Traffic processing method, device, equipment, storage medium and program product

Abstract

The present application provides a traffic processing method, device, electronic device, computer-readable storage medium and computer program product, including: when there is attack traffic in the mirror traffic of the traffic of the communication service party, obtain the first traffic link where the attack traffic is located, and the first network address of the host to which the attack traffic flows; obtain the mapping relationship between the traffic link and the physical address of the communication service party, and determine the first physical address corresponding to the first traffic link based on the mapping relationship; obtain the second network address of the host to which the traffic flows, and the second physical address corresponding to the traffic; match the second network address with the first network address to obtain a first matching result, and match the second physical address with the first physical address to obtain a second matching result; filter out the attack traffic from the traffic based on the first matching result and the second matching result. In this way, the accuracy of traffic filtering can be improved.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a traffic processing method, device, electronic device, computer-readable storage medium, and computer program product. Background Art

[0002] In the traffic transmission process of related technologies, if there is a large-traffic attack, in order to protect the internal network from the impact of the attack traffic, the attack traffic will be discarded at the inlet edge. However, since the relevant equipment at the inlet edge will be connected to several or even dozens of operators at the same time, if all the traffic flowing to the attacked host is discarded directly on the relevant equipment, it will affect the traffic on all traffic links, causing the business to be unable to operate normally. Summary of the invention

[0003] The embodiments of the present application provide a traffic processing method, device, electronic device, computer-readable storage medium, and computer program product, which can improve the accuracy of traffic filtering.

[0004] The technical solution of the embodiment of the present application is implemented as follows:

[0005] The present application provides a traffic processing method, including:

[0006] When there is attack traffic in the mirror traffic of the traffic of the communication service party, obtaining a first traffic link where the attack traffic is located and a first network address of a host to which the attack traffic flows, wherein the first traffic link and the first network address are determined based on the mirror traffic;

[0007] Acquire a mapping relationship between a traffic link and a physical address of the communication service provider, and determine a first physical address corresponding to the first traffic link based on the mapping relationship;

[0008] Obtaining a second network address of a host to which the traffic flows, and a second physical address corresponding to the traffic;

[0009] Matching the second network address with the first network address to obtain a first matching result, and matching the second physical address with the first physical address to obtain a second matching result;

[0010] Based on the first matching result and the second matching result, the attack traffic is filtered out from the traffic.

[0011] The present application provides a flow processing device, including:

[0012] A first acquisition module, configured to acquire, when attack traffic exists in the mirrored traffic of the traffic of the communication service party, a first traffic link where the attack traffic is located and a first network address of a host to which the attack traffic flows, wherein the first traffic link and the first network address are determined based on the mirrored traffic;

[0013] A determination module, configured to obtain a mapping relationship between a traffic link and a physical address of the communication service provider, and determine a first physical address corresponding to the first traffic link based on the mapping relationship;

[0014] A second acquisition module, used to acquire a second network address of a host to which the traffic flows, and a second physical address corresponding to the traffic;

[0015] a matching module, configured to match the second network address with the first network address to obtain a first matching result, and to match the second physical address with the first physical address to obtain a second matching result;

[0016] A filtering module is used to filter out the attack traffic from the traffic based on the first matching result and the second matching result.

[0017] In the above scheme, the number of traffic links corresponding to the communication service provider is at least one. Before obtaining the first traffic link where the attack traffic is located, the device also includes a detection module, and the detection module is used to mirror the traffic on each of the traffic links to obtain the first mirror traffic of each of the traffic links; detect each of the first mirror traffic respectively to obtain a detection result, and the detection result is used to indicate whether there is attack traffic in the corresponding first mirror traffic; when there is a detection result indicating that there is attack traffic in the first mirror traffic, it is determined that there is attack traffic in the traffic of the communication service provider.

[0018] In the above scheme, the detection module is also used to perform the following processing for each first mirrored traffic: obtaining the flow size of the first mirrored traffic within the target time period; when the flow size of the first mirrored traffic within the target time period is greater than the flow size threshold, determining that the detection result for the first mirrored traffic is a first detection result, and the first detection result is used to indicate that there is attack traffic in the first mirrored traffic; when the flow size of the first mirrored traffic within the target time period is less than or equal to the flow size threshold, determining that the detection result for the first mirrored traffic is a second detection result, and the second detection result is used to indicate that there is no attack traffic in the first mirrored traffic.

[0019] In the above scheme, the determination module is also used to obtain the network address of the communication service provider and the traffic link of the communication service provider, and construct a first mapping relationship between the network address and the traffic link; when the traffic link is in a communicative state, obtain the physical address of the communication service provider, and construct a second mapping relationship between the network address and the physical address; based on the first mapping relationship and the second mapping relationship, construct a mapping relationship between the traffic link of the communication service provider and the physical address.

[0020] In the above scheme, the number of the first matching results and the number of the second matching results are both multiple, the traffic includes multiple traffic packets, the first matching results and the traffic packets have a one-to-one correspondence, and the second matching results and the traffic packets have a one-to-one correspondence; the filtering module 4555 is also used to combine each of the first matching results with the corresponding second matching results to obtain multiple matching result combinations; for each matching result combination, when the first matching result in the matching result combination represents that the second network address matches the first network address, and the second matching result represents that the second physical address matches the first physical address, the traffic packet corresponding to the matching result combination is filtered out from the traffic.

[0021] In the above scheme, the filtering module is also used to perform one of the following operations for the traffic packet: discarding the traffic packet through a border router; limiting the speed of the traffic packet so that the traffic size transmitted by the traffic packet within the target time period is less than or equal to the traffic size threshold; sending the traffic packet to a backup host.

[0022] In the above scheme, the device also includes a sending module, which is used to send the traffic packet corresponding to the matching result combination to the host indicated by the second network address when at least one of the first matching result and the second matching result in the matching result combination fails to match.

[0023] In the above scheme, the device also includes a first information generating module, which is used to generate first risk warning information and send the first risk warning information to the target host when the first matching result in the matching result combination indicates that the second network address matches the first network address, and the second matching result indicates that the second physical address does not match the first physical address; or, when the first matching result indicates that the second network address does not match the first network address, and the second matching result indicates that the second physical address matches the first physical address, generate the first risk warning information and send the first risk warning information to the target host; wherein the first risk warning information is used to prompt the target host that there is a risk of being attacked by the attack traffic, and the target host is the host indicated by the second network address corresponding to the first matching result in the corresponding matching result combination.

[0024] In the above scheme, the device also includes a mirroring module, which is used to, when the first matching result in the matching result combination indicates that the second network address matches the first network address, and the second matching result indicates that the second physical address does not match the first physical address, mirror the traffic in the traffic packet corresponding to the matching result combination to obtain second mirrored traffic, and send the second mirrored traffic to the isolated host; or, when the first matching result indicates that the second network address does not match the first network address, and the second matching result indicates that the second physical address matches the first physical address, mirror the traffic in the traffic packet corresponding to the matching result combination to obtain second mirrored traffic, and send the second mirrored traffic to the isolated host; wherein the isolated host detects the second mirrored traffic to obtain a detection result indicating whether the second mirrored traffic is attack traffic; receives the detection result sent by the isolated host; when the detection result indicates that the second mirrored traffic is attack traffic, filters out the traffic packet corresponding to the matching result combination from the traffic; when the detection result indicates that the second mirrored traffic is not attack traffic, sends the traffic packet corresponding to the matching result combination to the host indicated by the corresponding second network address.

[0025] In the above scheme, the device also includes a second information generating module, which is used to generate second risk warning information and send the second risk warning information to the communication service provider corresponding to the first traffic link; wherein the second risk warning information is used to prompt that there is attack traffic in the traffic sent by the corresponding communication service provider, so that the communication service provider can control the communication status of the device corresponding to the attack traffic.

[0026] In the above scheme, the device also includes a message receiving module, which is used to receive a traffic notification message, and the traffic notification message is used to indicate that the attack traffic does not exist in the current traffic of the communication service provider; based on the traffic notification message, the current traffic of the communication service provider is sent to the corresponding host.

[0027] An embodiment of the present application provides an electronic device, including:

[0028] Memory for storing computer executable instructions or computer programs;

[0029] The processor is used to implement the traffic processing method provided in the embodiment of the present application when executing the computer executable instructions or computer program stored in the memory.

[0030] An embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions or a computer program for causing a processor to execute and implement the traffic processing method provided in the embodiment of the present application.

[0031] An embodiment of the present application provides a computer program product, which includes computer executable instructions or a computer program. A processor executes the computer executable instructions or the computer program so that the electronic device executes the traffic processing method provided in the embodiment of the present application.

[0032] The embodiments of the present application have the following beneficial effects:

[0033] When there is attack traffic in the mirror traffic of the communication service provider, the actual traffic can be matched in combination with the first network address of the host to which the attack traffic flows and the first physical address corresponding to the attack traffic, so as to filter out the attack traffic from the traffic based on the matching result. In this way, by analyzing the mirror traffic, when there is attack traffic in the mirror traffic, the attack traffic in the actual traffic is matched based on the first network address and the first physical address corresponding to the attack traffic, and the matched attack traffic is filtered out from the actual traffic; in this way, the attack traffic targeting a specific host can be accurately filtered, while the traffic flowing to other hosts and the traffic of other traffic links are not affected, which not only improves the accuracy of traffic filtering, but also ensures the normal operation of the business while protecting network security, thereby improving the stability and reliability of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 is a schematic diagram of the architecture of a traffic processing system 100 provided in an embodiment of the present application;

[0035] Figure 2 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0036] Figure 3 It is a flow chart of the flow processing method provided in the embodiment of the present application;

[0037] Figure 4 is a schematic diagram of a traffic link provided in an embodiment of the present application;

[0038] Figure 5 This is a first system architecture diagram of the traffic processing method provided in an embodiment of the present application;

[0039] Figure 6 It is a second system architecture diagram of the traffic processing method provided in an embodiment of the present application;

[0040] Figure 7 It is an architectural diagram of a traffic filtering system in the related technology provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0042] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0043] In the following description, the terms "first\second\third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0044] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0045] Before further describing the embodiments of the present application in detail, the nouns and terms involved in the embodiments of the present application are explained. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations.

[0046] 1) In response, it is used to indicate the conditions or states on which the executed operations depend. When the dependent conditions or states are met, one or more operations executed may be in real time or with a set delay. Unless otherwise specified, there is no restriction on the order in which the multiple operations executed are executed.

[0047] 2) Client, also known as user end, refers to the program corresponding to the server that provides local services to users. Except for some applications that can only run locally, it is generally installed on the terminal and needs to cooperate with the server to run, that is, there must be corresponding servers and service programs in the network to provide corresponding services. In this way, specific communication connections need to be established on the client and server sides to ensure the normal operation of the application, such as virtual scene clients (such as game clients) and video clients.

[0048] 3) Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that machines have the functions of perception, reasoning and decision-making.

[0049] 4) Distributed Denial of Service (DDOS) refers to a network attack method used to block the normal traffic of the target system, service or network, making it impossible to provide services to legitimate users.

[0050] 5) Internet Service Provider (ISP) is a company or organization that provides Internet access services. It is used to provide services to connect to the Internet for individuals, families, businesses and other organizations, allowing users to access and use the services and resources provided by the Internet. For example, it can be a carrier.

[0051] 6) Address Resolution Protocol (ARP) is a protocol used to resolve the IP address of the network layer into the physical address (MAC address) of the link layer, that is, to resolve the IP address to the MAC address.

[0052] 7) Network adapter address (MAC, Media Access Control Address), a unique identifier used to indicate network devices for communication in a physical network segment. It is usually embedded in a network interface card and is used for data transmission in a local area network or other network technologies.

[0053] 8) Edge Router (ER) is a device located at the edge of the network in the network architecture. It is mainly responsible for connecting the internal network (such as corporate LAN or home network) with the external network (such as the Internet), that is, it is used to connect internal traffic and external networks. The edge router is the import and export of network traffic and is responsible for handling large amounts of data transmission and routing decisions.

[0054] 9) Point of Presence (POP), also known as "access point" or "service access point", is used to indicate the service access point set up by the network service provider, through which customers can access the service provider's network. The access point can be physical, such as an exchange center, or virtual, such as a node on the Internet.

[0055] 10) Access Control List (ACL) is a series of defined instructions used to control traffic and access rights in the network; these instructions specify the users or system processes that are authorized to access or execute specific file systems, directories, or network services, as well as the operations that are allowed or denied.

[0056] 11) Internet Protocol address (IP) is a unique logical address used to identify each device or interface on the Internet. Each device connected to the Internet, such as computers, mobile phones, servers, etc., requires an IP address for communication and data exchange.

[0057] See also Figure 1 , Figure 1 It is an architectural diagram of a traffic processing system 100 provided in an embodiment of the present application, a terminal (terminal 400 is shown as an example), and the terminal 400 is connected to the server 200 via a network 300, wherein the network 300 may be a wide area network or a local area network, or a combination of the two, and data transmission is achieved using wireless or wired links.

[0058] The server 200 is used to obtain, when attack traffic exists in the mirror traffic of the traffic of the communication service provider, a first traffic link where the attack traffic is located and a first network address of a host to which the attack traffic flows, the first traffic link and the first network address being determined based on the mirror traffic; obtain a mapping relationship between the traffic link and the physical address of the communication service provider, and determine a first physical address corresponding to the first traffic link based on the mapping relationship; obtain a second network address of the host to which the traffic flows, and a second physical address corresponding to the traffic; match the second network address with the first network address to obtain a first matching result, and match the second physical address with the first physical address to obtain a second matching result; filter out the attack traffic from the traffic based on the first matching result and the second matching result; and transmit the filtered traffic to the terminal;

[0059] The terminal 400 is used to receive filtered traffic.

[0060] In some embodiments, the server 200 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks (CDN, Content Deliver Network), and big data and artificial intelligence platforms. The terminal 400 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a set-top box, an intelligent voice interaction device, a smart home appliance, a virtual reality device, a vehicle-mounted terminal, an aircraft, a portable music player, a personal digital assistant, a dedicated messaging device, a portable gaming device, a smart speaker, and a smart watch, but is not limited thereto. The terminal and the server may be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiments of the present application.

[0061] Next, an electronic device that implements the traffic processing method provided in the embodiment of the present application is described. Figure 2 , Figure 2 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may be a server or a terminal. Figure 1 Take the server shown in as an example, Figure 2 The electronic device shown includes: at least one processor 410, a memory 450, at least one network interface 420 and a user interface 430. The various components in the terminal 400 are coupled together via a bus system 440. It is understood that the bus system 440 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 440 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 440 is not shown in FIG. Figure 2Various buses are labeled as bus system 440 .

[0062] The processor 410 may be an integrated circuit chip having signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., wherein the general-purpose processor may be a microprocessor or any conventional processor, etc.

[0063] The user interface 430 includes one or more output devices 431 that enable display of media content, including one or more speakers and / or one or more visual display screens. The user interface 430 also includes one or more input devices 432, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

[0064] The memory 450 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard disk drives, optical disk drives, etc. The memory 450 may optionally include one or more storage devices that are physically remote from the processor 410.

[0065] The memory 450 includes a volatile memory or a non-volatile memory, and may also include both volatile and non-volatile memories. The non-volatile memory may be a read-only memory (ROM), and the volatile memory may be a random access memory (RAM). The memory 450 described in the embodiments of the present application is intended to include any suitable type of memory.

[0066] In some embodiments, memory 450 can store data to support various operations, examples of which include programs, modules, and data structures, or a subset or superset thereof, as exemplarily described below.

[0067] Operating system 451, including system programs for processing various basic system services and performing hardware-related tasks, such as a framework layer, a core library layer, a driver layer, etc., for implementing various basic services and processing hardware-based tasks;

[0068] A network communication module 452, used to reach other electronic devices via one or more (wired or wireless) network interfaces 420, exemplary network interfaces 420 include: Bluetooth, Wireless Compatibility Certification (WiFi), and Universal Serial Bus (USB), etc.;

[0069] a presentation module 453 for enabling display of information via one or more output devices 431 (e.g., display screen, speaker, etc.) associated with the user interface 430 (e.g., a user interface for operating peripherals and displaying content and information);

[0070] The input processing module 454 is used to detect one or more user inputs or interactions from one of the one or more input devices 432 and translate the detected inputs or interactions.

[0071] In some embodiments, the device provided in the embodiments of the present application can be implemented in software. Figure 2 The flow processing device 455 stored in the memory 450 is shown, which can be software in the form of a program and a plug-in, etc., and includes the following software modules: a first acquisition module 4551, a determination module 4552, a second acquisition module 4553, a matching module 4554 and a filtering module 4555. These modules are logical, and therefore can be arbitrarily combined or further split according to the functions implemented. The functions of each module will be described below.

[0072] In other embodiments, the device provided in the embodiments of the present application can be implemented in hardware. As an example, the traffic processing device provided in the embodiments of the present application can be a processor in the form of a hardware decoding processor, which is programmed to execute the traffic processing method provided in the embodiments of the present application. For example, the processor in the form of a hardware decoding processor can adopt one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs) or other electronic components.

[0073] In some embodiments, the terminal or server can implement the traffic processing method provided in the embodiments of the present application by running a computer program. For example, the computer program can be a native program or software module in the operating system; it can be a native application (APP, Application), that is, a local client, that is, a program that needs to be installed in the operating system to run, such as an instant messaging APP, a web browser APP; it can also be a small program, that is, a program that can be run only by downloading it to a browser environment; it can also be a small program that can be embedded in any APP. In short, the above-mentioned computer program can be any form of client, module or plug-in.

[0074] Based on the above description of the flow processing system and electronic device provided by the embodiment of the present application, the flow processing method provided by the embodiment of the present application is described below. In actual implementation, the flow processing method provided by the embodiment of the present application can be implemented by the terminal or the server alone, or by the terminal and the server in collaboration, so that Figure 1 The server 200 in the embodiment of the present application alone performs the traffic processing method provided in the embodiment of the present application as an example for explanation. Figure 3 , Figure 3 is a flow chart of the flow processing method provided by the embodiment of the present application. Next, Figure 3 The steps shown are explained.

[0075] Step 101, when there is attack traffic in the mirror traffic of the communication service provider's traffic, the server obtains a first traffic link where the attack traffic is located and a first network address of a host to which the attack traffic flows, wherein the first traffic link and the first network address are determined based on the mirror traffic.

[0076] It should be noted that the communication service provider here is the Internet Service Provider (ISP), which is a company or organization that provides Internet access services. It is used to provide services to connect to the Internet for individuals, families, enterprises and other organizations, so that users can access and use the services and resources provided by the Internet. For example, it can be an operator; and the network address is the IP address (Internet Protocol address), which is the Internet Protocol address, which is used to identify the unique logical address of each device or interface on the Internet. Among them, each device connected to the Internet, such as computers, mobile phones, servers, etc., requires an IP address for communication and data exchange; and the traffic link refers to the physical or logical connection between the user device (such as a personal computer, mobile phone, etc.) and the operator's network equipment (such as switches, routers, etc.), among which the connection device of the traffic link at the user device is the edge router (Edge Router). The edge router is a device located at the edge of the network in the network architecture. It is mainly responsible for connecting the internal network (such as an enterprise LAN or a home network) with the external network (such as the Internet). The edge router is the import and export of network traffic and is responsible for processing a large amount of data transmission and routing decisions. Therefore, the traffic sent from the operator will first flow to the edge router, and then be sent from the edge router to the user device (that is, the host).

[0077] In actual implementation, the number of traffic links corresponding to the communication service provider is at least one, and each traffic link is provided with an optical splitter. The traffic on each traffic link is mirrored, i.e., copied, through the optical splitter, and then the mirrored traffic is analyzed to determine whether there is attack traffic in the mirrored traffic. Specifically, before determining whether there is attack traffic in the mirrored traffic of the communication service provider's traffic, the traffic on each traffic link is mirrored to obtain the first mirrored traffic of each traffic link; each first mirrored traffic is detected respectively to obtain a detection result, and the detection result is used to indicate whether there is attack traffic in the corresponding first mirrored traffic; when there is a detection result indicating that there is attack traffic in the first mirrored traffic, it is determined that there is attack traffic in the traffic of the communication service provider. For example, see Figure 4 , Figure 4 is a schematic diagram of a traffic link provided in an embodiment of the present application, based on Figure 4 , the communication service provider is connected to the border router, and the border router is connected to the device at the user's site. The network address of the user device (that is, the device at the user's site) is 1.1.1.1; wherein, the splitter is set in the attack protection module, where the attack protection module can be a DDOS system, and AC refers to the traffic link corresponding to the communication service provider 1, and AB refers to the traffic link corresponding to the communication service provider 2.

[0078] It should be noted that when constructing a traffic link, each traffic link and the optical splitter set on the traffic link are determined, so that the traffic on each traffic link is mirrored based on the corresponding optical splitter to obtain the first mirrored traffic of each traffic link. Then, when there is a detection result indicating that there is attack traffic in the first mirrored traffic, the first traffic link corresponding to the first mirrored traffic corresponding to the corresponding detection result is determined, that is, the first traffic link where the attack traffic is located is determined; wherein, when there is a detection result indicating that there is attack traffic in the first mirrored traffic, the attack traffic in the first mirrored traffic corresponding to the corresponding detection result is also analyzed to obtain the destination address of the attack traffic, that is, the first network address of the host to which the attack traffic flows.

[0079] In this way, by detecting the mirrored traffic obtained by mirroring the traffic, it is avoided that the detection process affects the traffic transportation process, thereby improving the stability of the traffic transmission process, that is, improving the stability of the network.

[0080] In actual implementation, each first mirrored traffic is detected separately to obtain a detection result, which may be a process of performing the following processing on each first mirrored traffic: obtaining the flow size of the first mirrored traffic within a target time period; when the flow size of the first mirrored traffic within the target time period is greater than a flow size threshold, determining that the detection result for the first mirrored traffic is a first detection result, and the first detection result is used to indicate that attack traffic exists in the first mirrored traffic; when the flow size of the first mirrored traffic within the target time period is less than or equal to the flow size threshold, determining that the detection result for the first mirrored traffic is a second detection result, and the second detection result is used to indicate that attack traffic does not exist in the first mirrored traffic.

[0081] It should be noted that the target time period can be preset, such as 1 second; and the flow size of the first mirrored traffic within the target time period is also the size of the data transmission volume of the first mirrored traffic within the target time period, so that the flow size of the first mirrored traffic within the target time period is compared with the flow size threshold. When the comparison result indicates that the flow size of the first mirrored traffic within the target time period is greater than the flow size threshold, the detection result for the first mirrored traffic is determined to be the first detection result; when the comparison result indicates that the flow size of the first mirrored traffic within the target time period is less than or equal to the flow size threshold, the detection result for the first mirrored traffic is determined to be the second detection result; wherein the flow size threshold is also preset, for example, it can be 10G / s.

[0082] In this way, by comparing the mirrored traffic based on the pre-set traffic size threshold, it is possible to accurately detect whether there is attack traffic in the mirrored traffic, thereby improving the accuracy of traffic filtering in the subsequent process, which not only ensures network security, but also improves network stability and reliability.

[0083] Step 102: Obtain a mapping relationship between a traffic link and a physical address of a communication service provider, and determine a first physical address corresponding to a first traffic link based on the mapping relationship.

[0084] In actual implementation, the mapping relationship between the acquired traffic link and the physical address of the communication service provider can be a real-time mapping relationship, or a pre-built mapping relationship, which is not limited in the embodiments of the present application. As for the process of constructing the mapping relationship between the traffic link and the physical address of the communication service provider, it can be to obtain the network address of the communication service provider and the traffic link of the communication service provider, and construct a first mapping relationship between the network address and the traffic link; when the traffic link is in a communicative state, obtain the physical address of the communication service provider, and construct a second mapping relationship between the network address and the physical address; based on the first mapping relationship and the second mapping relationship, construct a mapping relationship between the traffic link and the physical address of the communication service provider.

[0085] It should be noted that the physical address, also known as the MAC address (Media Access Control address), refers to the unique identifier of a network device for communication in a physical network segment. It is usually embedded in a network interface card and is used for data transmission in a local area network or other network technologies. Among them, the traffic link being in a communicative state means that the traffic link is interoperable normally, that is, traffic transmission is being carried out based on the traffic link. The IP address is generally unchanged, while the MAC address will change with the replacement of the device or the change of the interface. Therefore, the physical address of the current communication service provider can only be determined after the traffic link is interoperable.

[0086] As for the process of obtaining the network address of the communication service provider and the traffic link of the communication service provider, the number of communication service providers can be at least one, and the number of traffic links corresponding to each communication service provider can also be at least one. Similarly, the network address corresponding to each communication service provider can also be at least one; after determining the communication service provider, at least one traffic link corresponding to each communication service provider can be determined, and then the network address corresponding to the device at the communication service provider connected to each traffic link can be determined, that is, the network address corresponding to the communication service provider is determined; based on this, after determining the communication service provider, the traffic link corresponding to the communication service provider and the network address of the device at the communication service provider can be directly obtained, and then based on the device at the communication service provider connected to each traffic link, a first mapping relationship between the network address and the traffic link is constructed, that is, based on the connection relationship between each traffic link and the device at the communication party, a first mapping relationship between the network address and the traffic link is constructed.

[0087] In actual implementation, as mentioned above, only after the traffic links are interconnected can the physical address of the current communication service provider be determined. Specifically, after the traffic links are interconnected, the border router can obtain the network address of the communication service provider, and then resolve the network address into a physical address, wherein the process of resolving the network address into a physical address can be implemented through an address resolution protocol, so that after the network address is resolved into a physical address, the second mapping relationship between the network address and the physical address is determined; based on this, based on the first mapping relationship between the network address and the traffic link, and the second mapping relationship between the network address and the physical address, the mapping relationship between the traffic link and the physical address can be determined, that is, the mapping relationship between the traffic link and the physical address is constructed.

[0088] Then, after obtaining the mapping relationship between the traffic link and the physical address of the communication service provider, and determining the first traffic link where the attack traffic is located, the first physical address corresponding to the first traffic link can be determined based on the mapping relationship, that is, the MAC address of the communication service provider device used to send the traffic on the first traffic link.

[0089] Step 103: Obtain a second network address of the host to which the traffic flows, and a second physical address corresponding to the traffic.

[0090] In actual implementation, the process of obtaining the second network address of the host to which the traffic flows and the second physical address corresponding to the traffic, wherein the traffic is the actually transmitted traffic, that is, the traffic sent by the communication service provider.

[0091] It should be noted that the traffic sent by the communication service provider is in the form of traffic packets, and each traffic packet contains the second network address of the host to which it flows, and the corresponding second physical address; wherein the second physical address corresponding to the traffic here refers to the MAC address of the communication service provider device that sends the corresponding traffic. Based on this, after obtaining the traffic sent by the communication service provider, the traffic is parsed to obtain the second network address of the host to which the traffic flows, and the second physical address corresponding to the traffic.

[0092] Step 104: Match the second network address with the first network address to obtain a first matching result, and match the second physical address with the first physical address to obtain a second matching result.

[0093] In actual implementation, after obtaining the first network address and the first physical address, a traffic filtering policy can be generated based on the first network address and the first physical address, so that the traffic can be filtered based on the traffic filtering policy, that is, the second network address is matched with the first network address in the traffic filtering policy to obtain a first matching result, and the second physical address is matched with the first physical address in the traffic filtering policy to obtain a second matching result.

[0094] It should be noted that the traffic filtering policy can be an access control list (ACL), which is a series of defined instructions used to control traffic and access rights in the network; these instructions specify the users or system processes that are authorized to access or execute specific file systems, directories, or network services, as well as the operations that are allowed or denied.

[0095] Step 105: Filter out attack traffic from the traffic based on the first matching result and the second matching result.

[0096] In actual implementation, the number of first matching results and the number of second matching results are both multiple, the traffic includes multiple traffic packets, the first matching results and the traffic packets have a one-to-one correspondence, and the second matching results and the traffic packets have a one-to-one correspondence; thus, based on the first matching results and the second matching results, the process of filtering out attack traffic from the traffic can be to combine each first matching result with the corresponding second matching result to obtain multiple matching result combinations; for each matching result combination, when the first matching result in the matching result combination represents that the second network address matches the first network address, and the second matching result represents that the second physical address matches the first physical address, the traffic packet corresponding to the matching result combination is filtered out from the traffic.

[0097] It should be noted that the traffic is transmitted in the form of traffic packets, that is, the communication service provider transmits the traffic by sending traffic packets, so the traffic includes multiple traffic packets, which refers to multiple traffic packets corresponding to the traffic; and as mentioned above, each traffic packet contains the second network address of the host to which it flows, and the corresponding second physical address. Therefore, there is a one-to-one correspondence between the first matching result obtained based on the second network address matching and the second matching result obtained based on the second physical address matching and the traffic packet. Based on this, there is also a one-to-one correspondence between the first matching result and the second matching result. In this way, each first matching result is combined with the corresponding second matching result to obtain multiple matching result combinations.

[0098] Then, for each matching result combination, when the first matching result in the matching result combination indicates that the second network address matches the first network address, and the second matching result indicates that the second physical address matches the first physical address, the traffic indicated by the traffic packet corresponding to the matching result combination is used as attack traffic, and the corresponding attack traffic is filtered out from the traffic.

[0099] In actual implementation, the process of filtering out the traffic packets corresponding to the matching result combination from the traffic may be, for the traffic packets, performing one of the following operations: discarding the traffic packets through the border router; limiting the speed of the traffic packets so that the traffic size transmitted by the traffic packets within the target time period is less than or equal to the traffic size threshold; sending the traffic packets to the backup host.

[0100] It should be noted that the specific process of discarding the traffic packet through the border router can be that the black hole routing strategy is adopted through the border router to guide the traffic packet, that is, send it to a virtual location, thereby discarding the traffic packet; wherein, the black hole routing strategy is a network routing strategy for handling malicious traffic or overload traffic, specifically, the malicious traffic or overload traffic is guided, that is, sent to a place called a "black hole", thereby discarding these traffic and preventing them from causing further damage to the network; here, guiding the malicious traffic or overload traffic to a place called a "black hole" means that by configuring the border router, the corresponding traffic is sent to a virtual location, that is, a non-existent interface or address, and this interface or address will not respond to any data packets, thereby effectively discarding these traffic.

[0101] The specific process of speed limiting the traffic packet may be to obtain a pre-set traffic size threshold, and then limit the traffic size transmitted by the traffic packet within the target time period to less than or equal to the traffic size threshold; wherein, a traffic packet includes at least one data packet, and the traffic size transmitted by the traffic packet within the target time period refers to the transmission speed of the traffic packet, that is, the amount of data transmitted within the target time period.

[0102] The specific process of sending the traffic packet to the backup host may be to guide the traffic packet to the backup host through the border router, wherein the backup host is different from the virtual location described above. The backup host is an actual address or interface, but is in an isolated or abandoned state, thereby sending the traffic packet to the backup host to ensure that the attack traffic corresponding to the traffic packet will not affect the host in use.

[0103] In some embodiments, when at least one of the first matching result and the second matching result in the matching result combination fails to match, the traffic packet corresponding to the matching result combination is sent to the host indicated by the second network address.

[0104] Among them, when at least one of the first matching result and the second matching result in the matching result combination fails to match, it means that when the first matching result in the matching result combination represents that the second network address does not match the first network address, and the second matching result represents that the second physical address does not match the first physical address, and when the first matching result in the matching result combination represents that the second network address does not match the first network address, and the second matching result represents that the second physical address matches the first physical address, and when the first matching result in the matching result combination represents that the second network address matches the first network address, and the second matching result represents that the second physical address does not match the first physical address.

[0105] It should be noted that when at least one of the first matching result and the second matching result in the matching result combination fails to match, it means that the traffic packet corresponding to the matching result combination is not attack traffic. Therefore, the traffic packet corresponding to the matching result combination is allowed to flow to the host indicated by the second network address, that is, the traffic packet corresponding to the matching result combination is sent to the host indicated by the second network address.

[0106] In some embodiments, when the first matching result in the matching result combination indicates that the second network address matches the first network address, and the second matching result indicates that the second physical address does not match the first physical address, a first risk warning message is generated and the first risk warning message is sent to the target host; or, when the first matching result indicates that the second network address does not match the first network address, and the second matching result indicates that the second physical address matches the first physical address, a first risk warning message is generated and the first risk warning message is sent to the target host; wherein the first risk warning message is used to prompt the target host that there is a risk of being attacked by attack traffic, and the target host is the host indicated by the second network address corresponding to the first matching result in the corresponding matching result combination.

[0107] It should be noted that when the first matching result in the matching result combination indicates that the second network address matches the first network address, and the second matching result indicates that the second physical address does not match the first physical address, or when the first matching result indicates that the second network address does not match the first network address, and the second matching result indicates that the second physical address matches the first physical address, it means that the first matching result matches one of the second matching results. Therefore, the traffic packet corresponding to the corresponding matching result combination is risky traffic, that is, there is a possibility that it is attack traffic. Based on this, the first risk warning information is sent to the target host, thereby prompting the target host that there is a risk of being attacked by attack traffic, so that the target host can take protection in advance.

[0108] In this way, if the first matching result matches one of the second matching results, the traffic packet corresponding to the corresponding matching result combination is regarded as risky traffic, thereby generating first risk warning information for prompting the target host that there is a risk of being attacked by attack traffic, and the first risk warning information is sent to the target host; in this way, the target host can be protected in advance, thereby enhancing the security of the network.

[0109] In some embodiments, when the first matching result in the matching result combination indicates that the second network address matches the first network address, and the second matching result indicates that the second physical address does not match the first physical address, the traffic in the traffic packet corresponding to the matching result combination is mirrored to obtain the second mirrored traffic, and the second mirrored traffic is sent to the isolated host; or, when the first matching result indicates that the second network address does not match the first network address, and the second matching result indicates that the second physical address matches the first physical address, the traffic in the traffic packet corresponding to the matching result combination is mirrored to obtain the second mirrored traffic, and the second mirrored traffic is sent to the isolated host; wherein the isolated host detects the second mirrored traffic to obtain a detection result indicating whether the second mirrored traffic is attack traffic; receives the detection result sent by the isolated host; when the detection result indicates that the second mirrored traffic is attack traffic, filters out the traffic packet corresponding to the matching result combination from the traffic; when the detection result indicates that the second mirrored traffic is not attack traffic, sends the traffic packet corresponding to the matching result combination to the host indicated by the corresponding second network address.

[0110] It should be noted that the isolated host can be a host in a sandbox environment, where the sandbox environment is an isolated execution environment that simulates a real operating system and allows the code to run under controlled conditions; the sandbox environment is usually isolated from the main system to ensure that any code executed in the sandbox will not affect the security or stability of the main system.

[0111] As described above, when the first matching result in the matching result combination indicates that the second network address matches the first network address, and the second matching result indicates that the second physical address does not match the first physical address, or when the first matching result indicates that the second network address does not match the first network address, and the second matching result indicates that the second physical address matches the first physical address, it means that the first matching result matches one of the second matching results. Therefore, the traffic packet corresponding to the corresponding matching result combination is risk traffic, that is, there is a possibility that it is attack traffic. Based on this, the second mirrored traffic obtained by mirroring the traffic in the traffic packet corresponding to the matching result combination is sent to the isolated host, so that the isolated host detects the second mirrored traffic and obtains a detection result indicating whether the second mirrored traffic is attack traffic.

[0112] Among them, when the detection result indicates that the second mirror traffic is attack traffic, the process of filtering out the traffic packets corresponding to the matching result combination from the traffic is as described above, that is, for the traffic packets corresponding to the matching result combination, one of the following operations is performed: discarding the traffic packets through the border router; limiting the speed of the traffic packets so that the traffic size transmitted by the traffic packets within the target time period is less than or equal to the traffic size threshold; sending the traffic packets to the backup host; and the specific processes of these three methods are as described above, and will not be repeated here.

[0113] When the detection result indicates that the second mirrored traffic is not attack traffic, the traffic packet corresponding to the matching result combination is sent to the host indicated by the corresponding second network address, that is, the traffic packet corresponding to the matching result combination is allowed to flow to the host indicated by the corresponding second network address; wherein the corresponding second network address refers to the second network address corresponding to the first matching result included in the matching result combination.

[0114] In this way, when the traffic may be attack traffic, that is, the traffic is at risk, the traffic will be directed to the isolated host to observe the traffic, thereby detecting potential attack traffic. This reduces the risk of missing potential attack traffic during the traffic filtering process, which not only improves the security of the traffic transmission process, but also improves the stability and reliability of the network.

[0115] In some embodiments, when there is attack traffic in the mirrored traffic of the communication service provider's traffic, in addition to filtering the traffic, the communication service provider can also sanction the device corresponding to the attack traffic. Specifically, when there is attack traffic in the mirrored traffic of the communication service provider's traffic, after obtaining the first traffic link where the attack traffic is located, it is also possible to generate second risk warning information and send the second risk warning information to the communication service provider corresponding to the first traffic link; wherein the second risk warning information is used to prompt the corresponding communication service provider that there is attack traffic in the traffic sent, so that the communication service provider can control the communication status of the device corresponding to the attack traffic.

[0116] It should be noted that the attack traffic here is sent by another user device, and the communication service provider only plays the role of forwarding traffic, so the device corresponding to the attack traffic refers to the source device that sends the attack traffic, rather than the communication service provider device used to forward the attack traffic; so that the communication service provider controls the communication state of the device corresponding to the attack traffic, it means that the communication service provider can limit the communication state of the device corresponding to the attack traffic, such as stopping the provision of network services to the device corresponding to the attack traffic, or limiting the traffic transmission speed of the device corresponding to the attack traffic, such as the size of the traffic transmitted within the target time period, etc., and this is not limited in the embodiments of the present application;

[0117] Among them, the second risk warning information includes the first physical address corresponding to the attack traffic, so that when the communication service provider receives the second risk warning information, it can query the communication party device that forwards the attack traffic based on the first physical address in the second risk warning information; then, based on the queried communication party device that sends the attack traffic, detect whether the traffic forwarded by the corresponding communication party device includes the attack traffic; when it is determined that the traffic sent by the corresponding communication party device includes the attack traffic, query the source device that sends the attack traffic, and then control the communication status of the source device that sends the attack traffic.

[0118] In this way, through the second risk warning information, the communication service provider can sanction the device corresponding to the attack traffic. Compared with the local solution of filtering traffic, it can fundamentally solve the problem of traffic attack, thereby reducing the possibility of being attacked by traffic from the same device again in the subsequent process.

[0119] In some embodiments, after filtering out the attack traffic from the traffic based on the first matching result and the second matching result, it is also possible to receive a traffic notification message, where the traffic notification message is used to indicate that there is no attack traffic in the current traffic of the communication service provider; based on the traffic notification message, the current traffic of the communication service provider is sent to the corresponding host.

[0120] It should be noted that the traffic notification message is used to indicate that there is no attack traffic in the current traffic of the communication service provider, that is, it is used to indicate that the attack traffic has been filtered. Therefore, it is not necessary to match according to the first physical address and the first network address, so that based on the traffic notification message, the current traffic of the communication service provider is sent to the corresponding host, that is, based on the traffic notification message, it is not necessary to match according to the first physical address and the first network address, and the current traffic of the communication service provider is directly sent to the corresponding host. In this way, after filtering the attack traffic, the traffic filtering operation can be revoked based on the traffic notification information, thereby realizing dynamic traffic filtering on demand and improving the flexibility of the traffic filtering process.

[0121] In some embodiments, see Figure 5 , Figure 5 This is a first system architecture diagram of the traffic processing method provided in the embodiment of the present application, based on Figure 5 The flow processing method provided in the embodiment of the present application is Figure 5 Specifically, when there is attack traffic in the mirror traffic of the traffic of the communication service provider, the process of obtaining the first traffic link where the attack traffic is located and the first network address of the host to which the attack traffic flows may be that when the attack protection module detects that there is attack traffic in the mirror traffic of the traffic of the communication service provider, the border router obtains the first traffic link where the attack traffic is located, that is, the first network address of the host to which the attack traffic flows. Figure 5 The traffic link 2 between the communication service provider 2 and the border router in a, and the first network address of the host to which the attack traffic flows, that is, Figure 5 The network address of the user device in a is 1.1.1.1;

[0122] Among them, the process of detecting whether there is attack traffic in the mirror traffic of the communication service provider's traffic is as described above. This is only used to illustrate that the corresponding detection process is performed by the attack protection module, and other details are not repeated; at the same time, the first traffic link where the attack traffic is located obtained by the border router, and the first network address of the host to which the attack traffic flows are sent by the attack protection module. Specifically, after detecting the attack traffic, the attack protection module queries the attack traffic, obtains the link information corresponding to the attack traffic, that is, the first traffic link where it is located and the network address of the attacked host, that is, the first network address, and sends the first traffic link and the first network address to the border router, such as Figure 5 In a, the traffic link 2 between the communication service provider 2 and the border router is the first traffic link, and the first network address is 1.1.1.1.

[0123] Then, the process of obtaining the mapping relationship between the traffic link and the physical address of the communication service provider, and determining the first physical address corresponding to the first traffic link based on the mapping relationship, may be that the border router obtains the mapping relationship between the traffic link and the physical address of the communication service provider, and determines the first physical address corresponding to the first traffic link based on the mapping relationship; wherein the process of obtaining the mapping relationship and the process of determining the first physical address corresponding to the first traffic link based on the mapping relationship are as described above, that is, first determining the first mapping relationship between the network address and the traffic link, such as Figure 5 In a, the traffic link 1 between the communication service provider 1 and the border router corresponds to IP1, and the traffic link 2 between the communication service provider 2 and the border router corresponds to IP2. Then, when the traffic link is in a communicable state, a second mapping relationship between the network address and the physical address is constructed, such as Figure 5 In a, IP1 corresponds to MAC1, and IP2 corresponds to MAC2; the process of determining the second mapping relationship between the network address and the physical address is as described above, and will not be repeated here; finally, the first mapping relationship and the second mapping relationship are used to construct a mapping relationship between the traffic link of the communication service provider and the physical address, such as Figure 5 In a, the traffic link 1 between the communication service provider 1 and the border router corresponds to MAC1, and the traffic link 2 between the communication service provider 2 and the border router corresponds to MAC2.

[0124] Next, the process of obtaining the second network address of the host to which the traffic flows and the second physical address corresponding to the traffic may be that the border router receives the traffic from other devices forwarded by the communication service provider, and parses the traffic to obtain the second network address of the host to which the traffic flows and the second physical address corresponding to the traffic; wherein the process of parsing the traffic to obtain the second network address of the host to which the traffic flows and the second physical address corresponding to the traffic is as described above, that is, as Figure 5The second network address of the host to which the traffic sent from communication service provider 1 flows obtained in a is 1.1.1.1, and the second physical address corresponding to the traffic is MAC1. The second network address of the host to which the traffic sent from communication service provider 2 flows obtained in a is 1.1.1.1, and the second physical address corresponding to the traffic is MAC2.

[0125] Then, the process of matching the second network address with the first network address to obtain the first matching result, and matching the second physical address with the first physical address to obtain the second matching result may be that the border router generates a traffic filtering policy based on the first network address and the first physical address, and then filters the traffic based on the traffic filtering policy, that is, matching the second network address with the first network address in the traffic filtering policy to obtain the first matching result, and matching the second physical address with the first physical address in the traffic filtering policy to obtain the second matching result. As mentioned above, the traffic filtering policy may be an access control list (ACL), which is a series of defined instructions for controlling traffic and access rights in the network; these instructions specify users or system processes that are authorized to access or execute specific file systems, directories, or network services, as well as operations that are allowed or denied.

[0126] Finally, based on the first matching result and the second matching result, the process of filtering out the attack traffic from the traffic may be, when the first matching result indicates that the second network address matches the first network address, and the second matching result indicates that the second physical address matches the first physical address, the corresponding traffic is taken as the attack traffic and filtered out from the traffic; and the process of filtering the attack traffic is as described above, and the embodiments of the present application are not repeated here; at the same time, when at least one of the first matching result and the second matching result in the matching result combination fails to match, the corresponding traffic is sent to the host indicated by the second network address;

[0127] Continuing with the above example, the first network address is 1.1.1.1, the first physical address is MAC2, and the second network address of the traffic sent from communication service provider 1 is 1.1.1.1, and the second physical address corresponding to the traffic is MAC1, the second network address of the host to which the traffic sent from communication service provider 2 flows is 1.1.1.1, and the second physical address corresponding to the traffic is MAC2. Therefore, based on the first matching result and the second matching result, it can be determined that the traffic sent from communication service provider 2 is attack traffic, so the attack traffic needs to be filtered out from the traffic, such as Figure 5 As shown in b in Figure 1, the dotted line is used to indicate that the corresponding attack traffic has been filtered and cannot flow to host 1.1.1.1.

[0128] In some embodiments, see Figure 6 , Figure 6 is a second system architecture diagram of the traffic processing method provided in the embodiment of the present application, based on Figure 6 The flow processing method provided in the embodiment of the present application is Figure 6 Specifically, after determining the communication service provider, the controller first enters the information of the communication service provider, that is, constructs a first mapping relationship between the network address of the communication service provider and the traffic link, such as Figure 6 In a, the traffic link 1 between the communication service provider 1 and the border router corresponds to IP1, and the traffic link 2 between the communication service provider 2 and the border router corresponds to IP2; then, the attack protection module records the third mapping relationship between the optical splitter and the traffic link; then, after the traffic link between the border router and the communication service provider is interconnected normally, the border router sends the second mapping relationship between the network address and the physical address of the communication service provider to the controller, such as Figure 6 In a, IP1 corresponds to MAC1, and IP2 corresponds to MAC2; wherein, the process of the border router determining the second mapping relationship between the network address and the physical address of the communication service provider is as described above, and will not be repeated here; then, the controller constructs a mapping relationship between the traffic link and the physical address of the communication service provider based on the predetermined first mapping relationship between the network address and the traffic link of the communication service provider and the received second mapping relationship between the network address and the physical address of the communication service provider, such as Figure 6 In a, the traffic link 1 between the communication service provider 1 and the border router corresponds to MAC1, and the traffic link 2 between the communication service provider 2 and the border router corresponds to MAC2;

[0129] Thus, when there is attack traffic in the mirror traffic of the communication service provider's traffic, the process of obtaining the first traffic link where the attack traffic is located and the first network address of the host to which the attack traffic flows may be, when the attack protection module detects through the optical splitter that there is attack traffic in the mirror traffic of the communication service provider's traffic, based on the constructed third mapping relationship, obtaining the first traffic link where the attack traffic is located, analyzing the attack traffic, and obtaining the first network address of the host to which the attack traffic flows; then sending the first traffic link where the attack traffic is located and the first network address of the host to which the attack traffic flows to the controller, such as Figure 6 In a, the traffic link 2 between the communication service provider 2 and the border router is the first traffic link, and the first network address, that is, the network address of the user equipment, is 1.1.1.1;

[0130] Then, the mapping relationship between the traffic link and the physical address of the communication service provider is obtained, and based on the mapping relationship, the process of determining the first physical address corresponding to the first traffic link can be that the controller obtains the mapping relationship between the traffic link and the physical address of the established communication service provider, and based on the mapping relationship, queries the first physical address corresponding to the first traffic link; and then sends a blocking rule to the border router based on the first physical address and the first network address, and the rule content is: the physical address is the first physical address, that is, MAC2, the network address of the attacked host is the first network address such as 1.1.1.1, and the action is filtering such as rejection, such as Figure 6 MAC2+1.1.1.1 in b is rejected; then, after receiving the blocking rule, the border router generates a traffic filtering policy that can be executed locally based on the blocking rule, the content of which is that the matched physical address is the first physical address, the matched network address is the first network address, and the action is to discard the traffic;

[0131] Next, the process of obtaining the second network address of the host to which the traffic flows and the second physical address corresponding to the traffic may be that the border router receives the traffic from other devices forwarded by the communication service provider, and parses the traffic to obtain the second network address of the host to which the traffic flows and the second physical address corresponding to the traffic; wherein, the process of parsing the traffic to obtain the second network address of the host to which the traffic flows and the second physical address corresponding to the traffic is as described above, and the embodiments of the present application will not be repeated here.

[0132] Then, the process of matching the second network address with the first network address to obtain a first matching result, and matching the second physical address with the first physical address to obtain a second matching result may be that the border router filters the traffic based on the generated traffic filtering policy, that is, matching the second network address with the first network address in the traffic filtering policy to obtain a first matching result, and matching the second physical address with the first physical address in the traffic filtering policy to obtain a second matching result. As mentioned above, the traffic filtering policy may be an access control list (ACL), which is a series of defined instructions for controlling traffic and access rights in the network; these instructions specify users or system processes that are authorized to access or execute specific file systems, directories, or network services, as well as operations that are allowed or denied.

[0133] Finally, based on the first matching result and the second matching result, the process of filtering out the attack traffic from the traffic may be, when the first matching result indicates that the second network address matches the first network address, and the second matching result indicates that the second physical address matches the first physical address, the corresponding traffic is treated as attack traffic and filtered out from the traffic; and the process of filtering the attack traffic is as described above, and the embodiments of the present application are not repeated here; at the same time, when at least one of the first matching result and the second matching result in the matching result combination fails to match, the corresponding traffic is sent to the host indicated by the second network address.

[0134] Continuing with the above example, the first network address is 1.1.1.1, the first physical address is MAC2, and the second network address of the traffic sent from communication service provider 1 is 1.1.1.1, and the second physical address corresponding to the traffic is MAC1, the second network address of the host to which the traffic sent from communication service provider 2 flows is 1.1.1.1, and the second physical address corresponding to the traffic is MAC2. Therefore, based on the first matching result and the second matching result, it can be determined that the traffic sent from communication service provider 2 is attack traffic, so the attack traffic needs to be filtered out from the traffic, such as Figure 6 As shown in b in Figure 1, the dotted line is used to indicate that the corresponding attack traffic has been filtered and cannot flow to host 1.1.1.1.

[0135] By applying the above-mentioned embodiments of the present application, when there is attack traffic in the mirror traffic of the communication service party, the actual traffic can be matched in combination with the first network address of the host to which the attack traffic flows and the first physical address corresponding to the attack traffic, thereby filtering out the attack traffic from the traffic based on the matching result. In this way, by analyzing the mirror traffic, when there is attack traffic in the mirror traffic, the attack traffic in the actual traffic is matched based on the first network address and the first physical address corresponding to the attack traffic, and the matched attack traffic is filtered out from the actual traffic; in this way, the attack traffic for a specific host can be accurately filtered, while the traffic flowing to other hosts and the traffic of other traffic links are not affected, which not only improves the accuracy of traffic filtering, but also ensures the normal operation of the business while protecting network security, thereby improving the stability and reliability of the network.

[0136] The following is an explanation of an exemplary application of the embodiments of the present application in a practical application scenario.

[0137] In related technologies, such as Figure 7 As shown, Figure 7 This is an architecture diagram of a flow filtering system in the related technology provided by the embodiment of the present application, based on Figure 7When a cloud service provider responds to an attack from the operator side, the border router in the access point will establish an interconnection link (traffic link) with each connected operator (communication service provider), and split the light on the link, mirroring the traffic (first mirror traffic) to the analysis and detection device (attack protection module) in the distributed denial of service system. When the analysis and detection device detects an application layer attack or a small traffic attack, the distributed denial of service system will directly send the host route to the border router to clean (filter) and inject the traffic after the traffic enters the distributed denial of service system, so as to ensure the normal access of the service to the greatest extent. However, when the attack traffic exceeds a certain threshold, the address of the attacked host will be reported to the controller, and the black hole route will be sent to the border router through the controller, so that the traffic will be discarded on the border router, protecting the internal network from the impact of large traffic attacks.

[0138] However, the cloud service provider's access point may be connected to multiple operators (up to dozens), but the attack traffic may only come from one or a few of them (some distributed denial of service attacks have regional characteristics and only attack from a certain area). Figure 7 As shown in the figure, when the address of the attacked host (the first network address) is 1.1.1.1, the traffic only enters from operator 2. At this time, the distributed denial of service system detects the existence of a distributed denial of service attack. In order to protect the internal network, the routing strategy of the traffic of the host with the traffic address of 1.1.1.1 is sent to the border router through the controller as black hole routing. Although this can ensure that the attack traffic of operator 2 is blocked, the normal access service traffic from operator 1 will also be blocked, resulting in the inability of operators to access the host of 1.1.1.1, causing service interruption. In other words, if there is a large traffic attack, in order to protect the internal network from the attack traffic, the attack traffic will be discarded at the entrance edge, but because the relevant equipment at the entrance edge will be connected to several or even dozens of operators at the same time, directly discarding all the traffic flowing to the attacked host on the relevant equipment will affect the traffic on all traffic links, resulting in the inability of the business to operate normally.

[0139] Based on this, an embodiment of the present application provides a method for processing traffic, by discarding the traffic entering a specific ingress link according to a specific host route, while other traffic is not affected. In this way, the traffic can be filtered accurately, and the access of other operators without attack traffic remains unaffected. While protecting the intranet, normal access to the business is guaranteed to the greatest extent, thereby improving network stability.

[0140] Next, the technical solution of this application is explained from the product side.

[0141] This application is mainly used on the operator entrance side of the access point. The operator's inbound traffic is detected through a splitter. When attack traffic is detected, the link information of the inbound operator of the attack source and the attacked host address are reported to the internal security controller. The controller queries the MAC address (first physical address) of the opposite device according to the inbound link (first traffic link), and performs black hole processing on the traffic according to the MAC address (first physical address) of the opposite device and the IP address (first network address) of the attacked host, thereby achieving more refined traffic discarding capabilities, solving the problem of all machine traffic being discarded when traffic is discarded through routing, and improving the availability of network services.

[0142] Next, the technical solution of the present application is explained from a technical perspective.

[0143] like Figure 6 As shown in a, the network of this system is composed of ER equipment (i.e., border router), DDOS system (i.e., attack protection module), splitter and controller. In the initial stage, the controller first enters the traffic link and IP address information (first mapping relationship) of the ISP (i.e., communication service provider). Then, after the traffic link is interconnected normally, the ER device can obtain the IP and MAC address mapping information of the link peer devices of ISP1 and ISP2 through ARP (second mapping relationship), and report the obtained IP and MAC address mapping information to the controller through the interface, so that the controller can form a one-to-one mapping relationship (mapping relationship) between ISP-traffic link-IP address-MAC address. Here, it is assumed that ISP1 corresponds to traffic link 1, IP1 and MAC1, and ISP2 corresponds to traffic link 2, IP2 and MAC2.

[0144] like Figure 6 As shown in Figure b, when the attack traffic enters the internal network from ISP2, the optical splitter mirrors the traffic on traffic link 2 to the DDOS system for analysis and detection, and finds that the traffic on the host traffic link contains attack traffic to host 1.1.1.1. The DDOS system reports the attack information, including the link information of traffic link 2 and the host address of 1.1.1.1. The controller queries the information of traffic link 2 and finds that it is ISP2 and the MAC address information is MAC2. Based on this information, the traffic filtering rule is constructed, the MAC is MAC2, the destination host address to be accessed is 1.1.1.1, the action is to reject, and it is sent to the ER device.

[0145] Then, the ER device receives the traffic filtering rule information and performs traffic filtering locally. For traffic entering from ISP2, if the destination host to be accessed is 1.1.1.1, the corresponding traffic will be discarded. When entering the ER device from ISP1, because the MAC address of its traffic packet is MAC1, it does not match the traffic filtering rule, so it can access host 1.1.1.1 normally. In this way, while filtering out the attack traffic, it also ensures that the access traffic of the operator entrance where the attack source is not located is normal, thus ensuring the normal access of the service to the greatest extent. When the attack traffic is detected and revoked, the DDOS system still notifies the controller to revoke the traffic blocking rule, realizing the dynamic blocking capability on demand.

[0146] In this way, through this application, the traffic of specific attack hosts can be discarded in a more refined manner based on the ingress link level, thereby achieving the technical effect of protecting the internal network from congestion caused by large-volume attacks and ensuring that normal traffic from other ingresses can be forwarded; and dynamic and refined control is performed based on real-time spectroscopic detection to ensure the maximum reliability of network services.

[0147] By applying the above-mentioned embodiments of the present application, when there is attack traffic in the mirror traffic of the communication service party, the actual traffic can be matched in combination with the first network address of the host to which the attack traffic flows and the first physical address corresponding to the attack traffic, thereby filtering out the attack traffic from the traffic based on the matching result. In this way, by analyzing the mirror traffic, when there is attack traffic in the mirror traffic, the attack traffic in the actual traffic is matched based on the first network address and the first physical address corresponding to the attack traffic, and the matched attack traffic is filtered out from the actual traffic; in this way, the attack traffic for a specific host can be accurately filtered, while the traffic flowing to other hosts and the traffic of other traffic links are not affected, which not only improves the accuracy of traffic filtering, but also ensures the normal operation of the business while protecting network security, thereby improving the stability and reliability of the network.

[0148] The following is a description of an exemplary structure of the flow processing device 455 provided in the embodiment of the present application implemented as a software module. In some embodiments, Figure 2 As shown, the software modules stored in the traffic processing device 455 of the memory 450 may include:

[0149] A first acquisition module 4551 is used to acquire, when attack traffic exists in the mirror traffic of the traffic of the communication service party, a first traffic link where the attack traffic is located and a first network address of a host to which the attack traffic flows, wherein the first traffic link and the first network address are determined based on the mirror traffic;

[0150] The determination module 4552 is used to obtain a mapping relationship between a traffic link and a physical address of the communication service provider, and determine a first physical address corresponding to the first traffic link based on the mapping relationship;

[0151] A second acquisition module 4553 is used to acquire a second network address of a host to which the traffic flows, and a second physical address corresponding to the traffic;

[0152] A matching module 4554, configured to match the second network address with the first network address to obtain a first matching result, and to match the second physical address with the first physical address to obtain a second matching result;

[0153] The filtering module 4555 is used to filter out the attack traffic from the traffic based on the first matching result and the second matching result.

[0154] In some embodiments, the number of traffic links corresponding to the communication service provider is at least one. Before obtaining the first traffic link where the attack traffic is located, the device also includes a detection module, and the detection module is used to mirror the traffic on each of the traffic links to obtain the first mirror traffic of each of the traffic links; detect each of the first mirror traffic respectively to obtain a detection result, and the detection result is used to indicate whether there is attack traffic in the corresponding first mirror traffic; when there is a detection result indicating that there is attack traffic in the first mirror traffic, it is determined that there is attack traffic in the traffic of the communication service provider.

[0155] In some embodiments, the detection module is further used to perform the following processing for each first mirrored traffic: obtaining the flow size of the first mirrored traffic within a target time period; when the flow size of the first mirrored traffic within the target time period is greater than a flow size threshold, determining that the detection result for the first mirrored traffic is a first detection result, and the first detection result is used to indicate that there is attack traffic in the first mirrored traffic; when the flow size of the first mirrored traffic within the target time period is less than or equal to the flow size threshold, determining that the detection result for the first mirrored traffic is a second detection result, and the second detection result is used to indicate that there is no attack traffic in the first mirrored traffic.

[0156] In some embodiments, the determination module 4552 is also used to obtain the network address of the communication service provider and the traffic link of the communication service provider, and construct a first mapping relationship between the network address and the traffic link; when the traffic link is in a communicative state, obtain the physical address of the communication service provider, and construct a second mapping relationship between the network address and the physical address; based on the first mapping relationship and the second mapping relationship, construct a mapping relationship between the traffic link of the communication service provider and the physical address.

[0157] In some embodiments, the number of the first matching results and the number of the second matching results are both multiple, the traffic includes multiple traffic packets, the first matching results and the traffic packets have a one-to-one correspondence, and the second matching results and the traffic packets have a one-to-one correspondence; the filtering module 4555 is also used to combine each of the first matching results with the corresponding second matching results to obtain multiple matching result combinations; for each matching result combination, when the first matching result in the matching result combination represents that the second network address matches the first network address, and the second matching result represents that the second physical address matches the first physical address, the traffic packet corresponding to the matching result combination is filtered out from the traffic.

[0158] In some embodiments, the filtering module 4555 is also used to perform one of the following operations for the traffic packet: discarding the traffic packet through a border router; limiting the speed of the traffic packet so that the traffic size transmitted by the traffic packet within the target time period is less than or equal to the traffic size threshold; sending the traffic packet to a backup host.

[0159] In some embodiments, the device also includes a sending module, which is used to send the traffic packet corresponding to the matching result combination to the host indicated by the second network address when at least one of the first matching result and the second matching result in the matching result combination fails to match.

[0160] In some embodiments, the device also includes a first information generation module, which is used to generate first risk warning information and send the first risk warning information to the target host when the first matching result in the matching result combination indicates that the second network address matches the first network address, and the second matching result indicates that the second physical address does not match the first physical address; or, when the first matching result indicates that the second network address does not match the first network address, and the second matching result indicates that the second physical address matches the first physical address, generate the first risk warning information and send the first risk warning information to the target host; wherein the first risk warning information is used to prompt the target host that there is a risk of being attacked by the attack traffic, and the target host is the host indicated by the second network address corresponding to the first matching result in the corresponding matching result combination.

[0161] In some embodiments, the device further includes a mirroring module, the mirroring module being used to, when the first matching result in the matching result combination indicates that the second network address matches the first network address, and the second matching result indicates that the second physical address does not match the first physical address, mirror the traffic in the traffic packet corresponding to the matching result combination to obtain second mirrored traffic, and send the second mirrored traffic to the isolated host; or, when the first matching result indicates that the second network address does not match the first network address, and the second matching result indicates that the second physical address matches the first physical address, mirror the traffic in the traffic packet corresponding to the matching result combination to obtain second mirrored traffic, and send the second mirrored traffic to the isolated host; wherein the isolated host detects the second mirrored traffic to obtain a detection result indicating whether the second mirrored traffic is attack traffic; receives the detection result sent by the isolated host; when the detection result indicates that the second mirrored traffic is attack traffic, filters out the traffic packet corresponding to the matching result combination from the traffic; when the detection result indicates that the second mirrored traffic is not attack traffic, sends the traffic packet corresponding to the matching result combination to the host indicated by the corresponding second network address.

[0162] In some embodiments, the device also includes a second information generation module, which is used to generate second risk warning information and send the second risk warning information to the communication service provider corresponding to the first traffic link; wherein the second risk warning information is used to prompt that there is attack traffic in the traffic sent by the corresponding communication service provider, so that the communication service provider can control the communication status of the device corresponding to the attack traffic.

[0163] In some embodiments, the device also includes a message receiving module, which is used to receive a traffic notification message, and the traffic notification message is used to indicate that the attack traffic does not exist in the current traffic of the communication service provider; based on the traffic notification message, the current traffic of the communication service provider is sent to the corresponding host.

[0164] The embodiment of the present application provides a computer program product, which includes computer executable instructions or computer programs, and the computer executable instructions or computer programs are stored in a computer-readable storage medium. The processor of the electronic device reads the computer executable instructions or computer programs from the computer-readable storage medium, and the processor executes the computer executable instructions or computer programs, so that the electronic device performs the above-mentioned traffic processing method of the embodiment of the present application.

[0165] The embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions or computer programs. When the computer-executable instructions or computer programs are executed by a processor, the processor will execute the traffic processing method provided by the embodiment of the present application, for example, Figure 3 The traffic processing method shown.

[0166] In some embodiments, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory, a magnetic surface memory, an optical disk, or a CD-ROM; or it may be various devices including one or any combination of the above memories.

[0167] In some embodiments, computer executable instructions may be in the form of a program, software, software module, script or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a stand-alone program or as a module, component, subroutine or other unit suitable for use in a computing environment.

[0168] As an example, computer-executable instructions may, but need not, correspond to a file in a file system, may be stored as part of a file storing other programs or data, such as in one or more scripts in a HyperText Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files storing one or more modules, subroutines, or code portions).

[0169] As an example, computer executable instructions may be deployed to be executed on one electronic device, or on multiple electronic devices located at one site, or on multiple electronic devices distributed at multiple sites and interconnected by a communication network.

[0170] In summary, the embodiments of the present application have the following beneficial effects:

[0171] (1) By analyzing the mirrored traffic, when there is attack traffic in the mirrored traffic, the attack traffic in the actual traffic is matched based on the first network address and the first physical address corresponding to the attack traffic, and the matched attack traffic is filtered out from the actual traffic; in this way, the attack traffic targeting a specific host can be accurately filtered, while the traffic flowing to other hosts and the traffic of other traffic links are not affected, which not only improves the accuracy of traffic filtering, but also ensures the normal operation of the business while protecting network security, thereby improving the stability and reliability of the network.

[0172] (2) By testing the mirrored traffic obtained by mirroring the traffic, the detection process is prevented from affecting the traffic transmission process, thereby improving the stability of the traffic transmission process, that is, improving the stability of the network.

[0173] (3) Compare the mirrored traffic with the pre-set traffic size threshold. This can accurately detect whether there is attack traffic in the mirrored traffic, thereby improving the accuracy of traffic filtering in the subsequent process, which not only ensures network security, but also improves network stability and reliability.

[0174] (4) If the first matching result matches one of the second matching results, the traffic packet corresponding to the corresponding matching result combination is regarded as risk traffic, thereby generating first risk warning information for prompting the target host that there is a risk of being attacked by the attack traffic, and sending the first risk warning information to the target host; in this way, the target host can take protective measures in advance, thereby enhancing the security of the network.

[0175] (5) After filtering the attack traffic, the traffic filtering operation can be revoked based on the traffic notification information, thereby achieving dynamic traffic filtering on demand and improving the flexibility of the traffic filtering process.

[0176] (6) Through this application, the traffic of a specific attacking host can be discarded in a more refined manner based on the ingress link level, thereby achieving the technical effect of protecting the internal network from congestion caused by large-volume attacks and ensuring that normal traffic from other ingresses can be forwarded; and dynamic and refined control can be performed based on real-time spectral detection to ensure the maximum reliability of network services.

[0177] (7) Through the second risk warning information, the communication service provider can sanction the device corresponding to the attack traffic. Compared with the local solution of filtering traffic, it can fundamentally solve the problem of being attacked by traffic, thereby reducing the possibility of being attacked by traffic from the same device again in the subsequent process.

[0178] (8) When the traffic may be attack traffic, that is, when there is a risk of traffic, the traffic will be directed to an isolated host to observe the traffic and detect potential attack traffic. This reduces the risk of missing potential attack traffic during traffic filtering, which not only improves the security of traffic transmission, but also improves the stability and reliability of the network.

[0179] It should be noted that in the embodiments of the present application, it involves obtaining data related to network addresses, physical addresses, and traffic links. When the embodiments of the present application are applied to specific products or technologies, user permission or consent is required, and the collection, use, and processing of relevant data must comply with relevant laws, regulations, and standards of relevant countries and regions.

[0180] The above is only an embodiment of the present application and is not intended to limit the protection scope of the present application. Any modifications, equivalent substitutions and improvements made within the spirit and scope of the present application are included in the protection scope of the present application.

Claims

1. A traffic processing method, characterized in that: The method comprises: Determine at least one traffic link corresponding to the communication service provider; For each of the traffic links, based on an optical splitter on the traffic link, mirroring the traffic on the traffic link to obtain first mirrored traffic of the traffic link; Detecting each of the first mirrored flows respectively to obtain a detection result, where the detection result is used to indicate whether there is attack traffic in the corresponding first mirrored flow; When the detection result indicates that there is attack traffic in the first mirrored traffic, obtaining a first traffic link where the attack traffic is located, and analyzing the attack traffic to obtain a first network address of a host to which the attack traffic flows; Obtaining a mapping relationship between a traffic link corresponding to the communication service provider and a physical address of the communication service provider, and determining a first physical address corresponding to the first traffic link based on the mapping relationship; Obtaining a second network address of a host to which the traffic flows, and a second physical address corresponding to the traffic; Matching the second network address with the first network address to obtain a first matching result, and matching the second physical address with the first physical address to obtain a second matching result; Based on the first matching result and the second matching result, the attack traffic is filtered out from the traffic of the communication service party.

2. The method according to claim 1, characterized in that The detecting each of the first mirrored flows respectively to obtain the detection result includes: The following processing is performed on each of the first mirrored flows: Obtaining the flow size of the first mirrored flow within a target time period; When the flow size of the first mirrored traffic in the target time period is greater than the flow size threshold, determining the detection result for the first mirrored traffic as a first detection result, where the first detection result is used to indicate that attack traffic exists in the first mirrored traffic; When the flow size of the first mirrored traffic in the target time period is less than or equal to the flow size threshold, determining that the detection result for the first mirrored traffic is a second detection result, where the second detection result is used to indicate that there is no attack traffic in the first mirrored traffic.

3. The method according to claim 1, characterized in that The obtaining of a mapping relationship between a traffic link corresponding to the communication service provider and a physical address of the communication service provider includes: Acquire the network address of the communication service provider and the traffic link of the communication service provider, and construct a first mapping relationship between the network address and the traffic link; When the traffic link is in a communicable state, obtaining the physical address of the communication service provider, and constructing a second mapping relationship between the network address and the physical address; Based on the first mapping relationship and the second mapping relationship, a mapping relationship between the traffic link of the communication service provider and the physical address is constructed.

4. The method according to claim 1, characterized in that The number of the first matching results and the number of the second matching results are both multiple, the traffic includes multiple traffic packets, there is a one-to-one correspondence between the first matching results and the traffic packets, and there is a one-to-one correspondence between the second matching results and the traffic packets; The filtering out the attack traffic from the traffic of the communication service party based on the first matching result and the second matching result includes: Combining each of the first matching results with the corresponding second matching result to obtain a plurality of matching result combinations; For each matching result combination, when the first matching result in the matching result combination indicates that the second network address matches the first network address, and the second matching result indicates that the second physical address matches the first physical address, the traffic packet corresponding to the matching result combination is filtered out from the traffic.

5. The method according to claim 4, characterized in that The filtering out the traffic packets corresponding to the matching result combination from the traffic includes: For the traffic package, perform one of the following operations: discarding the traffic packet through a border router; Limiting the speed of the traffic packet so that the traffic volume transmitted by the traffic packet within the target time period is less than or equal to the traffic volume threshold; The traffic packet is sent to the backup host.

6. The method according to claim 4, characterized in that The method further comprises: When at least one of the first matching result and the second matching result in the matching result combination fails to match, the traffic packet corresponding to the matching result combination is sent to the host indicated by the second network address.

7. The method according to claim 4, characterized in that The method further comprises: When the first matching result in the matching result combination indicates that the second network address matches the first network address, and the second matching result indicates that the second physical address does not match the first physical address, generating first risk warning information, and sending the first risk warning information to the target host; or, When the first matching result indicates that the second network address does not match the first network address, and the second matching result indicates that the second physical address matches the first physical address, generating the first risk warning information, and sending the first risk warning information to the target host; The first risk warning information is used to prompt the target host that there is a risk of being attacked by the attack traffic, and the target host is the host indicated by the second network address corresponding to the first matching result in the corresponding matching result combination.

8. The method according to claim 4, characterized in that The method further comprises: When the first matching result in the matching result combination indicates that the second network address matches the first network address, and the second matching result indicates that the second physical address does not match the first physical address, mirroring the traffic in the traffic packet corresponding to the matching result combination to obtain second mirrored traffic, and sending the second mirrored traffic to the isolated host; or When the first matching result indicates that the second network address does not match the first network address, and the second matching result indicates that the second physical address matches the first physical address, mirroring the traffic in the traffic packet corresponding to the matching result combination to obtain second mirrored traffic, and sending the second mirrored traffic to the isolated host; The isolated host is used to detect the second mirrored traffic and obtain a detection result indicating whether the second mirrored traffic is attack traffic; Receiving the detection result sent by the isolated host; When the detection result indicates that the second mirrored traffic is attack traffic, filtering out traffic packets corresponding to the matching result combination from the traffic; When the detection result indicates that the second mirrored traffic is not attack traffic, the traffic packet corresponding to the matching result combination is sent to a host indicated by the corresponding second network address.

9. The method according to claim 1, characterized in that When the detection result indicates that the first mirrored traffic contains attack traffic, after obtaining the first traffic link where the attack traffic is located, the method further includes: Generate second risk warning information, and send the second risk warning information to the communication service provider corresponding to the first traffic link; The second risk warning information is used to prompt that attack traffic exists in the traffic sent by the corresponding communication service provider, so that the communication service provider can control the communication status of the device corresponding to the attack traffic.

10. The method according to claim 1, characterized in that After filtering out the attack traffic from the traffic of the communication service party based on the first matching result and the second matching result, the method further includes: receiving a traffic notification message, wherein the traffic notification message is used to indicate that the attack traffic does not exist in the current traffic of the communication service provider; Based on the traffic notification message, the current traffic of the communication service provider is sent to the corresponding host.

11. A flow processing device, characterized in that: The device comprises: A detection module is used to determine at least one traffic link corresponding to a communication service provider; for each of the traffic links, based on the optical splitter on the traffic link, the traffic on the traffic link is mirrored to obtain a first mirrored traffic of the traffic link; each of the first mirrored traffic is detected respectively to obtain a detection result, wherein the detection result is used to indicate whether there is attack traffic in the corresponding first mirrored traffic A first acquisition module is used to, when the detection result indicates that there is attack traffic in the first mirrored traffic, acquire a first traffic link where the attack traffic is located, and analyze the attack traffic to obtain a first network address of a host to which the attack traffic flows; A determination module, configured to obtain a mapping relationship between a traffic link corresponding to the communication service provider and a physical address of the communication service provider, and determine a first physical address corresponding to the first traffic link based on the mapping relationship; A second acquisition module, used to acquire a second network address of a host to which the traffic flows, and a second physical address corresponding to the traffic; a matching module, configured to match the second network address with the first network address to obtain a first matching result, and to match the second physical address with the first physical address to obtain a second matching result; A filtering module is used to filter out the attack traffic from the traffic of the communication service party based on the first matching result and the second matching result.

12. An electronic device, characterized in that: include: Memory for storing computer executable instructions or computer programs; The processor is used to implement the traffic processing method described in any one of claims 1 to 10 when executing the computer executable instructions or computer programs stored in the memory.

13. A computer-readable storage medium, characterized in that: Computer executable instructions or computer programs are stored, which are used to cause a processor to execute and implement the traffic processing method described in any one of claims 1 to 10.

14. A computer program product comprising computer executable instructions or a computer program, characterized in that When the computer executable instructions or computer program are executed by a processor, the traffic processing method according to any one of claims 1 to 10 is implemented.

Images