An automated anti-DDoS strategy method based on cloud native systems

Abstract

The present invention discloses an anti-DDoS strategy automation method based on a cloud-native system, which relates to the field of network security. The method of the present invention includes combining and linking abstracted capabilities into a microservice chain in a certain order in the cloud-native system, and then deploying the microservice chain to a cloud server in the cloud-native system. Depending on the actual environment, the automation process can be divided into eight steps. They are traffic detection, threat assessment, capability pool selection, strategy combination, strategy deployment, real-time adjustment, logging and analysis, and closed-loop feedback. This solution can automate the execution of anti-DDoS strategies, improve the response speed of anti-DDoS strategies, reduce the required labor costs, optimize system performance, and improve anti-DDoS efficiency.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to an anti-DDoS strategy automation method based on a cloud native system. Background Art

[0002] DDoS attacks are one of the most important cyberattack methods currently used. Evolved from DoS attacks, they are characterized by their ability to rapidly deplete the target system's resources through a massive influx of requests, rendering it unable to provide services. This attack method can cause severe economic losses and reputational damage to businesses, organizations, or individuals. With the widespread use of the internet and the increasing connectivity of various devices, the scale and frequency of DDoS attacks are also increasing, posing greater challenges to network security.

[0003] Cloud-network convergence refers to the integration of cloud computing and communications networks, leveraging the respective strengths of both. Cloud computing can dynamically adjust resources based on demand, while networks enable fast data transmission and wider coverage, offering high flexibility and elasticity. Cloud-network convergence is extending to the user end, achieving cloud-edge convergence. This convergence leverages central and edge clouds to achieve full network coverage, maximizing the capabilities of cloud and networks.

[0004] Cloud native aims to leverage technologies such as cloud computing, containerization, and microservices to build highly flexible and manageable applications, leveraging the on-demand benefits of cloud computing. Cloud native enables on-demand application deployment, flexible combination and linkage between applications, and automated management, enabling flexible deployment of system functions and improving application responsiveness and efficiency.

[0005] Cloud-network convergence provides a flexible and robust foundation for a variety of cloud-native services. By abstracting traditional hardware functions into software capabilities and deploying them in a cloud-network converged environment, it overcomes the constraints of existing network structures, enabling flexible combination and linkage of system functions. This addresses the rigidity of traditional hardware deployment and the lack of efficient collaborative response mechanisms, while also supporting the automation of business policies.

[0006] Policy automation refers to the use of information technology to manage specific policies or processes. The entire management process is automatically executed through specific algorithms, without human intervention. Policy automation typically involves developing, implementing, and monitoring a policy or rule to ensure automated execution, adjusting and optimizing it as needed. Through policy automation, costs can be reduced and work efficiency and quality can be improved.

[0007] How to effectively mitigate DDoS attacks has always been a research hotspot. However, due to the rigidity of current network structures and the decentralized deployment of traditional anti-DDoS equipment, anti-DDoS strategies are fragmented, unable to coordinate and coordinate, and difficult to achieve policy automation. Summary of the Invention

[0008] To overcome the defects and shortcomings of the above-mentioned existing technologies, the present invention provides an anti-DDoS policy automation method based on a cloud-native system. The method can automatically and flexibly combine and link anti-DDoS capabilities to form a microservice chain to ensure the automated execution of tasks, and can adjust and optimize them as needed to achieve anti-DDoS policy automation.

[0009] In order to solve the above problems in the prior art, the present invention is implemented through the following technical solutions.

[0010] An automated anti-DDoS strategy method based on a cloud native system includes the following steps:

[0011] S1. Cloud-native systems abstract anti-DDoS hardware functions into software capabilities through software-based approaches, deploy them in a cloud-network converged environment, and build a dynamically schedulable capacity pool. Specifically, this involves decoupling traditional anti-DDoS functions from hardware, implementing network functions in a virtualized environment through network programming, and using management and orchestration systems (such as MANO) to configure, manage, and optimize virtual network functions. These functions are then deployed as containers anywhere on the physical network within the cloud-native system.

[0012] S2, through the microservice chain composed of capabilities in the capability pool in S1, conducts behavioral analysis and feature recognition on the traffic within the cloud native system to detect abnormal traffic in the cloud native system;

[0013] S3, through the cloud-native system's control center, conducts a threat assessment on the abnormal traffic detected by S2, determines whether the current traffic constitutes a DDoS attack, and analyzes the attack type and source.

[0014] S4. Based on the threat assessment results in S3, the cloud native system's control center selects several traffic-based detection and cleaning capabilities or IP-based source address governance capabilities from the capability pool built in S1. It combines the selected capabilities into a microservice chain in a set order. It then generates an anti-DDoS policy for the current DDoS attack and the assembled microservice chain, and deploys it to any idle node in the cloud native system.

[0015] S5. Implement anti-DDoS attack measures based on the deployed anti-DDoS strategy and continuously monitor the network status and DDoS attacks of the cloud native system.

[0016] S6. Adjust and optimize the deployed anti-DDoS strategy based on real-time monitoring intelligence;

[0017] S7. Record all attack events and response strategies, and analyze DDoS attack types, attack sources, and anti-DDoS strategy performance. This is used for subsequent detection and cleaning algorithm training, IP address blacklist and whitelist generation, DDoS attack traffic source tracing, and anti-DDoS strategy performance optimization.

[0018] S8. Based on the recording and analysis of new attack trends and S7 historical data, continuously improve and optimize the automated process of cloud-native system anti-DDoS strategies.

[0019] In S2, the behavior analysis specifically includes: building a normal behavior model based on historical data, and monitoring the traffic in real time, comparing it with the normal traffic model, and detecting and classifying abnormal behavior; the feature identification specifically includes: using machine learning and deep learning methods to identify traffic patterns, extract feature information in the traffic and analyze it; the abnormal traffic includes traffic from IP blacklists, traffic surges, traffic behavior patterns that do not conform to current or historical behavior, and traffic that frequently accesses sensitive data.

[0020] In S3, threat assessment specifically includes: using a known threat intelligence library to perform signature detection, establishing a behavior model, performing abnormal behavior detection, analyzing traffic characteristics and behaviors based on specific rules and heuristic algorithms, determining whether the current traffic involves a DDoS attack, determining whether the traffic has DDoS attack behavior, and whether the traffic characteristics match the current threat intelligence database.

[0021] In S4, if traffic needs to be cleaned, the traffic-based detection and cleaning capability is selected; if IP source addresses need to be managed, the IP-based source address management capability is selected.

[0022] In S6, the anti-DDoS strategy is adjusted and optimized based on the real-time intelligence monitored, including:

[0023] At least one of adding new capabilities to the microservice chain, changing the deployment location of the microservice chain, or regenerating the microservice chain is performed based on the real-time monitored network status and attack characteristics.

[0024] In S8, the automated process of the cloud native system's anti-DDoS strategy is continuously improved and optimized, specifically including: more efficient capability selection, better anti-DDoS strategy composition, optimized anti-DDoS strategy deployment, and enhanced cloud native system traceability capabilities.

[0025] The more efficient capability options include:

[0026] Machine learning optimization: Use machine learning algorithms to analyze historical attack data and determine which capabilities are most effective in specific scenarios.

[0027] The better anti-DDoS strategy consists of:

[0028] Strategy templates: Based on historical data analysis, common attack scenario strategy templates are established. When similar attacks are detected, the corresponding strategy templates are quickly called for defense, and the template content is adjusted according to new attack trends.

[0029] The deployment of the optimized anti-DDoS strategy includes:

[0030] Load balancing: Load balancing technology allows for flexible scheduling to maintain balanced computing, storage, and communication pressures at each location in the physical network when multiple anti-D strategies are deployed simultaneously. Specifically, if resources at a node or link in the physical network are depleted while resources at other nodes or links are sufficient, the capacity of the resource-depleted node or link is deployed to nodes or links with sufficient resources.

[0031] Improving the traceability capabilities of cloud native systems includes: sharing threat intelligence with other cloud service providers or security communities, and using shared data to improve overall traceability capabilities.

[0032] Compared with the prior art, the beneficial technical effects brought about by the present invention are as follows:

[0033] 1. The present invention abstracts hardware functions into software capabilities and dynamically schedules them, allowing the system to adjust resource allocation in real time according to actual needs, avoiding resource waste and improving the system's response speed. Based on traffic characteristics and attack types, it dynamically combines and adjusts microservice chains, making anti-DDoS strategies more flexible and able to quickly adapt to different attack scenarios. Through microservice chains, policy automation is achieved, improving anti-DDoS efficiency. Through the highly automated, intelligent, and flexible design of cloud-native systems, it can effectively respond to changing DDoS attack threats while maintaining an efficient and stable defense effect. The system has the ability to respond quickly, dynamically adjust, and optimize in real time, can adapt to complex attack scenarios, and through continuous learning and optimization, improves the defense level and traceability capabilities of cloud-native automated anti-DDoS.

[0034] 2. This invention uses deep learning and machine learning algorithms to extract and analyze traffic features, significantly improving the accuracy of abnormal traffic detection and reducing false alarm rates. By combining behavioral models, rules, and heuristic algorithms, it conducts comprehensive threat assessments, helping to accurately identify DDoS attack types and respond promptly.

[0035] 3. Based on real-time monitoring data, the system can automatically adjust the anti-DDoS strategy, including increasing or decreasing capacity and adjusting the deployment location, to ensure the continued effectiveness of the strategy in actual implementation.

[0036] 4. The present invention, through recording and analyzing attack events and response strategies, can continuously iterate and optimize the automated process of anti-DDoS, thereby improving the system's ability to respond to future attacks and the efficiency of anti-DDoS. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a schematic diagram of the automation capabilities of the present invention. DETAILED DESCRIPTION

[0038] The following will clearly and completely describe the technical solutions of the present invention in conjunction with specific embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0039] Example 1

[0040] As the most basic embodiment of the present invention, this embodiment discloses an anti-DDoS policy automation method based on a cloud native system, including the following steps:

[0041] S1. Cloud-native systems abstract anti-DDoS hardware functions into software capabilities through software-based approaches, deploy them in a cloud-network converged environment, and build a dynamically schedulable capacity pool. Specifically, this involves decoupling traditional anti-DDoS functions from hardware, implementing network functions in a virtualized environment through network programming, and using management and orchestration systems (such as MANO) to configure, manage, and optimize virtual network functions. These functions are then deployed as containers anywhere on the physical network within the cloud-native system.

[0042] S2, through the microservice chain composed of capabilities in the capability pool in S1, conducts behavioral analysis and feature recognition on the traffic within the cloud native system to detect abnormal traffic in the cloud native system;

[0043] S3, through the cloud-native system's control center, conducts a threat assessment on the abnormal traffic detected by S2, determines whether the current traffic constitutes a DDoS attack, and analyzes the attack type and source.

[0044] S4. Based on the threat assessment results in S3, the cloud native system's control center selects several traffic-based detection and cleaning capabilities or IP-based source address governance capabilities from the capability pool built in S1. It combines the selected capabilities into a microservice chain in a set order. It then generates an anti-DDoS policy for the current DDoS attack and the assembled microservice chain, and deploys it to any idle node in the cloud native system.

[0045] S5. Implement anti-DDoS attack measures based on the deployed anti-DDoS strategy and continuously monitor the network status and DDoS attacks of the cloud native system.

[0046] S6. Adjust and optimize the deployed anti-DDoS strategy based on real-time monitoring intelligence;

[0047] S7. Record all attack events and response strategies, and analyze DDoS attack types, attack sources, and anti-DDoS strategy performance. This is used for subsequent detection and cleaning algorithm training, IP address blacklist and whitelist generation, DDoS attack traffic source tracing, and anti-DDoS strategy performance optimization.

[0048] S8. Based on the recording and analysis of new attack trends and S7 historical data, continuously improve and optimize the automated process of cloud-native system anti-DDoS strategies.

[0049] This embodiment abstracts hardware functions into software capabilities and dynamically schedules them, allowing the system to adjust resource allocation in real time based on actual needs, avoiding resource waste and improving the system's response speed. Based on traffic characteristics and attack types, the microservice chain is dynamically combined and adjusted, making the anti-DDoS strategy more flexible and able to quickly adapt to different attack scenarios. Policy automation is achieved through the microservice chain, improving anti-DDoS efficiency. Through the highly automated, intelligent, and flexible design of the cloud-native system, it can effectively respond to the changing DDoS attack threats while maintaining an efficient and stable defense effect. The system has the ability to respond quickly, dynamically adjust, and optimize in real time, and can adapt to complex attack scenarios. Through continuous learning and optimization, it improves its own defense level and traceability capabilities.

[0050] Example 2

[0051] As a preferred embodiment of the present invention, this embodiment discloses an anti-DDoS policy automation method based on a cloud native system, including the following steps:

[0052] S1. Cloud-native systems abstract anti-DDoS hardware functions into software capabilities through software-based approaches, deploy them in a cloud-network converged environment, and build a dynamically schedulable capacity pool. Specifically, this involves decoupling traditional anti-DDoS functions from hardware, implementing network functions in a virtualized environment through network programming, and using management and orchestration systems (such as MANO) to configure, manage, and optimize virtual network functions. These functions are then deployed as containers anywhere on the physical network within the cloud-native system.

[0053] S2. Through the microservice chain composed of the collection capability, drainage capability and detection capability in the capability pool in S1, the traffic in the cloud native system is analyzed and the feature recognition is performed to detect abnormal traffic in the cloud native system; the behavior analysis specifically includes: building a normal behavior model based on historical data, and monitoring the traffic in real time, comparing it with the normal traffic model, and detecting and classifying abnormal behavior; the feature recognition specifically includes: using machine learning and deep learning methods to identify traffic patterns, extract feature information from the traffic and analyze it; the abnormal traffic includes traffic from the IP blacklist, traffic surges, traffic behavior patterns that do not conform to current or historical behavior, and traffic that frequently accesses sensitive data.

[0054] S3. Conduct a threat assessment on the abnormal traffic detected by S2 through the control center of the cloud native system to determine whether the current traffic is DDoS attack traffic and analyze the attack type and attack source. The threat assessment specifically includes: using a known threat intelligence library to perform signature detection, establishing a behavior model, performing abnormal behavior detection, analyzing traffic characteristics and behavior based on specific rules and heuristic algorithms, determining whether the current traffic involves a DDoS attack, determining whether the traffic has DDoS attack behavior, and whether the traffic characteristics match the current threat intelligence database.

[0055] S4. Based on the threat assessment results in S3, the cloud native system's control center selects several flow-based detection and cleaning capabilities or IP-based source address governance capabilities from the capability pool built in S1. If flow cleaning is required, flow-based detection and cleaning capabilities are selected; if IP source address governance is required, IP-based source address governance capabilities are selected. The selected capabilities are combined and linked into a microservice chain in a set order. An anti-DDoS policy is then generated for the current DDoS attack and the assembled microservice chain, and deployed to any idle node in the cloud native system.

[0056] S5. Implement anti-DDoS attack measures based on the deployed anti-DDoS strategy and continuously monitor the network status and DDoS attacks of the cloud native system.

[0057] S6. Adjust and optimize the deployed anti-DDoS strategy based on real-time monitoring intelligence;

[0058] S7. Record all attack events and response strategies, and analyze DDoS attack types, attack sources, and anti-DDoS strategy performance. This is used for subsequent detection and cleaning algorithm training, IP address blacklist and whitelist generation, DDoS attack traffic source tracing, and anti-DDoS strategy performance optimization.

[0059] S8. Based on the recording and analysis of new attack trends and S7 historical data, continuously improve and optimize the automated process of cloud-native system anti-DDoS strategies.

[0060] This embodiment uses deep learning and machine learning algorithms to extract and analyze traffic features, significantly improving the accuracy of abnormal traffic detection and reducing false alarm rates. By combining behavioral models, rules, and heuristic algorithms, it conducts comprehensive threat assessments, helping to accurately identify DDoS attack types and respond promptly.

[0061] Example 3

[0062] As the best embodiment of the present invention, this embodiment discloses an anti-DDoS policy automation method based on a cloud native system, including the following steps:

[0063] S1. Cloud-native systems abstract anti-DDoS hardware functions into software capabilities through software-based approaches, deploy them in a cloud-network converged environment, and build a dynamically schedulable capacity pool. Specifically, this involves decoupling traditional anti-DDoS functions from hardware, implementing network functions in a virtualized environment through network programming, and using management and orchestration systems (such as MANO) to configure, manage, and optimize virtual network functions. These functions are then deployed as containers anywhere on the physical network within the cloud-native system.

[0064] S2. Through the microservice chain consisting of the collection capabilities, traffic diversion capabilities, and detection capabilities in the capability pool in S1, traffic within the cloud native system is analyzed and characterized to detect abnormal traffic in the cloud native system. Behavioral analysis specifically includes: building a normal behavior model based on historical data, monitoring traffic in real time, and comparing it with the normal traffic model to detect and classify abnormal behavior. Characteristic identification specifically includes: using machine learning and deep learning methods to identify traffic patterns, extract characteristic information from the traffic, and analyze it. Abnormal traffic includes traffic from IP blacklists, traffic surges, traffic behavior patterns that do not conform to current or historical behavior, and traffic that frequently accesses sensitive data.

[0065] S3, through the cloud-native system's control center, conducts a threat assessment on the abnormal traffic detected by S2, determines whether the current traffic constitutes a DDoS attack, and analyzes the attack type and source. This threat assessment specifically includes: utilizing a known threat intelligence database for signature detection, establishing a behavioral model, detecting abnormal behavior, and analyzing traffic characteristics and behavior based on specific rules and heuristic algorithms to determine whether the current traffic involves a DDoS attack, whether the traffic exhibits DDoS attack behavior, and whether the traffic characteristics match the current threat intelligence database.

[0066] S4. Based on the threat assessment results in S3, the cloud native system's control center selects several flow-based detection and cleaning capabilities or IP-based source address governance capabilities from the capability pool built in S1. If flow cleaning is required, flow-based detection and cleaning capabilities are selected; if IP source address governance is required, IP-based source address governance capabilities are selected. The selected capabilities are combined and linked into a microservice chain in a set order. An anti-DDoS policy is then generated for the current DDoS attack and the assembled microservice chain, and deployed to any idle node in the cloud native system.

[0067] S5. Implement anti-DDoS attack measures based on the deployed anti-DDoS strategy and continuously monitor the network status and DDoS attacks of the cloud native system.

[0068] S6. Adjust and optimize the deployed anti-DDoS strategy based on the real-time intelligence monitored. This includes adding new capabilities to the microservice chain based on the real-time monitored network status and attack characteristics; changing the deployment location of the microservice chain; and regenerating the microservice chain.

[0069] S7. Record all attack events and response strategies, and analyze DDos attack types, attack sources, and anti-DDos strategy performance. Specifically, this includes: analyzing DDos attack types, attack sources, and anti-DDos strategy performance: whether the current DDoS attack includes unknown attack types, whether it comes from an unknown DDoS attack source, whether the same anti-DDoS strategy has been generated before, how well the anti-DDoS strategy performs, how much DDoS traffic was detected, and how much DDoS attack traffic was intercepted. This information is used for subsequent detection and cleaning algorithm training, IP address blacklist and whitelist generation, DDoS attack traffic tracing, and anti-DDoS strategy performance optimization.

[0070] S8: Based on the recording and analysis of new attack trends and historical data from S7, continuously improve and optimize the automated process of cloud-native systems' anti-DDoS policies. This includes more efficient capability selection, better anti-DDoS policy composition, optimized anti-DDoS policy deployment, and enhanced cloud-native systems' traceability capabilities.

[0071] The more efficient capability options include:

[0072] Machine learning optimization: Use machine learning algorithms to analyze historical attack data and determine which capabilities are most effective in specific scenarios.

[0073] The better anti-DDoS strategy consists of:

[0074] Strategy templates: Based on historical data analysis, common attack scenario strategy templates are established. When similar attacks are detected, the corresponding strategy templates are quickly called for defense, and the template content is adjusted according to new attack trends.

[0075] The deployment of the optimized anti-DDoS strategy includes:

[0076] Load balancing: Load balancing technology allows for flexible scheduling to maintain balanced computing, storage, and communication pressures at each location in the physical network when multiple anti-D policies are deployed simultaneously.

[0077] The flexible scheduling method specifically means that, in a physical network, if the resources of a certain node or a certain link are exhausted and the resources of other nodes or links are sufficient, the capacity of the node or link with exhausted resources is deployed to the node or link with sufficient resources.

[0078] Improving the traceability capabilities of cloud native systems includes: sharing threat intelligence with other cloud service providers or security communities, and using shared data to improve overall traceability capabilities.

[0079] In this embodiment, based on real-time monitoring data, the system can automatically adjust anti-DDoS strategies, including increasing or decreasing capabilities and adjusting deployment locations, to ensure the continued effectiveness of the strategies in actual implementation. By recording and analyzing attack events and response strategies, the system can continuously iterate and optimize the automated anti-DDoS process, improving the system's ability to respond to future attacks and its anti-DDoS efficiency.

Claims

1. A cloud-native system-based anti-DDoS strategy automation method, characterized in that: The following steps are involved: S1. Cloud-native systems abstract anti-DDoS hardware functions into software capabilities through software-based approaches, deploy them in a cloud-network converged environment, and build a dynamically schedulable capacity pool. S2, through the microservice chain composed of capabilities in the capability pool in S1, conducts behavioral analysis and feature recognition on the traffic within the cloud native system to detect abnormal traffic in the cloud native system; S3, through the cloud-native system's control center, conducts a threat assessment on the abnormal traffic detected by S2, determines whether the current traffic constitutes a DDoS attack, and analyzes the attack type and source. S4. Based on the threat assessment results in S3, the cloud native system's control center selects several capabilities from the capability pool built in S1, combines and links the selected capabilities into a microservice chain in a set order, and then generates an anti-DDoS policy for the current DDoS attack and the assembled microservice chain. It then deploys the policy to any idle node in the cloud native system. S5. Implement anti-DDoS attack measures based on the deployed anti-DDoS strategy and continuously monitor the network status and DDoS attacks of the cloud native system. S6. Automatically adjust and optimize deployed anti-DDoS strategies based on real-time monitoring intelligence; S7. Record all attack events and response strategies, and analyze DDos attack types, attack sources, and anti-DDos strategy performance; S8. Based on the recording and analysis of new attack trends and S7 historical data, continuously improve and optimize the automated process of cloud-native system anti-DDoS strategies.

2. The method for automating anti-DDoS policies based on a cloud-native system according to claim 1, characterized in that: In S2, the behavior analysis specifically includes: building a normal behavior model based on historical data, and monitoring the traffic in real time, comparing it with the normal traffic model, and detecting and classifying abnormal behavior; the feature identification specifically includes: using machine learning and deep learning methods to identify traffic patterns, extract feature information in the traffic and analyze it; the abnormal traffic includes traffic from IP blacklists, traffic surges, traffic behavior patterns that do not conform to current or historical behavior, and traffic that frequently accesses sensitive data.

3. The method for automating anti-DDoS policies based on a cloud-native system according to claim 2, characterized in that: In S3, threat assessment specifically includes: using a known threat intelligence library to perform signature detection, establishing a behavior model, performing abnormal behavior detection, analyzing traffic characteristics and behaviors based on specific rules and heuristic algorithms, determining whether the current traffic involves a DDoS attack, determining whether the traffic has DDoS attack behavior, and whether the traffic characteristics match the current threat intelligence database.

4. The method for automating anti-DDoS policies based on a cloud-native system according to claim 3, characterized in that: In S4, if traffic needs to be cleaned, the traffic-based detection and cleaning capability is selected; if IP source addresses need to be managed, the IP-based source address management capability is selected.

5. The method for automating anti-DDoS policies based on a cloud-native system according to claim 4, characterized in that: In S6, the anti-DDoS strategy is adjusted and optimized based on the real-time intelligence monitored, including: At least one of adding new capabilities to the microservice chain, changing the deployment location of the microservice chain, or regenerating the microservice chain is performed based on the real-time monitored network status and attack characteristics.

6. The method for automating anti-DDoS policies based on a cloud native system according to any one of claims 1 to 5, characterized in that: In S8, the automated process of the cloud native system's anti-DDoS strategy is continuously improved and optimized, specifically including: more efficient capability selection, better anti-DDoS strategy composition, optimized anti-DDoS strategy deployment, and enhanced cloud native system traceability capabilities.

7. The method for automating anti-DDoS strategies based on a cloud-native system according to claim 6, characterized in that: The more efficient capability options include: Machine learning optimization: Use machine learning algorithms to analyze historical attack data and determine which capabilities are most effective in specific scenarios.

8. The method for automating anti-DDoS policies based on a cloud-native system according to claim 6, characterized in that: The better anti-DDoS strategy consists of: Strategy templates: Based on historical data analysis, common attack scenario strategy templates are established. When similar attacks are detected, the corresponding strategy templates are quickly called for defense, and the template content is adjusted according to new attack trends.

9. The method for automating anti-DDoS strategies based on a cloud-native system according to claim 6, characterized in that: The deployment of the optimized anti-DDoS strategy includes: Load balancing: Load balancing technology allows for flexible scheduling to maintain balanced computing, storage, and communication pressures at each location in the physical network when multiple anti-D policies are deployed simultaneously. The flexible scheduling method specifically means that, in a physical network, if the resources of a certain node or a certain link are exhausted and the resources of other nodes or links are sufficient, the capacity of the node or link with exhausted resources is deployed to the node or link with sufficient resources.

10. The method for automating anti-DDoS strategies based on a cloud-native system according to claim 6, characterized in that: Improving the traceability capabilities of cloud native systems includes: sharing threat intelligence with other cloud service providers or security communities, and using shared data to improve overall traceability capabilities.

Images