Traffic cleaning method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a traffic cleaning method and device, electronic equipment and a storage medium, and the method comprises the steps: determining the attack type of an attack traffic based on the attack information of any attack traffic; based on the current load of any cleaning node, determining a target load corresponding to the cleaning node; based on the attack type and the target load, determining attack traffic needing to be adjusted and a corresponding new cleaning node; and sending the information representing the attack traffic needing to be adjusted and the information representing the corresponding new cleaning node to the corresponding border router, so that the border router sends the attack traffic needing to be adjusted to the new cleaning node. By reasonably distributing cleaning flow, realizing load balance of cleaning nodes and optimally configuring overall cleaning resources, the method adapts to continuously changing network environments, keeps stability and reliability of a network during large-scale attacks, improves processing efficiency and cleaning effect of attack flow, and improves defense effect.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and in particular to a traffic cleaning method, device, electronic device, and storage medium. Background Art

[0002] With the development of the Internet, network attacks occur frequently. For example, Distributed Denial of Service (DDoS) attacks occupy a large amount of network resources and seriously affect the normal operation of the network. Traffic cleaning is an effective defense against network attacks.

[0003] In the related art, one or more cleaning nodes are set to clean the attack traffic to obtain the cleaned traffic.

[0004] However, when the attack traffic is too large, the cleaning node may not be able to process it effectively due to excessive load, affecting the overall defense effect. Summary of the invention

[0005] The embodiments of the present application provide a traffic cleaning method, device, electronic device and storage medium for reasonably allocating cleaning traffic and improving defense effects.

[0006] In a first aspect, an embodiment of the present application provides a first flow cleaning method, the method comprising:

[0007] Based on the attack information of any attack traffic, determining the attack type of the attack traffic; and based on the current load of any cleaning node, determining the target load corresponding to the cleaning node;

[0008] Based on the attack type and the target load, determine the attack traffic that needs to be adjusted and the corresponding new cleaning node;

[0009] The information characterizing the attack traffic that needs to be adjusted and the information characterizing the corresponding new cleaning node are sent to the corresponding border router, so that the border router sends the attack traffic that needs to be adjusted to the new cleaning node.

[0010] The above scheme monitors the attack side and the cleaning side, redirects the attack traffic based on the attack type on the attack side and the target load on the cleaning side, that is, dynamically adjusts the cleaning node corresponding to the attack traffic, and achieves load balancing of the cleaning nodes by reasonably allocating the cleaning traffic. The overall cleaning resources are optimally configured to adapt to the ever-changing network environment, maintain the stability and reliability of the network during large-scale attacks, improve the processing efficiency and cleaning effect of the attack traffic, and improve the defense effect.

[0011] In some optional implementations, determining the attack type of the attack traffic based on the attack information of any attack traffic includes:

[0012] Based on the traffic characteristics and traffic patterns in the attack information, the attack type of the attack traffic is determined.

[0013] In some optional implementations, determining a target load corresponding to any cleaning node based on a current load of the cleaning node includes:

[0014] Based on the current load of the cleaning node, the traffic pattern and duration of the corresponding attack traffic, a target load corresponding to the cleaning node is determined.

[0015] In some optional implementations, based on the attack type and the target load, determining the attack traffic that needs to be adjusted and the corresponding new cleaning node includes:

[0016] For any cleaning node, based on the attack type of the corresponding attack traffic, determine the required load corresponding to the cleaning node;

[0017] Based on the required load, the corresponding target load and the corresponding load limit of each cleaning node, the attack traffic that needs to be adjusted and the corresponding new cleaning node are determined.

[0018] In some optional implementations, based on the required load, the corresponding target load, and the corresponding load limit corresponding to each cleaning node, determining the attack traffic that needs to be adjusted and the corresponding new cleaning node includes:

[0019] Determine an overloaded first cleaning node and an idle second cleaning node based on the required load, the target load, and the load limit corresponding to each cleaning node;

[0020] Attack flows that need to be adjusted are selected from the first cleaning nodes, and second cleaning nodes corresponding to the attack flows that need to be adjusted are determined based on first address information of the attack flows that need to be adjusted and second address information of the second cleaning nodes.

[0021] In some optional implementations, sending the information characterizing the attack traffic that needs to be adjusted and the information characterizing the corresponding new cleaning node to the corresponding border router includes:

[0022] Configure the Border Gateway Protocol flow rules (BGP Flow Spec) based on the attack traffic that needs to be adjusted and the corresponding new cleaning nodes;

[0023] The BGP Flow Spec is sent to the corresponding border router.

[0024] In a second aspect, an embodiment of the present application provides a first flow cleaning device, the device comprising:

[0025] A determination module, configured to determine the attack type of the attack traffic based on the attack information of any attack traffic; and to determine the target load corresponding to the cleaning node based on the current load of any cleaning node;

[0026] A reconfiguration module, used to determine the attack traffic that needs to be adjusted and the corresponding new cleaning node based on the attack type and the target load;

[0027] The sending module is used to send the information characterizing the attack traffic that needs to be adjusted and the information characterizing the corresponding new cleaning node to the corresponding border router, so that the border router sends the attack traffic that needs to be adjusted to the new cleaning node.

[0028] In some optional implementation manners, the determination module is specifically used to:

[0029] Based on the traffic characteristics and traffic patterns in the attack information, the attack type of the attack traffic is determined.

[0030] In some optional implementation manners, the determining module is specifically configured to:

[0031] Based on the current load of the cleaning node, the traffic pattern and duration of the corresponding attack traffic, a target load corresponding to the cleaning node is determined.

[0032] In some optional implementation manners, the reconfiguration module is specifically used to:

[0033] For any cleaning node, based on the attack type of the corresponding attack traffic, determine the required load corresponding to the cleaning node;

[0034] Based on the required load, the corresponding target load and the corresponding load limit of each cleaning node, the attack traffic that needs to be adjusted and the corresponding new cleaning node are determined.

[0035] In some optional implementation manners, the reconfiguration module is specifically used to:

[0036] Determine an overloaded first cleaning node and an idle second cleaning node based on the required load, the target load, and the load limit corresponding to each cleaning node;

[0037] Attack flows that need to be adjusted are selected from the first cleaning nodes, and second cleaning nodes corresponding to the attack flows that need to be adjusted are determined based on first address information of the attack flows that need to be adjusted and second address information of the second cleaning nodes.

[0038] In some optional implementation manners, the sending module is specifically used to:

[0039] Configure BGP Flow Spec based on the attack traffic that needs to be adjusted and the corresponding new cleaning nodes;

[0040] The BGP Flow Spec is sent to the corresponding border router.

[0041] In a third aspect, an embodiment of the present application provides an electronic device, comprising at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes any traffic cleaning method described in the first aspect.

[0042] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a processor, wherein when the program runs on the processor, the processor executes any of the traffic cleaning methods described in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 The first system architecture diagram provided for the embodiment of the present application;

[0045] Figure 2 A second system architecture diagram provided for an embodiment of the present application;

[0046] Figure 3 A third system architecture diagram provided for an embodiment of the present application;

[0047] Figure 4 A schematic diagram of a flow chart of a first flow cleaning method provided in an embodiment of the present application;

[0048] Figure 5 A fourth system architecture diagram provided for an embodiment of the present application;

[0049] Figure 6 A schematic diagram of a flow chart of a second flow cleaning method provided in an embodiment of the present application;

[0050] Figure 7 A schematic diagram of a flow chart of a third flow cleaning method provided in an embodiment of the present application;

[0051] Figure 8A schematic diagram of the structure of a flow cleaning device provided in an embodiment of the present application;

[0052] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0054] The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0055] In the description of this application, it should be noted that, unless otherwise clearly specified and limited, the term "connection" should be understood in a broad sense, for example, it can be directly connected, or indirectly connected through an intermediate medium, or it can be the internal connection of two devices. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0056] With the development of the Internet, network attacks occur frequently. For example, DDoS attacks occupy a large amount of network resources, seriously affecting the normal operation of the network. Traffic cleaning is an effective defense against network attacks.

[0057] In the related art, one or more cleaning nodes are set to clean the attack traffic to obtain the cleaned traffic.

[0058] See also Figure 1 As shown, the network architecture sets up a cleaning node. A single cleaning node may be overloaded due to the limitation of processing capacity, resulting in reduced cleaning efficiency or even service interruption.

[0059] See also Figure 2 As shown in the figure, although the network architecture has multiple cleaning nodes, since the attack traffic may come from different areas, the multiple cleaning nodes distributed in different areas cannot be effectively utilized, resulting in some node resources being idle while other nodes are overloaded.

[0060] When the attack traffic is too large, the cleaning node may not be able to process it effectively due to excessive load, affecting the overall defense effect.

[0061] In view of this, the embodiments of the present application propose a traffic cleaning method, device, electronic device and storage medium to reasonably allocate the cleaning traffic and improve the defense effect.

[0062] See also Figure 3 As shown, the system architecture provided by the present application includes a core router (RR), a border router (PE), and multiple cleaning nodes ( Figure 3 Taking two cleaning nodes as an example, more cleaning nodes can be set up in the implementation), intrusion detection system (IDS) and electronic equipment. Among them:

[0063] One or more core routers can be deployed in the network. Figure 3 Taking 1 as an example), the core router is the backbone of the network and is responsible for the main data transmission and routing decisions; the core router is configured with the Border Gateway Protocol (BGP) route reflector function to distribute routing information within the autonomous system (Autonomous System, AS).

[0064] Multiple border routers are deployed at the edge of the network. They are the interface between the user network and the Internet Service Provider (ISP) network. Each PE router is configured with a BGP session to establish a connection with the core router to receive and distribute routing information.

[0065] Multiple geographically distributed cleaning nodes are deployed in the network, and each cleaning node is equipped with a high-performance flow cleaning device. The cleaning node is connected to the border router via a high-speed network to receive and return traffic. Exemplarily, the cleaning device is configured with a BGP Flow Spec function. In an embodiment of the present application, the cleaning node reports load information to the electronic device. Figure 3 Taking two cleaning nodes (cleaning node 1 and cleaning node 2) as an example, more cleaning nodes may be set in implementation.

[0066] IDS is used to monitor and identify attack traffic in real time and report it to electronic devices.

[0067] The electronic device is used to monitor the security status of the entire network, including the load and attack traffic of the cleaning node. Based on the attack information of any attack traffic, the attack type of the attack traffic is determined; and based on the current load of any cleaning node, the target load corresponding to the cleaning node is determined; based on the attack type and the target load, the attack traffic that needs to be adjusted and the corresponding new cleaning node are determined; information characterizing the attack traffic that needs to be adjusted and information characterizing the corresponding new cleaning node are sent to the corresponding border router, so that the border router sends the attack traffic that needs to be adjusted to the new cleaning node.

[0068] The following will be combined with the accompanying drawings and specific embodiments to describe in detail the technical solution of the present application and how the technical solution of the present application solves the above technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0069] Figure 4 A flow chart of the first flow cleaning method provided in the embodiment of the present application is as follows: Figure 4 As shown, the following steps are included:

[0070] Step S401: based on the attack information of any attack traffic, determining the attack type of the attack traffic; and based on the current load of any cleaning node, determining the target load corresponding to the cleaning node.

[0071] In practice, multiple cleaning nodes are deployed in the network. If the cleaning nodes allocate cleaning traffic in a fixed manner, load imbalance may occur. Based on this, this embodiment monitors the attack side and the cleaning side for subsequent dynamic adjustment.

[0072] Since the attack information of the attack traffic reflects the relevant characteristics of the attack traffic, based on this, the attack type of the attack traffic is determined according to the attack information, and the attack type characterizes the load demand; since the current load of the cleaning node reflects whether the cleaning node is overloaded, but the traffic is dynamic, if it is directly based on the current load, it may be adjusted frequently. Based on this, the target load of the cleaning node is determined according to the current load, and the target load reflects the subsequent load of the cleaning node to a certain extent.

[0073] Step S402: Based on the attack type and the target load, determine the attack traffic that needs to be adjusted and the corresponding new cleaning node.

[0074] As mentioned above, the attack type characterizes the load demand, and the target load reflects the subsequent load of the cleaning node to a certain extent. Therefore, by combining these two pieces of information from the attack side and the cleaning side, the attack traffic that needs to be adjusted and the corresponding new cleaning node can be determined more reasonably.

[0075] Step S403: sending the information characterizing the attack traffic that needs to be adjusted and the information characterizing the corresponding new cleaning node to the corresponding border router, so that the border router sends the attack traffic that needs to be adjusted to the new cleaning node.

[0076] In implementation, after determining the attack traffic that needs to be adjusted and the corresponding new cleaning node, the adjustment information is sent to the corresponding border router, and the subsequent border router sends the adjusted attack traffic to the new cleaning node, thereby reasonably allocating the cleaning traffic.

[0077] For example, corresponding to the above Figure 3 In the system shown in the figure, if it is determined that attack flow 2 is the attack flow that needs to be adjusted, the corresponding new cleaning node is cleaning node 1, and the first adjustment information needs to be sent to PE1 and the second adjustment information needs to be sent to PE2; PE2 stops sending attack flow 2 to cleaning node 2 based on the second adjustment information, and PE1 sends attack flow 2 to cleaning node 1 based on the first adjustment information. After traffic redistribution, you can refer to Figure 5 shown.

[0078] The above scheme monitors the attack side and the cleaning side, redirects the attack traffic based on the attack type on the attack side and the target load on the cleaning side, that is, dynamically adjusts the cleaning node corresponding to the attack traffic, and achieves load balancing of the cleaning nodes by reasonably allocating the cleaning traffic. The overall cleaning resources are optimally configured to adapt to the ever-changing network environment, maintain the stability and reliability of the network during large-scale attacks, improve the processing efficiency and cleaning effect of the attack traffic, and improve the defense effect.

[0079] In some optional implementation manners, the above step S101 of determining the attack type of the attack traffic may be implemented by, but not limited to, the following methods:

[0080] Based on the traffic characteristics and traffic patterns in the attack information, the attack type of the attack traffic is determined.

[0081] As described above, the attack information of the attack traffic reflects the relevant characteristics of the attack traffic. Some information in the attack information is related to the load (such as traffic characteristics and traffic patterns), and some is not related to the load (such as address information). Based on this, this embodiment determines the attack type of the attack traffic based on the traffic characteristics and traffic patterns related to the load.

[0082] Exemplarily, the traffic feature is the attack peak value, and the traffic pattern is the type of attack to which the attack traffic belongs.

[0083] This embodiment does not limit the specific implementation method of determining the attack type of the attack traffic, such as training a type recognition model based on the traffic characteristics, traffic patterns and attack types of the sample traffic, and determining the attack type of the attack traffic through the type recognition model.

[0084] In some optional implementations, the above step S101 of determining the target load may be implemented by, but not limited to, the following methods:

[0085] Based on the current load of the cleaning node, the traffic pattern and duration of the corresponding attack traffic, a target load corresponding to the cleaning node is determined.

[0086] As mentioned above, since the current load of the cleaning node reflects whether the cleaning node is overloaded, but the traffic is dynamic, it may be adjusted frequently if it is directly based on the current load;

[0087] The traffic pattern and duration of the attack traffic reflect its dynamic correlation characteristics to a certain extent, such as whether it is about to end. Based on this, this embodiment determines the target load corresponding to the cleaning node based on the three pieces of information: the current load of the cleaning node, the traffic pattern of the corresponding attack traffic, and the duration.

[0088] This embodiment does not limit the specific implementation method for determining the attack type of the attack traffic, such as training a load identification model based on three pieces of information: the current load of the sample cleaning node, the traffic pattern and duration of the corresponding attack traffic, and determining the target load corresponding to the cleaning node through the load identification model; or determining an adjustment factor based on the traffic pattern and duration of the attack traffic, adjusting the current load of the cleaning node based on the adjustment factor, and determining the target load corresponding to the cleaning node.

[0089] Figure 6 A flow chart of a second flow cleaning method provided in an embodiment of the present application is shown as follows: Figure 6 As shown, the following steps are included:

[0090] Step S601: based on the attack information of any attack traffic, determining the attack type of the attack traffic; and based on the current load of any cleaning node, determining the target load corresponding to the cleaning node.

[0091] The specific implementation of step S601 may refer to other embodiments and will not be described in detail here.

[0092] Step S602: for any cleaning node, based on the attack type of the corresponding attack traffic, determine the required load corresponding to the cleaning node.

[0093] As described above, the attack type characterizes the load demand. Therefore, based on the attack type of the attack traffic, the demand load of the attack traffic can be accurately determined; based on the attack type of all attack traffic corresponding to the cleaning node, the demand load corresponding to the cleaning node can be accurately determined.

[0094] Exemplarily, a mapping relationship between attack types and demand loads is established, and the demand load of each attack flow is determined based on the mapping relationship; and the demand load corresponding to the cleaning node is determined based on the sum of all demand loads corresponding to the cleaning node.

[0095] Step S603: based on the required load, the corresponding target load and the corresponding load limit of each cleaning node, determine the attack traffic that needs to be adjusted and the corresponding new cleaning node.

[0096] Since the demand load corresponding to the cleaning node reflects the load required by the cleaning node to carry the corresponding attack traffic, the target load reflects the existing load of the cleaning node; in addition, the cleaning equipment deployed on each cleaning node may be different, that is, the load limit that can be achieved is also different, and the load limit will also affect the cleaning node to undertake the attack traffic;

[0097] Based on this, this embodiment can accurately determine which cleaning nodes need to be adjusted and which attack traffic needs to be adjusted by combining these three pieces of information.

[0098] Step S604: sending the information characterizing the attack traffic that needs to be adjusted and the information characterizing the corresponding new cleaning node to the corresponding border router, so that the border router sends the attack traffic that needs to be adjusted to the new cleaning node.

[0099] The specific implementation of step S604 may refer to other embodiments and will not be described in detail here.

[0100] In some optional implementation manners, the above step S603 may be implemented by but not limited to the following methods:

[0101] Determine an overloaded first cleaning node and an idle second cleaning node based on the required load, the target load, and the load limit corresponding to each cleaning node;

[0102] Attack flows that need to be adjusted are selected from the first cleaning nodes, and second cleaning nodes corresponding to the attack flows that need to be adjusted are determined based on first address information of the attack flows that need to be adjusted and second address information of the second cleaning nodes.

[0103] Since the cleaning equipment deployed on each cleaning node may be different, the cleaning capacity of each cleaning node is different, and the load limit that can be achieved is also different. Therefore, the load limit will also affect the attack traffic that the cleaning node can bear;

[0104] Based on this, this embodiment combines the required load, the target load and the load limit corresponding to the cleaning node to determine whether the cleaning node is overloaded, idle or operating normally.

[0105] Exemplarily, a load identification model is trained based on the required load, the corresponding target load, the corresponding load limit, and the load state (overload, idle, or normal operation) corresponding to the sample cleaning node, and the required load, the corresponding target load, and the corresponding load limit corresponding to the cleaning node are input into the load identification model to determine whether the cleaning node is overloaded, idle, or normal operation. Alternatively, load information is determined based on the required load and the corresponding target load, and the ratio of the load information to the load limit is determined. If the ratio is less than a first preset ratio, it is determined that the cleaning node is idle; if the ratio is greater than or equal to the first preset ratio and less than or equal to the second preset ratio, it is determined that the cleaning node is normal operation; if the ratio is greater than the second preset ratio, it is determined that the cleaning node is overloaded.

[0106] Furthermore, for the overloaded first cleaning nodes, the attack traffic that needs to be adjusted needs to be selected and migrated to the idle second cleaning nodes. Based on the attack traffic that needs to be adjusted and the address information of the second cleaning nodes, the second cleaning nodes corresponding to each attack traffic that needs to be adjusted can be determined more reasonably.

[0107] Exemplarily, a cleaning node closest to the address of the attack traffic that needs to be adjusted is selected from the second cleaning node. If the load of the cleaning node matches the attack traffic that needs to be adjusted (such as the difference between the load limit and the target load is greater than the required load of the attack traffic that needs to be adjusted), the cleaning node corresponding to the attack traffic that needs to be adjusted.

[0108] Figure 7 A flow chart of a third flow cleaning method provided in an embodiment of the present application is shown as follows: Figure 7 As shown, the following steps are included:

[0109] Step S701: based on the attack information of any attack traffic, determining the attack type of the attack traffic; and based on the current load of any cleaning node, determining the target load corresponding to the cleaning node.

[0110] Step S702: Based on the attack type and the target load, determine the attack traffic that needs to be adjusted and the corresponding new cleaning node.

[0111] The specific implementation of steps S701 to S702 may refer to other embodiments and will not be described in detail here.

[0112] Step S703: configure BGP FlowSpec based on the attack traffic that needs to be adjusted and the corresponding new cleaning node.

[0113] In this embodiment, a BGP FlowSpec rule is generated based on the attack traffic that needs to be adjusted and the corresponding new cleaning node to guide the redirection of the traffic.

[0114] Step S704: Send the BGP Flow Spec to the corresponding border router, so that the border router sends the attack traffic that needs to be adjusted to the new cleaning node.

[0115] By pushing the generated BGP Flow Spec to the PE routers in the network, timely updating and correct execution of the rules are ensured.

[0116] In implementation, the cleaning nodes participating in dynamic load balancing are all cleaning nodes in normal use. In some optional implementations, monitoring network components are deployed in electronic devices to quickly detect faults of cleaning nodes to ensure high availability of the network.

[0117] In some optional implementations, the electronic device also provides an interactive interface, through which information such as system status, configuration policies, management events, security reports and logs are displayed, so that relevant personnel can conduct audits, compliance and continuous security improvements.

[0118] like Figure 8 As shown, the embodiment of the present application provides a flow cleaning device 800, which includes:

[0119] The determination module 801 is used to determine the attack type of the attack traffic based on the attack information of any attack traffic; and determine the target load corresponding to the cleaning node based on the current load of any cleaning node;

[0120] A reconfiguration module 802, configured to determine the attack traffic that needs to be adjusted and the corresponding new cleaning node based on the attack type and the target load;

[0121] The sending module 803 is used to send the information characterizing the attack traffic that needs to be adjusted and the information characterizing the corresponding new cleaning node to the corresponding border router, so that the border router sends the attack traffic that needs to be adjusted to the new cleaning node.

[0122] In some optional implementation manners, the determination module 801 is specifically configured to:

[0123] Based on the traffic characteristics and traffic patterns in the attack information, the attack type of the attack traffic is determined.

[0124] In some optional implementation manners, the determination module 801 is specifically configured to:

[0125] Based on the current load of the cleaning node, the traffic pattern and duration of the corresponding attack traffic, a target load corresponding to the cleaning node is determined.

[0126] In some optional implementation manners, the reconfiguration module 802 is specifically configured to:

[0127] For any cleaning node, based on the attack type of the corresponding attack traffic, determine the required load corresponding to the cleaning node;

[0128] Based on the required load, the corresponding target load and the corresponding load limit of each cleaning node, the attack traffic that needs to be adjusted and the corresponding new cleaning node are determined.

[0129] In some optional implementation manners, the reconfiguration module 802 is specifically configured to:

[0130] Determine an overloaded first cleaning node and an idle second cleaning node based on the required load, the target load, and the load limit corresponding to each cleaning node;

[0131] Attack flows that need to be adjusted are selected from the first cleaning nodes, and second cleaning nodes corresponding to the attack flows that need to be adjusted are determined based on first address information of the attack flows that need to be adjusted and second address information of the second cleaning nodes.

[0132] In some optional implementation manners, the sending module 803 is specifically configured to:

[0133] Configure BGP Flow Spec based on the attack traffic that needs to be adjusted and the corresponding new cleaning nodes;

[0134] The BGP Flow Spec is sent to the corresponding border router.

[0135] Since the device is the device in the method in the embodiment of the present application, and the principle of solving the problem by the device is similar to that of the method, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0136] Based on the same technical concept, the embodiment of the present application also provides an electronic device 900, such as Fig. 9 As shown, it includes at least one processor 901 and a memory 902 connected to the at least one processor. The specific connection medium between the processor 901 and the memory 902 is not limited in the embodiment of the present application. Fig. 9For example, the processor 901 and the memory 902 are connected via a bus 903. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig. 9 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0137] Among them, the processor 901 is the control center of the electronic device, which can use various interfaces and lines to connect various parts of the electronic device, and realize data processing by running or executing instructions stored in the memory 902 and calling data stored in the memory 902. Optionally, the processor 901 may include one or more processing units, and the processor 901 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes the issuance of instructions. It is understandable that the above-mentioned modem processor may not be integrated into the processor 901. In some embodiments, the processor 901 and the memory 902 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

[0138] Processor 901 can be a general-purpose processor, such as a CPU, a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiment of the flow cleaning method can be directly embodied as a hardware processor execution, or can be executed by a combination of hardware and software modules in the processor.

[0139] The memory 902 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 902 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 902 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 902 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0140] In the embodiment of the present application, the memory 902 stores a computer program. When the program is executed by the processor 901, the processor 901 executes:

[0141] Based on the attack information of any attack traffic, determining the attack type of the attack traffic; and based on the current load of any cleaning node, determining the target load corresponding to the cleaning node;

[0142] Based on the attack type and the target load, determine the attack traffic that needs to be adjusted and the corresponding new cleaning node;

[0143] The information characterizing the attack traffic that needs to be adjusted and the information characterizing the corresponding new cleaning node are sent to the corresponding border router, so that the border router sends the attack traffic that needs to be adjusted to the new cleaning node.

[0144] In some optional implementations, the processor 901 specifically performs:

[0145] Based on the traffic characteristics and traffic patterns in the attack information, the attack type of the attack traffic is determined.

[0146] In some optional implementations, the processor 901 specifically performs:

[0147] Based on the current load of the cleaning node, the traffic pattern and duration of the corresponding attack traffic, a target load corresponding to the cleaning node is determined.

[0148] In some optional implementations, the processor 901 specifically performs:

[0149] For any cleaning node, based on the attack type of the corresponding attack traffic, determine the required load corresponding to the cleaning node;

[0150] Based on the required load, the corresponding target load and the corresponding load limit of each cleaning node, the attack traffic that needs to be adjusted and the corresponding new cleaning node are determined.

[0151] In some optional implementations, the processor 901 specifically performs:

[0152] Determine an overloaded first cleaning node and an idle second cleaning node based on the required load, the target load, and the load limit corresponding to each cleaning node;

[0153] Attack flows that need to be adjusted are selected from the first cleaning nodes, and second cleaning nodes corresponding to the attack flows that need to be adjusted are determined based on first address information of the attack flows that need to be adjusted and second address information of the second cleaning nodes.

[0154] In some optional implementations, the processor 901 specifically performs:

[0155] Configure BGP Flow Spec based on the attack traffic that needs to be adjusted and the corresponding new cleaning nodes;

[0156] The BGP Flow Spec is sent to the corresponding border router.

[0157] Since the electronic device is the electronic device in the method in the embodiment of the present application, and the principle of solving the problem by the electronic device is similar to that of the method, the implementation of the electronic device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0158] Based on the same technical concept, an embodiment of the present application also provides a computer-readable storage medium, which stores a computer program executable by a processor. When the program runs on the processor, the processor executes the steps of the above-mentioned traffic cleaning method.

[0159] In some optional embodiments, various aspects of the traffic cleaning method provided in the present application can also be implemented in the form of a program product, which contains computer-executable instructions. When the program product is run on a computer device, the computer-executable instructions are used to enable the computer device to execute the steps of the traffic cleaning method according to various exemplary embodiments of the present application described above in this specification.

[0160] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0161] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0162] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0163] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0164] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0165] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A flow cleaning method, characterized in that: Applied to electronic equipment, the method comprises: Based on the attack information of any attack traffic, determining the attack type of the attack traffic; and based on the current load of any cleaning node, determining the target load corresponding to the cleaning node; Based on the attack type and the target load, determine the attack traffic that needs to be adjusted and the corresponding new cleaning node; The information characterizing the attack traffic that needs to be adjusted and the information characterizing the corresponding new cleaning node are sent to the corresponding border router, so that the border router sends the attack traffic that needs to be adjusted to the new cleaning node.

2. The method according to claim 1, characterized in that Determining the attack type of the attack traffic based on the attack information of any attack traffic includes: Based on the traffic characteristics and traffic patterns in the attack information, the attack type of the attack traffic is determined.

3. The method according to claim 1, characterized in that Based on the current load of any cleaning node, determining a target load corresponding to the cleaning node includes: Based on the current load of the cleaning node, the traffic pattern and duration of the corresponding attack traffic, a target load corresponding to the cleaning node is determined.

4. The method according to claim 1, characterized in that Based on the attack type and the target load, determining the attack traffic that needs to be adjusted and the corresponding new cleaning node, including: For any cleaning node, based on the attack type of the corresponding attack traffic, determine the required load corresponding to the cleaning node; Based on the required load, the corresponding target load and the corresponding load limit of each cleaning node, the attack traffic that needs to be adjusted and the corresponding new cleaning node are determined.

5. The method according to claim 4, characterized in that Based on the required load, target load, and load limit of each cleaning node, the attack traffic that needs to be adjusted and the corresponding new cleaning node are determined, including: Determine an overloaded first cleaning node and an idle second cleaning node based on the required load, the target load, and the load limit corresponding to each cleaning node; Attack flows that need to be adjusted are selected from the first cleaning nodes, and second cleaning nodes corresponding to the attack flows that need to be adjusted are determined based on first address information of the attack flows that need to be adjusted and second address information of the second cleaning nodes.

6. The method according to any one of claims 1 to 5, characterized in that: Sending information characterizing the attack traffic that needs to be adjusted and information characterizing the corresponding new cleaning node to the corresponding border router includes: Configure BGP Flow Spec based on the attack traffic that needs to be adjusted and the corresponding new cleaning nodes; The BGP Flow Spec is sent to the corresponding border router.

7. A flow cleaning device, characterized in that: The device includes: A determination module, configured to determine the attack type of the attack traffic based on the attack information of any attack traffic; and to determine the target load corresponding to the cleaning node based on the current load of any cleaning node; A reconfiguration module, used to determine the attack traffic that needs to be adjusted and the corresponding new cleaning node based on the attack type and the target load; The sending module is used to send the information characterizing the attack traffic that needs to be adjusted and the information characterizing the corresponding new cleaning node to the corresponding border router, so that the border router sends the attack traffic that needs to be adjusted to the new cleaning node.

8. The device according to claim 7, characterized in that Identify modules, specifically for: Based on the traffic characteristics and traffic patterns in the attack information, the attack type of the attack traffic is determined.

9. An electronic device, characterized in that: The method comprises at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: It stores a computer program executable by a computer, and when the program is run on the computer, the computer is enabled to execute the method according to any one of claims 1 to 6.

Images