Abnormal traffic attack defense method and device, medium, product and electronic equipment

Abstract

The invention provides an abnormal traffic attack defense method and device, a medium, a product and electronic equipment, the method is applied to the technical field of computers, and the method comprises the following steps: distributing received traffic to each node in a block chain structure based on a smart contract, and if a target processing node detects that target traffic is abnormal traffic, sending the abnormal traffic to a server; if yes, an abnormal flow verification request is initiated based on the target flow, and if the abnormal flow verification request passes, a defense instruction is sent to all nodes for the target flow, so that all the nodes execute defense operation for the target flow.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically, to an abnormal traffic attack defense method, device, medium, product and electronic device in the field of computer technology. Background Art

[0002] Distributed Denial of Service (DDoS) is a type of network attack where attackers can send a large number of requests to a server through multiple terminals at the same time, making it impossible for the server to process normal user requests, causing service interruption or slowness. In the prior art, in order to prevent DDoS attacks, a content delivery network (CDN) can be used to disperse the traffic load and avoid server crashes. However, since user requests need to be identified by CDN in sequence before being sent to the server for processing, and the cost of CDN services is relatively high, a more efficient defense method for abnormal traffic attacks needs to be provided. Summary of the invention

[0003] The embodiments of the present application provide a method, device, medium, product and electronic device for defending against abnormal traffic attacks. The method can detect abnormal traffic by using each node in the blockchain. When abnormal traffic is detected at any node, all nodes of the blockchain can be used to defend and clean the abnormal traffic, thereby improving the detection and defense efficiency of the traffic, thereby improving the response speed of the server to user requests.

[0004] In a first aspect, an embodiment of the present application provides a method for defending against abnormal traffic attacks, the method comprising:

[0005] Distribute the received traffic to each node in the blockchain structure based on smart contracts;

[0006] If the target processing node detects that the target traffic is abnormal traffic, an abnormal traffic verification request is initiated based on the target traffic;

[0007] If the abnormal traffic verification request is passed, a defense instruction is sent to all nodes for the target traffic, so that all nodes perform a defense operation for the target traffic.

[0008] In a second aspect, an embodiment of the present application provides an abnormal traffic attack defense device, the device comprising:

[0009] A traffic distribution unit, used to distribute the received traffic to each node in the blockchain structure based on the smart contract;

[0010] an abnormal traffic detection unit, configured to initiate an abnormal traffic verification request based on the target traffic if the target processing node detects that the target traffic is abnormal traffic;

[0011] The defense operation unit is used to send a defense instruction to all nodes for the target traffic if the abnormal traffic verification request is passed, so that all nodes perform a defense operation for the target traffic.

[0012] In a third aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the above-mentioned method steps.

[0013] In a fourth aspect, an embodiment of the present application provides a computer program product, which stores a plurality of instructions suitable for being loaded by a processor and executing the above-mentioned method steps.

[0014] In a fifth aspect, an embodiment of the present application provides an electronic device, which may include: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the above-mentioned method steps.

[0015] In one or more embodiments of the present application, the received traffic is distributed to each node in the blockchain structure based on a smart contract. If the target processing node detects that the target traffic is abnormal traffic, an abnormal traffic verification request is initiated based on the target traffic. If the abnormal traffic verification request is passed, a defense instruction is sent to all nodes for the target traffic, so that all nodes perform defense operations for the target traffic. By using each node in the blockchain to detect abnormal traffic, when any node detects abnormal traffic, all nodes of the blockchain can be used to perform defense cleaning on the abnormal traffic, which improves the detection and defense efficiency of the traffic, thereby improving the response speed of the server to user requests. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 This is a system architecture diagram of abnormal traffic attack defense provided by an embodiment of the present application;

[0018] Figure 2 It is a flowchart of an abnormal traffic attack defense method provided by an embodiment of the present application;

[0019] Figure 3 It is a flowchart of an abnormal traffic attack defense method provided by an embodiment of the present application;

[0020] Figure 4 This is an example schematic diagram of target request distribution provided by an embodiment of the present application;

[0021] Figure 5 It is a structural diagram of an abnormal traffic attack defense device provided in an embodiment of the present application;

[0022] Figure 6 It is a structural diagram of an abnormal traffic attack defense device provided in an embodiment of the present application;

[0023] Figure 7 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0025] Users can use their own terminal devices to send requests to the transaction server, and the transaction server can process and respond to the user requests. The user's request is related to the functions, specific transaction requirements and scenarios of the transaction server, such as user login, data query, financial transaction, etc. Therefore, the transaction server can only guarantee the requests of all users when it runs in a normal state. Attackers can use DDoS attacks and other methods to make abnormal traffic flow to the transaction server, exhaust the resources of the transaction server, and cause normal users to be unable to access the service, thereby achieving a denial of service attack and the transaction server cannot meet the user's transaction needs. Among them, abnormal traffic can be a large number of requests in a short period of time, a large number of requests for the same transaction function in a short period of time, or requests containing information detection behavior messages. The information detection behavior messages can be messages that detect network status, service information or system characteristics.

[0026] The abnormal traffic attack defense method provided in the embodiment of the present application can be implemented by a computer program and can be run on an abnormal traffic attack defense device based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application. Figure 1, a system architecture diagram for abnormal traffic attack defense is provided for the embodiment of the present application. The abnormal traffic attack defense device can deploy a system network with a blockchain structure. The blockchain structure can contain multiple nodes, which can be node servers distributed all over the world. The blockchain structure is a distributed data storage and management method. The data is stored on multiple nodes instead of being concentrated on a single server. All nodes have a complete account book to ensure the transparency and consistency of the data. Due to the encryption technology and decentralized characteristics of the blockchain, the use of the blockchain structure can provide a high level of data security and prevent unauthorized modifications and attacks. Among them, each node configured by the abnormal traffic attack defense device can have an abnormal traffic detection function and a defense operation function. The abnormal traffic detection function is a function for the node to detect whether the received traffic is abnormal traffic, and the defense operation function is a function for performing defense operations on abnormal traffic.

[0027] like Figure 1 As shown, the user can use the terminal device he holds to send a request to the transaction server. In order to prevent abnormal traffic from flowing directly to the transaction server, the abnormal traffic attack defense device can make the request sent by the user first sent to the blockchain structure. In addition to being configured with multiple nodes, the blockchain structure is also configured with smart contracts. Smart contracts are a kind of self-executing contract in the blockchain. The terms of smart contracts can be directly written into the code and can be automatically executed when specific conditions are met. It has the characteristics of automatic execution, transparency, security, and efficiency, eliminating the cumbersome procedures in traditional contract execution, saving time and cost. Relevant staff and abnormal traffic attack defense devices can realize abnormal traffic detection functions and defense operation functions through smart contract control nodes. For example, smart contracts can be configured with abnormal traffic judgment methods, defense operation methods for abnormal traffic, etc. After the user's request is sent to the blockchain structure, the request can be sent to a node for abnormal traffic detection. If the request is determined to be non-abnormal traffic, that is, the request is a normal request from a normal user, the request can be sent to the transaction server so that the transaction server processes and responds to the request. If the node determines that the request is abnormal traffic, the node can perform defense operations against the abnormal traffic. The defense operations may include absorption, isolation or cleaning to prevent abnormal traffic from being sent to the transaction server.

[0028] The abnormal traffic attack defense method provided by the present application is described in detail below with reference to specific embodiments.

[0029] See also Figure 2 , which is a flow chart of a method for defending against abnormal traffic attacks according to an embodiment of the present application. Figure 2 As shown, the method of the embodiment of the present application may include the following steps S102-S106.

[0030] S102, distributing the received traffic to each node in the blockchain structure based on the smart contract.

[0031] Specifically, when many users send requests, the data stream formed by these requests constitutes traffic. The received traffic can be distributed to each node in the blockchain structure. These nodes can perform abnormal traffic detection on the traffic they receive. In order to improve the response speed of user requests and avoid overloading the server of a single node, relevant staff or abnormal traffic attack defense devices can set how to distribute traffic in the smart contract so that user requests can be sent to the appropriate node for abnormal traffic detection. For example, the smart contract can be set to send the request to the nearest node, or set to send the request to the currently most idle node. Multiple nodes perform abnormal traffic detection on the traffic together, which can improve the efficiency of abnormal traffic detection, thereby quickly sending normal requests to the transaction server to improve the response efficiency of the transaction server to normal requests.

[0032] S104: If the target processing node detects that the target traffic is abnormal traffic, an abnormal traffic verification request is initiated based on the target traffic.

[0033] Specifically, the target processing node can be any node in the blockchain structure, and the target traffic is part of the traffic distributed to the target processor. It can be understood that the target traffic can be a single request or can include multiple requests. Since each node can have an abnormal traffic detection function, the target processing node can detect whether the target traffic is abnormal traffic based on the configured abnormal traffic detection function. If the target processing node detects that the target traffic is abnormal traffic, it can initiate an abnormal traffic verification request based on the target traffic. Since there is a consensus mechanism for the nodes in the blockchain structure, the consensus mechanism means that different nodes in the blockchain structure need to reach a consensus to ensure that all nodes have a common understanding of the data and status on the blockchain, thereby further improving the security and reliability of abnormal traffic attack defense. Therefore, the abnormal traffic verification request is used to request other nodes to verify whether the target traffic is abnormal traffic.

[0034] S106: If the abnormal traffic verification request is passed, a defense instruction is sent to all nodes for the target traffic, so that all nodes perform defense operations for the target traffic.

[0035] Specifically, when all nodes on the blockchain structure determine that the target traffic is abnormal traffic, the abnormal traffic verification request passes, indicating that all nodes have a consensus on the result that the target traffic is abnormal traffic. If the abnormal traffic verification request passes, defense instructions can be sent to all nodes for the target traffic, so that all nodes perform defense operations on the target traffic. For example, defense operations may include absorption, isolation, or cleaning, etc. Absorption can be the process of managing and mitigating abnormal traffic at the network level, isolation can be separating abnormal traffic from the network to prevent abnormal traffic attacks or infections from spreading to other nodes or transaction servers, and cleaning can be the process of filtering abnormal traffic to remove abnormal requests and only pass normal requests to the transaction server. Since abnormal traffic often has the characteristic of excessively large traffic values, it is difficult for a single node to defend against it. Using all nodes in the blockchain structure to perform defense operations on target traffic improves the efficiency and success rate of defense operations, reduces the burden of a single cleaning center, and improves the ability to handle large-scale attacks.

[0036] In an embodiment of the present application, the received traffic is distributed to each node in the blockchain structure based on a smart contract. If the target processing node detects that the target traffic is abnormal traffic, an abnormal traffic verification request is initiated based on the target traffic. If the abnormal traffic verification request is passed, a defense instruction is sent to all nodes for the target traffic, so that all nodes perform defense operations for the target traffic. By using each node in the blockchain to detect abnormal traffic, when any node detects abnormal traffic, all nodes of the blockchain can be used to perform defense cleaning on the abnormal traffic, which improves the detection and defense efficiency of the traffic, thereby improving the response speed of the server to user requests.

[0037] See also Figure 3 , which is a flow chart of a method for defending against abnormal traffic attacks according to an embodiment of the present application. Figure 3 As shown, the method of the embodiment of the present application may include the following steps S202-S212.

[0038] S202, distribute the received traffic to each node in the blockchain structure based on the smart contract.

[0039] Specifically, the received traffic can be distributed to each node in the blockchain structure, and these nodes can perform abnormal traffic detection on the traffic they receive.

[0040] Optionally, in order to improve the response speed of user requests and avoid overloading the server of a single node, relevant staff or abnormal traffic attack defense devices can configure node distribution rules and abnormal judgment rules in the smart contract, where the node distribution rules are used to distribute traffic to each node in the blockchain network, and the abnormal judgment rules are used by nodes in the blockchain network to judge abnormal traffic and realize abnormal traffic detection function.

[0041] Optionally, the node distribution rules can enable user requests to be sent to appropriate nodes for abnormal traffic detection. The node distribution rules may include one or more of intelligent domain name resolution (Domain Name System, DNS) technology and load balancing technology. DNS technology can direct user requests to the node with the closest geographical location or the node with lighter load, thereby reducing latency and improving user experience. It can also dynamically adjust the resolution strategy based on the working status of each node viewed in real time to avoid sending requests to faulty nodes. Load balancing technology can evenly distribute user requests to each node, thereby preventing a single node from being overloaded. Among them, polling, weighted polling, minimum number of connections and other strategies can be used to distribute traffic according to the processing capacity of each node and the current load situation.

[0042] Optionally, in order to further improve the efficiency of the abnormal traffic attack defense of the blockchain structure, the abnormal traffic attack defense device can classify the nodes in the blockchain structure into receiving nodes and processing nodes. The receiving nodes are used to receive the distributed traffic in full and further distribute the received traffic to the appropriate processing nodes. The processing nodes are used to detect abnormal traffic. Although both the receiving nodes and the processing nodes can be configured with abnormal traffic detection functions and defense operation functions, and both participate in and receive commands from smart contracts, the nodes are classified and divided so that the receiving nodes focus on receiving traffic and distributing traffic according to node distribution rules, and the processing nodes focus on abnormal traffic detection, which can further improve the efficiency of abnormal traffic attack defense. Among them, the ratio between the receiving nodes and the processing nodes can be set by relevant staff and the abnormal traffic attack defense device, and can also be adjusted based on actual working conditions. For example, the receiving nodes can be transformed into processing nodes, and the processing nodes can also be transformed into receiving nodes.

[0043] When many users send requests, the data streams formed by these requests constitute traffic, so the target request sent by the user can be received, and then the target request can be sent to the target receiving node based on the node distribution rules in the smart contract. The target receiving node is a receiving node determined based on the node distribution rules and suitable for the target request. The target request is any request in the received traffic. After receiving the target request, the target receiving node can send the target request to the target processing node based on the node distribution rules. The target processing node performs abnormal traffic detection on the target request to determine whether the target request belongs to abnormal traffic.

[0044] Please also see Figure 4 , an example schematic diagram of target request distribution is provided for an embodiment of the present application. Receiving nodes, such as receiving node A and receiving node B, etc., may be configured in the blockchain structure. Processing nodes, such as processing node A and processing node B, etc. may also be configured. When a user's target request is received, a suitable target receiving node for the target request may be determined based on the node distribution rule in the smart contract. If the target receiving node is receiving node A, the target request may be distributed to receiving node A. Receiving node A may determine a suitable target processing node for the target request according to the node distribution rule. If the target processing node is processing node A, receiving node A may send the target request to processing node A for abnormal traffic detection.

[0045] S204: If the target processing node detects that the target traffic is abnormal traffic based on the abnormality judgment rule, characteristic information of the target traffic is obtained.

[0046] Specifically, the target processing node can be any processing node in the blockchain structure, and the target traffic is part of the traffic distributed to the target processor. It can be understood that the target traffic can be a single request or can include multiple requests. Since each node can have an abnormal traffic detection function, the target processing node can determine whether the target traffic is abnormal traffic based on the configured abnormal traffic detection function and the abnormal judgment rules in the smart contract. If the target processing node detects that the target traffic is abnormal traffic, it can obtain characteristic information of the target traffic, wherein the characteristic information may include the number of requests contained in the target traffic, the Internet Protocol Address (IP) of each request, the transaction function targeted by each request, etc.

[0047] Optionally, the abnormal judgment rules can be set and changed by relevant staff and the abnormal traffic attack defense device based on actual needs. For example, the abnormal judgment rules can include:

[0048] If the node detects that the flow value of the target traffic is greater than the flow threshold, the node can determine that the target traffic is abnormal traffic, where the flow value is used to indicate the size of the traffic, which can be the amount of data or request sent to the node within the same time, and the flow threshold can be the initial setting of the abnormal traffic attack defense device, or it can be set by relevant staff and the abnormal traffic attack defense device based on actual needs. Therefore, if the target processing node detects that the flow value of the target traffic is greater than the flow threshold, the target processing node can determine that the target traffic is abnormal traffic.

[0049] If the node detects that the amount of requests belonging to the same device address in the target traffic is greater than the first request threshold, the node can determine that the target traffic is abnormal traffic, wherein the device address can be the IP address of the terminal device requesting the said device, and the first request threshold is used to determine whether the amount of requests belonging to the same device address is too much. It can be the initial setting of the abnormal traffic attack defense device, and can also be set by relevant staff and the abnormal traffic attack defense device based on actual needs. Therefore, if the target processing node detects that the amount of requests belonging to the same device address in the target traffic is greater than the request threshold, the target processing node can determine that the target traffic is abnormal traffic.

[0050] If the node detects that the number of requests for the same transaction service in the target traffic is greater than the second request threshold, the node can determine that the target traffic is abnormal traffic, where the second request threshold is used to determine whether the number of requests for the same transaction service is too much. It can be the initial setting of the abnormal traffic attack defense device, or it can be set by relevant staff and the abnormal traffic attack defense device based on actual needs. Therefore, if the target processing node detects that the number of requests for the same transaction service is greater than the second request threshold, the target processing node can determine that the target traffic is abnormal traffic.

[0051] If the node detects that the device address corresponding to the target traffic exists in the access blacklist, the node can determine that the target traffic is abnormal traffic. The access blacklist can store abnormal device addresses, which are device addresses with abnormal traffic attack behaviors, or device addresses that are prohibited from accessing the transaction server by relevant staff and abnormal traffic attack defense devices. Therefore, if the target processing node detects that the device address corresponding to the target traffic exists in the access blacklist, the target processing node can determine that the target traffic is abnormal traffic.

[0052] If the node detects that the request message of the target traffic contains an information detection behavior message, the node can determine that the target traffic is abnormal traffic. The information detection behavior message can be a message for detecting network status, service information or system characteristics, etc. Therefore, if the target processing node detects that the request message of the target traffic contains an information detection behavior message, the target processing node can determine that the target traffic is abnormal traffic.

[0053] S206, generating an abnormal traffic verification request based on the characteristic information, and sending the abnormal traffic verification request to other nodes in the blockchain network.

[0054] Specifically, the target processing node can generate an abnormal traffic verification request based on the characteristic information, that is, the abnormal traffic verification request contains the characteristic information, and then send the abnormal traffic verification request to other nodes in the blockchain network, where the other nodes can be all nodes except the target processing node, or other processing nodes except the target processing node. Since there is a consensus mechanism among the nodes in the blockchain structure, the consensus mechanism means that different nodes in the blockchain structure need to reach an agreement to ensure that all nodes have a common understanding of the data and status on the blockchain, thereby further improving the security and reliability of the abnormal traffic attack defense, the abnormal traffic verification request is used to request other nodes to jointly verify whether the target traffic is abnormal traffic.

[0055] S208: If other nodes determine that the target traffic is abnormal traffic based on the abnormality judgment rule, it is determined that the abnormal traffic verification request is passed.

[0056] Specifically, other nodes can perform abnormal traffic detection on target traffic based on abnormal judgment rules and feature information based on the consensus mechanism and smart contracts. If other nodes also determine that the target traffic is abnormal traffic based on the abnormal judgment rules, the abnormal traffic verification request is determined to be passed.

[0057] S210: If the abnormal traffic verification request is passed, a defense instruction is sent to all nodes for the target traffic, so that all nodes perform defense operations for the target traffic.

[0058] Specifically, when all nodes on the blockchain structure determine that the target traffic is abnormal traffic, the abnormal traffic verification request passes, indicating that all nodes have a consensus on the result that the target traffic is abnormal traffic. If the abnormal traffic verification request passes, defense instructions can be sent to all nodes for the target traffic, so that all nodes perform defense operations on the target traffic. For example, defense operations may include absorption, isolation, or cleaning, etc. Absorption can be the process of managing and mitigating abnormal traffic at the network level, isolation can be separating abnormal traffic from the network to prevent abnormal traffic attacks or infections from spreading to other nodes or transaction servers, and cleaning can be the process of filtering abnormal traffic to remove abnormal requests and only pass normal requests to the transaction server. Since abnormal traffic often has the characteristic of excessively large traffic values, it is difficult for a single node to defend against it. Using all nodes in the blockchain structure to perform defense operations on target traffic improves the efficiency and success rate of defense operations, reduces the burden of a single cleaning center, and improves the ability to handle large-scale attacks.

[0059] Optionally, if the target processing node determines that the target traffic is abnormal traffic because the traffic value of the target traffic is greater than the traffic threshold, and the abnormal traffic verification request passes, a defense instruction can be sent to all nodes for the target traffic, and the target traffic can be distributed to all nodes so that all nodes clean the target traffic. Since the abnormal traffic attack defense device can classify nodes into receiving nodes and processing assembly points, the target traffic can also be distributed to all processing nodes so that all processing nodes clean the target traffic.

[0060] Optionally, the nodes performing defense operations can dynamically adjust the defense operation strategy according to the real-time traffic conditions, such as increasing the scale of traffic cleaning or redistributing traffic. Dynamic adjustment can quickly respond to changing attack patterns and improve the effectiveness of defense, thereby reasonably allocating resources to each node according to the attack scale and traffic conditions, and improving the efficiency of defense against abnormal traffic attacks.

[0061] Optionally, if the target traffic is abnormal traffic, the abnormal traffic attack defense device can obtain the characteristic information of the target traffic and the working information of each node when performing defense operations, so that relevant staff can analyze the attack mode of the target traffic and the effectiveness of the response of each node based on the characteristic information and work information, and adjust the relevant parameters of the smart contract according to the analysis results.

[0062] S212: If the target processing node detects that the target traffic is non-abnormal traffic, the target traffic is sent to the transaction server so that the transaction server processes the request in the target traffic.

[0063] Specifically, if the target processing node detects that the target traffic is non-abnormal traffic, that is, the target traffic does not meet the abnormal traffic in the abnormal judgment rule, it means that the request in the target traffic is a normal request sent by a normal user, then the target processing node can send the target traffic to the transaction server so that the transaction server can process and respond to the request in the target traffic.

[0064] Optionally, since there may be a small number of normal requests in the abnormal traffic, these normal requests are classified as abnormal traffic because they are sent at the same time or in the same area as the abnormal traffic. However, the node's defense operation can absorb, isolate or clean the abnormal traffic, so that normal requests can be filtered out from the target traffic. Each node can send the obtained normal requests to the transaction server, so that the transaction server processes and responds to the normal requests in the target traffic, further improving the accuracy of abnormal traffic attack defense and ensuring normal transaction requests of normal users.

[0065] In an embodiment of the present application, the received traffic is distributed to each node in the blockchain structure based on the smart contract. The node distribution rules and abnormal judgment rules can be configured in the smart contract, thereby improving the response speed of user requests and avoiding overload of the server of a single node. The nodes can be classified into receiving nodes and processing nodes. The receiving nodes focus on receiving traffic and distributing traffic according to the node distribution rules, and the processing nodes focus on abnormal traffic detection, which further improves the efficiency of abnormal traffic attack defense. If the target processing node detects that the target traffic is abnormal traffic based on the abnormal judgment rule, the characteristic information of the target traffic is obtained, and an abnormal traffic verification request is generated based on the characteristic information. The abnormal traffic verification request is sent to other nodes in the blockchain network. If other nodes determine that the target traffic is abnormal traffic based on the abnormal judgment rule, it is determined that the abnormal traffic verification request passes to ensure that all nodes have a common understanding of the data and status on the blockchain, thereby further improving the security and reliability of abnormal traffic attack defense. If the abnormal traffic verification request passes, a defense instruction is sent to all nodes for the target traffic, so that all nodes perform defense operations for the target traffic. By using each node in the blockchain to detect abnormal traffic, when any node detects abnormal traffic, all nodes in the blockchain can be used to defend and clean the abnormal traffic, which improves the efficiency of traffic detection and defense, thereby improving the server's response speed to user requests. If the target processing node detects that the target traffic is non-abnormal traffic, the target traffic is sent to the transaction server so that the transaction server processes the requests in the target traffic. It can also filter out normal requests from the abnormal traffic so that the transaction server processes and responds to normal requests in the target traffic, further improving the accuracy of abnormal traffic attack defense and ensuring normal transaction requests of normal users.

[0066] The following will be combined with the attached Figure 5 -Attached Figure 6 , the abnormal traffic attack defense device provided in the embodiment of the present application is introduced in detail. It should be noted that the attached Figure 5 -Attached Figure 6 The abnormal traffic attack defense device in the present application is used to execute Figure 1-Figure 4 For the convenience of explanation, only the part related to the embodiment of the present application is shown. For the specific technical details not disclosed, please refer to the present application. Figure 1-Figure 4 The embodiment shown.

[0067] See also Figure 5 , which shows a schematic diagram of the structure of an abnormal traffic attack defense device provided by an exemplary embodiment of the present application. The abnormal traffic attack defense device can be implemented as all or part of the device through software, hardware or a combination of both. The device 1 includes a traffic distribution unit 11, an abnormal traffic detection unit 12 and a defense operation unit 13.

[0068] A traffic distribution unit 11, used to distribute the received traffic to each node in the blockchain structure based on the smart contract;

[0069] The abnormal traffic detection unit 12 is used to initiate an abnormal traffic verification request based on the target traffic if the target processing node detects that the target traffic is abnormal traffic;

[0070] The defense operation unit 13 is used to send a defense instruction to all nodes for the target traffic if the abnormal traffic verification request is passed, so that all nodes perform a defense operation for the target traffic.

[0071] In this embodiment, the received traffic is distributed to each node in the blockchain structure based on the smart contract. If the target processing node detects that the target traffic is abnormal traffic, an abnormal traffic verification request is initiated based on the target traffic. If the abnormal traffic verification request is passed, a defense instruction is sent to all nodes for the target traffic, so that all nodes perform defense operations for the target traffic. By using each node in the blockchain to detect abnormal traffic, when any node detects abnormal traffic, all nodes in the blockchain can be used to perform defense cleaning on the abnormal traffic, which improves the detection and defense efficiency of the traffic, thereby improving the response speed of the server to user requests.

[0072] See also Figure 6 , which shows a schematic diagram of the structure of an abnormal traffic attack defense device provided by an exemplary embodiment of the present application. The abnormal traffic attack defense device can be implemented as all or part of the device through software, hardware or a combination of both. The device 1 includes a traffic distribution unit 11, a traffic value detection unit 14, an abnormal traffic detection unit 12, a consensus mechanism unit 15, a defense operation unit 13 and a transaction request processing unit 16.

[0073] A traffic distribution unit 11, used to distribute the received traffic to each node in the blockchain structure based on the smart contract;

[0074] Optionally, the smart contract includes node distribution rules and exception judgment rules, wherein the node distribution rules are used to distribute traffic to each node in the blockchain network, and the exception judgment rules are used by the nodes in the blockchain network to judge abnormal traffic.

[0075] Optionally, the node distribution rule includes one or more of intelligent domain name resolution technology and load balancing technology.

[0076] Optionally, the traffic distribution unit 11 is specifically used to receive a target request sent by a user, and send the target request to a target receiving node based on the node distribution rule, where the target request is any request in the received traffic;

[0077] The target receiving node sends the target request to a target processing node based on the node distribution rule.

[0078] A flow value detection unit 14, configured to determine that the target flow is abnormal flow if the target processing node detects that the flow value of the target flow is greater than a flow threshold;

[0079] The abnormal traffic detection unit 12 is used to initiate an abnormal traffic verification request based on the target traffic if the target processing node detects that the target traffic is abnormal traffic;

[0080] Optionally, the abnormal traffic detection unit 12 is specifically configured to obtain characteristic information of the target traffic if the target processing node detects that the target traffic is abnormal traffic based on the abnormality judgment rule;

[0081] An abnormal traffic verification request is generated based on the characteristic information, and the abnormal traffic verification request is sent to other nodes in the blockchain network.

[0082] The consensus mechanism unit 15 is used to determine that the abnormal traffic verification request is passed if the other nodes determine that the target traffic is abnormal traffic based on the abnormal judgment rule.

[0083] The defense operation unit 13 is used to send a defense instruction to all nodes for the target traffic if the abnormal traffic verification request is passed, so that all nodes perform a defense operation for the target traffic.

[0084] Optionally, the defense operation unit 13 is specifically used to send a defense instruction to all nodes for the target traffic if the abnormal traffic verification request is passed, and distribute the target traffic to all nodes so that all nodes clean the target traffic.

[0085] The transaction request processing unit 16 is configured to send the target traffic to a transaction server if the target processing node detects that the target traffic is non-abnormal traffic, so that the transaction server processes the request in the target traffic.

[0086] In this embodiment, the received traffic is distributed to each node in the blockchain structure based on the smart contract. The node distribution rules and abnormal judgment rules can be configured in the smart contract, thereby improving the response speed of user requests and avoiding overload of the server of a single node. The nodes can be classified into receiving nodes and processing nodes. The receiving nodes focus on receiving traffic and distributing traffic according to the node distribution rules, and the processing nodes focus on abnormal traffic detection, which further improves the efficiency of abnormal traffic attack defense. If the target processing node detects that the target traffic is abnormal traffic based on the abnormal judgment rule, the characteristic information of the target traffic is obtained, and an abnormal traffic verification request is generated based on the characteristic information. The abnormal traffic verification request is sent to other nodes in the blockchain network. If other nodes determine that the target traffic is abnormal traffic based on the abnormal judgment rule, it is determined that the abnormal traffic verification request passes, so as to ensure that all nodes have a common understanding of the data and status on the blockchain, thereby further improving the security and reliability of abnormal traffic attack defense. If the abnormal traffic verification request passes, a defense instruction is sent to all nodes for the target traffic, so that all nodes perform defense operations for the target traffic. By using each node in the blockchain to detect abnormal traffic, when any node detects abnormal traffic, all nodes in the blockchain can be used to defend and clean the abnormal traffic, which improves the efficiency of traffic detection and defense, thereby improving the server's response speed to user requests. If the target processing node detects that the target traffic is non-abnormal traffic, the target traffic is sent to the transaction server so that the transaction server processes the requests in the target traffic. It can also filter out normal requests from the abnormal traffic so that the transaction server processes and responds to normal requests in the target traffic, further improving the accuracy of abnormal traffic attack defense and ensuring normal transaction requests of normal users.

[0087] It should be noted that the abnormal traffic attack defense device provided in the above embodiment only uses the division of the above functional modules as an example when executing the abnormal traffic attack defense method. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the abnormal traffic attack defense device provided in the above embodiment and the abnormal traffic attack defense method embodiment belong to the same concept, and the implementation process thereof is detailed in the method embodiment, which will not be repeated here.

[0088] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0089] The present application also provides a computer storage medium, which can store multiple instructions, and the instructions are suitable for being loaded and executed by a processor as described above. Figure 1-Figure 4The abnormal traffic attack defense method of the embodiment shown in the figure can be specifically executed by referring to Figure 1-Figure 4 The specific description of the illustrated embodiment will not be repeated here.

[0090] The present application also provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor as described above. Figure 1-Figure 4 The abnormal traffic attack defense method of the embodiment shown in the figure can be specifically executed by referring to Figure 1-Figure 4 The specific description of the embodiment is shown in detail and will not be repeated here.

[0091] Please refer to Figure 7 , which shows a block diagram of the structure of an electronic device provided by an exemplary embodiment of the present application. The electronic device in the present application may include one or more of the following components: a processor 110, a memory 120, an input device 130, an output device 140, and a bus 150. The processor 110, the memory 120, the input device 130, and the output device 140 may be connected via the bus 150.

[0092] The processor 110 may include one or more processing cores. The processor 110 uses various interfaces and lines to connect various parts of the entire electronic device, and executes various functions and processes data of the terminal 100 by running or executing instructions, programs, code sets or instruction sets stored in the memory 120, and calling data stored in the memory 120. Optionally, the processor 110 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 110 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user pages, and applications; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 110, but may be implemented separately through a communication chip.

[0093] The memory 120 may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the memory 120 includes a non-transitory computer-readable medium (Non-Transitory Computer-Readable Storage Medium). The memory 120 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 120 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc. The operating system may be an Android system, including a system deeply developed based on the Android system, an IOS system developed by Apple, including a system deeply developed based on the IOS system or other systems.

[0094] The memory 120 can be divided into an operating system space and a user space. The operating system runs in the operating system space, and native and third-party applications run in the user space. In order to ensure that different third-party applications can achieve good operating results, the operating system allocates corresponding system resources to different third-party applications. However, the requirements for system resources in different application scenarios in the same third-party application are also different. For example, in the local resource loading scenario, the third-party application has higher requirements for disk reading speed; in the animation rendering scenario, the third-party application has higher requirements for GPU performance. The operating system and third-party applications are independent of each other, and the operating system often cannot perceive the current application scenario of the third-party application in a timely manner, resulting in the operating system being unable to perform targeted system resource adaptation according to the specific application scenario of the third-party application.

[0095] In order for the operating system to distinguish the specific application scenarios of third-party applications, it is necessary to open up data communication between third-party applications and the operating system so that the operating system can obtain the current scenario information of third-party applications at any time, and then perform targeted system resource adaptation based on the current scenario.

[0096] The input device 130 is used to receive input commands or data, and includes but is not limited to a keyboard, a mouse, a camera, a microphone, or a touch device. The output device 140 is used to output commands or data, and includes but is not limited to a display device and a speaker. In one example, the input device 130 and the output device 140 can be combined, and the input device 130 and the output device 140 are touch screen displays.

[0097] The touch display screen can be designed as a full screen, a curved screen or a special-shaped screen. The touch display screen can also be designed as a combination of a full screen and a curved screen, or a combination of a special-shaped screen and a curved screen, which is not limited in the embodiments of the present application.

[0098] In addition, those skilled in the art will appreciate that the structure of the electronic device shown in the above drawings does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown, or combine certain components, or arrange the components differently. For example, the electronic device also includes a radio frequency circuit, an input unit, a sensor, an audio circuit, a wireless fidelity (WiFi) module, a power supply, a Bluetooth module and other components, which will not be described in detail here.

[0099] exist Figure 7 In the electronic device shown, the processor 110 can be used to call the abnormal traffic attack defense application stored in the memory 120, and specifically perform the following operations:

[0100] Distribute the received traffic to each node in the blockchain structure based on smart contracts;

[0101] If the target processing node detects that the target traffic is abnormal traffic, an abnormal traffic verification request is initiated based on the target traffic;

[0102] If the abnormal traffic verification request is passed, a defense instruction is sent to all nodes for the target traffic, so that all nodes perform a defense operation for the target traffic.

[0103] In one embodiment, the smart contract includes node distribution rules and exception judgment rules, wherein the node distribution rules are used to distribute traffic to each node in the blockchain network, and the exception judgment rules are used by the nodes in the blockchain network to judge abnormal traffic.

[0104] In one embodiment, the node distribution rule includes one or more of intelligent domain name resolution technology and load balancing technology.

[0105] In one embodiment, when executing the smart contract-based distribution of received traffic to each node in the blockchain structure, the processor 110 specifically performs the following operations:

[0106] receiving a target request sent by a user, and sending the target request to a target receiving node based on the node distribution rule, wherein the target request is any request in the received traffic;

[0107] The target receiving node sends the target request to a target processing node based on the node distribution rule.

[0108] In one embodiment, when the processor 110 executes the following operations when initiating an abnormal traffic verification request based on the target traffic if the target processing node detects that the target traffic is abnormal traffic:

[0109] If the target processing node detects that the target flow is abnormal flow based on the abnormality judgment rule, then acquiring characteristic information of the target flow;

[0110] An abnormal traffic verification request is generated based on the characteristic information, and the abnormal traffic verification request is sent to other nodes in the blockchain network.

[0111] In one embodiment, before executing if the abnormal traffic verification request passes, sending a defense instruction to all nodes for the target traffic so that all nodes perform a defense operation for the target traffic, the processor 110 further performs the following operations:

[0112] If the other nodes determine that the target traffic is abnormal traffic based on the abnormality judgment rule, it is determined that the abnormal traffic verification request is passed.

[0113] In one embodiment, when executing the abnormal traffic attack defense method, the processor 110 further performs the following operations:

[0114] If the target processing node detects that the flow value of the target flow is greater than the flow threshold, the target processing node determines that the target flow is abnormal flow;

[0115] When the processor 110 executes the following operations specifically: if the abnormal traffic verification request is passed, sending a defense instruction to all nodes for the target traffic so that all nodes perform a defense operation for the target traffic:

[0116] If the abnormal traffic verification request is passed, a defense instruction is sent to all nodes for the target traffic, and the target traffic is distributed to all nodes, so that all nodes clean the target traffic.

[0117] In one embodiment, when executing the abnormal traffic attack defense method, the processor 110 further performs the following operations:

[0118] If the target processing node detects that the target traffic is non-abnormal traffic, the target traffic is sent to the transaction server so that the transaction server processes the request in the target traffic.

[0119] In this embodiment, the received traffic is distributed to each node in the blockchain structure based on the smart contract. The node distribution rules and abnormal judgment rules can be configured in the smart contract, thereby improving the response speed of user requests and avoiding overload of the server of a single node. The nodes can be classified into receiving nodes and processing nodes. The receiving nodes focus on receiving traffic and distributing traffic according to the node distribution rules, and the processing nodes focus on abnormal traffic detection, which further improves the efficiency of abnormal traffic attack defense. If the target processing node detects that the target traffic is abnormal traffic based on the abnormal judgment rule, the characteristic information of the target traffic is obtained, and an abnormal traffic verification request is generated based on the characteristic information. The abnormal traffic verification request is sent to other nodes in the blockchain network. If other nodes determine that the target traffic is abnormal traffic based on the abnormal judgment rule, it is determined that the abnormal traffic verification request passes, so as to ensure that all nodes have a common understanding of the data and status on the blockchain, thereby further improving the security and reliability of abnormal traffic attack defense. If the abnormal traffic verification request passes, a defense instruction is sent to all nodes for the target traffic, so that all nodes perform defense operations for the target traffic. By using each node in the blockchain to detect abnormal traffic, when any node detects abnormal traffic, all nodes in the blockchain can be used to defend and clean the abnormal traffic, which improves the efficiency of traffic detection and defense, thereby improving the server's response speed to user requests. If the target processing node detects that the target traffic is non-abnormal traffic, the target traffic is sent to the transaction server so that the transaction server processes the requests in the target traffic. It can also filter out normal requests from the abnormal traffic so that the transaction server processes and responds to normal requests in the target traffic, further improving the accuracy of abnormal traffic attack defense and ensuring normal transaction requests of normal users.

[0120] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0121] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

[0122] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions. For example, the smart contracts, user requests and feature information involved in this specification are all obtained with full authorization.

Claims

1. A method for defending against abnormal traffic attacks, the method comprising: Distribute the received traffic to each node in the blockchain structure based on smart contracts; If the target processing node detects that the target traffic is abnormal traffic, an abnormal traffic verification request is initiated based on the target traffic; If the abnormal traffic verification request is passed, a defense instruction is sent to all nodes for the target traffic, so that all nodes perform a defense operation for the target traffic.

2. According to the method of claim 1, the smart contract includes node distribution rules and abnormality judgment rules, wherein: The node distribution rule is used to distribute traffic to each node in the blockchain network, and the abnormality judgment rule is used by the nodes in the blockchain network to judge abnormal traffic.

3. According to the method of claim 2, the node distribution rules include one or more of intelligent domain name resolution technology and load balancing technology.

4. The method according to any one of claims 1 to 3, wherein the step of distributing the received traffic to each node in the blockchain structure based on a smart contract comprises: receiving a target request sent by a user, and sending the target request to a target receiving node based on the node distribution rule, wherein the target request is any request in the received traffic; The target receiving node sends the target request to a target processing node based on the node distribution rule.

5. The method according to claim 1 or 2, wherein if the target processing node detects that the target traffic is abnormal traffic, initiating an abnormal traffic verification request based on the target traffic comprises: If the target processing node detects that the target flow is abnormal flow based on the abnormality judgment rule, then acquiring characteristic information of the target flow; An abnormal traffic verification request is generated based on the characteristic information, and the abnormal traffic verification request is sent to other nodes in the blockchain network.

6. The method according to claim 5, wherein if the abnormal traffic verification request is passed, before sending a defense instruction to all nodes for the target traffic so that all nodes perform a defense operation for the target traffic, the method further comprises: If the other nodes determine that the target traffic is abnormal traffic based on the abnormality judgment rule, it is determined that the abnormal traffic verification request is passed.

7. The method according to claim 5, further comprising: If the target processing node detects that the flow value of the target flow is greater than the flow threshold, the target processing node determines that the target flow is abnormal flow; If the abnormal traffic verification request is passed, a defense instruction is sent to all nodes for the target traffic, so that all nodes perform a defense operation for the target traffic, including: If the abnormal traffic verification request is passed, a defense instruction is sent to all nodes for the target traffic, and the target traffic is distributed to all nodes, so that all nodes clean the target traffic.

8. The method according to claim 1, further comprising: If the target processing node detects that the target traffic is non-abnormal traffic, the target traffic is sent to the transaction server so that the transaction server processes the request in the target traffic.

9. An abnormal traffic attack defense device, the device comprising: A traffic distribution unit, used to distribute the received traffic to each node in the blockchain structure based on the smart contract; an abnormal traffic detection unit, configured to initiate an abnormal traffic verification request based on the target traffic if the target processing node detects that the target traffic is abnormal traffic; The defense operation unit is used to send a defense instruction to all nodes for the target traffic if the abnormal traffic verification request is passed, so that all nodes perform a defense operation for the target traffic.

10. A computer storage medium storing a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the method steps according to any one of claims 1 to 8.

11. A computer program product, wherein the computer program product stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the method steps according to any one of claims 1 to 8.

12. An electronic device comprising: A processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method steps as claimed in any one of claims 1 to 8.

Images