CDN abnormal traffic detection, processing methods, devices, equipment, media and products

Abstract

The present disclosure relates to the technical field of content distribution network, and discloses a method, device, equipment, medium and product for detecting and processing CDN abnormal traffic, including: obtaining a target bandwidth unit, and querying CDN traffic records and scheduling strategies. If the query result of the scheduling strategy indicates that it does not exist in the scheduling strategy, then obtaining the first record corresponding to the identifier of the target bandwidth unit in the CDN traffic record, and setting the last update time of the first record as the detection time of the target bandwidth unit, analyzing the traffic of the target bandwidth unit, and thus determining the traffic detection result corresponding to the target bandwidth unit. The present invention analyzes whether there is a scheduling strategy based on the traffic record, and then performs subsequent traffic analysis. Different traffic query results and scheduling strategy query results correspond to different traffic analyses, thereby more accurately identifying whether the target bandwidth unit is abnormal traffic, and improving the accuracy of abnormal traffic identification and detection efficiency.

Description

Technical Field

[0001] The present disclosure relates to the technical field of content distribution network, and in particular to a method, device, equipment, medium and product for detecting and processing abnormal CDN traffic. Background Art

[0002] Content Delivery Network (CDN) is an intelligent virtual network built on the existing network. It relies on edge servers deployed in various places and uses the load balancing, content distribution, scheduling and other functional modules of the central platform to enable users to obtain the required content nearby, reduce network congestion, and improve user access response speed and hit rate. As an efficient Internet content delivery solution, it aims to deliver content to users quickly and reliably.

[0003] However, like other network systems, CDNs also face various forms of abnormal traffic, which usually consumes a large amount of CDN resources, not only affecting the access quality of legitimate users, but also increasing the operating costs of CDNs, leading to insufficient node resources and affecting service quality. Therefore, a method for detecting abnormal CDN traffic is needed. Summary of the invention

[0004] In view of this, the present disclosure provides a method, device, equipment, medium and product for detecting and processing CDN abnormal traffic to solve the problem of detecting CDN abnormal traffic.

[0005] In a first aspect, the present disclosure provides a method for detecting abnormal CDN traffic, the method comprising:

[0006] Obtaining a target bandwidth unit, where the target bandwidth unit is used to characterize CDN access traffic within a first preset time period;

[0007] Based on the identifier of the target bandwidth unit, query the CDN traffic record and the scheduling policy to obtain the traffic query result and the scheduling policy query result of the target bandwidth unit;

[0008] If the scheduling policy query result representation does not exist in the scheduling policy, acquiring, based on the traffic query result, a first record corresponding to the identifier of the target bandwidth unit in the CDN traffic record;

[0009] Setting the last update time of the first record as the detection time of the target bandwidth unit;

[0010] The traffic of the target bandwidth unit is analyzed based on the last update time of the first record to determine a traffic detection result corresponding to the target bandwidth unit.

[0011] In a second aspect, the present disclosure provides a method for processing CDN abnormal traffic, the method comprising:

[0012] Acquire traffic information of abnormal traffic, where the abnormal traffic is detected based on the CDN abnormal traffic detection method of any of the above implementation modes;

[0013] Analyze the traffic information to determine the total amount of abnormal traffic on each node identifier;

[0014] Deducting the total amount of abnormal traffic from the preset traffic corresponding to the node identifier to obtain the total amount of available traffic corresponding to the node identifier;

[0015] Traffic scheduling is performed on the service node corresponding to the node identifier based on the total available traffic.

[0016] In a third aspect, the present disclosure provides a device for detecting abnormal CDN traffic, the device comprising:

[0017] A bandwidth acquisition module, used to acquire a target bandwidth unit, where the target bandwidth unit is used to represent the CDN access traffic within a first preset time period;

[0018] A policy query module, used to query CDN traffic records and scheduling policies based on the identifier of the target bandwidth unit, and obtain traffic query results and scheduling policy query results of the target bandwidth unit;

[0019] A first record acquisition module, configured to acquire, based on the traffic query result, a first record corresponding to the identifier of the target bandwidth unit in the CDN traffic record if the scheduling policy query result representation does not exist in the scheduling policy;

[0020] a detection time updating module, configured to set the last update time of the first record as the detection time of the target bandwidth unit;

[0021] The first traffic analysis module is used to analyze the traffic of the target bandwidth unit based on the last update time of the first record, and determine the traffic detection result corresponding to the target bandwidth unit.

[0022] In a fourth aspect, the present disclosure provides a device for processing CDN abnormal traffic, the device comprising:

[0023] A flow information acquisition module, used to acquire flow information of abnormal flow, where the abnormal flow is detected based on the CDN abnormal flow detection method of any of the above implementation modes;

[0024] A total amount calculation module is used to analyze the flow information and determine the total amount of abnormal flow on each node identifier;

[0025] A total amount deduction module, used to deduct the total amount of abnormal traffic from the preset traffic corresponding to the node identifier to obtain the total amount of available traffic corresponding to the node identifier;

[0026] The traffic scheduling module is used to perform traffic scheduling on the service node corresponding to the node identifier based on the total amount of available traffic.

[0027] In a fifth aspect, the present disclosure provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the CDN abnormal traffic detection method or CDN abnormal traffic processing method of any of the above-mentioned embodiments by executing the computer instructions.

[0028] In a sixth aspect, the present disclosure provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute any of the above-mentioned methods for detecting abnormal CDN traffic or methods for processing abnormal CDN traffic.

[0029] In a seventh aspect, the present disclosure provides a computer program product, including computer instructions, which are used to enable a computer to execute the CDN abnormal traffic detection method or CDN abnormal traffic processing method of any of the above-mentioned embodiments.

[0030] The CDN abnormal traffic detection method provided by the embodiment of the present disclosure is applied to the detection system, firstly obtaining the target bandwidth unit, querying the CDN traffic record and the scheduling strategy according to the identifier of the target bandwidth unit, analyzing the traffic of the target bandwidth unit according to the traffic query result and the scheduling strategy query result, thereby obtaining the traffic detection result of the target bandwidth unit, if the scheduling strategy query result indicates that it does not exist in the scheduling strategy, then obtaining the first record corresponding to the identifier of the target bandwidth unit in the CDN traffic record based on the traffic query result, and setting the last update time of the first record as the detection time of the target bandwidth unit, analyzing the traffic of the target bandwidth unit based on the last update time of the first record, and determining the traffic detection result corresponding to the target bandwidth unit. The method can further analyze whether there is a scheduling strategy according to the traffic record, and then perform subsequent traffic analysis, different traffic query results and scheduling strategy query results correspond to different traffic analyses, thereby more accurately identifying whether the target bandwidth unit is abnormal traffic, and improving the accuracy of abnormal traffic identification and detection efficiency.

[0031] The CDN abnormal traffic processing method provided by the embodiment of the present disclosure is applied to the scheduling system, obtains the traffic information of the abnormal traffic, analyzes the traffic information, determines the total amount of abnormal traffic of each node, deducts the total amount of abnormal traffic from the preset traffic, obtains the total amount of available traffic, and performs traffic scheduling based on the total amount of available traffic. The method can reduce the usage quota of the node by the scheduling system and avoid resource competition between normal traffic and abnormal traffic on the node. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 It is a flowchart of a method for detecting abnormal CDN traffic according to an embodiment of the present disclosure;

[0034] Figure 2 is a flow chart of another CDN abnormal traffic detection method according to an embodiment of the present disclosure;

[0035] Figure 3 It is a flowchart of a method for processing CDN abnormal traffic according to an embodiment of the present disclosure;

[0036] Figure 4 is an overall structural diagram of a flow detection method and a flow processing method according to an embodiment of the present disclosure;

[0037] Figure 5 is a structural schematic diagram of a flow detection system and a flow scheduling system according to an embodiment of the present disclosure;

[0038] Figure 6 is a schematic diagram of a flow detection method according to an embodiment of the present disclosure;

[0039] Figure 7 is a schematic diagram of a traffic processing method according to an embodiment of the present disclosure;

[0040] Figure 8 is a structural block diagram of a CDN abnormal traffic detection device according to an embodiment of the present disclosure;

[0041] Fig. 9 It is a schematic diagram of the hardware structure of the computer device of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0043] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0044] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0045] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0046] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0047] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0048] Content Delivery Network (CDN) is an efficient Internet content delivery solution that aims to deliver content to users quickly and reliably. However, like other network systems, CDN also faces various forms of abnormal traffic. Abnormal traffic will consume CDN resources, affect the user's access quality, and increase the operating cost of CDN. Based on this, the embodiments of the present disclosure provide a method for detecting CDN abnormal traffic and a method for processing CDN abnormal traffic.

[0049] According to an embodiment of the present disclosure, an embodiment of a method for detecting abnormal CDN traffic is provided, which can be applied to a system for detecting abnormal traffic. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0050] In this embodiment, a method for detecting abnormal CDN traffic is provided. Figure 1 is a flow chart of a method for detecting abnormal CDN traffic according to an embodiment of the present disclosure, such as Figure 1 As shown, the process includes the following steps:

[0051] Step S101, obtaining a target bandwidth unit.

[0052] The target bandwidth unit is used to represent the CDN access traffic within a first preset time period.

[0053] The first preset duration can be a unit time, or can be set according to demand, and the bandwidth unit within the first preset duration is extracted from the access log of the CDN service node as the detection object, and is determined as the target bandwidth unit. In addition, a threshold can be set according to demand, and the set threshold is a traffic threshold set according to demand. The bandwidth unit exceeding the set threshold may be abnormal traffic, and subsequent detection steps are performed.

[0054] Step S102: Based on the identifier of the target bandwidth unit, query the CDN traffic record and the scheduling policy to obtain the traffic query result and the scheduling policy query result of the target bandwidth unit.

[0055] The scheduling strategy in the CDN system intelligently distributes user requests to the optimal node, which improves content delivery efficiency, reduces network latency, helps balance loads, optimizes resource utilization, and enhances the overall stability and anti-attack capabilities of the system. It is a key infrastructure in the CDN system.

[0056] The target bandwidth unit is detected. The identifier of the target bandwidth unit is used to identify whether there is a corresponding bandwidth unit record (i.e., CDN traffic record) in the storage in the CDN network. The identifier of the target bandwidth unit may include a node identifier, an access domain name, and a request source. When querying, the identifier of the target bandwidth unit can be used as a keyword to query in the storage to obtain the corresponding detection record. According to the detection of the traffic record, it is queried whether there is a corresponding scheduling policy. Accordingly, the CDN traffic record and the scheduling policy are queried to obtain the traffic query result and the scheduling policy query result of the target bandwidth unit respectively.

[0057] Step S103: If the scheduling policy query result indicates that the scheduling policy does not exist, then based on the traffic query result, a first record corresponding to the identifier of the target bandwidth unit in the CDN traffic record is obtained.

[0058] The detection results of the traffic records include the existence of traffic records and the absence of traffic records. The existence of a scheduling strategy is subsequently determined based on different detection results. Different traffic analysis methods are used according to the existence of a scheduling strategy. The traffic detection results corresponding to the target bandwidth unit are determined based on the results of the traffic analysis. The traffic detection results include determining whether the target bandwidth unit is abnormal traffic.

[0059] Regardless of whether a corresponding traffic record is detected, in this embodiment, it is queried whether a scheduling policy exists. After determining the query result of the scheduling policy, different traffic analysis methods are used in combination with the traffic query result.

[0060] After querying whether there is a scheduling policy corresponding to the target bandwidth unit, if there is no corresponding scheduling policy, the first record corresponding to the identifier of the target bandwidth unit is determined according to the traffic query situation. The traffic query results include the existence of traffic records and the non-existence of traffic records. Regardless of whether there are traffic records, it is queried whether there is a scheduling policy. After determining the query result of the scheduling policy, the first record is determined in different ways according to whether there is a traffic record. The way to determine the first record can be to update the data in the queried record, or to insert a new record.

[0061] When the traffic query result indicates that there is a record corresponding to the identifier of the target bandwidth unit in the CDN traffic record, the queried record is the first record.

[0062] Step S104: Set the last update time of the first record as the detection time of the target bandwidth unit.

[0063] When there is no scheduling policy, the detection time in the queried record is updated, and the last updated time in the first record is the detection time of the target bandwidth unit. When there is a record corresponding to the identifier of the target bandwidth unit in the CDN traffic record, the last updated time in the queried first record is set as the detection time of the target bandwidth unit. When there is no record corresponding to the identifier of the target bandwidth unit in the CDN traffic record, the last updated time in the newly added first record is set as the detection time of the target bandwidth unit.

[0064] Step S105: Analyze the traffic of the target bandwidth unit based on the last update time of the first record to determine the traffic detection result corresponding to the target bandwidth unit.

[0065] The traffic of the target bandwidth unit is analyzed according to the time recorded in the first record, where the time recorded in the first record includes the detection time when it was first discovered in addition to the last update time. The duration of the detection can be determined based on the start time and the last update time. During the traffic analysis, the duration of the bandwidth unit can be analyzed. If the duration exceeds the set duration, it can be considered as abnormal traffic. If it exceeds the set duration, the detection range can be expanded to detect the bandwidth units of other nodes to further analyze whether there is abnormal traffic.

[0066] The CDN abnormal traffic detection method provided by the embodiment of the present disclosure first obtains the target bandwidth unit, queries the CDN traffic record and the scheduling policy according to the identifier of the target bandwidth unit, analyzes the traffic of the target bandwidth unit according to the traffic query result and the scheduling policy query result, thereby obtaining the traffic detection result of the target bandwidth unit. If the scheduling policy query result indicates that it does not exist in the scheduling policy, then the first record corresponding to the identifier of the target bandwidth unit in the CDN traffic record is obtained based on the traffic query result, and the last update time of the first record is set as the detection time of the target bandwidth unit. The traffic of the target bandwidth unit is analyzed based on the last update time of the first record to determine the traffic detection result corresponding to the target bandwidth unit. The method can further analyze whether there is a scheduling policy according to the traffic record, and then perform subsequent traffic analysis. Different traffic query results and scheduling policy query results correspond to different traffic analyses, thereby more accurately identifying whether the target bandwidth unit is abnormal traffic, thereby improving the accuracy of abnormal traffic identification and detection efficiency.

[0067] In some optional implementations, the above-mentioned CDN abnormal traffic detection method also includes: obtaining the total traffic volume of the target bandwidth unit; if the total traffic volume of the target bandwidth unit is greater than a preset traffic threshold, executing the steps of querying the CDN traffic record and the scheduling policy based on the identifier of the target bandwidth unit, and obtaining the traffic query result of the target bandwidth unit and the scheduling policy query result.

[0068] After the target bandwidth unit is obtained, the total flow of the target bandwidth unit is obtained. To improve the accuracy of the detection, subsequent detection may not be performed on all target bandwidth units, but a preset flow threshold may be set, and the total flow of the target bandwidth unit and the preset flow threshold may be compared. When the total flow of the target bandwidth unit is greater than the preset flow threshold, the steps of querying the CDN flow record and the scheduling policy based on the identifier of the target bandwidth unit in the above embodiment are performed to obtain the flow query result of the target bandwidth unit and the scheduling policy query result.

[0069] The method provided by the embodiment of the present disclosure screens the target bandwidth unit, and when the total flow of the target bandwidth unit is greater than a preset flow threshold, executes subsequent query steps, thereby saving detection resources and efficiency.

[0070] In this embodiment, a method for detecting abnormal CDN traffic is provided. Figure 2 is a flow chart of a method for detecting abnormal CDN traffic according to an embodiment of the present disclosure, such as Figure 2 As shown, the process includes the following steps:

[0071] Step S201, obtaining a target bandwidth unit.

[0072] The target bandwidth unit is used to represent the CDN access traffic within the first preset time period.

[0073] Step S202: Based on the identifier of the target bandwidth unit, query the CDN traffic record and the scheduling policy to obtain the traffic query result and the scheduling policy query result of the target bandwidth unit.

[0074] For details of steps S201-S202, please refer to Figure 1 Steps S101 and S102 of the illustrated embodiment will not be described in detail here.

[0075] Step S203: If the scheduling policy query result indicates that the scheduling policy does not exist, then based on the traffic query result, a first record corresponding to the identifier of the target bandwidth unit in the CDN traffic record is obtained.

[0076] Specifically, step S203 includes: if the traffic query result indicates that there is no record corresponding to the identifier of the target bandwidth unit in the CDN traffic record, then adding a record corresponding to the identifier of the target bandwidth unit to the CDN traffic record to obtain a first record.

[0077] When there is no record corresponding to the identifier of the target bandwidth unit in the CDN traffic record, a new first record is added based on the identifier of the target bandwidth unit, and the newly created first record is inserted into the storage. The newly created first record includes at least a unique identifier, a start time, a last updated time, and a bandwidth value. The unique identifier is the identifier of the target bandwidth unit, which specifically includes a node identifier, an access domain name, and a request source, and the target bandwidth unit is used as a unique identifier. The start time is the detection time for starting to detect the bandwidth unit, the last updated time is the latest detection time, and the bandwidth value is the unit time flow of the bandwidth unit.

[0078] Step S204: Set the last update time of the first record as the detection time of the target bandwidth unit.

[0079] For details of step S204, see Figure 1Step S104 of the illustrated embodiment will not be described in detail here.

[0080] Step S205: Analyze the traffic of the target bandwidth unit based on the last update time of the first record to determine the traffic detection result corresponding to the target bandwidth unit.

[0081] Specifically, the above step S205 includes: if the scheduling policy corresponding to the identifier of the target bandwidth unit is not found within a second preset time period after the last update time, determining that the traffic detection result corresponding to the target bandwidth unit is abnormal traffic.

[0082] The detection of the target bandwidth unit is continuous. When determining the last update time, the corresponding scheduling strategy may not be detected due to delay. In order to avoid the above situation, a second preset time is set. After the last update time, wait for the second preset time. If the scheduling strategy corresponding to the identifier of the target bandwidth unit is queried within the second preset time, there is no need to regard the traffic of the target bandwidth unit as abnormal traffic. If the scheduling strategy corresponding to the identifier of the target bandwidth unit is not queried within the second preset time, it means that there is an abnormal situation, and the traffic detection result corresponding to the target bandwidth unit can be determined as abnormal traffic.

[0083] The method provided by the embodiment of the present disclosure sets a second preset time period. When the scheduling policy corresponding to the identifier of the target bandwidth unit is not queried within the second preset time period after the last update time, the traffic detection result corresponding to the target bandwidth unit is determined as abnormal traffic, thereby avoiding false detection due to scheduling policy delays and improving the accuracy of abnormal traffic detection.

[0084] In some optional implementations, the above step S105 includes the following steps:

[0085] Step S301: If the scheduling policy corresponding to the identifier of the target bandwidth unit is found within a second preset time period after the last update time, a second record corresponding to the access domain name and the request source is obtained.

[0086] When the scheduling policy corresponding to the identifier of the target bandwidth unit is queried within the second preset time after the last update time, the traffic of the target bandwidth unit will not be directly determined as abnormal traffic. For further detection, the access domain name and request source are used as unique identifiers to query in the storage to obtain the corresponding second record.

[0087] Specifically, step S301 includes:

[0088] Step S3011, based on the access domain name and the request source, determine whether the second record is queried.

[0089] The query is performed using the access domain name and the request source as query keywords, and the query results include whether the second record is found or not found.

[0090] Step S3012: If the second record is not found, a record corresponding to the access domain name and the request source is added to obtain the second record.

[0091] If the second record is not found, a new second record is created based on the access domain name and the request source, and the newly created second record is inserted into the storage. The newly created second record includes at least a unique identifier, a start time, and a last updated time. The unique identifier includes the access domain name and the request source; the start time is the detection time when the detection starts, and the last updated time is the latest detection time.

[0092] Step S302: Set the last update time of the second record as the detection time of the target bandwidth unit.

[0093] After querying, obtain the second record, update the last update time in the second record, and set it as the detection time of the target bandwidth unit. If the second record is found after querying, the last update time in the second record can be directly set as the detection time of the target bandwidth unit. If the second record is not found after querying, add a second record, and set the last update time in the second record as the detection time of the target bandwidth unit.

[0094] In some optional implementations, the above method further includes:

[0095] Step S401, determining the duration between the last update time of the second record and the last update time.

[0096] The second record stores the last update time, and the duration between the last update time and the last update time of the second record is the duration.

[0097] Step S402: If the duration exceeds the third preset duration, it is determined that the traffic detection result corresponding to all bandwidth units corresponding to the access domain name and the request source is abnormal traffic.

[0098] The third preset duration is used to compare with the duration. If the duration exceeds the third preset duration, it indicates that the second record has not been updated for a long time, and the traffic detection result corresponding to all bandwidth units with the same "access domain name-request source" is marked as abnormal traffic. If, after comparison, the duration does not exceed the third preset duration, the process ends without further detection.

[0099] A timer is provided in the detection system used in the above-disclosed CDN abnormal traffic detection method, which can regularly delete detection records and "domain name-source" records that have not been found again for a period of time (the time threshold is configured according to actual conditions).

[0100] In some optional embodiments, the above-mentioned CDN abnormal traffic detection method also includes: sending traffic information of the abnormal traffic to a traffic scheduling system, the traffic information including a node identifier corresponding to the abnormal traffic and a size of the abnormal traffic, and the scheduling system is used to perform CDN traffic scheduling based on the traffic information of the abnormal traffic.

[0101] After analyzing the traffic of the target bandwidth unit, it can be determined whether the traffic corresponding to the target bandwidth unit is abnormal traffic. If there is abnormal traffic, the traffic information of the abnormal traffic can be sent to the traffic scheduling system, wherein the abnormal traffic includes the node identifier corresponding to the abnormal traffic and the size of the abnormal traffic.

[0102] The traffic scheduling system can perform CDN traffic scheduling on abnormal traffic on the same node. When there are multiple abnormal traffic on a node, the multiple abnormal traffic can be aggregated and then scheduled, thereby reducing the scheduling system's usage of the node and avoiding resource competition between regular traffic and abnormal traffic on the node.

[0103] According to an embodiment of the present disclosure, an embodiment of a method for processing abnormal CDN traffic is provided, which can be applied to a scheduling system for abnormal traffic. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0104] In this embodiment, a method for processing abnormal CDN traffic is provided. Figure 3 is a flow chart of a method for processing abnormal CDN traffic according to an embodiment of the present disclosure, such as Figure 3 As shown, the process includes the following steps:

[0105] Step S501, obtaining flow information of abnormal flow.

[0106] The abnormal traffic is detected based on the CDN abnormal traffic detection method in any of the above implementations.

[0107] The traffic information may include the traffic size of the abnormal traffic, the node identifier of the corresponding bandwidth unit, the access domain name, the request source, etc.

[0108] Step S502: Analyze the traffic information to determine the total amount of abnormal traffic on each node identifier.

[0109] Analyze the traffic information to obtain the size of abnormal traffic. The same node may have multiple abnormal traffic, so the total amount of abnormal traffic on each node ID is equivalent to the sum of all abnormal traffic on the node. Aggregate all abnormal traffic on the same node according to the node dimension to obtain the total amount of abnormal traffic on the node.

[0110] Step S503, deducting the total amount of abnormal traffic from the preset traffic corresponding to the node identifier to obtain the total amount of available traffic corresponding to the node identifier.

[0111] Each node identifier has a corresponding preset flow, from which the total amount of abnormal flow of the node is deducted to obtain the total amount of available flow of the node identifier.

[0112] Step S504: Perform traffic scheduling on the service node corresponding to the node identifier based on the total amount of available traffic.

[0113] After deducting the total amount of abnormal traffic, traffic scheduling is performed based on the total amount of available traffic.

[0114] The CDN abnormal traffic processing method provided by the embodiment of the present disclosure is applied to the scheduling system, which obtains the traffic information of the abnormal traffic, analyzes the traffic information, determines the total amount of abnormal traffic of each node, deducts the total amount of abnormal traffic from the preset traffic, obtains the total amount of available traffic, and performs traffic scheduling based on the total amount of available traffic. The method can reduce the usage quota of the node by the scheduling system and avoid resource competition between normal traffic and abnormal traffic on the node.

[0115] As a specific application example of the embodiment of the present invention, Figure 4 is an overall structure diagram of a flow detection method and a flow processing method according to an embodiment of the present disclosure, combined with Figure 5 The system structure diagram summarizes the method:

[0116] The method involves a traffic detection system and a traffic scheduling system. First, the access traffic aggregated by node identification, access domain name, and request source in unit time is extracted from the access log of the CDN service node as the object to be detected, which can be called a bandwidth unit. The domain name and request source bandwidth allocated to each CDN service node in unit time are obtained from the scheduling system as the detection basis, that is, the scheduling strategy. In the abnormal traffic detection process, for bandwidth units that have not appeared in the scheduling strategy for N consecutive unit times, they are marked as abnormal traffic units with "node-domain name-source" as the identifier, written into the abnormal traffic unit list, and fed back to the scheduling system. At the beginning of a new round of scheduling strategy generation, the scheduling system marks the abnormal traffic unit as "unschedulable" on the service node, and pre-deducts the resources occupied by the abnormal traffic unit from the available resources of the node to obtain the total available traffic, and schedules the total available traffic to generate and update the scheduling strategy.

[0117] As a specific application example of the embodiment of the present invention, Figure 6 is a schematic diagram of a flow detection method according to an embodiment of the present disclosure, the method is as follows:

[0118] First, obtain the bandwidth unit and determine whether the bandwidth unit is greater than the threshold to be detected. If it is greater than the threshold to be detected, detect the bandwidth unit. Query whether there is a corresponding bandwidth unit record in the storage. If it exists, determine whether there is a corresponding scheduling policy; if not, it is still necessary to determine whether there is a corresponding scheduling policy. If there is a detection record, if there is a corresponding scheduling policy, the bandwidth record of the detection record can be updated to 0, and the detection ends; if there is no corresponding scheduling policy, insert a new bandwidth unit record, and update the time and bandwidth values ​​in the new bandwidth unit. If there is no detection record, if there is a corresponding scheduling policy, update the bandwidth value of the bandwidth record to 0, and end the detection; if there is no corresponding scheduling policy, insert a new bandwidth unit record, and update the time and bandwidth values ​​therein. The detection record includes a unique identifier (node ​​identifier, access domain name, and request source), start time, last update time, and bandwidth value. Determine whether the duration of the bandwidth unit exceeds the threshold. If it does not exceed the threshold, update the last update time of the domain name-source record corresponding to the bandwidth unit; if it exceeds the threshold, mark the bandwidth unit as abnormal traffic. Determine whether the duration of subsequent access to the domain name-request source exceeds the threshold. If so, mark it as abnormal traffic. The scheduling strategy can be obtained from the scheduling system. A timer is set in the scheduling system to regularly delete expired strategies.

[0119] As a specific application example of the embodiment of the present invention, Figure 7It is a schematic diagram of a traffic processing method according to an embodiment of the present disclosure. The method is applied to a scheduling system, obtains abnormal traffic records in node A (the abnormal traffic water level part in the figure), and aggregates them according to the node dimension to obtain the total amount of abnormal traffic on the service node (i.e., the sum of the allocated traffic and abnormal traffic in node A, corresponding to all the traffic below the allocated traffic water level in node B), deducts the total amount of abnormal traffic, obtains the available traffic, and updates the scheduling strategy based on the available traffic. The method reduces the usage quota of the node by the scheduling system by marking the abnormal traffic on the node, thereby avoiding resource competition between regular traffic and abnormal traffic on the node.

[0120] In this embodiment, a device for detecting abnormal traffic of a CDN is also provided, and the device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made are not repeated here. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0121] This embodiment provides a CDN abnormal traffic detection device, such as Figure 8 As shown, including:

[0122] The bandwidth acquisition module 601 is used to acquire a target bandwidth unit, where the target bandwidth unit is used to represent the CDN access traffic within a first preset time period;

[0123] A policy query module 602 is used to query CDN traffic records and scheduling policies based on the identifier of the target bandwidth unit, and obtain traffic query results and scheduling policy query results of the target bandwidth unit;

[0124] A first record acquisition module 603 is configured to acquire, based on the traffic query result, a first record corresponding to the identifier of the target bandwidth unit in the CDN traffic record if the scheduling policy query result representation does not exist in the scheduling policy;

[0125] A detection time updating module 604, configured to set the last update time of the first record as the detection time of the target bandwidth unit;

[0126] The first traffic analysis module 605 is used to analyze the traffic of the target bandwidth unit based on the last update time of the first record, and determine the traffic detection result corresponding to the target bandwidth unit.

[0127] In some optional implementations, the first record acquisition module 603 is further used to: if the traffic query result indicates that there is no record corresponding to the identifier of the target bandwidth unit in the CDN traffic record, then add a record corresponding to the identifier of the target bandwidth unit to the CDN traffic record to obtain the first record.

[0128] In some optional implementations, the first traffic analysis module 605 is also used to: if the scheduling policy corresponding to the identifier of the target bandwidth unit is not queried within a second preset time after the last update time, determine that the traffic detection result corresponding to the target bandwidth unit is abnormal traffic.

[0129] In some optional implementations, the identifier of the target bandwidth unit includes a node identifier, an access domain name, and a request source, and the first traffic analysis module 605 includes:

[0130] A second record acquisition unit is configured to acquire the access domain name and a second record corresponding to the request source if a scheduling policy corresponding to the identifier of the target bandwidth unit is queried within a second preset time after the last update time;

[0131] The second time setting unit is configured to set the last update time of the second record as the detection time of the target bandwidth unit.

[0132] In some optional implementations, the second record obtaining unit includes:

[0133] A second record query subunit, used to determine whether the second record is found based on the access domain name and the request source;

[0134] The second record adding subunit is used to add the records corresponding to the access domain name and the request source to obtain the second record if the second record is not found.

[0135] In some optional embodiments, the device further comprises:

[0136] A second duration determination module, used to determine the duration between the last update time of the second record and the last update time;

[0137] The abnormal traffic determination module is used to determine that the traffic detection results corresponding to the access domain name and all bandwidth units corresponding to the request source are abnormal traffic if the duration exceeds a third preset duration.

[0138] In some optional embodiments, the device further comprises:

[0139] A total flow acquisition module, used to acquire the total flow of the target bandwidth unit;

[0140] The method execution module is used to execute the steps of querying CDN traffic records and scheduling strategies based on the identifier of the target bandwidth unit to obtain traffic query results and scheduling strategy query results of the target bandwidth unit if the total traffic volume of the target bandwidth unit is greater than a preset traffic threshold.

[0141] In some optional embodiments, the device further comprises:

[0142] The traffic sending module is used to send the traffic information of the abnormal traffic to the traffic scheduling system, wherein the traffic information includes the node identifier corresponding to the abnormal traffic and the size of the abnormal traffic. The scheduling system is used to perform CDN traffic scheduling based on the traffic information of the abnormal traffic.

[0143] This embodiment provides a device for processing CDN abnormal traffic, including:

[0144] A flow information acquisition module, used to acquire flow information of abnormal flow, where the abnormal flow is detected based on the above CDN abnormal flow detection method;

[0145] A total amount calculation module is used to analyze the flow information and determine the total amount of abnormal flow on each node identifier;

[0146] A total amount deduction module, used to deduct the total amount of abnormal traffic from the preset traffic corresponding to the node identifier to obtain the total amount of available traffic corresponding to the node identifier;

[0147] The traffic scheduling module is used to perform traffic scheduling on the service node corresponding to the node identifier based on the total amount of available traffic.

[0148] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0149] The CDN abnormal traffic detection device and the CDN abnormal traffic processing device in this embodiment are presented in the form of functional units, where the units refer to ASIC (Application Specific Integrated Circuit) circuits, processors and memories that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0150] The disclosed embodiment also provides a computer device having the above-mentioned CDN abnormal traffic detection method and CDN abnormal traffic processing device.

[0151] See also Fig. 9 , Fig. 9 is a schematic diagram of a computer device provided by an optional embodiment of the present disclosure, such as Fig. 9 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Fig. 9 A processor 10 is taken as an example.

[0152] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0153] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0154] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0155] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0156] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0157] The embodiments of the present disclosure also provide a computer-readable storage medium. The above-mentioned method according to the embodiments of the present disclosure can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium and downloaded through a network, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0158] A part of the present disclosure may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present disclosure through the operation of the computer. Those skilled in the art should understand that the existence of computer program instructions in computer-readable media includes, but is not limited to, source files, executable files, installation package files, etc., and accordingly, the way in which computer program instructions are executed by a computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to the computer.

[0159] Although the embodiments of the present disclosure are described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the present invention.

Claims

1. A method for detecting abnormal CDN traffic, characterized in that: The method comprises: Obtaining a target bandwidth unit, where the target bandwidth unit is used to characterize CDN access traffic within a first preset time period; Based on the identifier of the target bandwidth unit, query the CDN traffic record and the scheduling policy to obtain the traffic query result and the scheduling policy query result of the target bandwidth unit; If the scheduling policy query result representation does not exist in the scheduling policy, acquiring, based on the traffic query result, a first record corresponding to the identifier of the target bandwidth unit in the CDN traffic record; Setting the last update time of the first record as the detection time of the target bandwidth unit; Analyze the traffic of the target bandwidth unit based on the last update time of the first record to determine the traffic detection result corresponding to the target bandwidth unit; The analyzing the traffic of the target bandwidth unit based on the last update time of the first record to determine the traffic detection result corresponding to the target bandwidth unit includes: If the scheduling policy corresponding to the identifier of the target bandwidth unit is not found within a second preset time period after the last update time, it is determined that the traffic detection result corresponding to the target bandwidth unit is abnormal traffic.

2. The method according to claim 1, characterized in that The acquiring, based on the traffic query result, a first record corresponding to the identifier of the target bandwidth unit in the CDN traffic record includes: If the traffic query result indicates that a record corresponding to the identifier of the target bandwidth unit does not exist in the CDN traffic record, a record corresponding to the identifier of the target bandwidth unit is added to the CDN traffic record to obtain the first record.

3. The method according to claim 1, characterized in that The identifier of the target bandwidth unit includes a node identifier, an access domain name, and a request source, and the flow of the target bandwidth unit is analyzed based on the last update time of the first record to determine the flow detection result corresponding to the target bandwidth unit, including: If a scheduling policy corresponding to the identifier of the target bandwidth unit is found within a second preset time after the last update time, obtaining the access domain name and a second record corresponding to the request source; The last update time of the second record is set as the detection time of the target bandwidth unit.

4. The method according to claim 3, characterized in that The obtaining of the access domain name and the second record corresponding to the request source includes: Based on the access domain name and the request source, determining whether the second record is found; If the second record is not found, a record corresponding to the access domain name and the request source is added to obtain the second record.

5. The method according to claim 3, characterized in that: The method further comprises: Determine the duration between the last update time of the second record and the last update time; If the duration exceeds a third preset duration, it is determined that the traffic detection results corresponding to the access domain name and all bandwidth units corresponding to the request source are abnormal traffic.

6. The method according to claim 1, characterized in that The method further comprises: Obtaining the total amount of traffic of the target bandwidth unit; If the total traffic volume of the target bandwidth unit is greater than the preset traffic threshold, the steps of querying CDN traffic records and scheduling policies based on the identifier of the target bandwidth unit to obtain traffic query results and scheduling policy query results of the target bandwidth unit are executed.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: The flow information of the abnormal flow is sent to a flow scheduling system, wherein the flow information includes a node identifier corresponding to the abnormal flow and a size of the abnormal flow. The scheduling system is used to perform CDN flow scheduling based on the flow information of the abnormal flow.

8. A method for processing abnormal CDN traffic, characterized in that: The method comprises: Acquire traffic information of abnormal traffic, where the abnormal traffic is detected based on the CDN abnormal traffic detection method according to any one of claims 1 to 7; Analyze the traffic information to determine the total amount of abnormal traffic on each node identifier; Deducting the total amount of abnormal traffic from the preset traffic corresponding to the node identifier to obtain the total amount of available traffic corresponding to the node identifier; Traffic scheduling is performed on the service node corresponding to the node identifier based on the total available traffic.

9. A CDN abnormal traffic detection device, characterized in that: The device comprises: A bandwidth acquisition module, used to acquire a target bandwidth unit, where the target bandwidth unit is used to represent the CDN access traffic within a first preset time period; A policy query module, used to query CDN traffic records and scheduling policies based on the identifier of the target bandwidth unit, and obtain traffic query results and scheduling policy query results of the target bandwidth unit; A first record acquisition module, configured to acquire, based on the traffic query result, a first record corresponding to the identifier of the target bandwidth unit in the CDN traffic record if the scheduling policy query result representation does not exist in the scheduling policy; a detection time updating module, configured to set the last update time of the first record as the detection time of the target bandwidth unit; a first traffic analysis module, configured to analyze the traffic of the target bandwidth unit based on the last update time of the first record, and determine a traffic detection result corresponding to the target bandwidth unit; The first traffic analysis module is further configured to determine that the traffic detection result corresponding to the target bandwidth unit is abnormal traffic if the scheduling policy corresponding to the identifier of the target bandwidth unit is not found within a second preset time period after the last update time.

10. A device for processing CDN abnormal traffic, characterized in that: The device comprises: A flow information acquisition module, used to acquire flow information of abnormal flow, wherein the abnormal flow is detected based on the CDN abnormal flow detection method according to any one of claims 1 to 7; A total amount calculation module is used to analyze the flow information and determine the total amount of abnormal flow on each node identifier; A total amount deduction module, used to deduct the total amount of abnormal traffic from the preset traffic corresponding to the node identifier to obtain the total amount of available traffic corresponding to the node identifier; The traffic scheduling module is used to perform traffic scheduling on the service node corresponding to the node identifier based on the total amount of available traffic.

11. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the CDN abnormal traffic detection method according to any one of claims 1 to 7 or the CDN abnormal traffic processing method according to claim 8 by executing the computer instructions.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the CDN abnormal traffic detection method according to any one of claims 1 to 7, or the CDN abnormal traffic processing method according to claim 8.

13. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to cause a computer to execute the CDN abnormal traffic detection method according to any one of claims 1 to 7, or the CDN abnormal traffic processing method according to claim 8.

Images