Abnormal traffic end-to-end path reconstruction method, system and device and storage medium

Abstract

The invention discloses an abnormal traffic end-to-end path reconstruction method, system and device and a storage medium, and the method comprises the steps: obtaining source IP addresses of a plurality of target data messages, and judging whether the source IP addresses belong to an abnormal traffic range or not; when the source IP address belongs to the abnormal traffic range, reading the routing device ID from the target data message, and recording the occurrence frequency of each routing device ID in all the target data messages; sorting the routing device IDs according to the occurrence times from small to large to obtain a routing device ID sequence, and further determining an end-to-end path of the abnormal traffic according to the routing device ID sequence; wherein when the target data message is forwarded by the routing equipment, the corresponding routing equipment ID is marked to the target data message through the routing equipment. The abnormal traffic end-to-end path reconstruction method improves the efficiency and accuracy of abnormal traffic end-to-end path reconstruction, and can be applied to the technical field of network security.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, system, device and storage medium for end-to-end path reconstruction of abnormal traffic. Background Art

[0002] In large enterprises, it is a rigid requirement for branches to be networked through a wide area network. Large enterprises usually have branches all over the country, which may include dozens or even thousands of offices, factories, warehouses or retail outlets in different locations. These branches need to maintain efficient and secure communication with the headquarters and other branches. Many internal systems of enterprises are only allowed to access each other through the intranet environment and cannot be accessed through the Internet. Large-scale distributed networks increase potential security vulnerabilities and attack surfaces, and it is often necessary to locate the source of abnormal traffic in the network and rebuild the end-to-end path.

[0003] Usually, enterprises will deploy network security equipment (such as network firewalls, Internet behavior management equipment, etc.) at the network edge of core sites. However, due to the consideration of operation and maintenance costs and equipment procurement costs, some small organizations usually do not deploy high-end network security equipment. Therefore, when the core node detects abnormal traffic, it is necessary to trace the source of the traffic and the end-to-end path. However, in a complex WAN environment, troubleshooting the source of traffic is a complicated task. Considering that abnormal traffic itself changes dynamically, it is not continuous, and there may not be obvious patterns to follow, which further increases the difficulty of manually finding the source of abnormal traffic.

[0004] Traditional router devices usually only provide limited tools for troubleshooting, such as packet capture, ping, traceroute, etc. At the same time, traditional router equipment vendors have slow product iterations, each device runs independently, and lacks a global view. When a fault occurs, manual remote login to local network devices is required to manually collect information, which affects the efficiency and accuracy of end-to-end path reconstruction of abnormal traffic. Summary of the invention

[0005] The purpose of the present invention is to solve one of the technical problems existing in the prior art to at least a certain extent.

[0006] To this end, an object of an embodiment of the present invention is to provide a method for end-to-end path reconstruction of abnormal traffic, which improves the efficiency and accuracy of end-to-end path reconstruction of abnormal traffic.

[0007] Another object of an embodiment of the present invention is to provide an abnormal traffic end-to-end path reconstruction system.

[0008] In order to achieve the above technical objectives, the technical solutions adopted by the embodiments of the present invention include:

[0009] In a first aspect, an embodiment of the present invention provides a method for reconstructing an abnormal traffic end-to-end path, comprising the following steps:

[0010] Obtain source IP addresses of multiple target data packets, and determine whether the source IP addresses belong to the abnormal traffic range;

[0011] When the source IP address belongs to the abnormal traffic range, reading the routing device ID from the target data message, and recording the number of occurrences of each routing device ID in all the target data messages;

[0012] The routing device IDs are sorted from small to large according to the number of occurrences to obtain a routing device ID sequence, and then an end-to-end path of the abnormal traffic is determined according to the routing device ID sequence;

[0013] When the target data message is forwarded by a routing device, the routing device marks the corresponding routing device ID to the target data message.

[0014] Further, in an embodiment of the present invention, the step of marking the corresponding routing device ID to the target data message by the routing device specifically includes:

[0015] Acquire the target data message to be forwarded through the routing device, and determine whether the target data message is a fragment message;

[0016] When the target data message is not a fragment message, obtaining a random number within a preset range, and determining whether the random number is less than a preset value within the preset range;

[0017] When the random number is less than the preset value, the routing device ID corresponding to the routing device is obtained, the Identification field of the target data message is re-encoded according to the routing device ID, and the target data message is forwarded to the next-hop routing device.

[0018] Further, in one embodiment of the present invention, the re-encoding the Identification field of the target data message according to the routing device ID specifically includes:

[0019] Determine an ID code value according to the routing device ID;

[0020] The upper 12 bits of the Identification field of the target data message are modified according to the ID coding value to obtain the re-encoded target data message.

[0021] Further, in an embodiment of the present invention, the step of marking the corresponding routing device ID to the target data message by the routing device further includes:

[0022] When the random number is greater than or equal to the preset value, determining whether the routing device is the first-hop routing device of the target data message;

[0023] When the routing device is the first-hop routing device of the target data message, obtain a preset coding value, re-encode the Identification field of the target data message according to the preset coding value, and forward the target data message to the next-hop routing device;

[0024] When the routing device is not the first-hop routing device of the target data message, the target data message is directly forwarded to the next-hop routing device.

[0025] Further, in one embodiment of the present invention, the step of reading the routing device ID from the target data message and recording the number of occurrences of each routing device ID in all the target data messages specifically includes:

[0026] Reading a target coding value from the Identification field of the target data message, and determining whether the target coding value is the preset coding value;

[0027] When the target code value is not the preset code value, determining the corresponding routing device ID according to the target code value, and judging whether the routing device ID exists in the preset routing device ID table;

[0028] If the routing device ID exists in the routing device ID table, the occurrence count identification value of the routing device ID is increased by 1; if the routing device ID does not exist in the routing device ID table, the routing device ID is added to the routing device ID table, and the occurrence count identification value of the routing device ID is set to 1;

[0029] The number of occurrences of each routing device ID in all the target data messages is determined according to the number of occurrence identification values ​​of each routing device ID in the routing device ID table.

[0030] Further, in one embodiment of the present invention, the determining the end-to-end path of the abnormal traffic according to the routing device ID sequence specifically includes:

[0031] Determine a plurality of abnormal traffic devices and a corresponding arrangement order according to the routing device ID sequence;

[0032] An end-to-end path of the abnormal traffic is determined according to the abnormal traffic device and the arrangement order.

[0033] Furthermore, in one embodiment of the present invention, the abnormal traffic end-to-end path reconstruction method further includes a step of dynamically adjusting the preset value, which is specifically:

[0034] Increasing the preset value within the preset range increases the probability of the target data message being marked, thereby increasing the sensitivity of end-to-end path reconstruction of abnormal traffic;

[0035] or,

[0036] By reducing the preset value within the preset range, the probability of the target data message being marked is reduced, thereby reducing the performance overhead of end-to-end path reconstruction of abnormal traffic.

[0037] In a second aspect, an embodiment of the present invention provides an abnormal traffic end-to-end path reconstruction system, including:

[0038] An IP address determination module is used to obtain source IP addresses of multiple target data packets and determine whether the source IP addresses belong to the abnormal traffic range;

[0039] A routing device ID reading module, used for reading a routing device ID from the target data message when the source IP address belongs to the abnormal traffic range, and recording the number of occurrences of each routing device ID in all the target data messages;

[0040] A traffic path reconstruction module, used to sort the routing device IDs from small to large according to the number of occurrences to obtain a routing device ID sequence, and then determine the end-to-end path of the abnormal traffic according to the routing device ID sequence;

[0041] When the target data message is forwarded by a routing device, the routing device marks the corresponding routing device ID to the target data message.

[0042] In a third aspect, an embodiment of the present invention provides an abnormal traffic end-to-end path reconstruction device, comprising:

[0043] at least one processor;

[0044] at least one memory for storing at least one program;

[0045] When the at least one program is executed by the at least one processor, the at least one processor implements the above-mentioned method for end-to-end path reconstruction of abnormal traffic.

[0046] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which stores a program executable by a processor, and the program executable by the processor is used to execute the above-mentioned method for end-to-end path reconstruction of abnormal traffic when executed by the processor.

[0047] The advantages and beneficial effects of the present invention will be partly given in the following description, partly become apparent from the following description, or be understood through the practice of the present invention:

[0048] The embodiment of the present invention obtains source IP addresses of multiple target data messages, and determines whether the source IP addresses belong to the abnormal traffic range. When the source IP address belongs to the abnormal traffic range, the routing device ID is read from the target data message, and the number of occurrences of each routing device ID in all target data messages is recorded. The routing device IDs are sorted from small to large according to the number of occurrences to obtain a routing device ID sequence, and then the end-to-end path of the abnormal traffic is determined according to the routing device ID sequence, wherein when the target data message is forwarded by the routing device, the corresponding routing device ID is marked on the target data message through the routing device. According to the embodiment of the present invention, when a data message is forwarded by a routing device, a corresponding routing device ID is marked on the data message. Thus, when a network security device detects abnormal traffic, the routing device through which the target data message passes can be determined according to the routing device ID in the corresponding target data message, thereby counting the number of times each routing device ID appears in the abnormal traffic data message within a period of time. The routing device ID of a routing device with a higher hop count from the network security device has a greater probability of being covered by the routing device IDs of other routing devices on the traffic path. Therefore, the routing device ID of a routing device with a higher hop count from the network security device has a fewer number of appearances in the abnormal traffic data message. By sorting the routing device IDs from small to large according to the number of appearances in the abnormal traffic data message, a routing device ID sequence of the routing devices through which the abnormal traffic flows can be obtained, thereby determining the end-to-end path of the abnormal traffic, without the need to collect troubleshooting information from other devices when abnormal traffic is discovered, and without the need for manual intervention in troubleshooting, thereby improving the efficiency and accuracy of end-to-end path reconstruction of the abnormal traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solution in the embodiments of the present invention, the following introduction is made to the drawings required for use in the embodiments of the present invention. It should be understood that the drawings introduced below are only for the convenience of clearly describing some embodiments of the technical solution of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0050] Figure 1 A flowchart of a method for reconstructing an end-to-end path for abnormal traffic provided by an embodiment of the present invention;

[0051] Figure 2 A schematic diagram of a process of marking a routing device ID to a data message provided by an embodiment of the present invention;

[0052] Figure 3 A schematic diagram of a process for reading a routing device ID from a data message and recording the number of occurrences provided by an embodiment of the present invention;

[0053] Figure 4 A structural block diagram of an abnormal traffic end-to-end path reconstruction system provided by an embodiment of the present invention;

[0054] Figure 5 A structural block diagram of an abnormal traffic end-to-end path reconstruction device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0055] The embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and are not to be construed as limitations of the present invention. For the step numbers in the following embodiments, they are only provided for the convenience of explanation, and the order between the steps is not limited in any way, and the execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0056] In the description of the present invention, the meaning of "a plurality" is two or more than two. If there is a description of "a first" or "a second", it is only used for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features. In addition, unless otherwise defined, all technical and scientific terms used in this document have the same meaning as those commonly understood by those skilled in the art.

[0057] In the prior art, when abnormal traffic is detected at a core node, the source of the traffic can be manually checked through common network tools. Usually, the source of the traffic is found hop by hop by comparing the routing table of the router based on the source IP address of the traffic. The reverse path can also be detected at the core node through tools such as Tracert. This method has the following problems:

[0058] 1) In complex WANs, the round-trip paths are often inconsistent. If you use tools to view the paths directly, you may get the reverse path instead of the original path.

[0059] 2) Abnormal traffic in the network. Sometimes the source IP address is not in the network segment range of the source site. The reason may be a configuration error or malicious disguised traffic. Therefore, you cannot use tools directly to view the path. You can only remotely log in to each branch site to check whether there is abnormal traffic at the site.

[0060] 3) Manual troubleshooting is inefficient.

[0061] Common SDWAN products or some network management platforms support sending data packet collection, ping, traceroute and other requests to CPE devices at each site through a centralized management console, and then each CPE device returns the collected troubleshooting information to the console. Users can easily view the collected information from the console, and then analyze the source and end-to-end path of abnormal traffic in combination with the network topology and business traffic model within their own enterprise.

[0062] The above method provides a more convenient means for collecting troubleshooting information on network devices distributed in various places, but the specific troubleshooting means are the same as those of traditional router devices, and also require a lot of manual intervention and analysis.

[0063] In addition, in the SDWAN environment, for small sites, there is often only one physical line (for example, only one Internet), which means that the control channel and the data forwarding channel are the same. When abnormal traffic occurs in the network, not only the business data forwarding channel is unstable, but the control channel is also affected. At this time, the affected CPE device may have difficulty receiving instructions for collecting information, or it may be difficult to report the collected information to the console.

[0064] According to the definition of RFC 791, IPv4 packets support a special options field: Record Route. Therefore, IPv4 packets allow routers to insert their own IP addresses into the Options field when forwarding packets. This method can effectively and conveniently identify the source and path of data packets, but it is difficult to implement in actual deployment for the following reasons:

[0065] 1) Each router needs to insert its own IP address into the IPv4 header of the data packet. This operation has a great impact on the router forwarding performance.

[0066] 2) It may cause additional datagram fragmentation. If a datagram is already large, inserting a new field into it may cause the datagram length to be larger than the link MTU, resulting in additional datagram fragmentation. Data packet fragmentation can cause a sharp drop in router forwarding performance, and some routers may even discard fragmented packets by default. It may also disrupt the Path MTU detection mechanism in the network.

[0067] 3) Record Route is not compatible with existing router devices that do not support this function. Most commercial router devices do not support the Record Route function. Most companies' wide area networks are already built, not built from scratch. This makes it difficult to implement even if the Record Route function is newly developed.

[0068] In addition, in large enterprises, branches are spread all over the country. Therefore, when carrying out WAN transformation, it is usually implemented in batches, site by site. This also requires that any deployment of new functions needs to support incremental deployment and cannot affect the normal operation of other old sites.

[0069] Based on this, the embodiment of the present invention needs to solve the problem of how to detect the end-to-end path of specified traffic in a complex networking topology, and needs to meet the following conditions:

[0070] 1) It is lightweight enough and has low overhead on device forwarding performance;

[0071] 2) Support incremental deployment. In a large-scale networking environment, it is impossible to upgrade the equipment of all sites at the same time. Therefore, when implementing the embodiments of the present invention, it cannot affect sites that do not yet support the path reconstruction function;

[0072] 3) Robustness, that is, the results can be returned quickly even in extreme environments (for example, some nodes on the path are almost disconnected due to abnormal traffic).

[0073] Reference Figure 1 The embodiment of the present invention provides a method for reconstructing an abnormal traffic end-to-end path, which specifically includes the following steps:

[0074] S101, obtaining source IP addresses of multiple target data packets, and determining whether the source IP addresses belong to an abnormal traffic range;

[0075] S102, when the source IP address belongs to the abnormal traffic range, read the routing device ID from the target data message, and record the number of occurrences of each routing device ID in all target data messages;

[0076] S103, sorting the routing device IDs from small to large according to the number of occurrences to obtain a routing device ID sequence, and then determining the end-to-end path of the abnormal traffic according to the routing device ID sequence;

[0077] When the target data message is forwarded by the routing device, the routing device marks the target data message with the corresponding routing device ID.

[0078] Specifically, when adding a routing device as a new site in the SD-WAN console, the system automatically assigns a unique routing device ID in the entire network to the routing device of this site, which can also be called site ID. In the embodiment of the present invention, the value range of the routing device ID is set to 0 to 4095. Before forwarding a data message, the CPE will leave a mark in the data message. Later, at the receiving end, the end-to-end path of the abnormal traffic can be reconstructed by reading the mark in the data message.

[0079] It can be recognized that in the embodiment of the present invention, when a data message is forwarded by a routing device, the corresponding routing device ID is marked on the data message. In this way, when the network security device detects abnormal traffic, the routing device through which the target data message passes can be determined according to the routing device ID in the corresponding target data message, thereby counting the number of times each routing device ID appears in the abnormal traffic data message within a period of time. The routing device ID of a routing device with a higher hop count from the network security device has a greater probability of being covered by the routing device ID of other routing devices on the traffic path. Therefore, the routing device ID of a routing device with a higher hop count from the network security device has a fewer number of appearances in the abnormal traffic data message. By sorting the routing device IDs from small to large according to the number of appearances in the abnormal traffic data message, the routing device ID sequence of the routing devices through which the abnormal traffic flows can be obtained, thereby determining the end-to-end path of the abnormal traffic, without the need to collect troubleshooting information from other devices when abnormal traffic is discovered, and without manual intervention in troubleshooting, thereby improving the efficiency and accuracy of end-to-end path reconstruction of abnormal traffic.

[0080] As an optional implementation, the corresponding routing device ID is marked to the target data message by the routing device, which specifically includes:

[0081] S201, obtaining a target data message to be forwarded through a routing device, and determining whether the target data message is a fragment message;

[0082] S202: when the target data message is not a fragment message, obtain a random number within a preset range, and determine whether the random number is less than a preset value within the preset range;

[0083] S203: When the random number is less than a preset value, obtain a routing device ID corresponding to the routing device, re-encode the Identification field of the target data message according to the routing device ID, and forward the target data message to the next-hop routing device.

[0084] Specifically, the embodiment of the present invention takes into account the performance overhead of the router forwarding the data message when marking the target data message. Generally speaking, if the length of the data packet is modified, such as inserting a new field or overlay encapsulation, the overhead will be relatively large. If only the existing field value is changed and the checksum is recalculated, the performance overhead is very small. The underlying reason is that when the router processes the message, it is necessary to change the TTL field and recalculate the checksum, so most commercial network card hardware or router devices will make special optimizations for the checksum calculation, so that the performance overhead caused by the recalculation of the checksum operation can be almost ignored.

[0085] In the embodiment of the present invention, no new fields are inserted into the data packet, but the Identification field of the IPv4 header is reused and re-encoded. In the IP protocol standard, the identification field is used to mark the uniqueness of the data packet when the data packet is fragmented and reassembled. In most common IP protocol implementations, identification is an increasing value. When re-encoding, the embodiment of the present invention retains the lower 4 bits of the identification unchanged, and to some extent partially retains the uniqueness mark of the data packet. At the same time, the embodiment of the present invention only performs marking operations on non-fragmented data packets and does not modify the fragmented data packets. Since the encapsulation structure of the data packet is not changed, in theory, the changes made to the data packet in the embodiment of the present invention can be forward compatible and will not affect the normal operation of existing SDWAN CPE devices or third-party routing devices.

[0086] like Figure 2 The figure shows a flow chart of marking a routing device ID to a data message provided by an embodiment of the present invention. When the routing device obtains a target data message to be forwarded, it first determines whether the data message is a fragmented message. If so, the data message is directly forwarded to the next-hop routing device. If not, a random number x within a preset range is obtained, and it is determined whether the random number x is less than a preset value. In the embodiment of the present invention, the preset range is [0, 1), and the preset value is a preset value p within [0, 1). When the random number x is less than the preset value p, the routing device ID corresponding to the routing device is obtained, the Identification field of the target data message is re-encoded according to the routing device ID, and then the message checksum is recalculated, and the data message is forwarded to the next-hop routing device.

[0087] In some optional embodiments, whether the target data message is a fragment message may be determined by checking the corresponding identification bit in the Flags field of the IPv4 header.

[0088] As an optional implementation, the Identification field of the target data message is re-encoded according to the routing device ID, which specifically includes:

[0089] S2031, determining an ID code value according to the routing device ID;

[0090] S2032. Modify the upper 12 bits of the Identification field of the target data message according to the ID code value to obtain a re-encoded target data message.

[0091] Specifically, in the embodiment of the present invention, the value range of the routing device ID is 0 to 4095, that is, the routing device ID can be encoded as a 12-bit binary ID code value, and the ID code value is used to replace the upper 12 bits of the Identification field of the target data message to complete the marking of the target data message.

[0092] It should be noted that, in the embodiment of the present invention, when the routing device forwards a data message, a random number will be generated and a determination will be made as to whether the random number is less than a preset value. If so, the data message will be marked again with the routing device ID of the current routing device, and the mark will overwrite the existing mark in the data message.

[0093] As an optional implementation, the corresponding routing device ID is marked on the target data message by the routing device, further comprising:

[0094] S204, when the random number is greater than or equal to a preset value, determining whether the routing device is the first hop routing device of the target data message;

[0095] S205, when the routing device is the first-hop routing device of the target data message, obtain a preset coding value, re-encode the Identification field of the target data message according to the preset coding value, and forward the target data message to the next-hop routing device;

[0096] S206: When the routing device is not the first-hop routing device of the target data message, the target data message is directly forwarded to the next-hop routing device.

[0097] Specifically, when the random number x is greater than or equal to the preset value p, it is necessary to determine whether the current routing device is the first-hop routing device. If so, the target data message has not been marked, and a preset coding value (such as 0xfff) is obtained. The Identification field of the target data message is re-encoded according to the preset coding value, and then the message checksum is recalculated, and the data message is forwarded to the next-hop routing device; if not, it means that the target data message has been marked in the previous routing device, whether it is marked by the routing device ID or the preset coding value, there is no need to mark it again in the current routing device, and it is directly forwarded to the next-hop routing device.

[0098] It can be understood that the setting of random numbers and preset values ​​in the embodiments of the present invention is actually to sample and mark the data packets forwarded by the routing device. Under the premise that the preset range and the preset value are fixed, the probability of each data packet being marked by the current routing device is consistent. However, as the number of hops increases, there is a certain probability that the mark of the previous routing device is covered by the subsequent routing device, and there is also a certain probability that it is completely transmitted to the security network device, which ultimately results in the probability that the mark of the first-hop routing device is transmitted to the security network device is the lowest, and as the number of hops increases, the probability that the mark of the subsequent routing device is transmitted to the security network device gradually increases. Therefore, the embodiments of the present invention count the number of times the routing device ID appears in the target data message, and reflect the distance between the routing device and the security network device by sorting the number of occurrences, so that the end-to-end path of the abnormal traffic can be reconstructed.

[0099] As an optional implementation, the routing device ID is read from the target data message, and the number of occurrences of each routing device ID in all target data messages is recorded, which specifically includes:

[0100] S1021, reading a target coding value from the Identification field of the target data message, and determining whether the target coding value is a preset coding value;

[0101] S1022, when the target code value is not a preset code value, determining a corresponding routing device ID according to the target code value, and determining whether the routing device ID exists in a preset routing device ID table;

[0102] S1023. If the routing device ID exists in the routing device ID table, the occurrence count value of the routing device ID is increased by 1; if the routing device ID does not exist in the routing device ID table, the routing device ID is added to the routing device ID table, and the occurrence count value of the routing device ID is set to 1;

[0103] S1024: Determine the number of times each routing device ID appears in all target data messages according to the number of times each routing device ID appears in the routing device ID table.

[0104] Specifically, if a security device at a site detects abnormal traffic, we can reconstruct the end-to-end path of the abnormal traffic by examining the Identification field in the corresponding data packet header. Figure 3 The figure shows a flow chart of reading a routing device ID from a data message and recording the number of occurrences provided by an embodiment of the present invention. The SDWAN CPE device of the embodiment of the present invention maintains a hash table, namely, a routing device ID table (Site Table), which is used to store the number of occurrences of each site id in the data message. For each data message entering the CPE device, first determine whether its source IP address is within the range of abnormal traffic. If not, forward the data message to the next hop. If so, read the target coding value from the Identification field in the header of the data message, and determine whether the target coding value is a preset coding value (i.e., whether it is less than 0xfff); if so (i.e., equal to 0xfff), forward the data message to the next hop. If not (i.e., less than 0xfff), the target coding value is the routing device ID (site id) to determine whether the routing device ID exists in the preset routing device ID table; if so, add 1 to the occurrence count identification value of the routing device ID; if the routing device ID does not exist in the routing device ID table, add the routing device ID to the routing device ID table, and set the occurrence count identification value of the routing device ID to 1; the occurrence count of each routing device ID in all target data messages can be read according to the occurrence count identification value of each routing device ID in the routing device ID table.

[0105] As an optional implementation, determining the end-to-end path of the abnormal traffic according to the routing device ID sequence specifically includes:

[0106] S1031, determining a plurality of abnormal traffic devices and a corresponding arrangement order according to a routing device ID sequence;

[0107] S1032: Determine the end-to-end path of the abnormal traffic according to the abnormal traffic devices and the arrangement order.

[0108] Specifically, the end-to-end path of the abnormal traffic is reconstructed according to the number of occurrences of each routing device ID in the collected routing device ID table. Taking the preset range as [0, 1) and the preset value as p as an example, it is assumed that in the abnormal traffic path, a certain site A is k hops away from the current site. According to the above steps, when the random number x is less than p, site A will use the network device ID to mark the data message, that is, the probability that the data message is marked by the network device ID at site A is p, then the probability that the next hop site B detects the network device ID of site A is also p. Similarly, the data message at the next hop site The probability that point B is marked by the network device ID is also p, and when site B marks the data message, it will cover the network device ID of site A. The network device ID of site A can be retained in the data message only when the data message is not marked by the network device ID at the next hop site B (with a probability of 1-p). Then the condition for the next hop site C to monitor the network device ID of site A is that the data message is marked at site A and not marked at site B, that is, the probability is p*(1-p). By analogy, the probability of monitoring the network device ID of site A at the current site is p*(1-p). k-1 .

[0109] Obviously, p*(1-p) k-1 The value of decreases as the number of hops k increases, so the network device IDs in the routing device ID table are sorted from small to large according to the number of occurrences identification value count to obtain the routing device ID sequence {ID_k, ID_k-1, ..., ID_1}, where ID_k is the first routing device that observes the abnormal traffic. The path is drawn according to the sorting order of each abnormal traffic device in the routing device ID sequence, thereby reconstructing the end-to-end path of the abnormal traffic.

[0110] As an optional implementation, the abnormal traffic end-to-end path reconstruction method further includes a step of dynamically adjusting a preset value, which is specifically:

[0111] S301, increasing a preset value within a preset range, so that the probability of the target data message being marked increases, thereby increasing the sensitivity of end-to-end path reconstruction of abnormal traffic;

[0112] or,

[0113] S302: Reduce the preset value within a preset range, so that the probability of the target data message being marked is reduced, thereby reducing the performance overhead of end-to-end path reconstruction of abnormal traffic.

[0114] Specifically, when the preset range is [0, 1), the preset value p is equivalent to the probability that the data packet is marked by the network device ID of the current network device, that is, the data packet sampling frequency. When the p value is larger, the security network device can analyze the traffic source and path more sensitively and quickly, but the performance overhead will also be greater; when the p value is smaller, although the security network device needs a large number of data packets to analyze the traffic source and path, it reduces the performance overhead when forwarding data packets.

[0115] In an embodiment of the present invention, the preset value can be dynamically adjusted according to the number of data packets. If the number of data packets is small, the preset value needs to be increased to increase the sensitivity of end-to-end path reconstruction for abnormal traffic. If the number of data packets is large, the preset value needs to be reduced to reduce the performance overhead of end-to-end path reconstruction for abnormal traffic.

[0116] The above is a description of the method steps of the embodiment of the present invention. It can be recognized that when the data message is forwarded by the routing device, the embodiment of the present invention marks the corresponding routing device ID to the data message, so that when the network security device detects abnormal traffic, the routing device through which the target data message passes can be determined according to the routing device ID in the corresponding target data message, thereby counting the number of times each routing device ID appears in the abnormal traffic data message over a period of time, and the routing device ID of the routing device with a higher number of hops from the network security device is covered by the routing device ID of other routing devices on the traffic path. Therefore, the routing device ID of the routing device with a higher number of hops from the network security device has fewer appearances in the abnormal traffic data message. By sorting the routing device IDs from small to large according to the number of appearances in the abnormal traffic data message, the routing device ID sequence of the routing devices through which the abnormal traffic flows can be obtained, so that the end-to-end path of the abnormal traffic can be determined, and there is no need to collect troubleshooting information from other devices when abnormal traffic is found, and there is no need for manual intervention and troubleshooting, which improves the efficiency and accuracy of end-to-end path reconstruction of abnormal traffic.

[0117] Compared with the prior art, the embodiments of the present invention also have the following advantages:

[0118] 1) The performance overhead is small. The embodiment of the present invention does not add fields or overlay encapsulation to the data message, and the impact on the forwarding performance is almost negligible.

[0119] 2) Good forward compatibility. The embodiment of the present invention does not change the encapsulation format of the data packet, is compatible with third-party devices or old devices, and can achieve seamless upgrade and incremental deployment with services.

[0120] 3) Obtain results reliably and quickly. When an abnormality occurs, only the current site equipment is relied upon to rebuild the end-to-end path. There is no need for a large amount of manual intervention for troubleshooting, no need to interact with the equipment of other sites along the route, and no need to temporarily request other sites to collect troubleshooting information. Even if the control channels of other sites are also disturbed, it will not affect the end-to-end path reconstruction of the abnormal traffic.

[0121] Reference Figure 4 , an embodiment of the present invention provides an abnormal traffic end-to-end path reconstruction system, comprising:

[0122] An IP address judgment module is used to obtain the source IP addresses of multiple target data packets and judge whether the source IP addresses belong to the abnormal traffic range;

[0123] A routing device ID reading module is used to read the routing device ID from the target data message when the source IP address belongs to the abnormal traffic range, and record the number of occurrences of each routing device ID in all target data messages;

[0124] A traffic path reconstruction module is used to sort the routing device IDs from small to large according to the number of occurrences to obtain a routing device ID sequence, and then determine the end-to-end path of the abnormal traffic according to the routing device ID sequence;

[0125] When the target data message is forwarded by the routing device, the routing device marks the target data message with the corresponding routing device ID.

[0126] The contents of the above method embodiments are all applicable to the present system embodiments. The functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0127] Reference Figure 5 The embodiment of the present invention provides an abnormal traffic end-to-end path reconstruction device, comprising:

[0128] at least one processor;

[0129] at least one memory for storing at least one program;

[0130] When the at least one program is executed by the at least one processor, the at least one processor implements the above-mentioned method for end-to-end path reconstruction of abnormal traffic.

[0131] The contents of the above method embodiments are all applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0132] An embodiment of the present invention further provides a computer-readable storage medium, in which a program executable by a processor is stored. When the program executable by the processor is executed by the processor, it is used to execute the above-mentioned method for end-to-end path reconstruction of abnormal traffic.

[0133] A computer-readable storage medium of an embodiment of the present invention can execute an abnormal traffic end-to-end path reconstruction method provided by a method embodiment of the present invention, can execute any combination of implementation steps of the method embodiment, and has the corresponding functions and beneficial effects of the method.

[0134] The embodiment of the present invention also discloses a computer program product or a computer program, wherein the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes Figure 1 The method shown.

[0135] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the above-mentioned boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0136] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified to the contrary, one or more of the above-mentioned functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0137] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the above methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0138] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0139] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and editable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the above-mentioned program is printed, since the above-mentioned program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or processing in other suitable ways as necessary, and then stored in a computer memory.

[0140] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0141] In the above description of this specification, the description with reference to the terms "one embodiment / example", "another embodiment / example" or "certain embodiments / examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0142] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0143] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the above embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A method for reconstructing an abnormal traffic end-to-end path, characterized in that: The following steps are involved: Obtain source IP addresses of multiple target data packets, and determine whether the source IP addresses belong to the abnormal traffic range; When the source IP address belongs to the abnormal traffic range, reading the routing device ID from the target data message, and recording the number of occurrences of each routing device ID in all the target data messages; The routing device IDs are sorted from small to large according to the number of occurrences to obtain a routing device ID sequence, and then an end-to-end path of the abnormal traffic is determined according to the routing device ID sequence; When the target data message is forwarded by a routing device, the routing device marks the corresponding routing device ID to the target data message.

2. The abnormal traffic end-to-end path reconstruction method according to claim 1 is characterized in that: The step of marking the corresponding routing device ID to the target data message by the routing device specifically includes: Acquire the target data message to be forwarded through the routing device, and determine whether the target data message is a fragment message; When the target data message is not a fragment message, obtaining a random number within a preset range, and determining whether the random number is less than a preset value within the preset range; When the random number is less than the preset value, the routing device ID corresponding to the routing device is obtained, the Identification field of the target data message is re-encoded according to the routing device ID, and the target data message is forwarded to the next-hop routing device.

3. The abnormal traffic end-to-end path reconstruction method according to claim 2 is characterized in that: The re-encoding the Identification field of the target data message according to the routing device ID specifically includes: Determine an ID code value according to the routing device ID; The upper 12 bits of the Identification field of the target data message are modified according to the ID coding value to obtain the re-encoded target data message.

4. The abnormal traffic end-to-end path reconstruction method according to claim 2 is characterized in that: The step of marking the corresponding routing device ID to the target data message through the routing device further includes: When the random number is greater than or equal to the preset value, determining whether the routing device is the first-hop routing device of the target data message; When the routing device is the first-hop routing device of the target data message, obtain a preset coding value, re-encode the Identification field of the target data message according to the preset coding value, and forward the target data message to the next-hop routing device; When the routing device is not the first-hop routing device of the target data message, the target data message is directly forwarded to the next-hop routing device.

5. The abnormal traffic end-to-end path reconstruction method according to claim 4 is characterized in that: The step of reading the routing device ID from the target data message and recording the number of occurrences of each routing device ID in all the target data messages specifically includes: Reading a target coding value from the Identification field of the target data message, and determining whether the target coding value is the preset coding value; When the target code value is not the preset code value, determining the corresponding routing device ID according to the target code value, and judging whether the routing device ID exists in the preset routing device ID table; If the routing device ID exists in the routing device ID table, the occurrence count identification value of the routing device ID is increased by 1; if the routing device ID does not exist in the routing device ID table, the routing device ID is added to the routing device ID table, and the occurrence count identification value of the routing device ID is set to 1; The number of occurrences of each routing device ID in all the target data messages is determined according to the number of occurrence identification values ​​of each routing device ID in the routing device ID table.

6. The abnormal traffic end-to-end path reconstruction method according to claim 1 is characterized in that: The step of determining the end-to-end path of the abnormal traffic according to the routing device ID sequence specifically includes: Determine a plurality of abnormal traffic devices and a corresponding arrangement order according to the routing device ID sequence; An end-to-end path of the abnormal traffic is determined according to the abnormal traffic device and the arrangement order.

7. The abnormal traffic end-to-end path reconstruction method according to claim 2 is characterized in that: The abnormal traffic end-to-end path reconstruction method further includes a step of dynamically adjusting the preset value, which is specifically: Increasing the preset value within the preset range increases the probability of the target data message being marked, thereby increasing the sensitivity of end-to-end path reconstruction of abnormal traffic; or, By reducing the preset value within the preset range, the probability of the target data message being marked is reduced, thereby reducing the performance overhead of end-to-end path reconstruction of abnormal traffic.

8. An abnormal traffic end-to-end path reconstruction system, characterized in that: include: An IP address determination module is used to obtain source IP addresses of multiple target data packets and determine whether the source IP addresses belong to the abnormal traffic range; A routing device ID reading module, used for reading a routing device ID from the target data message when the source IP address belongs to the abnormal traffic range, and recording the number of occurrences of each routing device ID in all the target data messages; A traffic path reconstruction module, used to sort the routing device IDs from small to large according to the number of occurrences to obtain a routing device ID sequence, and then determine the end-to-end path of the abnormal traffic according to the routing device ID sequence; When the target data message is forwarded by a routing device, the routing device marks the corresponding routing device ID to the target data message.

9. An abnormal traffic end-to-end path reconstruction device, characterized in that: include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the method for end-to-end path reconstruction of abnormal traffic as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a program executable by a processor, characterized in that: The program executable by the processor is used to execute the method for end-to-end path reconstruction of abnormal traffic as described in any one of claims 1 to 7 when executed by the processor.

Images