Anti-DDoS information sharing method suitable for cloud native system

Abstract

The invention discloses an anti-DDoS (Distributed Denial of Service) intelligence sharing method suitable for a cloud native system, which belongs to the technical field of network security and is characterized by comprising the following steps of: a, carrying out intelligence sharing in the cloud native system by adopting direct sharing and indirect sharing; b, direct sharing is carried out, and intelligence information is transmitted through service chains connected in series among the capabilities; and c, indirect sharing: under the control of the control center of the cloud native system, carrying out information sharing through the information sharing capability. According to the invention, based on the cloud native system, anti-DDoS intelligence sharing is realized in the cloud native system, intelligence sharing can be carried out in time, and the efficiency of intelligence sharing is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an anti-DDoS intelligence sharing method applicable to a cloud native system. Background Art

[0002] DDoS attack is a distributed denial of service attack. DDoS attack is one of the most important means of attack in current network attacks. Its characteristic is that DDoS attack can quickly exhaust the resources of the target system through a large number of requests, causing it to be unable to provide services normally. This type of attack may cause economic losses and reputation damage to enterprises, organizations or individuals. With the popularization of the Internet and the increase in the connection of various devices, the scale and frequency of DDoS attacks are also growing, bringing greater challenges to network security.

[0003] Cloud-network integration refers to the combination of cloud computing and communication networks, which fully utilizes the respective advantages of cloud computing and networks. Cloud computing can dynamically adjust resources according to demand, while the network realizes fast data transmission and wider coverage, with high flexibility and elasticity. Cloud-network integration development deploys supercomputing power to the user end, realizes cloud-edge integration, and achieves full network coverage through central cloud and edge cloud, bringing cloud-network capabilities to the extreme. Cloud native aims to use cloud computing, containerization and microservice technologies to build highly flexible and easy-to-manage applications and give full play to the potential of cloud computing. Cloud native can deploy applications according to demand, and applications can be flexibly combined and linked, and automated management can be performed to achieve flexible deployment of network functions and improve the response speed and efficiency of applications.

[0004] Cloud-network integration provides flexible and sufficient basic conditions for various cloud-native businesses. Based on cloud-native, with the help of software-based concepts, it breaks through the constraints of the existing network structure, realizes the flexible combination and linkage of system functions, and has the characteristics of deployment, orchestration, expansion and update, solving the problems of rigid deployment and high cost of traditional hardware.

[0005] Intelligence sharing means that when a system is attacked, it can share information about the attack with other components in the system, such as the source of the attack, the specific techniques and methods used by the attacker, the attacker's operating procedures and behavior patterns. Through intelligence sharing, the various components of the system can more quickly identify and respond to threats in the network, prevent future attacks, improve the ability of collaboration between components, and reduce the losses caused by attacks.

[0006] Anti-DDoS intelligence sharing requires that anti-DDoS devices within the system interact with each other and communicate through internal interconnection of the system. However, due to the current network rigidification, anti-DDoS devices are deployed in isolation in the network, and anti-DDoS strategies are separated from each other, leading to problems such as untimely and difficult intelligence sharing.

[0007] A Chinese patent document with publication number CN117914596A and publication date April 19, 2024 discloses a defense method, system and storage medium against DDOS attacks, characterized in that the system comprises: a cross-network linkage defense platform, and end-side DDoS attack monitoring and processing nodes and anti-DDoS defense platforms corresponding to multiple operators, wherein the end-side DDoS attack monitoring and processing nodes are deployed in an Internet data center and / or a public cloud; The end-side DDoS attack monitoring and processing node is used to defend against the attack traffic when the attack traffic value of the network is less than or equal to the node processing limit; when the attack traffic value is greater than the node processing limit, the attack information corresponding to the attack traffic is reported to the anti-DDoS defense platform corresponding to the end-side DDoS attack monitoring and processing node and the cross-network linkage defense platform; The anti-DDoS defense platform is used to send a traffic cleaning instruction to the cleaning device according to the attack information after receiving the attack information, so as to clean the attack traffic; The cross-network linkage defense platform is used to share the attack information with the anti-DDoS defense platforms corresponding to the multiple operators respectively, so as to carry out advance defense against the attack traffic represented by the attack information.

[0008] The anti-DDOS attack defense method, system and storage medium disclosed in the patent document can defend against attack traffic, and when the attack traffic value is greater than the node processing limit, the attack information corresponding to the attack traffic is reported to the anti-DDoS defense platform and cross-network linkage defense platform corresponding to the DDoS attack monitoring and processing node, so that the anti-DDoS defense platform can send traffic cleaning instructions to the cleaning device according to the attack information after receiving the attack information, so as to clean the attack traffic, thereby improving the defense effect. However, there are still problems of untimely intelligence sharing and low intelligence sharing efficiency. Summary of the invention

[0009] In order to overcome the defects of the above-mentioned prior art, the present invention provides an anti-DDoS intelligence sharing method suitable for a cloud native system. The present invention is based on a cloud native system, realizes anti-DDoS intelligence sharing in the cloud native system, can perform intelligence sharing in a timely manner, and improves the efficiency of intelligence sharing.

[0010] The present invention is achieved through the following technical solutions: An anti-DDoS intelligence sharing method applicable to a cloud native system, characterized by comprising the following steps: a. Use direct and indirect sharing for intelligence sharing in cloud-native systems; b. Direct sharing: intelligence information is transmitted through a service chain connected in series between various capabilities; c. Indirect sharing: intelligence sharing is carried out through intelligence sharing capabilities under the control of the control center of the cloud native system.

[0011] In the step b, direct sharing specifically refers to the intelligence sharing between various capabilities or service chains in the cloud native system through the first-line connection. When a capability or service chain demander requires intelligence from another capability or service chain provider, the demand is sent to the control center. The control center connects the capability or service chain that provides the intelligence in series before the demander to form a new service chain.

[0012] When performing serial operations, the control center performs intelligence format conversion, intelligence data analysis, and decryption and re-encryption operations.

[0013] The capability or service chain provider performs encryption operations before providing intelligence, and the capability or service chain demander performs decryption operations before receiving intelligence.

[0014] In step c, indirect sharing includes intelligence sampling, intelligence feature extraction, intelligence analysis, intelligence sharing and intelligence feedback.

[0015] The intelligence sampling specifically refers to the control center sampling the output intelligence of the capabilities or service chains that have been deployed in the current cloud native system for subsequent intelligence feature extraction.

[0016] The intelligence feature extraction specifically refers to the control center extracting features through algorithms based on the sampled intelligence to perform performance evaluation and classification on the output intelligence of each capability or service chain.

[0017] The intelligence analysis specifically refers to the control center performing performance evaluation and intelligence classification on each capability or service chain based on the sampled data as a basis for allocating optimal intelligence sharing.

[0018] The intelligence sharing specifically refers to the control center sensing the intelligence needs of various capabilities or service chains in the cloud native system. When sensing the intelligence required by any capability or service chain, the control center selects the optimal intelligence capability or service chain provider based on the evaluation results and classification results, and sends the intelligence to the intelligence demander.

[0019] The intelligence feedback specifically refers to the capabilities or service chains in the cloud native system feeding back the intelligence sharing and usage to the control center after receiving the shared intelligence, including evaluating the intelligence quality, sharing efficiency and utilization rate of the intelligence.

[0020] The capability described in the present invention refers to a virtualized component abstracted from a traditional anti-DDoS function, which decouples the traditional anti-DDoS function from the hardware, implements the network function in a virtualized environment through network programming, uses a management and orchestration system to configure, manage and optimize the virtual network function, and deploys it in a container at any location on the physical network in the cloud native system.

[0021] The beneficial effects of the present invention are mainly manifested in the following aspects: 1. The present invention, a. adopts direct sharing and indirect sharing to share intelligence in the cloud native system; b. Direct sharing, intelligence information is transmitted through a service chain connected in series between various capabilities; c. Indirect sharing, intelligence sharing is carried out through intelligence sharing capabilities under the control of a control center of the cloud native system. Compared with the prior art, anti-DDoS intelligence sharing is realized in the cloud native system based on the cloud native system, and intelligence sharing can be carried out in a timely manner, thereby improving the efficiency of intelligence sharing.

[0022] 2. The present invention adopts direct sharing and indirect sharing for intelligence sharing, which can solve the problems of mutual separation between anti-DDoS devices in the current network, untimely and difficult sharing of attack intelligence, and has good applicability.

[0023] 3. In the present invention, the control center performs intelligence format conversion, intelligence data analysis, decryption and re-encryption operations when performing serial operations, which can ensure the uniformity of intelligence during transmission.

[0024] 4. In the present invention, in step c, indirect sharing includes intelligence sampling, intelligence feature extraction, intelligence analysis, intelligence sharing and intelligence feedback. Through these five stages, the cloud native system can more conveniently share anti-DDoS intelligence, and continuously optimize the intelligence sharing process through the feedback mechanism.

[0025] 5. The present invention solves the problem that anti-DDoS devices in the current network are deployed in isolation and DDoS threat intelligence is difficult to share. It realizes DDoS threat intelligence sharing in the cloud native system, making intelligence sharing easier to achieve.

[0026] 6. In order to solve the problem of untimely sharing of DDoS threat intelligence in the current network, the present invention establishes a DDoS threat intelligence sharing mechanism in the cloud native system, which can share intelligence faster and improve real-time performance.

[0027] 7. In order to solve the problem of untimely feedback of DDoS threat intelligence processing in the current network, the present invention establishes a DDoS intelligence feedback mechanism in the cloud native system, which can provide timely feedback on the effect of intelligence sharing. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments: Figure 1 It is a flowchart of the present invention. DETAILED DESCRIPTION

[0029] Example 1 See also Figure 1 , an anti-DDoS intelligence sharing method applicable to cloud native systems, comprising the following steps: a. Use direct and indirect sharing for intelligence sharing in cloud-native systems; b. Direct sharing: intelligence information is transmitted through a service chain connected in series between various capabilities; c. Indirect sharing: intelligence sharing is carried out through intelligence sharing capabilities under the control of the control center of the cloud native system.

[0030] This embodiment is the most basic implementation method, a. direct sharing and indirect sharing are used to share intelligence in the cloud native system; b. direct sharing, intelligence information is transmitted through a service chain connected in series between various capabilities; c. indirect sharing, intelligence sharing is carried out through intelligence sharing capabilities under the control of the control center of the cloud native system. Compared with the existing technology, anti-DDoS intelligence sharing is realized in the cloud native system based on the cloud native system, intelligence sharing can be carried out in a timely manner, and the efficiency of intelligence sharing is improved.

[0031] Example 2 See also Figure 1 , an anti-DDoS intelligence sharing method applicable to cloud native systems, comprising the following steps: a. Use direct and indirect sharing for intelligence sharing in cloud-native systems; b. Direct sharing: intelligence information is transmitted through a service chain connected in series between various capabilities; c. Indirect sharing: intelligence sharing is carried out through intelligence sharing capabilities under the control of the control center of the cloud native system.

[0032] Preferably, in step b, direct sharing specifically refers to intelligence sharing between various capabilities or service chains in the cloud native system through first-line serial connection. When a capability or service chain demander requires intelligence from another capability or service chain provider, the demand is sent to the control center. The control center connects the capability or service chain that provides the intelligence in series before the demander based on the demand to form a new service chain.

[0033] This embodiment is a preferred implementation method, which adopts direct sharing and indirect sharing for intelligence sharing, and can solve the problems of mutual separation between anti-DDoS devices in the current network, untimely and difficult sharing of attack intelligence, and has good applicability.

[0034] Example 3 See also Figure 1 , an anti-DDoS intelligence sharing method applicable to cloud native systems, comprising the following steps: a. Use direct and indirect sharing for intelligence sharing in cloud-native systems; b. Direct sharing: intelligence information is transmitted through a service chain connected in series between various capabilities; c. Indirect sharing: intelligence sharing is carried out through intelligence sharing capabilities under the control of the control center of the cloud native system.

[0035] In the step b, direct sharing specifically refers to the intelligence sharing between various capabilities or service chains in the cloud native system through the first-line connection. When a capability or service chain demander requires intelligence from another capability or service chain provider, the demand is sent to the control center. The control center connects the capability or service chain that provides the intelligence in series before the demander to form a new service chain.

[0036] When performing serial operations, the control center performs intelligence format conversion, intelligence data analysis, and decryption and re-encryption operations.

[0037] The capability or service chain provider performs encryption operations before providing intelligence, and the capability or service chain demander performs decryption operations before receiving intelligence.

[0038] In step c, indirect sharing includes intelligence sampling, intelligence feature extraction, intelligence analysis, intelligence sharing and intelligence feedback.

[0039] This embodiment is another preferred implementation method. When the control center performs serial operation, it performs intelligence format conversion, intelligence data analysis, and decryption and re-encryption operations to ensure the uniformity of intelligence during transmission.

[0040] In step c, indirect sharing includes intelligence sampling, intelligence feature extraction, intelligence analysis, intelligence sharing, and intelligence feedback. Through these five stages, the cloud native system can more conveniently share anti-DDoS intelligence and continuously optimize the intelligence sharing process through the feedback mechanism.

[0041] Example 4 See also Figure 1 , an anti-DDoS intelligence sharing method applicable to cloud native systems, comprising the following steps: a. Use direct and indirect sharing for intelligence sharing in cloud-native systems; b. Direct sharing: intelligence information is transmitted through a service chain connected in series between various capabilities; c. Indirect sharing: intelligence sharing is carried out through intelligence sharing capabilities under the control of the control center of the cloud native system.

[0042] In the step b, direct sharing specifically refers to the intelligence sharing between various capabilities or service chains in the cloud native system through the first-line connection. When a capability or service chain demander requires intelligence from another capability or service chain provider, the demand is sent to the control center. The control center connects the capability or service chain that provides the intelligence in series before the demander to form a new service chain.

[0043] When performing serial operations, the control center performs intelligence format conversion, intelligence data analysis, and decryption and re-encryption operations.

[0044] The capability or service chain provider performs encryption operations before providing intelligence, and the capability or service chain demander performs decryption operations before receiving intelligence.

[0045] Further preferably, in step c, indirect sharing includes intelligence sampling, intelligence feature extraction, intelligence analysis, intelligence sharing and intelligence feedback.

[0046] The intelligence sampling specifically refers to the control center sampling the output intelligence of the capabilities or service chains that have been deployed in the current cloud native system for subsequent intelligence feature extraction.

[0047] The intelligence feature extraction specifically refers to the control center extracting features through algorithms based on the sampled intelligence to perform performance evaluation and classification on the output intelligence of each capability or service chain.

[0048] This embodiment is another preferred implementation method. In order to solve the problem that anti-DDoS devices in the current network are deployed in isolation and DDoS threat intelligence is difficult to share, DDoS threat intelligence sharing is implemented in the cloud native system, making intelligence sharing easier to achieve.

[0049] Example 5 See also Figure 1 , an anti-DDoS intelligence sharing method applicable to cloud native systems, comprising the following steps: a. Use direct and indirect sharing for intelligence sharing in cloud-native systems; b. Direct sharing: intelligence information is transmitted through a service chain connected in series between various capabilities; c. Indirect sharing: intelligence sharing is carried out through intelligence sharing capabilities under the control of the control center of the cloud native system.

[0050] In the step b, direct sharing specifically refers to the intelligence sharing between various capabilities or service chains in the cloud native system through the first-line connection. When a capability or service chain demander requires intelligence from another capability or service chain provider, the demand is sent to the control center. The control center connects the capability or service chain that provides the intelligence in series before the demander to form a new service chain.

[0051] When performing serial operations, the control center performs intelligence format conversion, intelligence data analysis, and decryption and re-encryption operations.

[0052] The capability or service chain provider performs encryption operations before providing intelligence, and the capability or service chain demander performs decryption operations before receiving intelligence.

[0053] In step c, indirect sharing includes intelligence sampling, intelligence feature extraction, intelligence analysis, intelligence sharing and intelligence feedback.

[0054] The intelligence sampling specifically refers to the control center sampling the output intelligence of the capabilities or service chains that have been deployed in the current cloud native system for subsequent intelligence feature extraction.

[0055] The intelligence feature extraction specifically refers to the control center extracting features through algorithms based on the sampled intelligence to perform performance evaluation and classification on the output intelligence of each capability or service chain.

[0056] The intelligence analysis specifically refers to the control center performing performance evaluation and intelligence classification on each capability or service chain based on the sampled data as a basis for allocating optimal intelligence sharing.

[0057] The intelligence sharing specifically refers to the control center sensing the intelligence needs of various capabilities or service chains in the cloud native system. When sensing the intelligence required by any capability or service chain, the control center selects the optimal intelligence capability or service chain provider based on the evaluation results and classification results, and sends the intelligence to the intelligence demander.

[0058] This embodiment is another preferred implementation method. To address the problem of untimely sharing of DDoS threat intelligence in the current network, a DDoS threat intelligence sharing mechanism is established in the cloud native system, which can share intelligence faster and improve real-time performance.

[0059] Example 6 See also Figure 1 , an anti-DDoS intelligence sharing method applicable to cloud native systems, comprising the following steps: a. Use direct and indirect sharing for intelligence sharing in cloud-native systems; b. Direct sharing: intelligence information is transmitted through a service chain connected in series between various capabilities; c. Indirect sharing: intelligence sharing is carried out through intelligence sharing capabilities under the control of the control center of the cloud native system.

[0060] In the step b, direct sharing specifically refers to the intelligence sharing between various capabilities or service chains in the cloud native system through the first-line connection. When a capability or service chain demander requires intelligence from another capability or service chain provider, the demand is sent to the control center. The control center connects the capability or service chain that provides the intelligence in series before the demander to form a new service chain.

[0061] When performing serial operations, the control center performs intelligence format conversion, intelligence data analysis, and decryption and re-encryption operations.

[0062] The capability or service chain provider performs encryption operations before providing intelligence, and the capability or service chain demander performs decryption operations before receiving intelligence.

[0063] In step c, indirect sharing includes intelligence sampling, intelligence feature extraction, intelligence analysis, intelligence sharing and intelligence feedback.

[0064] The intelligence sampling specifically refers to the control center sampling the output intelligence of the capabilities or service chains that have been deployed in the current cloud native system for subsequent intelligence feature extraction.

[0065] The intelligence feature extraction specifically refers to the control center extracting features through algorithms based on the sampled intelligence to perform performance evaluation and classification on the output intelligence of each capability or service chain.

[0066] The intelligence analysis specifically refers to the control center performing performance evaluation and intelligence classification on each capability or service chain based on the sampled data as a basis for allocating optimal intelligence sharing.

[0067] Further preferably, the intelligence sharing specifically refers to the control center sensing the demand for intelligence of various capabilities or service chains in the cloud native system. When sensing the demand intelligence of any capability or service chain, the control center selects the optimal intelligence capability or service chain provider based on the evaluation results and classification results, and sends the intelligence to the intelligence demander.

[0068] The intelligence feedback specifically refers to the capabilities or service chains in the cloud native system feeding back the intelligence sharing and usage to the control center after receiving the shared intelligence, including evaluating the intelligence quality, sharing efficiency and utilization rate of the intelligence.

[0069] This embodiment is the best implementation method. To address the problem of untimely feedback on DDoS threat intelligence processing in the current network, a DDoS intelligence feedback mechanism is established in the cloud native system, which can provide timely feedback on the effect of intelligence sharing.

[0070] The basic principles of the present invention are as follows: Intelligence sharing in cloud native systems includes direct sharing and indirect sharing. Direct intelligence sharing refers to the sharing of intelligence between various capabilities or service chains in the cloud native system through the first-line connection; indirect sharing refers to intelligence sharing through intelligence sharing capabilities under the control of the control center of the cloud native system, including five stages: intelligence sampling, intelligence feature extraction, intelligence analysis, intelligence sharing, and intelligence feedback. Through the five stages of indirect sharing, the cloud native system can more conveniently share anti-DDoS intelligence, and through the feedback mechanism, continuously optimize the intelligence sharing process, and can share intelligence in a timely manner and improve the efficiency of intelligence sharing.

[0071] The capability refers to the virtualized components abstracted from traditional anti-DDoS functions, which decouple traditional anti-DDoS functions from hardware, implement network functions in a virtualized environment through network programming, and use management and orchestration systems such as MANO to configure, manage and optimize virtual network functions, which are deployed in containers at any location on the physical network in the cloud native system.

[0072] MANO refers to a unified framework for managing various virtual network functions and basic network virtualization architecture, which is used for business orchestration and device management.

Claims

1. An anti-DDoS intelligence sharing method applicable to cloud native systems, characterized in that: The following steps are involved: In the field of network security technology, a. Use direct and indirect sharing for intelligence sharing in cloud-native systems; b. Direct sharing: intelligence information is transmitted through a service chain connected in series between various capabilities; c. Indirect sharing: intelligence sharing is carried out through intelligence sharing capabilities under the control of the control center of the cloud native system.

2. The anti-DDoS intelligence sharing method applicable to cloud native systems according to claim 1, characterized in that: In the step b, direct sharing specifically refers to the intelligence sharing between various capabilities or service chains in the cloud native system through the first-line connection. When a capability or service chain demander requires intelligence from another capability or service chain provider, the demand is sent to the control center. The control center connects the capability or service chain that provides the intelligence in series before the demander to form a new service chain.

3. The anti-DDoS intelligence sharing method applicable to a cloud native system according to claim 2, characterized in that: When performing serial operations, the control center performs intelligence format conversion, intelligence data analysis, and decryption and re-encryption operations.

4. The anti-DDoS intelligence sharing method applicable to a cloud native system according to claim 3, characterized in that: The capability or service chain provider performs encryption operations before providing intelligence, and the capability or service chain demander performs decryption operations before receiving intelligence.

5. The anti-DDoS intelligence sharing method applicable to cloud native systems according to claim 1, characterized in that: In step c, indirect sharing includes intelligence sampling, intelligence feature extraction, intelligence analysis, intelligence sharing and intelligence feedback.

6. The anti-DDoS intelligence sharing method applicable to a cloud native system according to claim 5, characterized in that: The intelligence sampling specifically refers to the control center sampling the output intelligence of the capabilities or service chains that have been deployed in the current cloud native system for subsequent intelligence feature extraction.

7. The anti-DDoS intelligence sharing method applicable to a cloud native system according to claim 6, characterized in that: The intelligence feature extraction specifically refers to the control center extracting features through algorithms based on the sampled intelligence to perform performance evaluation and classification on the output intelligence of each capability or service chain.

8. The anti-DDoS intelligence sharing method applicable to a cloud native system according to claim 7, characterized in that: The intelligence analysis specifically refers to the control center performing performance evaluation and intelligence classification on each capability or service chain based on the sampled data as a basis for allocating optimal intelligence sharing.

9. The anti-DDoS intelligence sharing method applicable to cloud native systems according to claim 5, characterized in that: The intelligence sharing specifically refers to the control center sensing the intelligence needs of various capabilities or service chains in the cloud native system. When sensing the intelligence required by any capability or service chain, the control center selects the optimal intelligence capability or service chain provider based on the evaluation results and classification results, and sends the intelligence to the intelligence demander.

10. The anti-DDoS intelligence sharing method applicable to a cloud native system according to claim 8, characterized in that: The intelligence feedback specifically refers to the capabilities or service chains in the cloud native system feeding back the intelligence sharing and usage to the control center after receiving the shared intelligence, including evaluating the intelligence quality, sharing efficiency and utilization rate of the intelligence.

Images