Cloud native anti-DDoS defense method

Abstract

The invention discloses a cloud native anti-DDoS (Distributed Denial of Service) defense method, which belongs to the technical field of network security and is characterized by comprising the following steps: S1, software conversion: converting functions of an anti-DDoS system into capabilities to form an overlay network; s2, strategy automation: serially connecting the capabilities in the form of a service chain; s3, the service chain takes effect, and the corresponding execution sequence of each capability is stipulated through the service chain; and S4, capacity deployment: the capacity existing in the service chain is deployed on a cloud server of the underlying network to form an anti-DDoS strategy. According to the method and the device, the automation of the anti-DDoS strategy can be realized, and the response speed and the anti-DDoS efficiency of the anti-DDoS strategy are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a cloud native anti-DDoS defense method. Background Art

[0002] DDoS attack is a distributed denial of service attack. DDoS attack is one of the most important means of attack in current network attacks. Attackers manipulate multiple devices in the network to send a large number of illegal request messages to the target host, causing the target host to exhaust resources and be unable to respond to normal user requests, thereby achieving the purpose of the attack. Common DDoS attack methods include flood attacks and reflection amplification attacks. Cloud-network integration refers to the combination of cloud computing and communication networks, which fully utilizes the respective advantages of cloud computing and networks. Cloud computing can dynamically adjust resources according to demand, and the network realizes rapid data transmission and a wider coverage range, with high flexibility and elasticity. Cloud-network integration development deploys supercomputing power to the user end, realizes cloud-edge integration, and achieves full network coverage through central cloud and edge cloud, bringing cloud-network capabilities to the extreme.

[0003] Cloud native aims to use cloud computing, containerization and microservice technologies to build highly flexible and easy-to-manage applications and give full play to the potential of cloud computing. Cloud native can deploy applications according to demand, flexibly combine and link applications, perform automated management, realize flexible deployment of network functions, and improve the response speed and efficiency of applications. Cloud-network integration provides flexible and sufficient basic conditions for various cloud native businesses. Based on cloud native, with the help of software-based concepts, we can break through the constraints of the existing network structure and realize flexible combination and linkage of system functions.

[0004] Traditionally, mitigating DDoS attacks requires deploying anti-DDoS devices and policies in the physical network. However, the current anti-DDoS solution, which is based on hardware devices, lacks flexibility and elasticity in the system structure. Anti-DDoS devices are difficult to deploy flexibly, and anti-DDoS policies are separated from each other and lack the ability to automatically coordinate responses. This results in high equipment deployment costs for anti-DDoS systems in existing networks and slow response speeds for anti-DDoS policies.

[0005] A Chinese patent document with publication number CN114640610A and publication date June 17, 2022 discloses a cloud-native service governance method, device and storage medium, including: receiving service information from a service provider, and generating a registration list based on the service information, a cloud-native microservice platform is used to implement service registration and service discovery; responding to a service call request sent by a service consumer, retrieving a service list according to the registration list, and creating a service call connection between the service consumer and the target service provider in the service list to enable the service consumer to quickly call the target service provider remotely; building local native executable code for service providers and service consumers, and deploying and running the local native executable code on the cloud-native microservice platform to achieve rapid dynamic elastic scaling of the cloud-native microservice platform, improve resource utilization, and save costs.

[0006] The cloud-native service governance method, device and storage medium disclosed in the patent document reduce the third-party dependency and middleware deployment through cloud-native service registration discovery, use the existing service discovery method, and reduce the additional deployment of other service discovery components. However, there are still problems such as slow response speed of anti-DDoS strategy and low anti-DDoS efficiency. Summary of the invention

[0007] In order to overcome the defects of the above-mentioned prior art, the present invention provides a cloud-native anti-DDoS defense method, which can realize the automation of anti-DDoS strategy and improve the response speed and anti-DDoS efficiency of the anti-DDoS strategy.

[0008] The present invention is achieved through the following technical solutions: A cloud native anti-DDoS defense method, characterized by comprising the following steps: S1. Softwareization: The functions of the anti-DDoS system are softwareized into capabilities to form a coverage network. S2, policy automation, connecting capabilities in the form of service chains; S3, the service chain takes effect, and the corresponding order of execution of each capability is specified through the service chain; S4, capability deployment, deploy the capabilities in the service chain on the cloud servers of the underlying network to form an anti-DDoS strategy.

[0009] In the step S1, converting the functions of the anti-DDoS system into software capabilities means extracting and abstracting the underlying network functions and hardware device functions in the anti-DDoS system into capabilities.

[0010] The capabilities are deployed in cloud servers in the underlying network.

[0011] The capabilities include flow-based detection and cleaning capabilities and IP-based source address management capabilities.

[0012] The flow-based detection and cleaning capabilities include drainage capability, detection capability, cleaning capability and reinjection capability.

[0013] The flow-based detection and cleaning capability is used to detect data traffic in the cloud native system, remove DDoS attack data flows, and inject the cleaned traffic back into the cloud native system.

[0014] The IP-based source address management capabilities include source address verification capability, source address detection capability, and blacklist and whitelist capability.

[0015] The IP-based source address governance capability is used to manage the source addresses of data in the cloud native system and to control the source addresses of DDoS attacks.

[0016] The capabilities also include intelligence sharing capabilities.

[0017] The intelligence sharing capability is used to share intelligence in a cloud-native system.

[0018] The capability described in the present invention refers to a virtualized component abstracted from a traditional anti-DDoS function, which decouples the traditional anti-DDoS function from the hardware, implements the network function in a virtualized environment through network programming, uses a management and orchestration system to configure, manage and optimize the virtual network function, and deploys it in a container at any location on the physical network in the cloud native system.

[0019] The anti-DDoS strategy described in the present invention is achieved by the control center analyzing user needs, perceiving the current network status of the cloud native system, and predicting future attacks, abstracting the capabilities and combining and linking them in a set order to form a service chain that is then deployed to the cloud native system.

[0020] The anti-DDoS described in the present invention is anti-D.

[0021] The beneficial effects of the present invention are mainly manifested in the following aspects: 1. The present invention, S1, softwareization, softwareizes the functions of the anti-DDoS system into capabilities to form a coverage network; S2, policy automation, connects the capabilities in series in the form of a service chain; S3, service chain effectiveness, specifies the corresponding order of execution of each capability through the service chain; S4, capability deployment, deploys the capabilities existing in the service chain on the cloud server of the underlying network to form an anti-DDoS strategy. Compared with the prior art, it can realize the automation of the anti-DDoS strategy and improve the response speed and anti-DDoS efficiency of the anti-DDoS strategy.

[0022] 2. The present invention abstracts the anti-DDoS hardware functions in the traditional network into software capabilities and systematically organizes them, deploys them on the cloud on demand according to user needs, forms an overlay network of the anti-DDoS system, and combines and links the capabilities on the overlay network in the form of service chains to achieve automation of anti-DDoS strategies with high flexibility and elasticity.

[0023] 3. The present invention abstracts the anti-DDoS system functions into multiple capabilities, separates them from the hardware facilities to which they belong, and deploys them on the cloud in the form of software, thus realizing a cloud-native anti-DDoS system structure.

[0024] 4. In the present invention, the abstraction capability in the cloud native system can form a microservice chain in sequence, which can be combined into an anti-DDoS strategy and has automation capabilities.

[0025] 5. The present invention abstracts the hardware functions in the traditional network into multiple capabilities to form an overlay network. The decision-making automation formulates anti-DDoS attack strategies on demand, concentrates the anti-DDoS strategies within a controllable range, and combines the capabilities in the overlay network into anti-DDoS attack strategies in sequence in the form of a service chain through policy automation according to user needs. All capabilities in cloud-native anti-DDoS attacks are deployed on cloud servers in the underlying network, which has higher flexibility and scalability.

[0026] 6. The present invention, by abstracting the hardware functions in the traditional network into multiple capabilities, can better manage and deploy distributed anti-DDoS strategies. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments: Figure 1 This is a schematic diagram of cloud native deployment in the present invention; Figure 2 It is a schematic diagram of the strategy automation process in the present invention. DETAILED DESCRIPTION

[0028] Example 1 See also Figure 1 and Figure 2 , a cloud native anti-DDoS defense method, comprising the following steps: S1. Softwareization: The functions of the anti-DDoS system are softwareized into capabilities to form a coverage network. S2, policy automation, connecting capabilities in the form of service chains; S3, the service chain takes effect, and the corresponding order of execution of each capability is specified through the service chain; S4, capability deployment, deploy the capabilities in the service chain on the cloud servers of the underlying network to form an anti-DDoS strategy.

[0029] The capability described in the present invention refers to a virtualized component abstracted from a traditional anti-DDoS function, which decouples the traditional anti-DDoS function from the hardware, implements the network function in a virtualized environment through network programming, uses a management and orchestration system to configure, manage and optimize the virtual network function, and deploys it in a container at any location on the physical network in the cloud native system.

[0030] The anti-DDoS strategy described in the present invention is achieved by the control center analyzing user needs, perceiving the current network status of the cloud native system, and predicting future attacks, abstracting the capabilities and combining and linking them in a set order to form a service chain that is then deployed to the cloud native system.

[0031] This embodiment is the most basic implementation method, S1, softwareization, softwareizing the functions of the anti-DDoS system into capabilities to form a coverage network; S2, policy automation, connecting the capabilities in the form of a service chain; S3, service chain effectiveness, specifying the corresponding order of execution of each capability through the service chain; S4, capability deployment, deploying the capabilities in the service chain on the cloud server of the underlying network to form an anti-DDoS strategy. Compared with the existing technology, it can realize the automation of the anti-DDoS strategy and improve the response speed and anti-DDoS efficiency of the anti-DDoS strategy.

[0032] Example 2 See also Figure 1 and Figure 2 , a cloud native anti-DDoS defense method, comprising the following steps: S1. Softwareization: The functions of the anti-DDoS system are softwareized into capabilities to form a coverage network. S2, policy automation, connecting capabilities in the form of service chains; S3, the service chain takes effect, and the corresponding order of execution of each capability is specified through the service chain; S4, capability deployment, deploy the capabilities in the service chain on the cloud servers of the underlying network to form an anti-DDoS strategy.

[0033] The capability described in the present invention refers to a virtualized component abstracted from a traditional anti-DDoS function, which decouples the traditional anti-DDoS function from the hardware, implements the network function in a virtualized environment through network programming, uses a management and orchestration system to configure, manage and optimize the virtual network function, and deploys it in a container at any location on the physical network in the cloud native system.

[0034] The anti-DDoS strategy described in the present invention is achieved by the control center analyzing user needs, perceiving the current network status of the cloud native system, and predicting future attacks, abstracting the capabilities and combining and linking them in a set order to form a service chain that is then deployed to the cloud native system.

[0035] In the step S1, converting the functions of the anti-DDoS system into software capabilities means extracting and abstracting the underlying network functions and hardware device functions in the anti-DDoS system into capabilities.

[0036] This embodiment is a preferred implementation method, which abstracts the anti-DDoS hardware functions in the traditional network into software capabilities and systematically organizes them, deploys them on the cloud on demand according to user needs, forms an overlay network of the anti-DDoS system, and combines and links the capabilities on the overlay network in the form of service chains to achieve anti-DDoS strategy automation with high flexibility and elasticity.

[0037] Example 3 See also Figure 1 and Figure 2 , a cloud native anti-DDoS defense method, comprising the following steps: S1. Softwareization: The functions of the anti-DDoS system are softwareized into capabilities to form a coverage network. S2, policy automation, connecting capabilities in the form of service chains; S3, the service chain takes effect, and the corresponding order of execution of each capability is specified through the service chain; S4, capability deployment, deploy the capabilities in the service chain on the cloud servers of the underlying network to form an anti-DDoS strategy.

[0038] The capability described in the present invention refers to a virtualized component abstracted from a traditional anti-DDoS function, which decouples the traditional anti-DDoS function from the hardware, implements the network function in a virtualized environment through network programming, uses a management and orchestration system to configure, manage and optimize the virtual network function, and deploys it in a container at any location on the physical network in the cloud native system.

[0039] The anti-DDoS strategy described in the present invention is achieved by the control center analyzing user needs, perceiving the current network status of the cloud native system, and predicting future attacks, abstracting the capabilities and combining and linking them in a set order to form a service chain that is then deployed to the cloud native system.

[0040] In the step S1, converting the functions of the anti-DDoS system into software capabilities means extracting and abstracting the underlying network functions and hardware device functions in the anti-DDoS system into capabilities.

[0041] The capabilities are deployed in cloud servers in the underlying network.

[0042] The capabilities include flow-based detection and cleaning capabilities and IP-based source address management capabilities.

[0043] This embodiment is another preferred implementation method, which abstracts the anti-DDoS system functions into multiple capabilities, separates them from the hardware facilities to which they belong, and deploys them on the cloud in the form of software, thereby realizing a cloud-native anti-DDoS system structure.

[0044] Example 4 See also Figure 1 and Figure 2 , a cloud native anti-DDoS defense method, comprising the following steps: S1. Softwareization: The functions of the anti-DDoS system are softwareized into capabilities to form a coverage network. S2, policy automation, connecting capabilities in the form of service chains; S3, the service chain takes effect, and the corresponding order of execution of each capability is specified through the service chain; S4, capability deployment, deploy the capabilities in the service chain on the cloud servers of the underlying network to form an anti-DDoS strategy.

[0045] The capability described in the present invention refers to a virtualized component abstracted from a traditional anti-DDoS function, which decouples the traditional anti-DDoS function from the hardware, implements the network function in a virtualized environment through network programming, uses a management and orchestration system to configure, manage and optimize the virtual network function, and deploys it in a container at any location on the physical network in the cloud native system.

[0046] The anti-DDoS strategy described in the present invention is achieved by the control center analyzing user needs, perceiving the current network status of the cloud native system, and predicting future attacks, abstracting the capabilities and combining and linking them in a set order to form a service chain that is then deployed to the cloud native system.

[0047] In the step S1, converting the functions of the anti-DDoS system into software capabilities means extracting and abstracting the underlying network functions and hardware device functions in the anti-DDoS system into capabilities.

[0048] The capabilities are deployed in cloud servers in the underlying network.

[0049] The capabilities include flow-based detection and cleaning capabilities and IP-based source address management capabilities.

[0050] The flow-based detection and cleaning capabilities include drainage capability, detection capability, cleaning capability and reinjection capability.

[0051] The flow-based detection and cleaning capability is used to detect data traffic in the cloud native system, remove DDoS attack data flows, and inject the cleaned traffic back into the cloud native system.

[0052] This embodiment is another preferred implementation method. The abstraction capability in the cloud native system can form a microservice chain in sequence, which can be combined into an anti-DDoS strategy with automation capabilities.

[0053] Example 5 See also Figure 1 and Figure 2 , a cloud native anti-DDoS defense method, comprising the following steps: S1. Softwareization: The functions of the anti-DDoS system are softwareized into capabilities to form a coverage network. S2, policy automation, connecting capabilities in the form of service chains; S3, the service chain takes effect, and the corresponding order of execution of each capability is specified through the service chain; S4, capability deployment, deploy the capabilities in the service chain on the cloud servers of the underlying network to form an anti-DDoS strategy.

[0054] The capability described in the present invention refers to a virtualized component abstracted from a traditional anti-DDoS function, which decouples the traditional anti-DDoS function from the hardware, implements the network function in a virtualized environment through network programming, uses a management and orchestration system to configure, manage and optimize the virtual network function, and deploys it in a container at any location on the physical network in the cloud native system.

[0055] The anti-DDoS strategy described in the present invention is achieved by the control center analyzing user needs, perceiving the current network status of the cloud native system, and predicting future attacks, abstracting the capabilities and combining and linking them in a set order to form a service chain that is then deployed to the cloud native system.

[0056] In the step S1, converting the functions of the anti-DDoS system into software capabilities means extracting and abstracting the underlying network functions and hardware device functions in the anti-DDoS system into capabilities.

[0057] The capabilities are deployed in cloud servers in the underlying network.

[0058] The capabilities include flow-based detection and cleaning capabilities and IP-based source address management capabilities.

[0059] The flow-based detection and cleaning capabilities include drainage capability, detection capability, cleaning capability and reinjection capability.

[0060] The flow-based detection and cleaning capability is used to detect data traffic in the cloud native system, remove DDoS attack data flows, and inject the cleaned traffic back into the cloud native system.

[0061] The IP-based source address management capabilities include source address verification capability, source address detection capability, and blacklist and whitelist capability.

[0062] The IP-based source address governance capability is used to manage the source addresses of data in the cloud native system and to control the source addresses of DDoS attacks.

[0063] This embodiment is another preferred implementation method, which abstracts the hardware functions in the traditional network into multiple capabilities to form an overlay network. Decision automation formulates anti-DDoS attack strategies on demand, concentrates the anti-DDoS strategies within a controllable range, and combines the capabilities in the overlay network into anti-DDoS attack strategies in sequence in the form of service chains through policy automation according to user needs. All capabilities in cloud-native anti-DDoS attacks are deployed on cloud servers in the underlying network, which has higher flexibility and scalability.

[0064] Example 6 See also Figure 1 and Figure 2 , a cloud native anti-DDoS defense method, comprising the following steps: S1. Softwareization: The functions of the anti-DDoS system are softwareized into capabilities to form a coverage network. S2, policy automation, connecting capabilities in the form of service chains; S3, the service chain takes effect, and the corresponding order of execution of each capability is specified through the service chain; S4, capability deployment, deploy the capabilities in the service chain on the cloud servers of the underlying network to form an anti-DDoS strategy.

[0065] The capability described in the present invention refers to a virtualized component abstracted from a traditional anti-DDoS function, which decouples the traditional anti-DDoS function from the hardware, implements the network function in a virtualized environment through network programming, uses a management and orchestration system to configure, manage and optimize the virtual network function, and deploys it in a container at any location on the physical network in the cloud native system.

[0066] The anti-DDoS strategy described in the present invention is achieved by the control center analyzing user needs, perceiving the current network status of the cloud native system, and predicting future attacks, abstracting the capabilities and combining and linking them in a set order to form a service chain that is then deployed to the cloud native system.

[0067] In the step S1, converting the functions of the anti-DDoS system into software capabilities means extracting and abstracting the underlying network functions and hardware device functions in the anti-DDoS system into capabilities.

[0068] The capabilities are deployed in cloud servers in the underlying network.

[0069] The capabilities include flow-based detection and cleaning capabilities and IP-based source address management capabilities.

[0070] The flow-based detection and cleaning capabilities include drainage capability, detection capability, cleaning capability and reinjection capability.

[0071] The flow-based detection and cleaning capability is used to detect data traffic in the cloud native system, remove DDoS attack data flows, and inject the cleaned traffic back into the cloud native system.

[0072] The IP-based source address management capabilities include source address verification capability, source address detection capability, and blacklist and whitelist capability.

[0073] The IP-based source address governance capability is used to manage the source addresses of data in the cloud native system and to control the source addresses of DDoS attacks.

[0074] The capabilities also include intelligence sharing capabilities.

[0075] The intelligence sharing capability is used to share intelligence in a cloud-native system.

[0076] This embodiment is the best implementation method. By abstracting the hardware functions in the traditional network into multiple capabilities, the distributed anti-DDoS strategy can be better managed and deployed.

[0077] The basic principles of the present invention are as follows: Cloud Native: All abstract capabilities are separated from the hardware devices to which they belong and are deployed on cloud servers in the form of software. Anti-DDoS strategies will no longer rely on hardware devices and will have higher scalability and flexibility.

[0078] Policy automation: The abstraction capability can be formed into a microservice chain in sequence and combined into an anti-DDoS strategy.

[0079] Flexible deployment: All abstract capabilities in cloud native are deployed to the cloud and can be flexibly deployed according to user needs.

[0080] The capability refers to the virtualized components abstracted from traditional anti-DDoS functions, which decouple traditional anti-DDoS functions from hardware, implement network functions in a virtualized environment through network programming, and use management and orchestration systems such as MANO to configure, manage and optimize virtual network functions, which are deployed in containers at any location on the physical network in the cloud native system.

[0081] MANO refers to a unified framework for managing various virtual network functions and basic network virtualization architecture, which is used for business orchestration and device management.

Claims

1. A cloud-native anti-DDoS defense method, characterized in that: The following steps are involved: S1. Softwareization: The functions of the anti-DDoS system are softwareized into capabilities to form a coverage network. S2, policy automation, connecting capabilities in the form of service chains; S3, the service chain takes effect, and the corresponding order of execution of each capability is specified through the service chain; S4, capability deployment, deploy the capabilities in the service chain on the cloud servers of the underlying network to form an anti-DDoS strategy.

2. A cloud-native anti-DDoS defense method according to claim 1, characterized in that: In the step S1, converting the functions of the anti-DDoS system into software capabilities means extracting and abstracting the underlying network functions and hardware device functions in the anti-DDoS system into capabilities.

3. The cloud-native anti-DDoS defense method according to claim 1, characterized in that: The capabilities are deployed in cloud servers in the underlying network.

4. The cloud-native anti-DDoS defense method according to claim 1, characterized in that: The capabilities include flow-based detection and cleaning capabilities and IP-based source address management capabilities.

5. A cloud-native anti-DDoS defense method according to claim 4, characterized in that: The flow-based detection and cleaning capabilities include drainage capability, detection capability, cleaning capability and reinjection capability.

6. A cloud-native anti-DDoS defense method according to claim 5, characterized in that: The flow-based detection and cleaning capability is used to detect data traffic in the cloud native system, remove DDoS attack data flows, and inject the cleaned traffic back into the cloud native system.

7. A cloud-native anti-DDoS defense method according to claim 4, characterized in that: The IP-based source address management capabilities include source address verification capability, source address detection capability, and blacklist and whitelist capability.

8. A cloud-native anti-DDoS defense method according to claim 7, characterized in that: The IP-based source address governance capability is used to manage the source addresses of data in the cloud native system and to control the source addresses of DDoS attacks.

9. The cloud-native anti-DDoS defense method according to claim 1, characterized in that: The capabilities also include intelligence sharing capabilities.

10. A cloud-native anti-DDoS defense method according to claim 9, characterized in that: The intelligence sharing capability is used to share intelligence in a cloud-native system.

Images