DDoS defense method, device, computer device, storage medium and program product

Abstract

The application relates to a DDoS defense method, device, computer equipment, storage medium and program product. The method comprises the following steps: acquiring source IP information corresponding to traffic information; acquiring a protection rule corresponding to the source IP information from a preset rule library, and acquiring IP attribution information corresponding to the source IP information from a preset IP attribution database; determining a defense measure corresponding to the traffic information according to the IP attribution information and the protection rule; and the defense measure is used for representing whether the traffic information is subjected to DDoS defense. The method can quickly and efficiently identify and analyze whether the traffic needs to be subjected to DDoS defense and the corresponding defense measure based on the IP attribution of the traffic and the corresponding protection rule at the network layer, so that the system security is improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a DDoS defense method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] A Distributed Denial of Service (DDoS) attack is a malicious attack in which multiple computers or network nodes coordinate to send a large number of requests or data packets to a target, exhausting the target system's resources and preventing it from responding to legitimate users' requests. In today's network environment, DDoS attacks have become very common, posing a serious threat to network services.

[0003] Traditional technologies primarily rely on monitoring whether actual traffic exceeds a traffic threshold to determine whether to defend against DDoS attacks targeting the system. However, in traditional technologies, the traffic threshold is set based on empirical values, which cannot meet actual protection needs and are not conducive to improving system security. Summary of the Invention

[0004] Therefore, it is necessary to provide a DDoS defense method, device, computer equipment, computer-readable storage medium, and computer program product that can improve system security in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a DDoS defense method, including:

[0006] Obtain the source IP information corresponding to the traffic information;

[0007] The protection rules corresponding to the source IP information are obtained from a preset rule base, and the IP attribution information corresponding to the source IP information is obtained from a preset IP attribution database; the protection rules represent the processing methods for traffic with different IP attributions.

[0008] Based on the IP attribution information and the protection rules, the corresponding defense measures for the traffic information are determined; the defense measures are used to characterize whether to perform DDoS protection on the traffic information.

[0009] In one embodiment, the protection rule includes at least one sub-rule, and determining the defense measures corresponding to the traffic information based on the IP attribution information and the protection rule includes:

[0010] According to the priority of each sub-rule, the verification reference information and the IP attribution information corresponding to each sub-rule are compared in turn to obtain the verification result of each sub-rule for the traffic information.

[0011] Based on the verification results of each sub-rule for the traffic information, the corresponding defense measures for the traffic information are determined.

[0012] In one embodiment, comparing the verification reference information corresponding to each of the sub-rules with the IP attribution information to obtain the verification result of each of the sub-rules for the traffic information includes:

[0013] For each sub-rule, if the verification reference information corresponding to the sub-rule matches the IP attribution information, the verification result of the sub-rule for the traffic information is determined to be successful.

[0014] For each sub-rule, if the verification reference information corresponding to the sub-rule does not match the IP attribution information, the verification result of the sub-rule for the traffic information is determined to be a verification failure.

[0015] In one embodiment, determining the defense measures corresponding to the traffic information based on the verification results of each of the sub-rules for the traffic information includes:

[0016] For each sub-rule, if the verification result of the sub-rule for the traffic information is successful, obtain the action information corresponding to the sub-rule; the action information represents the defense measures against the traffic information;

[0017] Based on the priority of each sub-rule, target action information is determined from the action information corresponding to each sub-rule as the defense measure corresponding to the traffic information; the priority of the sub-rule corresponding to the target action information is higher than the priority of the sub-rules other than the sub-rule corresponding to the target action information.

[0018] In one embodiment, obtaining the IP attribution information corresponding to the source IP information from a preset IP attribution database includes:

[0019] A red-black tree is determined based on the IP network segment corresponding to the source IP information; the red-black tree is used to filter out the source IP information from the preset IP address information; the IP address information in the red-black tree is stored in host order.

[0020] In the preset IP address information in the red-black tree, the search is performed bit by bit, starting from the least significant bit of the IP address information, until the target IP address information that matches the source IP information is found.

[0021] The IP attribution information corresponding to the target IP address information in the preset IP attribution database is used as the IP attribution information corresponding to the source IP information.

[0022] In one embodiment, the method further includes:

[0023] Based on the IP attribution information and the protection rules, determine the attack behavior records corresponding to the traffic information;

[0024] The preset rule base is updated based on the recorded attack behavior.

[0025] In one embodiment, after the step of determining the defense measures corresponding to the traffic information, the method further includes:

[0026] Execute the defense measures corresponding to each of the traffic information, and determine the traffic information to be forwarded in each of the traffic information based on the execution results of the defense measures corresponding to each of the traffic information;

[0027] The traffic information to be forwarded is sent to the service server corresponding to the traffic information to be forwarded; the service server is used to process the traffic information.

[0028] Secondly, this application also provides a DDoS defense device applied to a load balancer, comprising:

[0029] The acquisition module is used to obtain the source IP information corresponding to the traffic information;

[0030] The filtering module is used to obtain the protection rules corresponding to the source IP information from a preset rule base, and to obtain the IP attribution information corresponding to the source IP information from a preset IP attribution database; the protection rules represent the processing methods for traffic with different IP attributions.

[0031] The determination module is used to determine the defense measures corresponding to the traffic information based on the IP attribution information and the protection rules; the defense measures are used to characterize whether to perform DDoS defense on the traffic information.

[0032] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program that, when executed by the processor, implements the steps of the method described above.

[0033] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the steps of the above-described method.

[0034] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the steps of the above-described method.

[0035] The aforementioned DDoS defense methods, devices, computer equipment, computer-readable storage media, and computer program products acquire source IP information corresponding to traffic information in a timely manner, enabling subsequent analysis based on the source IP to determine whether DDoS defense should be implemented. They retrieve protection rules corresponding to the source IP information from a preset rule base and IP attribution information from a preset IP attribution database. These protection rules characterize the processing methods for traffic with different IP attributions, thus accurately acquiring the protection rules and IP attribution corresponding to the source IP based on the rule base and IP attribution database. This allows for subsequent determination of whether DDoS defense should be implemented and the corresponding defense measures based on the IP attribution information and protection rules. Based on the IP attribution information and protection rules, the corresponding defense measures for the traffic information are determined. These defense measures characterize whether DDoS defense should be implemented for the traffic information, accurately analyzing the processing methods for traffic corresponding to the IP attribution information according to the protection rules, and obtaining accurate defense measures. This allows for rapid and efficient identification and analysis at the network layer based on the IP attribution of traffic and corresponding protection rules to determine whether DDoS defense is needed and the corresponding defense measures, thereby improving system security. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 This is an application environment diagram of a DDoS defense method in one embodiment;

[0038] Figure 2 This is a flowchart illustrating a DDoS defense method in one embodiment;

[0039] Figure 3 This is a schematic diagram of the architecture of a DDoS defense system in one embodiment;

[0040] Figure 4 This is a schematic diagram of a location-based DDoS defense process in one embodiment;

[0041] Figure 5 This is a structural block diagram of a DDoS defense device in one embodiment;

[0042] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0044] The DDoS defense method provided in this application embodiment can be applied to, for example... Figure 1 The application environment shown is illustrated. The anti-DDoS load balancing cluster (such as an anti-DDoS attack load balancing cluster) can be composed of load balancers. The management platform can be a server used to manage the anti-DDoS load balancing cluster 102, and the log storage system can store detailed information about attack packets / attack traffic. The log storage system can be integrated into the management platform or placed in the cloud or on other network servers. The load balancer in the anti-DDoS load balancing cluster can obtain attack traffic / non-attack traffic sent by clients, and perform DDoS defense on attack traffic and forward non-attack traffic to a business server cluster composed of business servers. The load balancer obtains the source IP information corresponding to the traffic information; the load balancer obtains the protection rules corresponding to the source IP information from a preset rule base, and obtains the IP attribution information corresponding to the source IP information from a preset IP attribution database; the load balancer determines the defense measures corresponding to the traffic information based on the IP attribution information and the protection rules; the defense measures are used to characterize whether to perform DDoS defense on the traffic information. The management platform can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0045] In one exemplary embodiment, such as Figure 2 As shown, a DDoS defense method is provided. Taking the application of this method to a load balancer as an example, the method includes the following steps S202 to S206. Wherein:

[0046] Step S202: Obtain the source IP information corresponding to the traffic information.

[0047] Traffic information can refer to data / information transmitted through the Internet or internal networks. In practical applications, traffic information can be used to perform specific business services.

[0048] Source IP information can refer to the Internet Protocol (IP) address of the party sending data packets in network communication.

[0049] As an example, each business server can obtain traffic information from clients. The business server can then process the traffic information and perform corresponding operations to provide business services to users. To avoid the impact of DDoS attacks on business services, the load balancer can analyze and parse the traffic information before forwarding it to the business servers, obtaining the source IP information corresponding to the traffic information to determine whether the traffic information is attack traffic.

[0050] Step S204: Obtain the protection rules corresponding to the source IP information from the preset rule base, and obtain the IP attribution information corresponding to the source IP information from the preset IP attribution database.

[0051] The preset rule base can refer to a pre-set database used to record protection rules (such as processing methods) for traffic information.

[0052] Among them, protection rules can refer to information that characterizes the processing methods for traffic belonging to different IP addresses.

[0053] The preset IP attribution database refers to a pre-set database used to find / determine the IP attribution information corresponding to the source IP information of traffic information. In practical applications, the preset IP attribution database may include a GEO IP database, which can be used to map IP addresses to geographic location information. The GEO IP database can provide information such as the country, region, city, latitude and longitude, and time zone of the IP address, enabling applications to provide location services, geo-targeted advertising, content distribution, and other functions based on the user's IP address.

[0054] Among them, IP attribution information can refer to information that represents the geographical location, organization or institution to which the IP address belongs. In practical applications, IP attribution information may include, but is not limited to, operator, province, city, country, latitude and longitude.

[0055] As an example, to accurately determine whether traffic is attack traffic, the load balancer can obtain pre-set reference information from the management platform, such as a preset rule base and a preset IP attribution database. The preset rule base stores several protection rules, which describe corresponding discrimination conditions. Each source IP information can have a corresponding protection rule. If the source IP information of the traffic meets the discrimination conditions described by the protection rule corresponding to that source IP information, then the traffic information will be determined as attack traffic. The preset IP attribution database stores IP attribution information corresponding to various source IP information, which describes the mapping relationship between source IP information and its corresponding IP attribution information. The load balancer can match the source IP information of the traffic information one by one with the source IP information corresponding to each protection rule in the preset rule base, and use the protection rule corresponding to the matched source IP information (such as the same source IP information as the traffic information) as the protection rule corresponding to the source IP information of the traffic information, thereby obtaining the protection rule corresponding to the source IP information from the preset rule base. The load balancer can also compare the source IP information of the traffic information one by one with the source IP information in the preset IP attribution database to find the IP attribution information corresponding to the source IP information of the traffic information, thereby obtaining the IP attribution information corresponding to the source IP information from the preset IP attribution database.

[0056] Step S206: Determine the defense measures corresponding to the traffic information based on the IP attribution information and protection rules.

[0057] Among them, defense measures can refer to information used to characterize whether to perform DDoS defense on traffic information.

[0058] As an example, IP address attribution information can be used to characterize the geographical location of traffic information. Load balancers can then perform location-based DDoS protection based on IP address attribution information and protection rules. In practical applications, the load balancer can analyze the discrimination conditions described in the protection rules and, by comparing these conditions with the IP address attribution information, determine the discrimination result of the traffic information's IP address attribution information for each condition. Then, based on the discrimination result of the traffic information's IP address attribution information for each condition, the load balancer can determine whether DDoS protection is needed for the traffic information and, if so, what DDoS protection measures to take.

[0059] The aforementioned DDoS defense method obtains the source IP information corresponding to the traffic information in a timely manner, enabling subsequent analysis based on the source IP to determine whether DDoS defense should be implemented. It retrieves protection rules corresponding to the source IP information from a pre-set rule base and IP attribution information from a pre-set IP attribution database. Protection rules characterize the processing methods for traffic with different IP attributions, thus accurately obtaining the protection rules and IP attribution corresponding to the source IP based on the rule base and IP attribution database. This allows for subsequent determination of whether DDoS defense should be implemented and the corresponding defense measures based on the IP attribution information and protection rules. Based on the IP attribution information and protection rules, the corresponding defense measures for the traffic information are determined. These defense measures characterize whether DDoS defense should be implemented for the traffic information, accurately analyzing the processing methods for traffic corresponding to the IP attribution information according to the protection rules, and obtaining accurate defense measures. This allows for rapid and efficient identification and analysis at the network layer based on the traffic's IP attribution and corresponding protection rules to determine whether DDoS defense is needed and the corresponding defense measures, thereby improving system security.

[0060] In an exemplary embodiment, the protection rule includes at least one sub-rule. Based on the IP attribution information and the protection rule, the defense measures corresponding to the traffic information are determined, including: according to the priority of each sub-rule, comparing the verification reference information and IP attribution information corresponding to each sub-rule in turn to obtain the verification result of each sub-rule for the traffic information; and determining the defense measures corresponding to the traffic information based on the verification result of each sub-rule for the traffic information.

[0061] Sub-rules can refer to the information that makes up the protection rules. In practical applications, sub-rules can include, but are not limited to, judgment conditions.

[0062] Priority can refer to information that characterizes the importance and / or urgency of a sub-rule. In practical applications, when sorting sub-rules according to their importance and / or urgency, the sub-rules with higher priority are placed earlier. In specific implementations, when determining whether to defend against DDoS attacks on traffic information, sub-rules with higher priority are used first.

[0063] The verification reference information corresponding to the sub-rule can refer to information used to determine whether to perform DDoS protection on traffic information. In practical applications, the verification reference information may include, but is not limited to, whether to perform DDoS protection on traffic information belonging to a specific IP.

[0064] Among them, the verification result of the sub-rule for traffic information can refer to information that indicates whether DDoS defense is required for traffic information.

[0065] As an example, traffic information can correspond to at least one protection rule. A protection rule can consist of several judgment conditions and other information. The information constituting the protection rule can be used as sub-rules, each with a pre-set priority. When it's necessary to determine whether to implement DDoS protection for the traffic information, the load balancer can compare the verification reference information and IP address attribution information corresponding to each sub-rule according to their respective priorities. This yields the verification result of each sub-rule for the traffic information. The load balancer can then synthesize these verification results to determine whether to implement DDoS protection for the traffic information and, if so, the necessary defensive measures.

[0066] In this embodiment, by comparing the verification reference information and IP attribution information of each sub-rule according to their respective priorities, the verification results of each sub-rule for traffic information are obtained. Based on the verification results of each sub-rule for traffic information, the corresponding defense measures for traffic information are determined. This allows for the sequential verification of traffic information by combining the priorities of each rule in the protection rules, and the determination of whether to implement DDoS defense for traffic information based on the verification results. Thus, the IP attribution information of traffic information is screened in a focused manner based on the protection rules, prioritizing judgment on specific aspects, and timely determining whether to implement DDoS defense, thereby improving the efficiency of DDoS defense.

[0067] In some embodiments, the verification reference information and IP attribution information corresponding to each sub-rule are compared to obtain the verification result of each sub-rule for traffic information, including: for each sub-rule, if the verification reference information corresponding to the sub-rule matches the IP attribution information, the verification result of the sub-rule for traffic information is determined to be verification passed; for each sub-rule, if the verification reference information corresponding to the sub-rule does not match the IP attribution information, the verification result of the sub-rule for traffic information is determined to be verification failed.

[0068] Among them, the verification reference information corresponding to the sub-rule matching the IP attribution information can include the verification reference information corresponding to the sub-rule being the same as the IP attribution information.

[0069] The mismatch between the verification reference information and the IP attribution information corresponding to the sub-rule can include the fact that the verification reference information and the IP attribution information are different.

[0070] As an example, for each sub-rule, if the verification reference information corresponding to the sub-rule is the same as the IP attribution information, or if the verification reference information corresponding to the sub-rule includes a sub-rule containing IP attribution information corresponding to traffic information, the load balancer can determine that the verification reference information of the sub-rule matches the IP attribution information. In this case, the load balancer can set the verification result of the sub-rule for traffic information to pass. Conversely, if the verification reference information corresponding to the sub-rule is different from the IP attribution information, or if the verification reference information corresponding to the sub-rule does not contain a sub-rule containing IP attribution information corresponding to traffic information, the load balancer can determine that the verification reference information of the sub-rule does not match the IP attribution information. In this case, the load balancer can set the verification result of the sub-rule for traffic information to fail.

[0071] In this embodiment, for each sub-rule, if the verification reference information corresponding to the sub-rule matches the IP attribution information, the verification result of the sub-rule for traffic information is determined to be successful; if the verification reference information corresponding to the sub-rule does not match the IP attribution information, the verification result of the sub-rule for traffic information is determined to be unsuccessful. This allows for detailed analysis of the matching between the verification reference information and the IP attribution information corresponding to the sub-rule, accurately obtaining the verification result of the sub-rule for traffic information, improving the accuracy of the verification result, and enabling subsequent accurate determination of whether to perform DDoS defense on traffic information, thereby improving the accuracy of DDoS defense and enhancing system security.

[0072] In some embodiments, the defense measures corresponding to the traffic information are determined based on the verification results of each sub-rule for the traffic information, including: for each sub-rule, if the verification result of the sub-rule for the traffic information is successful, obtaining the action information corresponding to the sub-rule; the action information represents the defense measures for the traffic information; and, based on the priority of each sub-rule, determining the target action information as the defense measure corresponding to the traffic information from the action information corresponding to each sub-rule; the priority of the sub-rule corresponding to the target action information is higher than the priority of the sub-rules other than the sub-rule corresponding to the target action information.

[0073] Action information can refer to information that characterizes defensive measures against traffic information.

[0074] The target action information can refer to the action information corresponding to the highest priority sub-rule. In practical applications, the priority of the sub-rule corresponding to the target action information can be higher than the priority of the sub-rules other than the sub-rules corresponding to the target action information.

[0075] As an example, sub-rules are pre-defined with corresponding action information. For each sub-rule, if the verification result for traffic information by the sub-rule passes, the load balancer can use the action information corresponding to that sub-rule as a defense against the traffic information. The load balancer can determine the target action information as the defense against the traffic information from the action information corresponding to each sub-rule that has passed verification, based on their respective priorities. In practical applications, the load balancer can compare the priorities of each sub-rule that has passed verification one by one, and select the sub-rule with the highest priority from among those that have passed verification. At this point, the load balancer can use the action information corresponding to the highest priority sub-rule among the passed sub-rules as the target action information, and use this target action information as the defense against the traffic information.

[0076] In this embodiment, for each sub-rule, if the verification result of the sub-rule regarding traffic information is passed, the corresponding action information of the sub-rule is obtained; the action information represents the defense measures against traffic information; according to the priority of each sub-rule, the target action information is determined from the action information corresponding to each sub-rule as the defense measure against traffic information; the priority of the sub-rule corresponding to the target action information is higher than the priority of the other sub-rules in each sub-rule, so that the target action information used as the defense measure against traffic information can be accurately screened from the action information corresponding to each verified sub-rule based on priority, thereby achieving key screening and improving the accuracy and acquisition efficiency of the defense measures against traffic information.

[0077] In some embodiments, obtaining IP attribution information corresponding to source IP information from a preset IP attribution database includes: determining a red-black tree based on the IP network segment corresponding to the source IP information; using the red-black tree to filter source IP information from preset IP address information; storing IP address information in the red-black tree in host order; searching bit by bit in the preset IP address information in the red-black tree, starting from the least significant bit, until a target IP address matching the source IP information is found; and using the IP attribution information corresponding to the target IP address information in the preset IP attribution database as the IP attribution information corresponding to the source IP information.

[0078] The IP network segment can include, but is not limited to, IPv4 and IPv6 network segments.

[0079] Red-black trees can refer to pre-built models used to filter source IP information from preset IP address information. In practical applications, red-black trees can include binary search trees.

[0080] The preset IP address information can refer to the IP address information corresponding to each node in the red-black tree.

[0081] Host order can refer to the byte order used when storing multi-byte integers.

[0082] The target IP address information can refer to the same IP address information as the source IP information.

[0083] As an example, to improve the efficiency of obtaining IP address information, at least one red-black tree is pre-set. Each red-black tree can correspond to a type of IP network segment. The load balancer can select the red-black tree corresponding to the IP network segment that is the same as the IP network segment corresponding to the source IP information from the pre-set red-black trees. Since each node in the red-black tree can be used to store / represent a type of IP address information, the IP address information corresponding to each node in the red-black tree can be used as the preset IP address information corresponding to the red-black tree. Furthermore, since the preset IP address information in the red-black tree can be stored in host order, the load balancer can search bit by bit in the preset IP address information in the red-black tree, starting from the least significant bit, until it finds an IP address that matches / is the same as the source IP information as the target IP address information. Then, the load balancer can use the IP address information corresponding to the target IP address information in the preset IP address database as the IP address information corresponding to the source IP information.

[0084] In this embodiment, a red-black tree is determined based on the IP network segment corresponding to the source IP information. The red-black tree is used to filter out the source IP information from the preset IP address information. The IP address information in the red-black tree is stored in host order. In the preset IP address information in the red-black tree, the search is performed bit by bit starting from the least significant bit until the target IP address information that matches the source IP information is found. The IP address information corresponding to the target IP address information in the preset IP address database is used as the IP address information corresponding to the source IP information. This allows for a quick search of the IP address information corresponding to the source IP information based on the red-black tree, improving the efficiency of obtaining IP address information.

[0085] In some embodiments, the method further includes: determining the attack behavior record corresponding to the traffic information based on IP attribution information and protection rules; and updating the preset rule base based on the attack behavior record.

[0086] Among them, attack behavior records can refer to information that indicates whether traffic information needs to be protected against DDoS. In practical applications, when traffic information is determined to be DDoS-based attack traffic, the load balancer can generate attack behavior records based on the traffic information. Attack behavior records can describe the location, time and other information of the DDoS attack. In specific implementations, attack behavior records can include, but are not limited to, attack log information.

[0087] As an example, a load balancer can analyze traffic information based on its IP address and corresponding protection rules to determine if it is attack traffic. When traffic is identified as attack traffic, it generates an attack behavior record based on the time of the determination, the load balancer's identifier, and the source of the attack traffic (e.g., IP address). The load balancer can periodically analyze these attack behavior records and adjust the protection rules corresponding to the IP address, thereby updating the preset rule base.

[0088] In this embodiment, attack behavior records corresponding to traffic information are determined based on IP attribution information and protection rules. The preset rule base is updated based on the attack behavior records. This allows for timely updates to the preset rule base in conjunction with the attack behavior of the attack traffic, and flexible adjustments to protection rules for different IP attributions, thereby improving the flexibility and accuracy of DDoS defense.

[0089] In some embodiments, after determining the defense measures corresponding to the traffic information, the method further includes: executing the defense measures corresponding to each traffic information, and determining the traffic information to be forwarded in each traffic information based on the execution result of the defense measures corresponding to each traffic information; sending the traffic information to be forwarded to the service server corresponding to the traffic information to be forwarded; the service server is used to process the traffic information.

[0090] The execution result of the defense measures corresponding to the traffic information can refer to whether the defense measures corresponding to the traffic information have been successfully executed. In practical applications, the defense measures corresponding to the traffic information can include, but are not limited to, packet loss, blacklisting (such as adding to the blacklist), whitelisting (such as adding to the whitelist), etc. Therefore, the execution result of the defense measures corresponding to the traffic information can include, but is not limited to, successfully dropping the traffic packets corresponding to the traffic information, successfully blacklisting the IP address corresponding to the traffic information, and successfully whitelisting the IP address corresponding to the traffic information.

[0091] Among them, traffic information to be forwarded can refer to traffic information that needs to be forwarded to the business server.

[0092] In this context, a business server can refer to a server used to process traffic information. In practical applications, a business server can provide corresponding business services by processing traffic information.

[0093] As an example, after the load balancer obtains the corresponding defense measures for each traffic segment, it can execute these measures, such as packet loss or blocking. Based on the execution results of these measures (e.g., whether packet loss or blocking was successful), the load balancer determines the traffic that needs to be forwarded to the business server. This traffic is designated as the traffic to be forwarded. The load balancer then analyzes the business server that actually needs to process the traffic to be forwarded and designates that server as the corresponding business server for forwarding the traffic. The load balancer then sends the traffic to be forwarded to the corresponding business server. The business server can then process the received traffic to provide services or functions.

[0094] In this embodiment, by executing the defense measures corresponding to each traffic information and determining the traffic information to be forwarded in each traffic information based on the execution results of the defense measures corresponding to each traffic information, the traffic information to be forwarded is sent to the business server corresponding to the traffic information to be forwarded. The business server is used to process the traffic information and can accurately analyze the traffic information that needs to be forwarded to the business server by combining the execution results of the defense measures for each traffic information, thereby optimizing resource utilization and improving the security and stability of the system.

[0095] In some embodiments, such as Figure 1As shown, to conduct DDoS defense based on geographical location in network scenarios such as enterprise networks, data centers, cloud service providers, and carriers, the management platform can be used to manage anti-DDoS clusters (such as a cluster to resist DDoS attacks). The management content mainly includes: distributing and dynamically updating the GEO IP library (such as a preset IP attribution database); distributing anti-DDoS configuration files (such as a preset rule base); and receiving attack log information reported by the anti-DDoS service and forwarding it to the log storage system for use in machine learning and behavioral analysis. The anti-DDoS cluster is set up before the business server cluster. The anti-DDoS cluster can consist of several load balancers, meaning the anti-DDoS function of the anti-DDoS cluster is integrated into the load balancer, thus seamlessly replacing load balancers such as LVS and DPVS, reducing migration costs for enterprises and cloud service providers. After receiving traffic, the anti-DDoS cluster extracts traffic information, including but not limited to source IP and destination IP information. The system searches for matching protection rules for the target IP (e.g., source IP) issued by the management platform. Based on the source IP, it quickly retrieves the IP's attribution information, including but not limited to ISP, province, city, country, and latitude / longitude, within a local high-speed cache system built using the GEO IP database. This attribution information is then compared with the protection rules. Appropriate protective measures are taken according to the rules. Finally, the cleaned traffic is load-balanced and forwarded to the backend business servers, achieving the goal of geolocation-based defense. Simultaneously, attack logs are pushed to the management platform in real time.

[0096] like Figure 3 The diagram illustrates the architecture of a DDoS defense system. This system can be applied to a load balancer and includes a packet receiving module, a configuration loading module, a GEO IP library module, a packet cleaning module, a log reporting module, and a load balancing module. The packet receiving module primarily takes over the network interface card (NIC), quickly collects packets, and distributes them to the processing core. The configuration loading module receives geolocation protection configuration rules (such as protection rules) from the management platform and is also responsible for loading and dynamically updating the GEO IP library. The GEO IP library module is a high-speed cache module for IP geolocation information in memory, utilizing an efficient caching mechanism for fast IP lookup. The packet cleaning module is responsible for searching the source IP's location information in the GEO cache module according to the configured destination IP protection rules, and then executing corresponding protection actions based on the location information matching relationship. For legitimate packets (such as non-attack traffic), they are forwarded to the business server cluster through the load balancing module. Finally, the log reporting module reports attack logs generated by the attack to the management platform for use in machine learning and behavioral analysis.

[0097] A load balancer integrated with anti-D function (such as an anti-D load balancer) can be used to implement geolocation-based DDoS defense. The anti-D load balancer can be developed based on load balancers such as DPVS (Data Plane Virtual Switch) through secondary development, combining the anti-D function with the load balancer. The reason for using DPVS for secondary development is that DPVS is a high-performance four-layer load balancer based on DPDK, which can provide higher performance. The anti-D load balancer can also be developed using DPDK high-performance packet processing frameworks such as VPP (Vector Packet Processor) D. As Figure 4 shown, a schematic diagram of the process of geolocation-based DDoS defense is provided. Configuration is sent from the management platform, where the configuration includes a GEO IP database file. The GEO IP library is stored in the format of <IP network segment, operator, city, province, country>. Additionally, an IP protection rule file, with the protected IP name as the file name, and the internal rules are <priority, inclusion, match item, action>. The match item consists of <country, province, city>. The configuration module loads the IP protection rule file and stores it in memory. After the anti-D load balancer starts, the GEOIP module loads the GEO IP library. Since there are Ipv4 and Ipv6 network segments in the GEO IP library, in order to improve query efficiency, two Red-Black Tree structures are established to store Ipv4 and IPv6 network segments respectively. The Ipv4 segments are stored in host order. In this way, when looking up and comparing, for similar network segments, comparison starts from the lowest bit, which can further improve efficiency. After the program starts, it takes over the physical network card and waits for packets to arrive. When a packet enters the cleaning module, the cleaning module extracts <IP protocol, source IP, destination IP> from the packet. If there is a configuration, the corresponding IP protection rule is found through the destination IP, and based on the source IP, the GEO information of the source IP is found from the GEO IP module. The GEO information is matched according to the priority of the rule. If a match is found, the corresponding action defined by the rule is executed. Actions include but are not limited to packet dropping, blacklisting, and whitelisting. The cleaning module will also record the detailed information of the attack packet <node ID, destination IP, source IP, GEO information>, and the log module reports this information to the management platform. The management platform stores it in the log storage system for machine learning and behavior analysis. The management platform can dynamically update the protection rules based on the analysis results. For the cleaned packets, they are forwarded by the load balancing module to the backend business servers.

[0098] In this embodiment, rapid and efficient geolocation identification is achieved at the network layer (transport layer), enabling appropriate protective measures against attacks or abnormal traffic. Since processing is performed at the network layer, the burden on backend servers (web application firewalls (WAFs) and other security devices) is effectively reduced. Early interception of malicious traffic reduces threats to backend applications and data, lowers security risks, protects sensitive information and business continuity, and simultaneously pushes log information to the management platform in real time, storing it in the log storage system. This provides strong data support for behavioral analysis and machine learning, facilitating dynamic adjustments to protection strategies based on learning results.

[0099] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0100] Based on the same inventive concept, this application also provides a DDoS defense device for implementing the DDoS defense method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more DDoS defense device embodiments provided below can be found in the limitations of the DDoS defense method described above, and will not be repeated here.

[0101] In one exemplary embodiment, such as Figure 5 As shown, a DDoS defense device is provided, applied to a load balancer, including: an acquisition module 502, a filtering module 504, and a determination module 506, wherein:

[0102] The acquisition module 502 is used to acquire the source IP information corresponding to the traffic information.

[0103] The filtering module 504 is used to obtain the protection rules corresponding to the source IP information from a preset rule base, and to obtain the IP attribution information corresponding to the source IP information from a preset IP attribution database.

[0104] The determination module 506 is used to determine the defense measures corresponding to the traffic information based on the IP attribution information and the protection rules; the defense measures are used to characterize whether to perform DDoS defense on the traffic information.

[0105] In one exemplary embodiment, the protection rule includes at least one sub-rule, and the determining module 506 is further configured to compare the verification reference information corresponding to each sub-rule and the IP attribution information in sequence according to the priority of each sub-rule, to obtain the verification result of each sub-rule for the traffic information; and determine the defense measures corresponding to the traffic information based on the verification result of each sub-rule for the traffic information.

[0106] In one exemplary embodiment, the determining module 506 is further configured to, for each sub-rule, determine that the verification result of the sub-rule for the traffic information is verified as successful if the verification reference information corresponding to the sub-rule matches the IP attribution information; and for each sub-rule, determine that the verification result of the sub-rule for the traffic information is verified as unsuccessful if the verification reference information corresponding to the sub-rule does not match the IP attribution information.

[0107] In one exemplary embodiment, the determining module 506 is further configured to, for each sub-rule, if the verification result of the sub-rule for the traffic information is successful, obtain action information corresponding to the sub-rule; the action information represents a defense measure against the traffic information; and, based on the priority of each sub-rule, determine target action information as the defense measure corresponding to the traffic information from the action information corresponding to each sub-rule; the priority of the sub-rule corresponding to the target action information is higher than the priority of the sub-rules other than the sub-rule corresponding to the target action information.

[0108] In one exemplary embodiment, the filtering module 504 is further configured to determine a red-black tree based on the IP network segment corresponding to the source IP information; the red-black tree is used to filter out the source IP information from preset IP address information; the IP address information in the red-black tree is stored in host order; in the preset IP address information in the red-black tree, the search is performed bit by bit starting from the least significant bit of the IP address information until a target IP address information matching the source IP information is found; the IP attribution information corresponding to the target IP address information in the preset IP attribution database is used as the IP attribution information corresponding to the source IP information.

[0109] In one exemplary embodiment, the above-described apparatus further includes an update module, which is specifically configured to determine the attack behavior record corresponding to the traffic information based on the IP attribution information and the protection rules; and update the preset rule base based on the attack behavior record.

[0110] In one exemplary embodiment, the above-described apparatus further includes a forwarding module, which is specifically used to execute defense measures corresponding to each of the traffic information, and determine the traffic information to be forwarded in each of the traffic information based on the execution result of the defense measures corresponding to each of the traffic information; send the traffic information to be forwarded to the service server corresponding to the traffic information to be forwarded; and the service server is used to process the traffic information.

[0111] The modules in the aforementioned DDoS defense device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0112] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 6 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores data such as traffic information and source IP information. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a DDoS defense method.

[0113] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0114] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0115] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0116] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0117] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0118] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0119] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0120] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A DDoS defense method, characterized in that, Applied to load balancers, the method includes: Obtain the source IP information corresponding to the traffic information; The protection rules corresponding to the source IP information are obtained from a preset rule base, and the IP attribution information corresponding to the source IP information is obtained from a preset IP attribution database; the protection rules represent the processing methods for traffic with different IP attributions; the IP attribution information includes operator, province, city, country, latitude and longitude; Based on the IP attribution information and the protection rules, determine the defense measures corresponding to the traffic information; the defense measures are used to characterize whether to perform DDoS defense on the traffic information; including: determining the priority of the sub-rules according to the importance and / or urgency of the sub-rules of the protection rules, comparing the verification reference information corresponding to each sub-rule with the IP attribution information in sequence to obtain the verification result of each sub-rule for the traffic information, and if the verification result of the sub-rule for the traffic information is successful, taking the action information corresponding to the highest priority sub-rule among the successful sub-rules as the defense measures corresponding to the traffic information.

2. The method according to claim 1, characterized in that, The comparison of the verification reference information corresponding to each of the sub-rules with the IP attribution information yields the verification result of each sub-rule for the traffic information, including: For each sub-rule, if the verification reference information corresponding to the sub-rule matches the IP attribution information, the verification result of the sub-rule for the traffic information is determined to be successful. For each sub-rule, if the verification reference information corresponding to the sub-rule does not match the IP attribution information, the verification result of the sub-rule for the traffic information is determined to be a verification failure.

3. The method according to claim 1, characterized in that, The method further includes: For each sub-rule, if the verification result of the sub-rule for the traffic information is successful, obtain the action information corresponding to the sub-rule; the action information represents the defense measures against the traffic information; Based on the priority of each sub-rule, target action information is determined from the action information corresponding to each sub-rule as the defense measure corresponding to the traffic information; the priority of the sub-rule corresponding to the target action information is higher than the priority of the sub-rules other than the sub-rule corresponding to the target action information.

4. The method according to claim 1, characterized in that, The step of obtaining the IP attribution information corresponding to the source IP information from a preset IP attribution database includes: A red-black tree is determined based on the IP network segment corresponding to the source IP information; the red-black tree is used to filter out the source IP information from the preset IP address information; the IP address information in the red-black tree is stored in host order. In the preset IP address information in the red-black tree, the search is performed bit by bit, starting from the least significant bit of the IP address information, until the target IP address information that matches the source IP information is found. The IP attribution information corresponding to the target IP address information in the preset IP attribution database is used as the IP attribution information corresponding to the source IP information.

5. The method according to claim 1, characterized in that, The method further includes: Based on the IP attribution information and the protection rules, determine the attack behavior records corresponding to the traffic information; The preset rule base is updated based on the recorded attack behavior.

6. The method according to claim 1, characterized in that, After the step of determining the defense measures corresponding to the traffic information, the method further includes: Execute the defense measures corresponding to each of the traffic information, and determine the traffic information to be forwarded in each of the traffic information based on the execution results of the defense measures corresponding to each of the traffic information; The traffic information to be forwarded is sent to the service server corresponding to the traffic information to be forwarded; the service server is used to process the traffic information.

7. A DDoS defense device, characterized in that, Applied to a load balancer, the device includes: The acquisition module is used to obtain the source IP information corresponding to the traffic information; The filtering module is used to obtain the protection rules corresponding to the source IP information from a preset rule base, and to obtain the IP attribution information corresponding to the source IP information from a preset IP attribution database; the protection rules represent the processing methods for traffic with different IP attributions; the IP attribution information includes operator, province, city, country, latitude and longitude; A determination module is used to determine the defense measures corresponding to the traffic information based on the IP attribution information and the protection rules; the defense measures are used to characterize whether to perform DDoS defense on the traffic information; including: determining the priority of the sub-rules according to the importance and / or urgency of the sub-rules of the protection rules, comparing the verification reference information corresponding to each sub-rule with the IP attribution information in sequence to obtain the verification result of each sub-rule for the traffic information, and if the verification result of the sub-rule for the traffic information is successful, taking the action information corresponding to the highest priority sub-rule among the successful sub-rules as the defense measures corresponding to the traffic information.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images