Anti-DDoS strategy automation method based on cloud native system

Abstract

The invention discloses an anti-DDoS strategy automation method based on a cloud native system, and relates to the field of network security. The method comprises the steps that abstracted capabilities are combined and linked into a micro-service chain according to a certain sequence in a cloud native system, then the micro-service chain is deployed to a cloud server in the cloud native system, and an automatic process can be divided into eight steps according to the actual environment. The three steps are respectively flow detection, threat assessment, capability pool selection, strategy combination, strategy deployment, real-time adjustment, log recording and analysis and closed-loop feedback. According to the scheme, the anti-D strategy can be automatically executed, the response speed of the anti-D strategy is improved, the required labor cost is reduced, the system performance is optimized, and the anti-D efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to an anti-DDoS strategy automation method based on a cloud native system. Background Art

[0002] DDoS attacks are one of the most important means of attack in current network attacks. They evolved from DoS attacks and are characterized by the fact that DDoS attacks can quickly exhaust the resources of the target system through a large number of requests, causing it to be unable to provide services normally. This type of attack may cause serious economic losses and reputation damage to enterprises, organizations or individuals. With the popularization of the Internet and the increase in the connection of various devices, the scale and frequency of DDoS attacks are also growing, bringing greater challenges to network security.

[0003] Cloud-network integration refers to the combination of cloud computing and communication networks, which fully utilizes the respective advantages of cloud computing and networks. Cloud computing can dynamically adjust resources according to demand, while the network achieves fast data transmission and wider coverage, with high flexibility and elasticity. Cloud-network integration is sinking to the user end, realizing cloud-edge integration, achieving full network coverage through central cloud and edge cloud, and bringing cloud-network capabilities to the extreme.

[0004] Cloud native aims to use technologies such as cloud computing, containerization, and microservices to build highly flexible and easy-to-manage applications, giving full play to the advantages of cloud computing on-demand. Cloud native can deploy applications according to demand, flexibly combine and link applications, perform automated management, realize flexible deployment of system functions, and improve the response speed and efficiency of applications.

[0005] Cloud-network integration provides flexible and sufficient basic conditions for various cloud-native businesses. By abstracting traditional hardware functions into software capabilities and deploying them in a cloud-network integration environment, it is possible to break through the constraints of the existing network structure, achieve flexible combination and linkage of system functions, solve problems such as rigid traditional hardware deployment and lack of efficient collaborative response mechanisms, and support the automation of business strategies.

[0006] Policy automation refers to the use of information technology to manage specific policies or processes. The entire management process is automatically executed through specific algorithms without human intervention. Policy automation usually involves the formulation, implementation and monitoring of a policy or rule to ensure the automated execution of tasks, and to adjust and optimize as needed. Through policy automation, costs can be reduced and work efficiency and quality can be improved.

[0007] How to effectively mitigate DDoS attacks has always been a research hotspot. However, due to the rigidity of the current network structure and the scattered deployment of traditional anti-DDoS equipment, anti-DDoS strategies are fragmented and unable to work together, making it difficult to achieve strategy automation. Summary of the invention

[0008] In order to overcome the defects and shortcomings of the above-mentioned prior art, the present invention provides an anti-DDoS strategy automation method based on a cloud native system, which can automatically and flexibly combine and link anti-DDoS capabilities to form a microservice chain to ensure the automated execution of tasks, and adjust and optimize according to needs to realize anti-DDoS strategy automation.

[0009] In order to solve the above problems existing in the prior art, the present invention is implemented through the following technical solutions.

[0010] An anti-DDoS strategy automation method based on a cloud native system includes the following steps: S1. The cloud-native system abstracts the anti-DDoS hardware functions into software capabilities through the software concept, deploys them in a cloud-network converged environment, and builds a capacity pool that can be dynamically scheduled. Specifically, it decouples traditional anti-DDoS functions from hardware, implements network functions in a virtualized environment through network programming, uses management and orchestration systems (such as MANO, Management and Orchestration) to configure, manage, and optimize virtual network functions, and deploys them in containers at any location on the physical network in the cloud-native system. S2, through the microservice chain composed of capabilities in the capability pool in S1, conduct behavior analysis and feature recognition on the traffic in the cloud native system to detect abnormal traffic in the cloud native system; S3, through the control center of the cloud native system, conducts threat assessment on the abnormal traffic detected by S2, determines whether the current traffic belongs to DDoS attack traffic, and analyzes the attack type and attack source; S4. Based on the threat assessment results in S3, the control center of the cloud native system selects several traffic-based detection and cleaning capabilities or IP-based source address governance capabilities from the capability pool built in S1, combines and links the selected capabilities into a microservice chain in a set order, and then generates an anti-DDoS strategy for the current DDoS attack and the formed microservice chain, and deploys it to any idle node of the cloud native system; S5. Implement anti-DDoS attack measures according to the deployed anti-DDoS strategy, and continuously monitor the network status and DDoS attacks of the cloud native system; S6. Adjust and optimize the deployed anti-DDoS strategy based on the real-time intelligence monitored; S7. Record all attack events and response strategies, and analyze DDos attack types, attack sources, and anti-DDos strategy performance, for subsequent detection and cleaning algorithm training, IP address blacklist and whitelist generation, DDoS attack traffic source tracing, and anti-DDoS strategy performance optimization; S8. Based on the recording and analysis of new attack trends and S7 historical data, continuously improve and optimize the automated process of anti-DDoS strategies of cloud native systems.

[0011] In S2, the behavior analysis specifically includes: building a normal behavior model based on historical data, and monitoring the traffic in real time, comparing it with the normal traffic model, and detecting and classifying abnormal behavior; the feature identification specifically includes: using machine learning and deep learning methods to identify traffic patterns, extract feature information from the traffic and analyze it; the abnormal traffic includes traffic from the IP blacklist, traffic surges, traffic behavior patterns that do not conform to current or historical behaviors, and traffic that frequently accesses sensitive data.

[0012] In S3, the threat assessment specifically includes: using a known threat intelligence library to perform signature detection, establishing a behavior model, performing abnormal behavior detection, analyzing traffic characteristics and behaviors based on specific rules and heuristic algorithms, determining whether the current traffic involves a DDoS attack, determining whether the traffic has DDoS attack behavior, and whether the traffic characteristics match the current threat intelligence database.

[0013] In S4, if it is necessary to clean the traffic, select the traffic-based detection and cleaning capability; if it is necessary to manage the IP source address, select the IP-based source address management capability.

[0014] In S6, adjusting and optimizing the anti-DDoS strategy based on the real-time intelligence monitored specifically includes: At least one of adding new capabilities to the microservice chain, changing the deployment location of the microservice chain, or regenerating the microservice chain is performed based on the real-time monitored network status and attack characteristics.

[0015] In S8, the automated process of the cloud native system's anti-DDoS strategy is continuously improved and optimized, specifically including: more efficient capability selection, better anti-DDoS strategy composition, optimized anti-DDoS strategy deployment, and improved cloud native system traceability capabilities.

[0016] The more efficient capability options include: Machine learning optimization: Use machine learning algorithms to analyze historical attack data and analyze which capabilities are most effective in specific scenarios.

[0017] The better anti-DDoS strategy consists of: Strategy templates: Based on historical data analysis, common attack scenario strategy templates are established. When similar attacks are detected, the corresponding strategy templates are quickly called for defense, and the template content is adjusted according to new attack trends.

[0018] The deployment of the optimized anti-DDoS strategy includes: Load balancing: Through load balancing technology, when multiple anti-D strategies are deployed at the same time, the computing, storage and communication pressures at each location in the physical network are balanced through flexible scheduling; the flexible scheduling specifically means that in the physical network, if the resources of a node or a link are exhausted and the resources of other nodes or links are sufficient, the capacity of the node or link with exhausted resources will be deployed to the node or link with sufficient resources.

[0019] Improving the traceability capability of the cloud native system includes: sharing threat intelligence with other cloud service providers or security communities, and using shared data to improve the overall traceability capability.

[0020] Compared with the prior art, the beneficial technical effects brought by the present invention are as follows: 1. The present invention abstracts hardware functions into software capabilities and dynamically schedules them, so that the system can adjust resource configuration in real time according to actual needs, avoid resource waste and improve the response speed of the system. Based on traffic characteristics and attack types, the microservice chain is dynamically combined and adjusted to make the anti-DDoS strategy more flexible and able to quickly adapt to different attack scenarios. The strategy automation is realized through the microservice chain, which improves the anti-DDoS efficiency. Through the highly automated, intelligent and flexible design of the cloud native system, it can effectively respond to the changing DDoS attack threats while maintaining an efficient and stable defense effect. The system has the ability to respond quickly, dynamically adjust, and optimize in real time, can adapt to complex attack scenarios, and through continuous learning and optimization, improves the defense level and traceability of cloud native automated anti-DDoS.

[0021] 2. The present invention uses deep learning and machine learning algorithms to extract and analyze traffic features, greatly improving the detection accuracy of abnormal traffic and reducing the false alarm rate. It also conducts comprehensive threat assessments through the combination of behavioral models, rules, and heuristic algorithms, which helps to accurately identify DDoS attack types and respond in a timely manner.

[0022] 3. In the present invention, based on real-time monitoring data, the system can automatically adjust the anti-DDoS strategy, including the increase or decrease of capacity, adjustment of deployment location, etc., to ensure the continuous effectiveness of the strategy in actual implementation.

[0023] 4. The present invention, through recording and analyzing attack events and response strategies, the system can continuously iterate and optimize the automated process of anti-DDoS, thereby improving the system's ability to respond to future attacks and the efficiency of anti-DDoS. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a schematic diagram of the automation capability of the present invention. DETAILED DESCRIPTION

[0025] The technical solution of the present invention will be clearly and completely described below in conjunction with specific embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] Example 1 As the most basic embodiment of the present invention, this embodiment discloses an anti-DDoS strategy automation method based on a cloud native system, comprising the following steps: S1. The cloud-native system abstracts the anti-DDoS hardware functions into software capabilities through the software concept, deploys them in a cloud-network converged environment, and builds a capacity pool that can be dynamically scheduled. Specifically, it decouples traditional anti-DDoS functions from hardware, implements network functions in a virtualized environment through network programming, uses management and orchestration systems (such as MANO, Management and Orchestration) to configure, manage, and optimize virtual network functions, and deploys them in containers at any location on the physical network in the cloud-native system. S2, through the microservice chain composed of capabilities in the capability pool in S1, conduct behavior analysis and feature recognition on the traffic in the cloud native system to detect abnormal traffic in the cloud native system; S3, through the control center of the cloud native system, conducts threat assessment on the abnormal traffic detected by S2, determines whether the current traffic belongs to DDoS attack traffic, and analyzes the attack type and attack source; S4. Based on the threat assessment results in S3, the control center of the cloud native system selects several traffic-based detection and cleaning capabilities or IP-based source address governance capabilities from the capability pool built in S1, combines and links the selected capabilities into a microservice chain in a set order, and then generates an anti-DDoS strategy for the current DDoS attack and the formed microservice chain, and deploys it to any idle node of the cloud native system; S5. Implement anti-DDoS attack measures according to the deployed anti-DDoS strategy, and continuously monitor the network status and DDoS attacks of the cloud native system; S6. Adjust and optimize the deployed anti-DDoS strategy based on the real-time intelligence monitored; S7. Record all attack events and response strategies, and analyze DDos attack types, attack sources, and anti-DDos strategy performance, for subsequent detection and cleaning algorithm training, IP address blacklist and whitelist generation, DDoS attack traffic source tracing, and anti-DDoS strategy performance optimization; S8. Based on the recording and analysis of new attack trends and S7 historical data, continuously improve and optimize the automated process of anti-DDoS strategies of cloud native systems.

[0027] In this embodiment, hardware functions are abstracted into software capabilities and dynamically scheduled, so that the system can adjust resource configuration in real time according to actual needs, avoid resource waste and improve the response speed of the system. Based on traffic characteristics and attack types, the microservice chain is dynamically combined and adjusted to make the anti-DDoS strategy more flexible and able to quickly adapt to different attack scenarios. The strategy automation is achieved through the microservice chain, which improves the anti-DDoS efficiency. Through the highly automated, intelligent and flexible design of the cloud native system, it can effectively respond to the changing DDoS attack threats while maintaining an efficient and stable defense effect. The system has the ability to respond quickly, dynamically adjust, and optimize in real time, can adapt to complex attack scenarios, and improve its own defense level and traceability capabilities through continuous learning and optimization.

[0028] Example 2 As a preferred embodiment of the present invention, this embodiment discloses an anti-DDoS strategy automation method based on a cloud native system, comprising the following steps: S1. The cloud-native system abstracts the anti-DDoS hardware functions into software capabilities through the software concept, deploys them in a cloud-network converged environment, and builds a capacity pool that can be dynamically scheduled. Specifically, it decouples traditional anti-DDoS functions from hardware, implements network functions in a virtualized environment through network programming, uses management and orchestration systems (such as MANO, Management and Orchestration) to configure, manage, and optimize virtual network functions, and deploys them in containers at any location on the physical network in the cloud-native system. S2. Through the microservice chain composed of the collection capability, drainage capability and detection capability in the capability pool in S1, the traffic in the cloud native system is analyzed and featured, and abnormal traffic in the cloud native system is detected; the behavior analysis specifically includes: building a normal behavior model based on historical data, and monitoring the traffic in real time, comparing it with the normal traffic model, and detecting and classifying abnormal behavior; the feature identification specifically includes: using machine learning and deep learning methods to identify traffic patterns, extract feature information from the traffic and analyze it; the abnormal traffic includes traffic from the IP blacklist, traffic surges, traffic behavior patterns that do not conform to current or historical behaviors, and traffic that frequently accesses sensitive data.

[0029] S3. Perform threat assessment on the abnormal traffic detected by S2 through the control center of the cloud native system to determine whether the current traffic belongs to DDoS attack traffic, and analyze the attack type and attack source; the threat assessment specifically includes: using the known threat intelligence library to perform signature detection, establish a behavior model, perform abnormal behavior detection, analyze the characteristics and behavior of the traffic based on specific rules and heuristic algorithms, determine whether the current traffic involves a DDoS attack, determine whether the traffic has DDoS attack behavior, and whether the traffic characteristics match the current threat intelligence database S4. Based on the threat assessment results in S3, the control center of the cloud native system selects several traffic-based detection and cleaning capabilities or IP-based source address governance capabilities from the capability pool built in S1. If traffic needs to be cleaned, the traffic-based detection and cleaning capabilities are selected; if IP source addresses need to be governed, the IP-based source address governance capabilities are selected. The selected capabilities are combined and linked into a microservice chain in the set order, and then an anti-DDoS strategy is generated for the current DDoS attack and the formed microservice chain, and it is deployed to any idle node of the cloud native system. S5. Implement anti-DDoS attack measures according to the deployed anti-DDoS strategy, and continuously monitor the network status and DDoS attacks of the cloud native system; S6. Adjust and optimize the deployed anti-DDoS strategy based on the real-time intelligence monitored; S7. Record all attack events and response strategies, and analyze DDos attack types, attack sources, and anti-DDos strategy performance, for subsequent detection and cleaning algorithm training, IP address blacklist and whitelist generation, DDoS attack traffic source tracing, and anti-DDoS strategy performance optimization; S8. Based on the recording and analysis of new attack trends and S7 historical data, continuously improve and optimize the automated process of anti-DDoS strategies of cloud native systems.

[0030] In this embodiment, deep learning and machine learning algorithms are used to extract and analyze traffic features, greatly improving the detection accuracy of abnormal traffic and reducing the false alarm rate. A comprehensive threat assessment is performed through the combination of behavioral models, rules, and heuristic algorithms, which helps to accurately identify the type of DDoS attacks and respond in a timely manner.

[0031] Example 3 As the best embodiment of the present invention, this embodiment discloses an anti-DDoS strategy automation method based on a cloud native system, including the following steps: S1. The cloud-native system abstracts the anti-DDoS hardware functions into software capabilities through the software concept, deploys them in a cloud-network converged environment, and builds a capacity pool that can be dynamically scheduled. Specifically, it decouples traditional anti-DDoS functions from hardware, implements network functions in a virtualized environment through network programming, uses management and orchestration systems (such as MANO, Management and Orchestration) to configure, manage, and optimize virtual network functions, and deploys them in containers at any location on the physical network in the cloud-native system. S2. Through the microservice chain composed of the collection capability, drainage capability and detection capability in the capability pool in S1, the traffic in the cloud native system is analyzed and feature identified, and abnormal traffic in the cloud native system is detected; the behavior analysis specifically includes: building a normal behavior model based on historical data, and monitoring the traffic in real time, comparing it with the normal traffic model, and detecting and classifying abnormal behavior; the feature identification specifically includes: using machine learning and deep learning methods to identify traffic patterns, extract feature information from the traffic and analyze it; the abnormal traffic includes traffic from the IP blacklist, traffic surges, traffic behavior patterns that do not conform to current or historical behaviors, and traffic that frequently accesses sensitive data; S3, through the control center of the cloud native system, conducts a threat assessment on the abnormal traffic detected by S2, determines whether the current traffic belongs to DDoS attack traffic, and analyzes the attack type and attack source; the threat assessment specifically includes: using a known threat intelligence library to perform signature detection, establish a behavior model, perform abnormal behavior detection, analyze the characteristics and behavior of the traffic based on specific rules and heuristic algorithms, determine whether the current traffic involves a DDoS attack, determine whether the traffic has DDoS attack behavior, and whether the traffic characteristics match the current threat intelligence database; S4. Based on the threat assessment results in S3, the control center of the cloud native system selects several traffic-based detection and cleaning capabilities or IP-based source address governance capabilities from the capability pool built in S1. If traffic needs to be cleaned, the traffic-based detection and cleaning capabilities are selected; if IP source addresses need to be governed, the IP-based source address governance capabilities are selected. The selected capabilities are combined and linked into a microservice chain in the set order, and then an anti-DDoS strategy is generated for the current DDoS attack and the formed microservice chain, and it is deployed to any idle node of the cloud native system. S5. Implement anti-DDoS attack measures according to the deployed anti-DDoS strategy, and continuously monitor the network status and DDoS attacks of the cloud native system; S6. Adjust and optimize the deployed anti-DDoS strategy based on the real-time intelligence monitored; specifically, add new capabilities to the microservice chain based on the real-time monitored network status and attack characteristics; change the deployment location of the microservice chain; and regenerate the microservice chain; S7. Record all attack events and response strategies, and analyze DDos attack types, attack sources, and anti-DDos strategy performance, including: Analyze DDos attack types, attack sources, and anti-DDos strategy performance: whether the current DDoS attack contains unknown attack types, whether it comes from unknown DDoS attack sources, whether the same anti-DDoS strategy has been generated before, and the performance of the anti-DDoS strategy, how much DDoS traffic has been detected, and how much DDoS attack traffic has been intercepted; used for subsequent detection and cleaning algorithm training, IP address blacklist and whitelist generation, DDoS attack traffic tracing, and anti-DDoS strategy performance optimization; S8. Based on the recording and analysis of new attack trends and S7 historical data, continuously improve and optimize the automated process of anti-DDoS strategies for cloud native systems, including more efficient capability selection, better anti-DDoS strategy composition, optimized anti-DDoS strategy deployment, and improved traceability capabilities for cloud native systems. The more efficient capability options include: Machine learning optimization: Use machine learning algorithms to analyze historical attack data and analyze which capabilities are most effective in specific scenarios.

[0032] The better anti-DDoS strategy consists of: Strategy templates: Based on historical data analysis, common attack scenario strategy templates are established. When similar attacks are detected, the corresponding strategy templates are quickly called for defense, and the template content is adjusted according to new attack trends.

[0033] The deployment of the optimized anti-DDoS strategy includes: Load balancing: Through load balancing technology, when multiple anti-D strategies are deployed at the same time, the computing, storage and communication pressures at each location in the physical network are balanced through flexible scheduling; The flexible scheduling specifically means that, in a physical network, if resources of a certain node or a certain link are exhausted and resources of other nodes or links are sufficient, the capacity of the node or link with exhausted resources is deployed to the node or link with sufficient resources.

[0034] Improving the traceability capability of the cloud native system includes: sharing threat intelligence with other cloud service providers or security communities, and using shared data to improve the overall traceability capability.

[0035] In this embodiment, based on real-time monitoring data, the system can automatically adjust the anti-DDoS strategy, including increasing or decreasing capabilities, adjusting deployment locations, etc., to ensure the continued effectiveness of the strategy in actual implementation; by recording and analyzing attack events and response strategies, the system can continuously iterate and optimize the anti-DDoS automated process, and improve the system's ability to respond to future attacks and the efficiency of anti-DDoS.

Claims

1. An anti-DDoS strategy automation method based on a cloud native system, characterized in that: The following steps are involved: S1. The cloud-native system abstracts the anti-DDoS hardware functions into software capabilities through the software concept, deploys them in a cloud-network converged environment, and builds a capability pool that can be dynamically scheduled. S2, through the microservice chain composed of capabilities in the capability pool in S1, conduct behavior analysis and feature recognition on the traffic in the cloud native system to detect abnormal traffic in the cloud native system; S3, through the control center of the cloud native system, conducts threat assessment on the abnormal traffic detected by S2, determines whether the current traffic belongs to DDoS attack traffic, and analyzes the attack type and attack source; S4. Based on the threat assessment results in S3, the control center of the cloud native system selects several capabilities from the capability pool built in S1, combines and links the selected capabilities into a microservice chain in a set order, and then generates an anti-DDoS strategy for the current DDoS attack and the formed microservice chain, and deploys it to any idle node of the cloud native system; S5. Implement anti-DDoS attack measures according to the deployed anti-DDoS strategy, and continuously monitor the network status and DDoS attacks of the cloud native system; S6. Automatically adjust and optimize the deployed anti-DDoS strategy based on the real-time intelligence monitored; S7. Record all attack events and response strategies, and analyze DDos attack types, attack sources, and anti-DDos strategy performance; S8. Based on the recording and analysis of new attack trends and S7 historical data, continuously improve and optimize the automated process of anti-DDoS strategies of cloud native systems.

2. According to claim 1, the method for automating anti-DDoS strategies based on cloud native systems is characterized by: In S2, the behavior analysis specifically includes: building a normal behavior model based on historical data, and monitoring the traffic in real time, comparing it with the normal traffic model, and detecting and classifying abnormal behavior; the feature identification specifically includes: using machine learning and deep learning methods to identify traffic patterns, extract feature information from the traffic and analyze it; the abnormal traffic includes traffic from the IP blacklist, traffic surges, traffic behavior patterns that do not conform to current or historical behaviors, and traffic that frequently accesses sensitive data.

3. The method for automating anti-DDoS strategies based on a cloud native system according to claim 2, characterized in that: In S3, the threat assessment specifically includes: using a known threat intelligence library to perform signature detection, establishing a behavior model, performing abnormal behavior detection, analyzing traffic characteristics and behaviors based on specific rules and heuristic algorithms, determining whether the current traffic involves a DDoS attack, determining whether the traffic has DDoS attack behavior, and whether the traffic characteristics match the current threat intelligence database.

4. The method for automating anti-DDoS strategies based on a cloud native system according to claim 3, characterized in that: In S4, if it is necessary to clean the traffic, select the traffic-based detection and cleaning capability; if it is necessary to manage the IP source address, select the IP-based source address management capability.

5. The method for automating anti-DDoS strategies based on a cloud native system according to claim 4, characterized in that: In S6, adjusting and optimizing the anti-DDoS strategy based on the real-time intelligence monitored specifically includes: At least one of adding new capabilities to the microservice chain, changing the deployment location of the microservice chain, or regenerating the microservice chain is performed based on the real-time monitored network status and attack characteristics.

6. The method for automating anti-DDoS strategies based on a cloud native system according to any one of claims 1 to 5, characterized in that: In S8, the automated process of the cloud native system's anti-DDoS strategy is continuously improved and optimized, specifically including: more efficient capability selection, better anti-DDoS strategy composition, optimized anti-DDoS strategy deployment, and improved cloud native system traceability capabilities.

7. The method for automating anti-DDoS strategies based on a cloud native system according to claim 6, characterized in that: The more efficient capability options include: Machine learning optimization: Use machine learning algorithms to analyze historical attack data and analyze which capabilities are most effective in specific scenarios.

8. The method for automating anti-DDoS strategies based on a cloud native system according to claim 6, characterized in that: The better anti-DDoS strategy consists of: Strategy templates: Based on historical data analysis, common attack scenario strategy templates are established. When similar attacks are detected, the corresponding strategy templates are quickly called for defense, and the template content is adjusted according to new attack trends.

9. The method for automating anti-DDoS strategies based on a cloud native system according to claim 6, characterized in that: The deployment of the optimized anti-DDoS strategy includes: Load balancing: Through load balancing technology, when multiple anti-D strategies are deployed at the same time, the computing, storage and communication pressures at each location in the physical network are balanced through flexible scheduling; The flexible scheduling specifically means that, in a physical network, if resources of a certain node or a certain link are exhausted and resources of other nodes or links are sufficient, the capacity of the node or link with exhausted resources is deployed to the node or link with sufficient resources.

10. The method for automating anti-DDoS strategies based on a cloud native system according to claim 6, characterized in that: Improving the traceability capability of the cloud native system includes: sharing threat intelligence with other cloud service providers or security communities, and using shared data to improve the overall traceability capability.

Images