Anti-DDoS flow detection cleaning method suitable for cloud native system

Abstract

The invention discloses an anti-DDoS (Distributed Denial of Service) flow detection cleaning method suitable for a cloud native system, which belongs to the technical field of network security and is characterized by comprising the following steps of: 1, abstracting an anti-DDoS function into capabilities through capability abstraction in the cloud native system, and forming a service chain by the abstracted capabilities through a control center; step 2, collecting traffic in the cloud native system through the traffic collection capability; step 3, routing scheduling is carried out through the cloud native system; step 4, performing anomaly detection on the flow collected in the cloud native system through the flow detection capability; step 5, cleaning the detected traffic in the cloud native system through the traffic cleaning capability; and step 6, reinjecting the cleaned traffic in the cloud native system to the user through the traffic reinjection capability. Based on the cloud native system, detection and cleaning of the flow are realized in the cloud native system, and the cleaning efficiency and flexibility are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an anti-DDoS traffic detection and cleaning method suitable for a cloud native system. Background Art

[0002] DDoS attack is a distributed denial of service attack. DDoS attack is one of the most important means of attack in current network attacks. Its characteristic is that DDoS attack can quickly exhaust the resources of the target system through a large number of requests, causing it to be unable to provide services normally. This type of attack may cause economic losses and reputation damage to enterprises, organizations or individuals. With the popularization of the Internet and the increase in the connection of various devices, the scale and frequency of DDoS attacks are also growing, bringing greater challenges to network security.

[0003] Cloud-network integration refers to the combination of cloud computing and communication networks, which fully utilizes the respective advantages of cloud computing and networks. Cloud computing can dynamically adjust resources according to demand, while the network realizes fast data transmission and wider coverage, with high flexibility and elasticity. Cloud-network integration development deploys supercomputing power to the user end, realizes cloud-edge integration, and achieves full network coverage through central cloud and edge cloud, bringing cloud-network capabilities to the extreme. Cloud native aims to use cloud computing, containerization and microservice technologies to build highly flexible and easy-to-manage applications and give full play to the potential of cloud computing. Cloud native can deploy applications according to demand, and applications can be flexibly combined and linked, and automated management can be performed to achieve flexible deployment of network functions and improve the response speed and efficiency of applications. Cloud-network integration provides flexible and sufficient basic conditions for various cloud-native businesses. On the basis of cloud native, with the help of software-based concepts, it breaks through the constraints of the existing network structure, realizes flexible combination and linkage of system functions, has the characteristics of deployment, orchestration, expansion and update, and solves the problems of rigid deployment and high cost of traditional hardware.

[0004] Traffic detection and cleaning refers to monitoring network traffic. If abnormal or malicious attack traffic is detected, the traffic is cleaned and filtered using set algorithms or rules to remove abnormal or malicious attack traffic in the network to ensure the security and normal operation of the network. This method is crucial for defending against DDoS attacks, malware propagation and other network security threats.

[0005] Traditional anti-DDoS attack methods include traffic detection and cleaning, which requires the deployment of dedicated anti-DDoS attack equipment and software functions in the physical network, resulting in a lack of flexibility and elasticity in traditional anti-DDoS attack systems, which in turn leads to the current problems of low efficiency and low flexibility of traffic detection and cleaning.

[0006] A Chinese patent document with publication number CN117375942A and publication date January 9, 2024 discloses a method and device for preventing DDoS attacks based on node cleaning, the method comprising: monitoring network traffic information of a protected server, and analyzing the network traffic information to obtain abnormal network traffic, when the size of the abnormal network traffic exceeds the defense threshold corresponding to the protected server, obtaining a preset traffic cleaning node set, pulling the abnormal network traffic to the traffic cleaning node set, and performing node cleaning on the abnormal network traffic through a preset traffic cleaning method to obtain a network traffic cleaning result, the network traffic cleaning result comprising a first target network abnormal traffic and a first normal access traffic, and injecting the first normal access traffic back to the protected server according to a preset traffic injection route.

[0007] The method and device for preventing DDoS attacks based on node cleaning disclosed in the patent document can prevent DDoS attacks. However, the cleaning efficiency and flexibility are poor. Summary of the invention

[0008] In order to overcome the defects of the above-mentioned prior art, the present invention provides an anti-DDoS traffic detection and cleaning method suitable for a cloud native system. The present invention is based on a cloud native system, abstracts all traditional anti-DDoS attack functions into capabilities, can break through the constraints of the existing network structure, and realize traffic detection and cleaning in the cloud native system, thereby improving cleaning efficiency and flexibility.

[0009] The present invention is achieved through the following technical solutions: An anti-DDoS traffic detection and cleaning method applicable to a cloud native system, characterized in that it comprises the following steps: Step 1: In the cloud native system, the anti-DDoS function is abstracted into capabilities through capability abstraction, and the abstracted capabilities are combined into a service chain through the control center; Step 2: Traffic collection phase: Traffic is collected in the cloud native system through traffic collection capabilities. Step 3: During the traffic diversion phase, routing scheduling is performed through the cloud native system; Step 4: During the traffic detection phase, the traffic collected in the cloud native system is detected for anomalies through traffic detection capabilities. Step 5: During the traffic cleaning phase, the traffic detected in the cloud native system is cleaned using the traffic cleaning capability. Step 6: During the traffic reinjection phase, the cleaned traffic in the cloud native system is injected back to the user through the traffic reinjection capability.

[0010] In step 2, the traffic collection capability is obtained through the traffic collection function abstraction, and the traffic collection capability is used to be deployed in the cloud native system.

[0011] In step 3, performing routing scheduling through the cloud native system means abstracting the routing scheduling function into routing scheduling capability, performing optimal allocation through the scheduling algorithm of the control center, and completing the optimal traffic scheduling plan.

[0012] In step 4, the flow detection capability is abstracted through the flow statistics analysis function, and the flow detection capability is used to identify abnormal patterns and behaviors in the flow.

[0013] In step 5, the traffic cleaning capability is abstracted by the filtering function.

[0014] In step 5, the traffic cleaning capability is used to clean and filter the transmitted traffic to remove abnormal attack traffic.

[0015] In step 6, the traffic reinjection capability is abstracted through the routing scheduling function in the physical network. The traffic reinjection capability is used to inject the cleaned traffic back to the user according to user needs under the control of the control center of the cloud native system.

[0016] In step 1, the control center adjusts the capabilities in the service chain for different types of DDoS attacks and network environments.

[0017] In step 4, the traffic detection capability includes traffic statistics, traffic analysis, behavior pattern recognition and abnormal pattern detection.

[0018] In step 5, the traffic cleaning capabilities include data packet filtering, traffic shaping, attack traffic blocking, and IP blacklist and whitelist management.

[0019] The capability described in the present invention refers to a virtualized component abstracted from a traditional anti-DDoS function, which decouples the traditional anti-DDoS function from the hardware, implements the network function in a virtualized environment through network programming, uses a management and orchestration system to configure, manage and optimize the virtual network function, and deploys it in a container at any location on the physical network in the cloud native system.

[0020] The beneficial effects of the present invention are mainly manifested in the following aspects: 1. Compared with the prior art, the present invention, based on the cloud native system, abstracts all traditional anti-DDoS attack functions into capabilities, can break through the constraints of the existing network structure, realize traffic detection and cleaning in the cloud native system, and improve cleaning efficiency and flexibility.

[0021] 2. The present invention aims to solve the problem of low efficiency of traffic detection and cleaning against DDoS attacks in current networks, and implements traffic detection and cleaning in a cloud-native system, thereby greatly improving the cleaning efficiency.

[0022] 3. In view of the problem that the anti-DDoS attack traffic detection and cleaning functions are difficult to deploy in the current network, the present invention realizes traffic detection and cleaning in the cloud native system with higher flexibility.

[0023] 4. The present invention aims at the problem of insufficient accuracy of flow detection and cleaning in the current network, and distinguishes normal flow and attack flow in the process of detection and cleaning, which is conducive to improving the detection accuracy.

[0024] 5. In the present invention, in step 1, the control center adjusts the capabilities in the service chain for different types of DDoS attacks and network environments, thereby improving the flexibility and response speed of the system.

[0025] 6. In the present invention, in step 4, the flow detection capability includes flow statistics, flow analysis, behavior pattern recognition and abnormal pattern detection, and realizes comprehensive monitoring and rapid response to the flow through centralized control.

[0026] 7. In the present invention, in step 5, the traffic cleaning capability includes data packet filtering, traffic shaping, attack traffic blocking and IP blacklist and whitelist management, which can ensure efficient cleaning and filtering of various DDoS attack traffic.

[0027] 8. In the traffic collection stage, the present invention abstracts the traffic collection function that relies on traditional hardware into traffic collection capability, and deploys it to various locations of the cloud native system according to demand. It is no longer restricted by the ports, locations and configurations of traditional collection hardware. When the control center perceives user needs, the traffic collection capability in the cloud native system can collect traffic at any port, any location and any configuration, with higher flexibility.

[0028] 9. In the traffic diversion stage, the present invention abstracts the routing function and the scheduling function into routing scheduling capabilities. The cloud native system will make optimal allocations based on user needs through the scheduling algorithm of the control center and select the appropriate cloud native system location, thereby achieving optimal traffic scheduling planning, which is conducive to improving cleaning efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments: Figure 1 It is a flowchart of the present invention. DETAILED DESCRIPTION

[0030] Example 1 See also Figure 1 , an anti-DDoS traffic detection and cleaning method suitable for cloud native systems, comprising the following steps: Step 1: In the cloud native system, the anti-DDoS function is abstracted into capabilities through capability abstraction, and the abstracted capabilities are combined into a service chain through the control center; Step 2: Traffic collection phase: Traffic is collected in the cloud native system through traffic collection capabilities. Step 3: During the traffic diversion phase, routing scheduling is performed through the cloud native system; Step 4: During the traffic detection phase, the traffic collected in the cloud native system is detected for anomalies through traffic detection capabilities. Step 5: During the traffic cleaning phase, the traffic detected in the cloud native system is cleaned using the traffic cleaning capability. Step 6: During the traffic reinjection phase, the cleaned traffic in the cloud native system is injected back to the user through the traffic reinjection capability.

[0031] This embodiment is the most basic implementation method. Compared with the existing technology, it is based on the cloud native system and abstracts all traditional anti-DDoS attack functions into capabilities. It can break through the constraints of the existing network structure, realize traffic detection and cleaning in the cloud native system, and improve cleaning efficiency and flexibility.

[0032] Example 2 See also Figure 1 , an anti-DDoS traffic detection and cleaning method suitable for cloud native systems, comprising the following steps: Step 1: In the cloud native system, the anti-DDoS function is abstracted into capabilities through capability abstraction, and the abstracted capabilities are combined into a service chain through the control center; Step 2: Traffic collection phase: Traffic is collected in the cloud native system through traffic collection capabilities. Step 3: During the traffic diversion phase, routing scheduling is performed through the cloud native system; Step 4: During the traffic detection phase, the traffic collected in the cloud native system is detected for anomalies through traffic detection capabilities. Step 5: During the traffic cleaning phase, the traffic detected in the cloud native system is cleaned using the traffic cleaning capability. Step 6: During the traffic reinjection phase, the cleaned traffic in the cloud native system is injected back to the user through the traffic reinjection capability.

[0033] In step 2, the traffic collection capability is obtained through the traffic collection function abstraction, and the traffic collection capability is used to be deployed in the cloud native system.

[0034] This embodiment is a preferred implementation method. To address the problem of low efficiency of anti-DDoS attack traffic detection and cleaning in the current network, traffic detection and cleaning are implemented in the cloud native system, which greatly improves the cleaning efficiency.

[0035] Example 3 See also Figure 1 , an anti-DDoS traffic detection and cleaning method suitable for cloud native systems, comprising the following steps: Step 1: In the cloud native system, the anti-DDoS function is abstracted into capabilities through capability abstraction, and the abstracted capabilities are combined into a service chain through the control center; Step 2: Traffic collection phase: Traffic is collected in the cloud native system through traffic collection capabilities. Step 3: During the traffic diversion phase, routing scheduling is performed through the cloud native system; Step 4: During the traffic detection phase, the traffic collected in the cloud native system is detected for anomalies through traffic detection capabilities. Step 5: During the traffic cleaning phase, the traffic detected in the cloud native system is cleaned using the traffic cleaning capability. Step 6: During the traffic reinjection phase, the cleaned traffic in the cloud native system is injected back to the user through the traffic reinjection capability.

[0036] Preferably, in step 2, the traffic collection capability is obtained through traffic collection function abstraction, and the traffic collection capability is used to be deployed in a cloud native system.

[0037] In step 3, performing routing scheduling through the cloud native system means abstracting the routing scheduling function into routing scheduling capability, performing optimal allocation through the scheduling algorithm of the control center, and completing the optimal traffic scheduling plan.

[0038] In step 4, the flow detection capability is abstracted through the flow statistics analysis function, and the flow detection capability is used to identify abnormal patterns and behaviors in the flow.

[0039] This embodiment is another preferred implementation method. To address the problem that anti-DDoS attack traffic detection and cleaning functions are difficult to deploy in the current network, traffic detection and cleaning are implemented in the cloud native system with higher flexibility.

[0040] In view of the problem of insufficient accuracy of traffic detection and cleaning in the current network, distinguishing normal traffic from attack traffic in the detection and cleaning process is conducive to improving detection accuracy.

[0041] Example 4 See also Figure 1 , an anti-DDoS traffic detection and cleaning method suitable for cloud native systems, comprising the following steps: Step 1: In the cloud native system, the anti-DDoS function is abstracted into capabilities through capability abstraction, and the abstracted capabilities are combined into a service chain through the control center; Step 2: Traffic collection phase: Traffic is collected in the cloud native system through traffic collection capabilities. Step 3: During the traffic diversion phase, routing scheduling is performed through the cloud native system; Step 4: During the traffic detection phase, the traffic collected in the cloud native system is detected for anomalies through traffic detection capabilities. Step 5: During the traffic cleaning phase, the traffic detected in the cloud native system is cleaned using the traffic cleaning capability. Step 6: During the traffic reinjection phase, the cleaned traffic in the cloud native system is injected back to the user through the traffic reinjection capability.

[0042] In step 2, the traffic collection capability is obtained through the traffic collection function abstraction, and the traffic collection capability is used to be deployed in the cloud native system.

[0043] In step 3, performing routing scheduling through the cloud native system means abstracting the routing scheduling function into routing scheduling capability, performing optimal allocation through the scheduling algorithm of the control center, and completing the optimal traffic scheduling plan.

[0044] In step 4, the flow detection capability is abstracted through the flow statistics analysis function, and the flow detection capability is used to identify abnormal patterns and behaviors in the flow.

[0045] In step 5, the traffic cleaning capability is abstracted by the filtering function.

[0046] In step 5, the traffic cleaning capability is used to clean and filter the transmitted traffic to remove abnormal attack traffic.

[0047] This embodiment is another preferred implementation mode. In step 1, the control center adjusts the capabilities in the service chain for different types of DDoS attacks and network environments, thereby improving the flexibility and response speed of the system.

[0048] In step 4, traffic detection capabilities include traffic statistics, traffic analysis, behavior pattern recognition, and abnormal pattern detection, which enable comprehensive monitoring and rapid response to traffic through centralized control.

[0049] Example 5 See also Figure 1 , an anti-DDoS traffic detection and cleaning method suitable for cloud native systems, comprising the following steps: Step 1: In the cloud native system, the anti-DDoS function is abstracted into capabilities through capability abstraction, and the abstracted capabilities are combined into a service chain through the control center; Step 2: Traffic collection phase: Traffic is collected in the cloud native system through traffic collection capabilities. Step 3: During the traffic diversion phase, routing scheduling is performed through the cloud native system; Step 4: During the traffic detection phase, the traffic collected in the cloud native system is detected for anomalies through traffic detection capabilities. Step 5: During the traffic cleaning phase, the traffic detected in the cloud native system is cleaned using the traffic cleaning capability. Step 6: During the traffic reinjection phase, the cleaned traffic in the cloud native system is injected back to the user through the traffic reinjection capability.

[0050] In step 2, the traffic collection capability is obtained through the traffic collection function abstraction, and the traffic collection capability is used to be deployed in the cloud native system.

[0051] In step 3, performing routing scheduling through the cloud native system means abstracting the routing scheduling function into routing scheduling capability, performing optimal allocation through the scheduling algorithm of the control center, and completing the optimal traffic scheduling plan.

[0052] In step 4, the flow detection capability is abstracted through the flow statistics analysis function, and the flow detection capability is used to identify abnormal patterns and behaviors in the flow.

[0053] Further preferably, in step 5, the flow cleaning capability is obtained by abstracting the filtering function.

[0054] In step 5, the traffic cleaning capability is used to clean and filter the transmitted traffic to remove abnormal attack traffic.

[0055] In step 6, the traffic reinjection capability is abstracted through the routing scheduling function in the physical network. The traffic reinjection capability is used to inject the cleaned traffic back to the user according to user needs under the control of the control center of the cloud native system.

[0056] In step 1, the control center adjusts the capabilities in the service chain for different types of DDoS attacks and network environments.

[0057] This embodiment is another preferred implementation method. In step 5, the traffic cleaning capability includes data packet filtering, traffic shaping, attack traffic blocking, and IP blacklist and whitelist management, which can ensure efficient cleaning and filtering of various DDoS attack traffic.

[0058] Example 6 See also Figure 1 , an anti-DDoS traffic detection and cleaning method suitable for cloud native systems, comprising the following steps: Step 1: In the cloud native system, the anti-DDoS function is abstracted into capabilities through capability abstraction, and the abstracted capabilities are combined into a service chain through the control center; Step 2: Traffic collection phase: Traffic is collected in the cloud native system through traffic collection capabilities. Step 3: During the traffic diversion phase, routing scheduling is performed through the cloud native system; Step 4: During the traffic detection phase, the traffic collected in the cloud native system is detected for anomalies through traffic detection capabilities. Step 5: During the traffic cleaning phase, the traffic detected in the cloud native system is cleaned using the traffic cleaning capability. Step 6: During the traffic reinjection phase, the cleaned traffic in the cloud native system is injected back to the user through the traffic reinjection capability.

[0059] In step 2, the traffic collection capability is obtained through the traffic collection function abstraction, and the traffic collection capability is used to be deployed in the cloud native system.

[0060] In step 3, performing routing scheduling through the cloud native system means abstracting the routing scheduling function into routing scheduling capability, performing optimal allocation through the scheduling algorithm of the control center, and completing the optimal traffic scheduling plan.

[0061] In step 4, the flow detection capability is abstracted through the flow statistics analysis function, and the flow detection capability is used to identify abnormal patterns and behaviors in the flow.

[0062] In step 5, the traffic cleaning capability is abstracted by the filtering function.

[0063] In step 5, the traffic cleaning capability is used to clean and filter the transmitted traffic to remove abnormal attack traffic.

[0064] In step 6, the traffic reinjection capability is abstracted through the routing scheduling function in the physical network. The traffic reinjection capability is used to inject the cleaned traffic back to the user according to user needs under the control of the control center of the cloud native system.

[0065] In step 1, the control center adjusts the capabilities in the service chain for different types of DDoS attacks and network environments.

[0066] In step 4, the traffic detection capability includes traffic statistics, traffic analysis, behavior pattern recognition and abnormal pattern detection.

[0067] In step 5, the traffic cleaning capabilities include data packet filtering, traffic shaping, attack traffic blocking, and IP blacklist and whitelist management.

[0068] This embodiment is the best implementation method. In the traffic collection stage, the traffic collection function that relies on traditional hardware is abstracted into traffic collection capability, and deployed to various locations of the cloud native system according to needs. It is no longer restricted by the ports, locations and configurations of traditional collection hardware. When the control center perceives user needs, the traffic collection capability in the cloud native system can collect traffic at any port, any location and any configuration, with higher flexibility.

[0069] In the traffic diversion stage, the routing function and scheduling function are abstracted into routing scheduling capabilities. The cloud native system will make optimal allocation based on user needs through the scheduling algorithm of the control center and select the appropriate cloud native system location, thereby achieving optimal traffic scheduling planning and improving cleaning efficiency.

[0070] The basic principles of the present invention are as follows: Traffic detection and cleaning are performed in the cloud native system. The abstracted capabilities are composed of a traffic detection and cleaning service chain composed of the control center. In the traffic collection stage, traffic data is obtained through flexibly deployed traffic collection capabilities. In the traffic diversion stage, the traffic is diverted to the appropriate location in the cloud native system through the optimal scheduling algorithm. In the traffic detection stage, centralized control is used to perform traffic analysis and identify abnormal traffic. In the traffic cleaning stage, filtering functions, cleaning algorithms, and IP blacklists and whitelists are used to clean abnormal traffic. In the traffic reinjection stage, the cleaned traffic is re-injected into the user system to achieve normal traffic reflux.

[0071] Based on the cloud-native system, all traditional anti-DDoS attack functions are abstracted into capabilities, which can break through the constraints of the existing network structure, realize traffic detection and cleaning in the cloud-native system, and improve cleaning efficiency and flexibility.

[0072] The capability refers to the virtualized components abstracted from traditional anti-DDoS functions, which decouple traditional anti-DDoS functions from hardware, implement network functions in a virtualized environment through network programming, and use management and orchestration systems such as MANO to configure, manage and optimize virtual network functions, which are deployed in containers at any location on the physical network in the cloud native system.

[0073] MANO refers to a unified framework for managing various virtual network functions and basic network virtualization architecture, which is used for business orchestration and device management.

[0074] The flow classification and continuous monitoring process during flow detection and cleaning is as follows: Traffic classification: During the traffic collection and diversion phase, the cloud native system monitors the traffic in the network in real time. When it senses that a user is under attack or is about to be attacked, the traffic in the current network is diverted to the cloud native system through the traffic collection and diversion function. Normal traffic and attack traffic are distinguished through pre-set algorithms, including: traffic classification based on traffic behavior characteristics, traffic classification based on deep learning and machine learning, and traffic classification based on signature detection.

[0075] Traffic is classified based on its behavioral characteristics. Traffic that meets expected behavior patterns is considered normal traffic, while traffic that does not meet expected behavior patterns or has obvious attack characteristics is considered attack traffic.

[0076] Traffic classification based on deep learning and machine learning means extracting traffic features, selecting classification algorithms, performing feature learning, training models, and classifying normal traffic and attack traffic.

[0077] Traffic classification based on signature detection refers to identifying known DDoS attack traffic through pre-defined rules or signatures, matching it with known attack signatures, and distinguishing normal traffic from attack traffic.

[0078] Continuous monitoring: The cloud native system detects the collected current network traffic to determine whether the user is currently or will be attacked by DDoS. If it is determined that the user is currently under DDoS attack, it will perceive the user's defense needs and enter the traffic cleaning stage; if it is determined that the user is about to be attacked by DDoS, it will send an early warning message to the user. In the traffic cleaning stage, the cloud native system confirms that the current user is under DDoS attack, which triggers the cleaning function of the cloud native system. Through pre-set algorithms or rules, such as deep learning or machine learning-based methods, rule-based methods, and behavior feature-based methods, it identifies malicious attack traffic in the traffic, screens, filters, and processes abnormal traffic, and removes malicious attack traffic. In the traffic reinjection stage, the traffic that has been cleaned in the cloud native system is reinjected into the network to restore the normal service of the network. While implementing traffic reinjection, the reinjected traffic is verified so that the legitimate traffic is reinjected into the network. After completing the traffic detection and injecting the traffic back into the network, the attack event is recorded in the network log, including the traffic characteristics and behavior patterns of the attack.

Claims

1. An anti-DDoS traffic detection and cleaning method suitable for cloud native systems, characterized in that: The following steps are involved: Step 1: In the cloud native system, the anti-DDoS function is abstracted into capabilities through capability abstraction, and the abstracted capabilities are combined into a service chain through the control center; Step 2: Traffic collection phase: Traffic is collected in the cloud native system through traffic collection capabilities. Step 3: During the traffic diversion phase, routing scheduling is performed through the cloud native system; Step 4: During the traffic detection phase, the traffic collected in the cloud native system is detected for anomalies through traffic detection capabilities. Step 5: During the traffic cleaning phase, the traffic detected in the cloud native system is cleaned using the traffic cleaning capability. Step 6: During the traffic reinjection phase, the cleaned traffic in the cloud native system is injected back to the user through the traffic reinjection capability.

2. According to claim 1, the anti-DDoS traffic detection and cleaning method suitable for cloud native systems is characterized by: In step 2, the traffic collection capability is obtained through the traffic collection function abstraction, and the traffic collection capability is used to be deployed in the cloud native system.

3. According to claim 1, the anti-DDoS traffic detection and cleaning method suitable for cloud native systems is characterized by: In step 3, performing routing scheduling through the cloud native system means abstracting the routing scheduling function into routing scheduling capability, performing optimal allocation through the scheduling algorithm of the control center, and completing the optimal traffic scheduling plan.

4. The anti-DDoS traffic detection and cleaning method applicable to a cloud native system according to claim 1, characterized in that: In step 4, the flow detection capability is abstracted through the flow statistics analysis function, and the flow detection capability is used to identify abnormal patterns and behaviors in the flow.

5. The anti-DDoS traffic detection and cleaning method applicable to a cloud native system according to claim 1, characterized in that: In step 5, the traffic cleaning capability is abstracted by the filtering function.

6. The anti-DDoS traffic detection and cleaning method applicable to a cloud native system according to claim 5, characterized in that: In step 5, the traffic cleaning capability is used to clean and filter the transmitted traffic to remove abnormal attack traffic.

7. The anti-DDoS traffic detection and cleaning method applicable to a cloud native system according to claim 1, characterized in that: In step 6, the traffic reinjection capability is abstracted through the routing scheduling function in the physical network. The traffic reinjection capability is used to inject the cleaned traffic back to the user according to user needs under the control of the control center of the cloud native system.

8. The anti-DDoS traffic detection and cleaning method applicable to a cloud native system according to claim 1, characterized in that: In step 1, the control center adjusts the capabilities in the service chain for different types of DDoS attacks and network environments.

9. The anti-DDoS traffic detection and cleaning method applicable to a cloud native system according to claim 1, characterized in that: In step 4, the traffic detection capability includes traffic statistics, traffic analysis, behavior pattern recognition and abnormal pattern detection.

10. The anti-DDoS traffic detection and cleaning method applicable to a cloud native system according to claim 1, characterized in that: In step 5, the traffic cleaning capabilities include data packet filtering, traffic shaping, attack traffic blocking, and IP blacklist and whitelist management.

Images