system

Abstract

The invention discloses an anti-DDoS strategy deployment method of a cloud native system, and relates to the technical field of network security. The method specifically comprises the steps that a user using the cloud native system sends an anti-D strategy demand to a control center of the cloud native system, and the control center analyzes the anti-D strategy demand of the user; and S3, generating an anti-D strategy according to an analysis result of the control center according to the anti-D strategy demand of the user in the step S1, and deploying the anti-D strategy to the cloud native system used by the user by the control center. On the basis that an existing anti-D strategy is abstracted into capacity, how to deploy the anti-D strategy in a cloud native system at any time and any place according to user requirements is achieved, so that the deployment cost is reduced, and the anti-D strategy is compatible with the current network environment.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically to an anti-DDoS strategy deployment method for a cloud native system. Background Art

[0002] DDoS attacks are one of the most important means of attack in current network attacks. They evolved from DoS attacks and are characterized by the fact that DDoS attacks can quickly exhaust the resources of the target system through a large number of requests, causing it to be unable to provide services normally. This type of attack may cause serious economic losses and reputation losses to enterprises, organizations or individuals.

[0003] With the popularization of the Internet and the increase in the connection of various devices, the scale and frequency of DDoS attacks are also growing, posing greater challenges to network security.

[0004] Cloud-network integration refers to the combination of cloud computing and communication networks, which fully utilizes the respective advantages of cloud computers and networks. Cloud computing can dynamically adjust resources according to demand, and the network side realizes fast data transmission and wider coverage, with high flexibility and elasticity. Cloud-network integration development deploys supercomputing power to the user end, realizes cloud-edge integration, and achieves full network coverage through central cloud and edge cloud, bringing cloud-network capabilities to the extreme.

[0005] Cloud native aims to use technologies such as cloud computing, containerization, and microservices to build highly flexible and easy-to-manage applications and give full play to the potential of cloud computing. Cloud native can deploy applications according to demand, flexibly combine and link applications, perform automated management, realize flexible deployment of network functions, and improve the response speed and efficiency of applications.

[0006] Cloud-network integration provides flexible and sufficient basic conditions for various cloud-native businesses. Based on cloud-native, with the help of software-based concepts, traditional anti-D is abstracted into capabilities, breaking through the constraints of the existing network structure, realizing flexible combination and linkage of system functions, and possessing new features such as deployment, orchestration, expansion and update, solving the problems of rigid deployment and high cost of traditional hardware.

[0007] Flexible deployment means that services or applications can be deployed at any time and any place in computer systems and networks according to user needs and configuration environment, and services or applications can be dynamically adjusted according to actual conditions, including adjusting configuration parameters, changing deployment locations, increasing or decreasing resources, etc., so that services or applications can adapt to different environments and scenarios, including different hardware platforms, operating systems, network environments, etc.

[0008] Traditional anti-D methods require the deployment of corresponding hardware devices and software functions in the physical network, which leads to the lack of flexibility and elasticity of traditional anti-D systems, which in turn leads to problems such as inability to deploy on demand, difficulty in mutual compatibility of anti-D policies, and high deployment costs. Currently, there are technologies that can abstract all anti-D functions into capabilities, which can break through the constraints of the existing network structure; however, how to deploy anti-D policies at any time and any place in the cloud native system according to user needs, and how to be compatible with the current network environment is an urgent problem to be solved. Summary of the invention

[0009] In order to overcome the defects and shortcomings of the above-mentioned prior art, the present invention provides an anti-DDoS strategy deployment method for a cloud native system. The purpose of the present invention is to deploy an anti-DDoS strategy in a cloud native system at any time and any place according to user needs, based on the existing abstraction of anti-D strategies as capabilities, so as to reduce deployment costs and make it compatible with the current network environment.

[0010] In order to solve the above problems existing in the prior art, the present invention is implemented through the following technical solutions.

[0011] The present invention provides a method for deploying an anti-DDoS strategy for a cloud native system, the method comprising the following steps: S1. Users of the cloud native system send anti-D policy requirements to the control center of the cloud native system, and the control center analyzes the user's anti-D policy requirements; specifically, The control center determines the key attributes of user needs from the user's anti-D strategy requirements, and then conducts risk assessment on user needs; S2. According to the analysis results of the user's anti-D policy requirements in step S1, the control center generates an anti-D policy, and the control center deploys the anti-D policy to the cloud native system used by the user; The anti-D strategy is achieved by the control center analyzing user needs, perceiving the current network status of the cloud native system, and predicting future attacks, abstracting capabilities, combining and linking them in a set order to form a service chain and deploying them to the cloud native system. The capability refers to the virtualized components abstracted from traditional anti-D functions; decoupling traditional anti-D functions from hardware, implementing network functions in a virtualized environment through network programming, using management and orchestration systems to configure, manage and optimize virtual network functions, and deploying them in containers at any location on the physical network in the cloud native system.

[0012] Further preferably, the method also includes a real-time monitoring step after the anti-D strategy is deployed, that is, after the anti-D strategy is deployed, the control center receives user feedback and network capacity usage in real time, and uses a detection algorithm to monitor whether the anti-D strategy meets user expectations. If the expected effect is not achieved, the control center issues a control instruction to optimize the deployed anti-D strategy.

[0013] More preferably, the optimizing the anti-D strategy that has been deployed includes readjusting the deployment mode of the anti-D strategy.

[0014] More preferably, the control center issues a control instruction to optimize the deployed anti-D strategy, including any one or more combinations of the following three trigger conditions; The first trigger condition is a sudden hardware failure in the physical network, a network connection failure, or an adjustment; The second trigger condition is that user needs and anti-D strategies fail to achieve the expected effects due to deployment problems; The third trigger condition is to perform load balancing when multiple anti-D strategies are deployed at the same time.

[0015] More preferably, the load balancing specifically refers to maintaining the balance of computing, storage and communication pressure at each location in the physical network through flexible scheduling when multiple anti-D strategies are deployed simultaneously.

[0016] More preferably, the flexible scheduling form specifically means that in the physical network, if the resources of a certain node or a certain link are exhausted, and the resources of other nodes or links are sufficient, the capacity of the node or link with exhausted resources is deployed to the node or link with sufficient resources.

[0017] Further preferably, in step S1, the control center determines the key attributes of the user's needs from the user's anti-D strategy requirements, and the key attributes include the user's needs for a certain capability, the user's needs for time certainty in anti-D, or the user's needs for a certain resource.

[0018] Further preferably, in step S1, risk assessment of user needs is performed, specifically, a probability analysis method or an expert system risk assessment method is used to comprehensively assess the DDoS attack risks currently faced by the user, the types of attacks suffered, and potential attack sources.

[0019] Further preferably, in step S2, after the anti-D strategy is generated, the control center selects a suitable location in the physical network of the cloud native system for deployment, and deploys various capabilities on the service chain in a container manner.

[0020] Further preferably, the deployment location of the anti-D strategy is determined based on the key attributes of the user's needs and the actual physical network conditions of the cloud native system. The actual physical network conditions of the cloud native system include the resource occupancy or link bandwidth of each node or link.

[0021] Compared with the prior art, the beneficial technical effects brought by the present invention are as follows: 1. The present invention can deploy anti-D strategies at any time and any place in the cloud native system according to user needs. Compared with the existing anti-D strategy deployment method, the deployment cost is reduced. The anti-D strategy is generated by combining the perception of the current network status of the cloud native system and the prediction of future attacks, so that the generated anti-D strategy can be compatible with the current network environment of the cloud native system.

[0022] 2. The present invention abstracts traditional anti-D functions into virtualized components to form various anti-D capabilities, and then deploys them in containers at any location in the physical network of the cloud native system, solving the problem of high cost of anti-D policy deployment in the current network, and also solving the problem that the current network structure is rigid and the anti-D function depends on hardware devices, making it difficult to deploy flexibly. According to user needs, the perception of the current network status of the cloud native system, and the prediction of future attacks, the present invention combines and links the abstracted capabilities in a set order to form a service chain and deploys it to the cloud native system, which can realize on-demand deployment of anti-D policies, solve the problems of rigid and inflexible management of current anti-D policies, and can flexibly schedule policies through flexible deployment of anti-D policies. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 The figure is a flow chart of the anti-DDoS strategy deployment method of the cloud native system of the present invention. DETAILED DESCRIPTION

[0024] The technical solution for achieving the purpose of the present invention is further described below through specific embodiments. It should be noted that the technical solution claimed to be protected by the present invention includes but is not limited to the following embodiments.

[0025] Example 1 As a preferred embodiment of the present invention, refer to the attached specification Figure 1 As shown, this embodiment discloses a method for deploying an anti-DDoS strategy for a cloud native system, the method comprising the following steps: S1. Users of the cloud native system send anti-D policy requirements to the control center, and the control center analyzes the user's anti-D policy requirements; specifically, The control center determines the key attributes of user needs from the user's anti-D strategy requirements, and then conducts risk assessment on user needs; S2. According to the analysis results of the user's anti-D policy requirements in step S1, the control center generates an anti-D policy, and the control center deploys the anti-D policy to the cloud native system used by the user; The anti-D strategy is achieved by the control center analyzing user needs, perceiving the current network status of the cloud native system, and predicting future attacks, abstracting capabilities, combining and linking them in a set order to form a service chain and deploying them to the cloud native system. The capability refers to the virtualized components abstracted from traditional anti-D functions; decoupling traditional anti-D functions from hardware, implementing network functions in a virtualized environment through network programming, using management and orchestration systems (such as MANO, Management and Orchestration) to configure, manage and optimize virtual network functions, and deploying them in containers at any location of the physical network in the cloud native system.

[0026] In this embodiment, various traditional anti-D functions are abstracted into various virtualized components to form various anti-D capabilities, which are integrated into the capability pool of the control center. Then, based on the analysis of user needs, the perception of the current network status of the cloud native system, and the prediction of future attacks, the corresponding capabilities are extracted from the capability pool, and the extracted capabilities are combined and linked in a set order to form a service chain and deployed to the cloud native system.

[0027] Example 2 As another preferred embodiment of the present invention, this embodiment is based on the above-mentioned embodiment 1, and further supplements and explains the technical solution of the present invention in detail. Figure 1 As shown, the method also includes a real-time monitoring step after the anti-D strategy is deployed, that is, after the anti-D strategy is deployed, the control center receives user feedback and network capacity usage in real time, and uses a detection algorithm to monitor whether the anti-D strategy meets user expectations. If the expected effect is not achieved, the control center issues a control instruction to optimize the deployed anti-D strategy.

[0028] The optimizing of the deployed anti-D strategy includes readjusting the deployment mode of the anti-D strategy.

[0029] Furthermore, the control center issues control instructions to optimize the deployed anti-D strategy, including any one or more combinations of the following three trigger conditions; The first trigger condition is a sudden hardware failure in the physical network, a network connection failure, or an adjustment; The second trigger condition is that user needs and anti-D strategies fail to achieve the expected effects due to deployment problems; The third trigger condition is to perform load balancing when multiple anti-D strategies are deployed at the same time.

[0030] The load balancing specifically refers to maintaining the balance of computing, storage and communication pressure at each location in the physical network through flexible scheduling when multiple anti-D strategies are deployed simultaneously.

[0031] The flexible scheduling specifically means that, in a physical network, if resources of a certain node or a certain link are exhausted and resources of other nodes or links are sufficient, the capacity of the node or link with exhausted resources is deployed to the node or link with sufficient resources.

[0032] Example 3 As another preferred embodiment of the present invention, this embodiment further supplements and elaborates on the technical solution of the present invention on the basis of the above-mentioned embodiment 1 or embodiment 2. In this embodiment, in step S1, the control center determines the key attributes of the user's requirements from the user's anti-D strategy requirements, and the key attributes include the user's requirements for a certain specific capability, the user's requirements for time certainty against D, or the user's requirements for a certain specific resource.

[0033] In step S1, risk assessment of user needs is performed, specifically, using probability analysis or expert system risk assessment methods to conduct a comprehensive assessment of the DDoS attack risks currently faced by users, the types of attacks suffered, and potential attack sources.

[0034] In step S2, after the anti-D policy is generated, the control center selects a suitable location in the physical network of the cloud native system for deployment, and deploys various capabilities on the service chain in the form of containers.

[0035] The deployment location of the anti-D policy is determined based on the key attributes of user needs and the actual physical network conditions of the cloud native system. The actual physical network conditions of the cloud native system include the resource occupancy or link bandwidth of each node or link.

[0036] Example 4 As another preferred embodiment of the present invention, this embodiment is a further detailed supplement and elaboration of the technical solution of the present invention on the basis of the above-mentioned embodiment 1, embodiment 2 or embodiment 3.

[0037] In this embodiment, deploying an anti-D strategy in a cloud-native system requires going through three stages, namely: user demand analysis stage, deployment location selection stage, and post-deployment real-time monitoring stage; the deployed anti-D strategy also needs to have two functions, namely flexible scheduling and load balancing.

[0038] According to the user demand analysis phase among the three phases mentioned above, when a user suffers from a DDoS attack, the control center of the cloud native system perceives the user demand and analyzes the user's anti-D strategy requirements. First, it is necessary to determine the key attributes of the user demand, such as whether the user requires a certain capability or whether there is a demand for time certainty in anti-D. Then, a risk assessment is conducted on the user's demand. Based on the collected intelligence, the DDoS attack risk faced by the user is assessed, including the attack type and potential attack source.

[0039] According to the deployment location selection stage in the above three stages, after analyzing user needs, the control center in the cloud native system will deploy the anti-D strategy to the cloud native system according to user needs. The anti-D strategy is implemented by a service chain formed by the linkage of abstracted capability combinations. Capabilities are virtualized components abstracted from traditional anti-D functions by software methods. Specifically, traditional anti-D functions are decoupled from hardware, and network functions are implemented in a virtualized environment through network programming. Management and orchestration systems (such as MANO, Management and Orchestration) are used to configure, manage and optimize virtual network functions, such as drainage functions, cleaning functions, detection functions, etc., which can be deployed to various locations in the cloud native system in the form of containers. The choice of deployment location is mainly based on user needs and the actual situation in the network. Select a suitable location in the physical network of the cloud native system and deploy various capabilities on the service chain in the form of containers.

[0040] According to the post-deployment real-time monitoring stage among the above three stages, the anti-D efficiency of the anti-D strategy is evaluated after its deployment to determine whether it has met the user's expected requirements and provide feedback. If the anti-D efficiency required by the user is not met, the control center will readjust the deployment method of the anti-D strategy through automated components based on user needs and the actual network environment.

[0041] The deployed anti-D strategy has a flexible scheduling function, which mainly means optimizing the deployed anti-D strategy through automated components. It includes three trigger conditions: C1: Sudden hardware failures, network connection failures, and human adjustments in the physical network.

[0042] C2: User needs and anti-D strategies did not meet expectations due to deployment issues.

[0043] C3: When multiple anti-D strategies are deployed at the same time, load balancing is performed.

[0044] The deployed anti-D strategy has a load balancing function, which is mainly to maintain the balance of computing, storage, and communication pressure at each location in the physical network through flexible scheduling when multiple anti-D strategies are deployed at the same time.

[0045] Example 5 As another preferred embodiment of the present invention, this embodiment is a further detailed supplement and elaboration of the technical solution of the present invention on the basis of the above-mentioned embodiment 1, embodiment 2, embodiment 3 or embodiment 4.

[0046] In this embodiment, deploying an anti-D strategy in a cloud-native system requires three stages, namely, analysis of user demand for using the cloud-native system, selection of deployment locations, and real-time monitoring after deployment. The deployment strategy also needs to include two functions, namely, flexible scheduling and liability balancing.

[0047] In the user demand analysis phase, users send anti-D strategy requirements to the control center, and the control center analyzes the user's anti-D strategy requirements. First, the control center determines the key attributes of the user's requirements, such as the user's need for a certain capability, the user's need for time certainty in anti-D, or the user's need for a specific resource. After determining the key attributes of the user's requirements, the user's requirements are risk assessed, and risk assessment methods such as probability analysis and expert systems are used to conduct a comprehensive assessment of the DDoS attack risks currently faced by users, the types of attacks suffered, and potential attack sources.

[0048] The anti-D strategy is achieved by the control center analyzing user needs, perceiving the current network status, and predicting future attacks. The capabilities are abstracted and combined in a certain order to form a service chain and deployed to the cloud native system. The capabilities are virtualized components abstracted from traditional anti-D functions. The traditional anti-D functions are decoupled from the hardware, and network functions are implemented in a virtualized environment through network programming. Management and orchestration systems (such as MANO, Management and Orchestration) are used to configure, manage, and optimize virtual network functions. They can be deployed in containers at any location in the physical network of the cloud native system.

[0049] After forming an anti-D strategy, select a suitable location in the physical network of the cloud native system for deployment, and deploy various capabilities on the service chain in the form of containers. The choice of deployment location is mainly determined based on user needs and actual network conditions. For example, which resources or time certainty the user requires, the resource occupancy of each node in the network, link bandwidth, etc.

[0050] After the anti-D strategy is deployed, its efficiency is evaluated. Based on user feedback and network capacity usage, a detection algorithm is used to detect whether the anti-D strategy meets user expectations. If the ideal efficiency is not achieved, the control center will issue control instructions to readjust the deployment method.

[0051] The control center issues control instructions to optimize the deployed anti-D strategy, including any one or more combinations of the following three trigger conditions; The first trigger condition is a sudden hardware failure in the physical network, a network connection failure, or an adjustment; The second trigger condition is that user needs and anti-D strategies fail to achieve the expected effects due to deployment problems; The third trigger condition is to perform load balancing when multiple anti-D strategies are deployed at the same time.

[0052] The load balancing specifically refers to maintaining the balance of computing, storage and communication pressure at each location in the physical network through flexible scheduling when multiple anti-D strategies are deployed simultaneously. The flexible scheduling specifically refers to that in the physical network, if the resources of a node or a link are exhausted and the resources of other nodes or links are sufficient, the capacity of the node or link with exhausted resources will be deployed to the node or link with sufficient resources.

Claims

1. A method for deploying anti-DDoS strategies for a cloud native system, characterized in that: The method comprises the following steps: S1. Users of the cloud native system send anti-D policy requirements to the control center of the cloud native system, and the control center analyzes the user's anti-D policy requirements; specifically, The control center determines the key attributes of user needs from the user's anti-D strategy requirements, and then conducts risk assessment on user needs; S2. According to the analysis results of the user's anti-D policy requirements in step S1, the control center generates an anti-D policy, and the control center deploys the anti-D policy to the cloud native system used by the user; The anti-D strategy is achieved by the control center analyzing user needs, perceiving the current network status of the cloud native system, and predicting future attacks, abstracting capabilities, combining and linking them in a set order to form a service chain and deploying them to the cloud native system. The capability refers to the virtualized components abstracted from traditional anti-D functions; decoupling traditional anti-D functions from hardware, implementing network functions in a virtualized environment through network programming, using management and orchestration systems to configure, manage and optimize virtual network functions, and deploying them in containers at any location on the physical network in the cloud native system.

2. The anti-DDoS strategy deployment method for a cloud native system according to claim 1, characterized in that: The method also includes a real-time monitoring step after the anti-D strategy is deployed, that is, after the anti-D strategy is deployed, the control center receives user feedback and network capacity usage in real time, and uses a detection algorithm to monitor whether the anti-D strategy meets user expectations. If the expected effect is not achieved, the control center issues a control instruction to optimize the deployed anti-D strategy.

3. The anti-DDoS strategy deployment method for a cloud native system according to claim 2, characterized in that: The optimization of the already deployed anti-D strategy includes readjusting the deployment method of the anti-D strategy.

4. The anti-DDoS strategy deployment method for a cloud native system according to claim 2, characterized in that: The control center issues control instructions to optimize the deployed anti-D strategy, including any one or more combinations of the following three trigger conditions; The first trigger condition is a sudden hardware failure in the physical network, a network connection failure, or an adjustment; The second trigger condition is that user needs and anti-D strategies fail to achieve the expected effects due to deployment problems; The third trigger condition is to perform load balancing when multiple anti-D strategies are deployed at the same time.

5. The anti-DDoS strategy deployment method for a cloud native system according to claim 4, characterized in that: The load balancing specifically refers to maintaining the balance of computing, storage, and communication pressure at each location in the physical network through flexible scheduling when multiple anti-D strategies are deployed simultaneously.

6. The anti-DDoS strategy deployment method for a cloud native system according to claim 5, characterized in that: The flexible scheduling specifically means that, in a physical network, if resources of a certain node or a certain link are exhausted and resources of other nodes or links are sufficient, the capacity of the node or link with exhausted resources is deployed to the node or link with sufficient resources.

7. The anti-DDoS strategy deployment method for a cloud native system according to any one of claims 1 to 6, characterized in that: In step S1, the control center determines the key attributes of the user's requirements from the user's anti-D strategy requirements, which include the user's requirements for a certain capability, the user's requirements for time certainty against D, or the user's requirements for a certain resource.

8. The anti-DDoS strategy deployment method for a cloud native system according to any one of claims 1 to 6, characterized in that: In step S1, risk assessment of user needs is performed, specifically, using probability analysis or expert system risk assessment methods to conduct a comprehensive assessment of the DDoS attack risks currently faced by users, the types of attacks suffered, and potential attack sources.

9. The anti-DDoS strategy deployment method for a cloud native system according to any one of claims 1 to 6, characterized in that: In step S2, after the anti-D policy is generated, the control center selects a suitable location in the physical network of the cloud native system for deployment, and deploys various capabilities on the service chain in the form of containers.

10. The anti-DDoS strategy deployment method for a cloud native system according to any one of claims 1 to 6, characterized in that: The deployment location of the anti-D policy is determined based on the key attributes of user needs and the actual physical network conditions of the cloud native system. The actual physical network conditions of the cloud native system include the resource occupancy or link bandwidth of each node or link.

Images