Attack detection equipment, method and device and medium

Abstract

The embodiment of the invention provides attack detection equipment, method and device and a medium, which are used for solving the problems that a single CPU core cannot be expanded, more computing resources are occupied and the processing efficiency is low in the prior art. For each NetFlow flow, sending the NetFlow flow to a corresponding target flow statistics CPU core according to the source IP and the destination IP in the quintuple of the NetFlow flow and the stored IP address range processed by each flow statistics CPU core; each flow statistics CPU core counts the message number and the byte number of the NetFlow flow of each IP address in the IP address range, carries out DDoS detection, directly completes NetFlow flow summarization and DDoS detection of the same IP address in the flow statistics CPU core, does not need to be transmitted to a single CPU core for summarization, reduces the occupation of computing resources, improves the processing efficiency, and can also carry out core expansion.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to an attack detection device, method, apparatus and medium. Background Art

[0002] like Figure 1 1. The schematic diagram of the current network detection function (NetFlow) traffic statistics and distributed denial of service attack (DDoS) detection process is shown. After receiving at least one data packet, the processor distributes the received data packet to each parsing central processing unit (CPU) core in turn according to the packet-by-packet sharing rule for NetFlow parsing. After parsing, the NetFlow traffic encapsulated in the data packet and the five-tuple of the NetFlow traffic are obtained, and the five-tuple is hashed. Based on the hash result, the corresponding NetFlow traffic is distributed to the corresponding traffic statistics CPU core. Each traffic statistics CPU core restores each NetFlow traffic received by the traffic statistics CPU core, determines the number of packets and bytes of each NetFlow traffic in each preset period, and sends the source Internet Protocol (Internet Protocol) corresponding to each NetFlow traffic to the CPU core. The single CPU core aggregates the traffic according to the received information, counts the total number of packets and bytes of all NetFlow traffic corresponding to each IP address in each statistical period, and performs DDoS detection for each IP address according to the total number of packets and bytes of all NetFlow traffic corresponding to the IP address in each statistical period.

[0003] However, since traffic aggregation and DDoS detection are performed through a single CPU core, there are performance bottlenecks such as the single CPU core cannot be expanded and occupies a large amount of computing resources, resulting in low processing efficiency. Summary of the invention

[0004] The embodiments of the present application provide an attack detection device, method, apparatus and medium to solve the problems in the prior art that a single CPU core cannot be expanded, occupies a large amount of computing resources and has low processing efficiency.

[0005] In a first aspect, an embodiment of the present application provides an attack detection device, the device comprising a processor, a plurality of analysis central processing unit CPU cores, and a plurality of traffic statistics CPU cores;

[0006] The processor is used to receive each data packet to be analyzed encapsulating the NetFlow traffic of the network detection function, and send each data packet to be analyzed to each analysis CPU core in sequence;

[0007] Each analysis CPU core is used to parse each received data packet to be analyzed, obtain the encapsulated NetFlow flow and the corresponding five-tuple, the number of packets and the number of bytes; for each NetFlow flow, according to the source IP and destination IP in the five-tuple of the NetFlow flow and the IP address range processed by each saved flow statistics CPU core, determine the target flow statistics CPU core corresponding to the NetFlow flow, and send the NetFlow flow to the target flow statistics CPU core;

[0008] Each traffic statistics CPU core is used to count the number of packets and bytes of the NetFlow traffic of each IP address within the IP address range processed by the traffic statistics CPU core, and perform distributed denial of service attack DDoS detection based on the number of packets and bytes of the NetFlow traffic of each IP address.

[0009] In a second aspect, an embodiment of the present application provides an attack detection method, the method comprising:

[0010] Receive each data packet to be analyzed that encapsulates NetFlow traffic;

[0011] Parse each received data packet to be analyzed to obtain encapsulated NetFlow traffic and the corresponding five-tuple, number of messages and number of bytes; for each NetFlow traffic, determine the target traffic statistics CPU core corresponding to the NetFlow traffic according to the source IP and destination IP in the five-tuple of the NetFlow traffic and the IP address range processed by each traffic statistics CPU core in the attack detection device, and send the NetFlow traffic to the target traffic statistics CPU core; make each traffic statistics CPU core count the number of messages and bytes of the NetFlow traffic of each IP address within the IP address range processed by the target traffic statistics CPU core, and perform distributed denial of service attack DDoS detection according to the number of messages and bytes of the NetFlow traffic of each IP address.

[0012] In a third aspect, an embodiment of the present application further provides an attack detection device, the device comprising:

[0013] A receiving module, used for receiving each data packet to be analyzed encapsulated with NetFlow traffic;

[0014] The processing module is used to parse each received data packet to be analyzed, obtain the encapsulated NetFlow flow and the corresponding five-tuple, message number and byte number; for each NetFlow flow, according to the source IP and destination IP in the five-tuple of the NetFlow flow, and the IP address range processed by each flow statistics CPU core in the attack detection device, determine the target flow statistics CPU core corresponding to the NetFlow flow, and send the NetFlow flow to the target flow statistics CPU core; make each flow statistics CPU core count the message number and byte number of the NetFlow flow of each IP address within the IP address range processed by the target flow statistics CPU core, and perform distributed denial of service attack DDoS detection according to the message number and byte number of the NetFlow flow of each IP address.

[0015] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the steps of the attack detection method as described in any one of the above items are implemented.

[0016] In an embodiment of the present application, the attack detection device includes a processor, multiple parsing central processing unit CPU cores, and multiple traffic statistics CPU cores; the processor is used to receive each data packet to be analyzed that encapsulates NetFlow traffic, and sends each data packet to be analyzed to each parsing CPU core in sequence; each parsing CPU core is used to parse each received data packet to be analyzed, and obtain the encapsulated NetFlow traffic and the corresponding five-tuple, the number of packets, and the number of bytes; for each NetFlow traffic, according to the source IP and destination IP in the five-tuple of the NetFlow traffic, and the IP address range processed by each traffic statistics CPU core, the target traffic statistics CPU core corresponding to the NetFlow traffic is determined, and the NetFlow traffic is sent to the target traffic statistics CPU core; each traffic statistics CPU core The core is used to count the number of packets and bytes of the NetFlow traffic of each IP address within the IP address range processed by the traffic statistics CPU core, and perform distributed denial of service attack DDoS detection based on the number of packets and bytes of the NetFlow traffic of each IP address, so that multiple traffic statistics CPU cores can process the NetFlow traffic within the corresponding IP address range respectively, and directly complete the aggregation and DDoS detection of the NetFlow traffic of the same IP address in the traffic statistics CPU core without transmitting it to a single CPU core for aggregation, thereby reducing the computing resources occupied by each traffic statistics CPU core and improving the processing efficiency. In addition, since each traffic statistics CPU core only processes the NetFlow traffic of the IP address range corresponding to the traffic statistics CPU core, the core can also be expanded. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 This is a schematic diagram of the current NetFlow traffic statistics and DDoS detection process;

[0019] Figure 2 A schematic diagram of the structure of an attack detection device provided in an embodiment of the present application;

[0020] Figure 3 A schematic diagram of a DDoS detection process provided in an embodiment of the present application;

[0021] Figure 4 One of the schematic diagrams of a statistical period occupied by NetFlow traffic provided in an embodiment of the present application;

[0022] Figure 5 A second schematic diagram of a statistical period occupied by NetFlow traffic provided in an embodiment of the present application;

[0023] Figure 6 This is a diagram of the current NetFlow traffic restoration method;

[0024] Figure 7 A schematic diagram of an attack detection process provided in an embodiment of the present application;

[0025] Figure 8 A schematic diagram of an attack detection process provided in an embodiment of the present application;

[0026] Fig. 9 A schematic diagram of the structure of an attack detection device provided in an embodiment of the present application;

[0027] Fig.10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to make the purpose and implementation method of the present application clearer, the exemplary implementation method of the present application will be clearly and completely described below in conjunction with the drawings in the exemplary embodiments of the present application. Obviously, the described exemplary embodiments are only part of the embodiments of the present application, rather than all the embodiments.

[0029] It should be noted that the brief description of terms in this application is only for the convenience of understanding the embodiments described below, and is not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their common and usual meanings.

[0030] The terms "first", "second", "third", etc. in the specification and claims of this application and the above drawings are used to distinguish similar or similar objects or entities, and do not necessarily mean to limit a specific order or sequence, unless otherwise noted. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances.

[0031] The terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover but not exclude inclusion, for example, a product or device comprising a list of components is not necessarily limited to all the components expressly listed but may include other components not expressly listed or inherent to such product or device.

[0032] The term "module" refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functions associated with that element.

[0033] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0034] For the convenience of explanation, the above description has been made in conjunction with specific embodiments. However, the above exemplary discussion is not intended to be exhaustive or limit the embodiments to the specific forms disclosed above. Based on the above teachings, various modifications and variations can be obtained. The selection and description of the above embodiments are to better explain the principles and practical applications, so that those skilled in the art can better use the embodiments and various different variations of the embodiments suitable for specific use considerations.

[0035] The embodiment of the present application provides an attack detection device, method, apparatus and medium, wherein the attack detection device includes a processor, multiple analysis central processing unit CPU cores, and multiple traffic statistics CPU cores; the processor is used to receive each data packet to be analyzed that encapsulates NetFlow traffic, and sends each data packet to be analyzed to each analysis CPU core in sequence; each analysis CPU core is used to parse each received data packet to be analyzed, obtain the encapsulated NetFlow traffic and the corresponding five-tuple, the number of packets and the number of bytes; for each NetFlow traffic, according to the source IP and destination IP in the five-tuple of the NetFlow traffic, and the IP address range processed by each traffic statistics CPU core, determine the target traffic statistics CPU core corresponding to the NetFlow traffic, and send the NetFlow traffic to the target traffic statistics CPU core ; Each traffic statistics CPU core is used to count the number of packets and bytes of the NetFlow traffic of each IP address within the IP address range processed by the traffic statistics CPU core, and perform distributed denial of service attack DDoS detection based on the number of packets and bytes of the NetFlow traffic of each IP address, so that multiple traffic statistics CPU cores can process the NetFlow traffic within the corresponding IP address range respectively, and directly complete the aggregation and DDoS detection of the NetFlow traffic of the same IP address in the traffic statistics CPU core without transmitting it to a single CPU core for aggregation, thereby reducing the computing resources occupied by each traffic statistics CPU core and improving the processing efficiency. In addition, since each traffic statistics CPU core only processes the NetFlow traffic within the IP address range corresponding to the traffic statistics CPU core, the core can also be expanded.

[0036] Embodiment 1:

[0037] Figure 2 A schematic diagram of the structure of an attack detection device provided in an embodiment of the present application, the attack detection device includes a processor 201, multiple analysis central processing unit CPU cores 202, and multiple traffic statistics CPU cores 203;

[0038] The processor 201 is used to receive each data packet to be analyzed encapsulated with NetFlow traffic, and send each data packet to be analyzed to each analysis CPU core 202 in sequence;

[0039] Each parsing CPU core 202 is used to parse each received data packet to be analyzed, obtain the encapsulated NetFlow flow and the corresponding five-tuple, the number of packets and the number of bytes; for each NetFlow flow, according to the source IP and destination IP in the five-tuple of the NetFlow flow and the IP address range processed by each saved flow statistics CPU core 203, determine the target flow statistics CPU core 203 corresponding to the NetFlow flow, and send the NetFlow flow to the target flow statistics CPU core 203;

[0040] Each traffic statistics CPU core 203 is used to count the number of packets and bytes of the NetFlow traffic of each IP address within the IP address range processed by the traffic statistics CPU core 203, and perform distributed denial of service attack DDoS detection based on the number of packets and bytes of the NetFlow traffic of each IP address.

[0041] The processor 201 receives each data packet to be analyzed through a high-performance multi-queue of a data plane development kit (DPDK), wherein the data packet to be analyzed may be a User Datagram Protocol (UPD) data packet, in which NetFlow traffic is encapsulated.

[0042] After receiving the data packet to be analyzed, the processor 201 Figure 3 The DDoS detection process schematic diagram shown in the figure adopts a packet-by-packet sharing rule to send each data packet to be analyzed to each analysis CPU core 202 in sequence in order to improve the analysis efficiency.

[0043] Each analysis CPU core 202 uses NetFlow v5 version tools or NetFlow v9 version tools to parse the data packets to be analyzed sent to the NetFlow analysis module, and obtains the NetFlow traffic encapsulated in each data packet to be analyzed and the five-tuple, message number and byte number of the NetFlow traffic.

[0044] The five-tuple of NetFlow traffic includes source IP, destination IP, protocol, source port, and destination port; the NetFlow parsing module may be a CPU core used for NetFlow parsing, etc., which is not limited here.

[0045] In one possible implementation, in an embodiment of the present application, each parsing CPU core 202 stores the IP address range processed by each traffic statistics CPU core 203, wherein one traffic statistics CPU core 203 is used to aggregate NetFlow traffic and perform DDoS detection on one or more IP addresses, and one traffic statistics CPU core 203 corresponds to one or several IP address ranges, one IP address range contains one or more IP addresses, and the IP address ranges corresponding to each traffic statistics CPU core 203 do not overlap.

[0046] Therefore, after obtaining the five-tuple of each NetFlow flow after parsing, each parsing CPU core 202 may Figure 3 As shown, for each NetFlow flow, the target flow statistics CPU core 203 corresponding to the NetFlow flow is determined based on the source IP and destination IP in the quintuple of the NetFlow flow and the IP address range processed by each saved flow statistics CPU core 203, and the NetFlow flow and the corresponding source IP and destination IP, number of packets, and number of bytes in the quintuple are sent to the target flow statistics CPU core 203.

[0047] In another possible implementation, in the embodiment of the present application, each parsing CPU core 202 stores a hash value corresponding to any IP address within the IP address range processed by each traffic statistics CPU core 203 .

[0048] Therefore, after obtaining the five-tuple of each parsed NetFlow flow, each parsing CPU core 202 hashes the source IP and destination IP in the five-tuple of the NetFlow flow for each NetFlow flow, and determines the target hash value corresponding to the source IP and destination IP of the NetFlow flow; based on the target hash value corresponding to the source IP and destination IP of the NetFlow flow, and the hash value corresponding to any IP address within the IP address range processed by each traffic statistics CPU core 203, the target traffic statistics CPU core 203 corresponding to the NetFlow flow is determined, and the NetFlow flow and the corresponding source IP and destination IP, number of packets, and number of bytes in the five-tuple are sent to the target traffic statistics CPU core 203.

[0049] After receiving the NetFlow traffic and the corresponding source IP and destination IP, number of packets, and number of bytes in the five-tuple, each target traffic statistics CPU core 203 determines, for each IP address within the IP address range processed by the target traffic statistics CPU core 203, at least one NetFlow traffic corresponding to the IP address received by the target traffic statistics CPU core 203 based on the source IP and destination IP in the five-tuple of the NetFlow traffic received by the target traffic statistics CPU core 203; and counts the number of packets and the number of bytes of each NetFlow traffic corresponding to the IP address to determine the total number of packets and the total number of bytes of all NetFlow traffic corresponding to the IP address; and determines whether the total number of packets of all NetFlow traffic corresponding to the IP address exceeds the first preset number of packets, or whether the total number of bytes of all NetFlow traffic corresponding to the IP address exceeds the first preset number of bytes. If so, it is determined that the IP address is under DDoS attack.

[0050] In the embodiment of the present application, multiple traffic statistics CPU cores are used to process the NetFlow traffic within the corresponding IP address range respectively, and the aggregation and DDoS detection of the NetFlow traffic of the same IP address are completed directly in the traffic statistics CPU core without the need to transmit it to a single CPU core for aggregation. This reduces the computing resources occupied by each traffic statistics CPU core and improves the processing efficiency. In addition, since each traffic statistics CPU core only processes the NetFlow traffic within the IP address range corresponding to the traffic statistics CPU core, the core can also be expanded.

[0051] Embodiment 2:

[0052] In order to accurately summarize the NetFlow traffic, based on the above embodiments, in the embodiments of the present application, each traffic statistics CPU core 203 is specifically used to determine the statistical period occupied by each NetFlow traffic according to the start time and end time carried by the NetFlow traffic corresponding to the IP address for any IP address within the IP address range processed by the traffic statistics CPU core 203, and determine the target number of packets and target number of bytes of all NetFlow traffic corresponding to the IP address in each statistical period according to the statistical period occupied by each NetFlow traffic and the number of packets and bytes of each NetFlow traffic corresponding to the IP address.

[0053] In the embodiment of the present application, each target traffic statistics CPU core 203 determines the statistical period occupied by each NetFlow flow according to the start time and end time carried by each NetFlow flow corresponding to the IP address, the start time and end time of each statistical period, for any IP address within the IP address range processed by the target traffic statistics CPU core 203. Among them, the time length corresponding to each statistical period is the same, and for example, the time length corresponding to each statistical period is 5 seconds.

[0054] For any NetFlow flow corresponding to the IP address, determine the first duration of each statistical period occupied by the NetFlow flow according to the statistical period occupied by the NetFlow flow, the start time and the end time of each statistical period, and determine the ratio of the first duration of each statistical period occupied by the NetFlow flow to the total duration corresponding to the start time and the end time of the NetFlow flow; determine the target number of sub-packets and the target number of sub-bytes of the NetFlow flow in each statistical period occupied according to the ratio of the first duration of each statistical period occupied by the NetFlow flow to the total duration, and the number of packets and bytes of the NetFlow flow.

[0055] For each statistical period, the target number of packets and the target number of bytes corresponding to all NetFlow flows corresponding to the IP address in the statistical period are determined according to the target number of sub-packets and the target number of sub-bytes of each NetFlow flow corresponding to the IP address in the statistical period.

[0056] In one possible implementation, for any IP address, after obtaining the target number of packets and target number of bytes corresponding to all NetFlow traffic corresponding to the IP address in each statistical period, it is determined whether there is any statistical period in which the target number of packets corresponding to the IP address exceeds the first preset number, or the target number of bytes exceeds the second preset number. If so, it is determined that the IP address is under DDoS attack.

[0057] In the embodiment of the present application, statistics are collected on the target number of packets and the target number of bytes of all NetFlow flows corresponding to each IP address in each statistical period, so as to accurately summarize the NetFlow flows.

[0058] Embodiment 3:

[0059] On the basis of the above-mentioned embodiments, in the embodiment of the present application, each traffic statistics CPU core 203 is specifically used to determine, for any NetFlow traffic corresponding to the IP address, whether the start time and end time carried in the NetFlow traffic are within the same statistical period; if so, the statistical period is determined to be the statistical period occupied by the NetFlow traffic; if not, when the statistical periods in which the start time and the end time are located are adjacent, the adjacent statistical periods are determined as the statistical periods occupied by the NetFlow traffic; if the statistical periods in which the start time and the end time are located are not adjacent, the statistical period in which the start time and the end time are located and the statistical period between the two statistical periods are both determined as the statistical period occupied by the NetFlow traffic.

[0060] In an embodiment of the present application, for any NetFlow flow corresponding to the IP address, it is determined whether the start time and end time carried in the NetFlow flow are within the same statistical period. If so, the statistical period is determined to be the statistical period occupied by the NetFlow flow, and it is determined that the statistical period occupied by the NetFlow flow is one.

[0061] For example, Figure 4 One of the schematic diagrams of the statistical period occupied by NetFlow traffic is shown. The start time of the NetFlow traffic is 10:30:11, and the end time is 10:30:13. The statistical periods are [10:30:05, 10:30:10], [10:30:10, 10:30:15], [10:30:15, 10:30:20], [10:30:20, 10:30:25], and [10:30:25, 10:30:30]. It is determined by judging that the start time and end time carried in the NetFlow traffic are both within the same statistical period [10:30:10, 10:30:15]. The statistical period [10:30:10, 10:30:15] is determined as the statistical period occupied by the NetFlow traffic, and it is determined that the statistical period occupied by the NetFlow traffic is one.

[0062] If the start time and end time carried in the NetFlow traffic are not in the same statistical period, determine the first statistical period in which the start time of the NetFlow traffic is located and the second statistical period in which the end time of the NetFlow traffic is located, and judge whether the first statistical period and the second statistical period are adjacent. If they are adjacent, determine the two adjacent statistical periods as the statistical period occupied by the NetFlow traffic, that is, determine the first statistical period in which the start time of the NetFlow traffic is located and the second statistical period in which the end time is located as the statistical period occupied by the NetFlow traffic; if they are not adjacent, determine the first statistical period, the second statistical period and the statistical period between the first statistical period and the second statistical period as the statistical period occupied by the NetFlow traffic, and determine that the NetFlow traffic occupies multiple statistical periods.

[0063] For example, Figure 5 The second schematic diagram of the statistical period occupied by the NetFlow flow is shown. The start time of the NetFlow flow is 10:30:12, and the end time is 10:30:22. The statistical periods are [10:30:05, 10:30:10], [10:30:10, 10:30:15], [10:30:15, 10:30:20], [10:30:20, 10:30:25], and [10:30:25, 10:30:30]. It is determined by judging that the start time and end time carried in the NetFlow flow are not in the same statistical period, and it is determined that the start time of the NetFlow flow is within the statistical period [10:30:10, 10:30:15], and the NetFl The end time of the ow flow is within the statistical period [10:30:20, 10:30:25]. Since the statistical period [10:30:10, 10:30:15] where the start time is located is not adjacent to the statistical period [10:30:20, 10:30:25] where the end time is located, the statistical period [10:30:10, 10:30:15] where the start time of the NetFlow flow is located, the statistical period [10:30:20, 10:30:25] where the end time is located, and the statistical period [10:30:15, 10:30:20] between these two statistical periods are all determined as the statistical periods occupied by the NetFlow flow, and it is determined that the number of statistical periods occupied by the NetFlow flow is multiple.

[0064] Embodiment 4:

[0065] In order to further accurately summarize the NetFlow traffic, on the basis of the above-mentioned embodiments, in the embodiment of the present application, each traffic statistics CPU core 203 is specifically used to, for any NetFlow traffic, if the NetFlow traffic occupies one statistical period, determine the number of packets and bytes corresponding to the NetFlow traffic as the target number of sub-packets and target number of sub-bytes within the statistical period; if the NetFlow traffic occupies multiple statistical periods, determine the time period occupied by the NetFlow traffic according to the start time and end time of the NetFlow traffic, and determine the target number of sub-packets and target number of sub-bytes of the NetFlow traffic in each statistical period according to the length of the time period in each statistical period and the number of packets and bytes of the NetFlow traffic.

[0066] At present, when counting the number of packets and bytes of NetFlow traffic in each statistical period, a sliding window is usually used to restore on the time axis, and the restoration ratio of the sliding window is usually a fixed ratio or determined according to a statistical distribution method such as a normal distribution. Figure 6 The schematic diagram of the current NetFlow traffic restoration method is shown, in which 50% of the number of messages and bytes are restored in the current statistical period corresponding to the receipt of the NetFlow traffic, 20% of the number of messages and bytes are restored in the previous statistical period and the next statistical period of the current statistical period, and 5% of the number of messages and bytes are restored in the previous statistical period and the next statistical period of the next statistical period. However, if a fixed ratio is used for restoration without combining the start time and end time of the NetFlow traffic, there may be errors; if the restoration is performed using a restoration ratio determined by a statistical distribution method such as a normal distribution, there is a problem that the ratio of each statistical period cannot be accurately determined, resulting in poor accuracy in the restoration of the NetFlow traffic. Therefore, in order to improve the accuracy of NetFlow traffic restoration, in an embodiment of the present application, the proportion of NetFlow traffic in each statistical period is determined in combination with the start time and end time of the NetFlow traffic, and the process of NetFlow traffic restoration provided by the present application is described below.

[0067] In an embodiment of the present application, for any NetFlow flow corresponding to the IP address, if the statistical period occupied by the NetFlow flow is one, the number of packets corresponding to the NetFlow flow is determined as the target number of sub-packets within the statistical period, and the number of bytes corresponding to the NetFlow flow is determined as the target number of sub-bytes within the statistical period.

[0068] Also Figure 4Taking an example for explanation, the number of packets of the NetFlow traffic is 100 and the number of bytes is 5000. Since the statistical period occupied by the NetFlow traffic is one, namely [10:30:10, 10:30:15], in an embodiment of the present application, the number of packets 100 corresponding to the NetFlow traffic is determined as the target number of sub-packets within the statistical period [10:30:10, 10:30:15], and the number of bytes 5000 corresponding to the NetFlow traffic is determined as the target number of sub-bytes within the statistical period [10:30:10, 10:30:15].

[0069] In an embodiment of the present application, for any NetFlow flow corresponding to the IP address, if the NetFlow flow occupies multiple statistical periods, the time period occupied by the NetFlow flow is determined according to the start time and end time of the NetFlow flow; the length of the time period occupied by the NetFlow flow in each statistical period is determined according to the time period occupied by the NetFlow flow and the start time and end time of each statistical period occupied by the NetFlow flow; for each statistical period occupied by the NetFlow flow, according to the ratio of the length of the time period in the statistical period to the length of the time period, the number of packets and the number of bytes of the NetFlow flow, the product value of the ratio and the number of packets of the NetFlow flow is determined as the target sub-packet number of the NetFlow flow in the statistical period, and the product value of the ratio and the number of bytes of the NetFlow flow is determined as the target sub-byte number of the NetFlow flow in the statistical period.

[0070] Among them, if the product value of the ratio and the number of messages is not an integer or the product value of the ratio and the number of bytes is not an integer, the integer product value of the ratio and the number of messages or the integer product value of the ratio and the number of bytes can be determined by rounding or rounding.

[0071] In a possible implementation, if the NetFlow flow occupies two statistical periods, then for the statistical period in which the start time of the NetFlow flow is located, based on the end time of the statistical period in which the start time of the NetFlow flow is located, the length of the time period occupied by the NetFlow flow within the statistical period is determined to be the difference between the end time of the statistical period and the start time of the NetFlow flow; for the statistical period in which the end time of the NetFlow flow is located, based on the start time of the statistical period in which the end time of the NetFlow flow is located, the length of the time period occupied by the NetFlow flow within the statistical period is determined to be the difference between the end time of the NetFlow flow and the start time of the statistical period.

[0072] In another possible implementation, if the statistical periods occupied by the NetFlow flow are greater than two, then for the statistical period in which the start time of the NetFlow flow is located, based on the end time of the statistical period in which the start time of the NetFlow flow is located, the length of the time period occupied by the NetFlow flow within the statistical period is determined to be the difference between the end time of the statistical period and the start time of the NetFlow flow; for the statistical period in which the end time of the NetFlow flow is located, based on the start time of the statistical period in which the end time of the NetFlow flow is located, the length of the time period occupied by the NetFlow flow within the statistical period is determined to be the difference between the end time of the NetFlow flow and the start time of the statistical period; for each statistical period located between the two statistical periods, the time length of the statistical period is determined to be the length of the time period occupied by the NetFlow flow within the statistical period.

[0073] Also Figure 5For example, the number of packets of the NetFlow flow is 100, and the number of bytes is 5000. Since the NetFlow flow occupies three statistical periods, namely [10:30:10, 10:30:15], [10:30:15, 10:30:20], and [10:30:20, 10:30:25], for the statistical period [10:30:10, 10:30:15], according to the start time 10:30:12 of the NetFlow flow and the end time 10:30:15 of the statistical period, it is determined that the time period occupied by the NetFlow flow is 3 seconds within the statistical period, and the NetFlow flow is determined to be 3 seconds. The ratio of the length of the time period occupied by the NetFlow traffic in the statistical period to the time period is 3 / 10. The product value (30) of the ratio (3 / 10) and the number of packets of the NetFlow traffic (100) is determined as the target number of sub-packets of the NetFlow traffic in the statistical period. The product value (1500) of the ratio (3 / 10) and the number of bytes of the NetFlow traffic (5000) is determined as the target number of sub-bytes of the NetFlow traffic in the statistical period. For the statistical period [10:30:15, 10:30:20], the time length of the statistical period, i.e., 5 seconds, is determined as the time period occupied by the NetFlow traffic in the statistical period. The length of the period, and determine that the ratio of the length of the time period occupied by the NetFlow flow in the statistical period to the time period is 5 / 10, the product value (50) of the ratio (5 / 10) and the number of messages of the NetFlow flow (100) is determined as the target number of sub-messages of the NetFlow flow in the statistical period, and the product value (2500) of the ratio (5 / 10) and the number of bytes of the NetFlow flow (5000) is determined as the target number of sub-bytes of the NetFlow flow in the statistical period; for the statistical period [10:30:20, 10:30:25], according to the end time 10:30 of the NetFlow flow: 22 and the starting time of the statistical period is 10:30:20, determine that the length of the time period occupied by the NetFlow flow in the statistical period is 2 seconds, and determine that the ratio of the length of the time period occupied by the NetFlow flow in the statistical period to the time period is 2 / 10, and determine the product value (20) of the ratio (2 / 10) and the number of packets of the NetFlow flow (100) as the target sub-packet number of the NetFlow flow in the statistical period, and determine the product value (1000) of the ratio (2 / 10) and the number of bytes of the NetFlow flow (5000) as the target sub-byte number of the NetFlow flow in the statistical period.

[0074] In the embodiment of the present application, the proportion of NetFlow traffic in each statistical period is determined in combination with the start time and end time of the NetFlow traffic. This does not involve complex calculations and is simple and practical. It can also more accurately count the proportion of NetFlow traffic in each statistical period, thereby facilitating further accurate aggregation of the NetFlow traffic in each statistical period.

[0075] Embodiment 5:

[0076] On the basis of the above-mentioned embodiments, in the embodiment of the present application, each parsing CPU core 202 is further used to count the number of NetFlow flows corresponding to the same source IP or the same destination IP according to the source IP and destination IP in the quintuple of each NetFlow flow; for each source IP or destination IP, determine whether the number of NetFlow flows corresponding to the source IP or destination IP is greater than a preset number; if not, then for the NetFlow flow of the source IP or destination IP, continue to execute the step of determining the target flow statistics CPU core 203 corresponding to the NetFlow flow according to the source IP and destination IP in the quintuple of the NetFlow flow and the IP address range processed by each saved flow statistics CPU core 203.

[0077] In an embodiment of the present application, after obtaining the five-tuple of each NetFlow flow after parsing, the number of NetFlow flows corresponding to the same source IP and the number of NetFlow flows corresponding to the same destination IP are counted respectively according to the source IP and destination IP in the five-tuple of each NetFlow flow.

[0078] For each source IP or destination IP, determine whether the quantity of NetFlow flows corresponding to the source IP or destination IP is greater than a preset quantity. If not, determine that each NetFlow flow corresponding to the IP address is non-top NetFlow flow.

[0079] For each non-top NetFlow flow, the subsequent step of determining the target flow statistics CPU core 203 corresponding to the NetFlow flow is continued according to the source IP and destination IP in the quintuple of the NetFlow flow and the IP address range processed by each saved flow statistics CPU core 203.

[0080] Embodiment 6:

[0081] In order to avoid exceeding the processing capacity of a single traffic statistics CPU core, based on the above embodiments, in the embodiment of the present application, the device further includes a main CPU core;

[0082] Each analysis CPU core 202 is further used to determine the NetFlow flow of the source IP or the destination IP as the top NetFlow flow if the amount of the NetFlow flow of the source IP or the destination IP is greater than a preset amount, and to divert each top NetFlow flow to each flow statistics CPU core 203;

[0083] Each traffic statistics CPU core 203 is further used to count the number of packets and bytes of each top NetFlow flow corresponding to the source IP or destination IP received by the traffic statistics CPU core 203, and send the number of packets and bytes of each top NetFlow flow in the traffic statistics CPU core 203 and the corresponding IP address information to the main CPU core;

[0084] The main CPU core is used to count the number of packets and bytes of each top NetFlow flow sent by each flow statistics CPU core 203 and the corresponding IP address information, count the total number of packets and bytes of each top NetFlow flow corresponding to the IP address, and perform DDoS detection based on the total number of packets and bytes.

[0085] If the parsing CPU core 202 determines that the number of all NetFlow flows corresponding to a certain source IP or destination IP is greater than a preset number, each NetFlow flow corresponding to the source IP or destination IP is determined as a top NetFlow flow. Since the number of top NetFlow flows corresponding to the same IP address is large, it usually exceeds the processing capacity of a single flow statistics CPU core. Therefore, in the embodiment of the present application, each top NetFlow flow is split according to the flow-by-flow sharing rule, that is, each topNetFlow flow is split to each flow statistics CPU core 203 in turn.

[0086] After receiving the topNetFlow traffic within the IP range not processed by the traffic statistics CPU core 203, each traffic statistics CPU core 203 counts the number of packets and bytes of all topNetFlow traffic corresponding to the same source IP or the same destination IP received by the traffic statistics CPU core 203 within each statistical period, and sends the number of packets and bytes of all top NetFlow traffic corresponding to the same source IP or the same destination IP in the traffic statistics CPU core 203 within each statistical period, as well as the corresponding IP address information to the main CPU core.

[0087] Among them, the implementation process of counting the number of packets and bytes of all topNetFlow flows corresponding to the same source IP or the same destination IP received by the traffic statistics CPU core 203 in each statistical period is the same as the process of summarizing the NetFlow flows in each statistical period provided in the above embodiment, and will not be repeated here.

[0088] After receiving the number of messages and bytes of all top NetFlow flows corresponding to the same IP address in the traffic statistics CPU core 203 sent by each traffic statistics CPU core 203 within each statistical period, the main CPU core synchronously counts the total number of messages and the total number of bytes of all top NetFlow flows sent by each traffic statistics CPU core 203 corresponding to the IP address within each statistical period based on the IP address corresponding to the top NetFlow flows sent by each traffic statistics CPU core 203 and the number of messages and bytes within each statistical period.

[0089] In one possible implementation, the main CPU core determines whether the total number of messages of all top NetFlow flows corresponding to the same IP address exceeds the second preset number of messages, or whether the total number of bytes of all top NetFlow flows corresponding to the same IP address exceeds the second preset number of bytes. If so, it is determined that the IP address is under a DDoS attack.

[0090] In another possible implementation, the main CPU core determines whether the target number of messages of all top NetFlow traffic corresponding to the same IP address in any statistical period exceeds the third preset number, or the target number of bytes exceeds the fourth preset number. If so, it is determined that the IP address is under DDoS attack.

[0091] In an embodiment of the present application, by determining a large number of top NetFlow flows corresponding to the same IP address, the top NetFlow flows are diverted to each flow statistics CPU core for statistics first, and then the statistical results are sent to the main CPU core for final aggregation to avoid exceeding the processing capacity of a single flow statistics CPU core.

[0092] Embodiment 7:

[0093] In order to enable each traffic statistics CPU core to achieve optimal performance, on the basis of the above embodiments, in the embodiment of the present application, each parsing CPU core 202 is specifically used to obtain the number of top NetFlow flows that each traffic statistics CPU core 203 can process; according to the number of top NetFlow flows that each traffic statistics CPU core 203 can process, determine the proportion of top NetFlow flows diverted to each traffic statistics CPU core 203; based on the top NetFlow flow proportion of each traffic statistics CPU core 203, divert each top NetFlow flow.

[0094] In the embodiment of the present application, each parsing CPU core 202 obtains the number of top NetFlow flows that each traffic statistics CPU core 203 can process, and for each traffic statistics CPU core 203, based on the number of top NetFlow flows that the traffic statistics CPU core 203 can process and the total number of top NetFlow flows that all traffic statistics CPU cores 203 can process, the ratio of the number of top NetFlow flows that the traffic statistics CPU core 203 can process to the total number of top NetFlow flows that all traffic statistics CPU cores 203 can process is determined as the proportion of top NetFlow flows diverted to the traffic statistics CPU core 203.

[0095] After determining the proportion of top NetFlow traffic diverted to each traffic statistics CPU core 203, determine the number of top NetFlow traffic actually processed by each traffic statistics CPU core 203 according to the proportion of top NetFlow traffic that each traffic statistics CPU core 203 can process and the number of all top NetFlow traffic, and divert all the above top NetFlow traffic based on the number of top NetFlow traffic actually processed by each traffic statistics CPU core 203.

[0096] In the embodiment of the present application, traffic is distributed according to the ratio of top NetFlow traffic that each traffic statistics CPU core can process, so that each traffic statistics CPU core can achieve optimal performance.

[0097] The above embodiments are described below with a specific embodiment. Figure 7 The attack detection process diagram includes the following steps:

[0098] Step 1: The processor receives each data packet to be analyzed through the DPDK high-performance multi-queue, and uses the packet-by-packet sharing rule to send each data packet to be analyzed to the parsing CPU core in sequence.

[0099] Step 2: Each analysis CPU core uses NetFlow v5 version tools or NetFlow v9 version tools to perform NetFlow analysis on the data packets to be analyzed sent to the analysis CPU core, and obtain the NetFlow traffic encapsulated in each data packet to be analyzed and the corresponding five-tuple, number of packets and number of bytes.

[0100] In addition, based on the source IP and destination IP in the quintuple of each NetFlow flow, the number of NetFlow flows corresponding to the same source IP or the same destination IP is counted, and for each source IP or destination IP, it is determined whether the number of NetFlow flows corresponding to the source IP or destination IP is greater than a preset number. If so, it is determined that each NetFlow flow corresponding to the IP address is a topNetFlow flow; if not, it is determined that each NetFlow flow corresponding to the IP address is a non-top NetFlow flow.

[0101] For the top NetFlow traffic, the proportion of top NetFlow traffic diverted to each traffic statistics CPU core is determined according to the number of top NetFlow traffic that each traffic statistics CPU core can process and the total number of top NetFlow traffic that all traffic statistics CPU cores can process; the number of top NetFlow traffic actually processed by each traffic statistics CPU core is determined according to the proportion of top NetFlow traffic diverted to each traffic statistics CPU core and the number of all top NetFlow traffic; and based on the number of top NetFlow traffic actually processed by each traffic statistics CPU core, the rule of flow-by-flow sharing is adopted to divert all the above top NetFlow traffic to each traffic statistics CPU core in turn.

[0102] For each non-top NetFlow flow, the source IP and destination IP in the quintuple of the non-top NetFlow flow are hashed to determine the target hash value corresponding to the source IP (Session Initiation Protocol, SIP) and destination IP (Destination Initiation Protocol, DIP) of the non-top NetFlow flow; the target hash value corresponding to the source IP and destination IP of the non-top NetFlow flow is matched with the hash value corresponding to any IP address in the IP address range processed by each CPU core, the target flow statistics CPU core corresponding to the non-top NetFlow flow is determined, and the non-topNetFlow flow is sent to the target flow statistics CPU core.

[0103] Step three, for each target traffic statistics CPU core, for each IP address within the IP address range processed by the target traffic statistics CPU core, count the target message number and target byte number of all non-top NetFlow traffic corresponding to the IP address in each statistical period; determine whether there is any statistical period in which the target message number corresponding to the IP address exceeds the first preset number, or the target byte number exceeds the second preset number. If so, it is determined that the IP address is under DDoS attack.

[0104] Specifically, after receiving the top NetFlow traffic within the IP range not processed by the CPU core, each traffic statistics CPU core counts the number of packets and bytes of all top NetFlow traffic corresponding to the same source IP or the same destination IP received by the traffic statistics CPU core within each statistical period, and sends the number of packets and bytes of all top NetFlow traffic corresponding to the same source IP or the same destination IP in the traffic statistics CPU core, as well as the corresponding IP address information to the main CPU core. After receiving the number of messages and bytes of all topNetFlow flows corresponding to the same IP address in the traffic statistics CPU core sent by each traffic statistics CPU core within each statistical period, the main CPU core synchronously counts the total number of messages and the total number of bytes of all top NetFlow flows sent by each traffic statistics CPU core corresponding to the IP address within each statistical period according to the IP address corresponding to the topNetFlow flows sent by each traffic statistics CPU core and the number of messages and the number of bytes within each statistical period; and determines whether the total number of messages of all top NetFlow flows corresponding to the same IP address exceeds the second preset number of messages, or whether the total number of bytes of all top NetFlow flows corresponding to the same IP address exceeds the second preset number of bytes. If so, it is determined that the IP address is under DDoS attack.

[0105] Embodiment 8:

[0106] Based on the same concept, on the basis of the above embodiments, the embodiment of the present application provides an attack detection method. Figure 8 A schematic diagram of an attack detection process provided in an embodiment of the present application, the process includes:

[0107] S801: Receive data packets to be analyzed that are encapsulated with NetFlow traffic.

[0108] The attack detection method provided in the embodiments of the present application is applied to the parsing CPU core in the attack detection device shown in the above embodiments.

[0109] The parsing CPU core receives each to-be-analyzed data packet encapsulated with NetFlow traffic and sent to the parsing CPU core by the processor in the attack detection device.

[0110] S802: Parse each received data packet to be analyzed to obtain encapsulated NetFlow traffic and the corresponding five-tuple, number of packets and number of bytes; for each NetFlow traffic, determine the target traffic statistics CPU core corresponding to the NetFlow traffic based on the source IP and destination IP in the five-tuple of the NetFlow traffic and the IP address range processed by each traffic statistics CPU core in the attack detection device, and send the NetFlow traffic to the target traffic statistics CPU core; make each traffic statistics CPU core count the number of packets and bytes of the NetFlow traffic of each IP address within the IP address range processed by the target traffic statistics CPU core, and perform distributed denial of service attack DDoS detection based on the number of packets and bytes of the NetFlow traffic of each IP address.

[0111] The parsing process and the process of collecting statistics on NetFlow traffic and detecting DDoS can be found in the above embodiments and will not be described in detail here.

[0112] In the embodiment of the present application, multiple traffic statistics CPU cores are used to process the NetFlow traffic within the corresponding IP address range respectively, and the aggregation and DDoS detection of the NetFlow traffic of the same IP address are completed directly in the traffic statistics CPU core without the need to transmit it to a single CPU core for aggregation. This reduces the computing resources occupied by each traffic statistics CPU core and improves the processing efficiency. In addition, since each traffic statistics CPU core only processes the NetFlow traffic within the IP address range corresponding to the traffic statistics CPU core, the core can also be expanded.

[0113] On the basis of the above embodiments, in the embodiment of the present application, before determining the target traffic statistics CPU core corresponding to the NetFlow flow according to the source IP and destination IP in the quintuple of the NetFlow flow and the IP address range processed by each traffic statistics CPU core in the saved attack detection device, the method further includes:

[0114] According to the source IP and destination IP in the quintuple of each NetFlow flow, count the number of NetFlow flows corresponding to the same source IP or the same destination IP;

[0115] For each source IP or destination IP, determine whether the number of NetFlow flows corresponding to the source IP or destination IP is greater than the preset number. If not, continue to execute the step of determining the target traffic statistics CPU core corresponding to the NetFlow flow based on the source IP and destination IP in the quintuple of the NetFlow flow and the IP address range processed by each saved traffic statistics CPU core.

[0116] In order to avoid exceeding the processing capacity of a single traffic statistics CPU core, based on the above embodiments, in the embodiment of the present application, if the amount of NetFlow traffic of the source IP or destination IP is greater than a preset amount, the method further includes:

[0117] The NetFlow flow of the source IP or destination IP is determined as the top NetFlow flow, and each top NetFlow flow is distributed to each flow statistics CPU core;

[0118] Control each traffic statistics CPU core, count the number of packets and bytes of each top NetFlow flow corresponding to the source IP or destination IP received by the traffic statistics CPU core, and send the number of packets and bytes of each top NetFlow flow in the traffic statistics CPU core and the corresponding IP address information to the main CPU core;

[0119] The control main CPU core counts the number of packets and bytes of each top NetFlow flow sent by each flow statistics CPU core and the corresponding IP address information, counts the total number of packets and bytes of each top NetFlow flow corresponding to the IP address, and performs DDoS detection based on the total number of packets and bytes.

[0120] In order to enable each traffic statistics CPU core to achieve optimal performance, based on the above embodiments, in the embodiment of the present application, each top NetFlow flow is diverted to each traffic statistics CPU core, including:

[0121] Get the number of top NetFlow flows that each flow statistics CPU core can process;

[0122] According to the amount of top NetFlow traffic that each traffic statistics CPU core can process, determine the proportion of top NetFlow traffic that is diverted to each traffic statistics CPU core;

[0123] Based on the top NetFlow traffic ratio of each flow statistics CPU core, each top NetFlow traffic is divided.

[0124] Embodiment 9:

[0125] Based on the same concept, on the basis of the above embodiments, the embodiment of the present application provides an attack detection device, Fig. 9 A schematic diagram of the structure of an attack detection device provided in an embodiment of the present application is shown in FIG. Fig. 9 As shown, the device comprises:

[0126] The receiving module 901 is used to receive each data packet to be analyzed which is encapsulated with NetFlow traffic;

[0127] Processing module 902 is used to parse each received data packet to be analyzed, obtain encapsulated NetFlow traffic and the corresponding five-tuple, number of packets and number of bytes; for each NetFlow traffic, according to the source IP and destination IP in the five-tuple of the NetFlow traffic, and the IP address range processed by each traffic statistics CPU core in the attack detection device, determine the target traffic statistics CPU core corresponding to the NetFlow traffic, and send the NetFlow traffic to the target traffic statistics CPU core; enable each traffic statistics CPU core to count the number of packets and bytes of the NetFlow traffic of each IP address within the IP address range processed by the target traffic statistics CPU core, and perform distributed denial of service attack DDoS detection according to the number of packets and bytes of the NetFlow traffic of each IP address.

[0128] In a possible implementation, the processing module 902 is further used to determine the target traffic statistics CPU core corresponding to the NetFlow flow according to the source IP and destination IP in the quintuple of the NetFlow flow and the IP address range processed by each traffic statistics CPU core in the attack detection device, and then count the number of NetFlow flows corresponding to the same source IP or the same destination IP according to the source IP and destination IP in the quintuple of each NetFlow flow; for each source IP or destination IP, determine whether the number of NetFlow flows corresponding to the source IP or destination IP is greater than a preset number; if not, continue to execute the step of determining the target traffic statistics CPU core corresponding to the NetFlow flow according to the source IP and destination IP in the quintuple of the NetFlow flow and the IP address range processed by each traffic statistics CPU core.

[0129] In a possible implementation, the processing module 902 is further used to determine the NetFlow flow of the source IP or destination IP as the top NetFlow flow if the number of NetFlow flows of the source IP or destination IP is greater than a preset number, and to divert each top NetFlow flow to each traffic statistics CPU core; control each traffic statistics CPU core to count the number of packets and bytes of each top NetFlow flow corresponding to the source IP or destination IP received by the traffic statistics CPU core, and send the number of packets and bytes of each top NetFlow flow in the traffic statistics CPU core and the corresponding IP address information to the main CPU core; control the main CPU core to count the total number of packets and bytes of each top NetFlow flow corresponding to the IP address according to the number of packets and bytes of each top NetFlow flow sent by each traffic statistics CPU core and the corresponding IP address information, and perform DDoS detection based on the total number of packets and bytes.

[0130] In one possible implementation, the processing module 902 is specifically used to obtain the number of top NetFlow flows that each traffic statistics CPU core can process; determine the proportion of top NetFlow flows diverted to each traffic statistics CPU core based on the number of top NetFlow flows that each traffic statistics CPU core can process; and divert each top NetFlow flow based on the proportion of topNetFlow flows of each traffic statistics CPU core.

[0131] Embodiment 10:

[0132] Based on the same technical concept, the present application also provides an electronic device, Fig.10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Fig.10 As shown, it includes: a processor 1001, a communication interface 1002, a memory 1003 and a communication bus 1004, wherein the processor 1001, the communication interface 1002, and the memory 1003 communicate with each other through the communication bus 1004;

[0133] The memory 1003 stores a computer program. When the program is executed by the processor 1001, the processor 1001 performs the following steps:

[0134] Receive each data packet to be analyzed that encapsulates NetFlow traffic;

[0135] Parse each received data packet to be analyzed to obtain encapsulated NetFlow traffic and the corresponding five-tuple, number of messages and number of bytes; for each NetFlow traffic, determine the target traffic statistics CPU core corresponding to the NetFlow traffic according to the source IP and destination IP in the five-tuple of the NetFlow traffic and the IP address range processed by each traffic statistics CPU core in the saved attack detection device, and send the NetFlow traffic to the target traffic statistics CPU core; make each traffic statistics CPU core count the number of messages and bytes of the NetFlow traffic of each IP address within the IP address range processed by the target traffic statistics CPU core, and perform distributed denial of service attack DDoS detection according to the number of messages and bytes of the NetFlow traffic of each IP address.

[0136] In a possible implementation, the processor 1001 is further configured to, before determining the target traffic statistics CPU core corresponding to the NetFlow traffic based on the source IP and destination IP in the quintuple of the NetFlow traffic and the IP address range processed by each traffic statistics CPU core in the attack detection device, count the number of NetFlow traffic corresponding to the same source IP or the same destination IP based on the source IP and destination IP in the quintuple of each NetFlow traffic; for each source IP or destination IP, determine whether the number of NetFlow traffic corresponding to the source IP or destination IP is greater than a preset number; if not, continue to execute the step of determining the target traffic statistics CPU core corresponding to the NetFlow traffic based on the source IP and destination IP in the quintuple of the NetFlow traffic and the IP address range processed by each traffic statistics CPU core for the NetFlow traffic of the source IP or destination IP.

[0137] In a possible implementation, the processor 1001 is further used to, if the number of NetFlow flows of the source IP or destination IP is greater than a preset number, determine the NetFlow flows of the source IP or destination IP as top NetFlow flows, and divert each top NetFlow flow to each traffic statistics CPU core; control each traffic statistics CPU core to count the number of packets and bytes of each top NetFlow flow corresponding to the source IP or destination IP received by the traffic statistics CPU core, and send the number of packets and bytes of each top NetFlow flow in the traffic statistics CPU core and the corresponding IP address information to the main CPU core; control the main CPU core to count the total number of packets and bytes of each top NetFlow flow corresponding to the IP address according to the number of packets and bytes of each top NetFlow flow sent by each traffic statistics CPU core and the corresponding IP address information, and perform DDoS detection based on the total number of packets and bytes.

[0138] In one possible implementation, the processor 1001 is specifically used to obtain the number of top NetFlow flows that each traffic statistics CPU core can process; determine the proportion of top NetFlow flows to be diverted to each traffic statistics CPU core based on the number of top NetFlow flows that each traffic statistics CPU core can process; and divert each top NetFlow flow based on the top NetFlow flow proportion of each traffic statistics CPU core.

[0139] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0140] The communication interface 1002 is used for communication between the above electronic device and other devices.

[0141] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0142] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (Network Processor, NP), etc.; it can also be a digital signal processing processor (Digital Signal Processing, DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0143] Embodiment 11:

[0144] Based on the same technical concept, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program that can be executed by an electronic device. When the program runs on the electronic device, the electronic device implements any of the above embodiments when executing.

[0145] The above-mentioned computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor in the electronic device, including but not limited to magnetic storage such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc., optical storage such as CD, DVD, BD, HVD, etc., and semiconductor storage such as ROM, EPROM, EEPROM, non-volatile memory (NANDFLASH), solid-state drive (SSD), etc.

[0146] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0147] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0148] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0149] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0150] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An attack detection device, characterized in that: The device includes a processor, a plurality of analysis central processing unit CPU cores, and a plurality of traffic statistics CPU cores; The processor is used to receive each data packet to be analyzed encapsulating the NetFlow traffic of the network detection function, and send each data packet to be analyzed to each analysis CPU core in sequence; Each analysis CPU core is used to parse each received data packet to be analyzed, and obtain the encapsulated NetFlow flow and the corresponding five-tuple, the number of packets and the number of bytes; For each NetFlow flow, according to the source IP and destination IP in the quintuple of the NetFlow flow and the IP address range processed by each saved flow statistics CPU core, determine the target flow statistics CPU core corresponding to the NetFlow flow, and send the NetFlow flow to the target flow statistics CPU core; Each traffic statistics CPU core is used to count the number of packets and bytes of the NetFlow traffic of each IP address within the IP address range processed by the traffic statistics CPU core, and perform distributed denial of service attack DDoS detection based on the number of packets and bytes of the NetFlow traffic of each IP address.

2. The device according to claim 1, characterized in that Each traffic statistics CPU core is specifically used to determine, for any IP address within the IP address range processed by the traffic statistics CPU core, the statistical period occupied by each NetFlow flow according to the start time and end time carried by the NetFlow flow corresponding to the IP address, and determine the target number of messages and target number of bytes of all NetFlow flows corresponding to the IP address in each statistical period according to the statistical period occupied by each NetFlow flow and the number of messages and number of bytes of each NetFlow flow corresponding to the IP address.

3. The device according to claim 2, characterized in that Each traffic statistics CPU core is specifically used to determine, for any NetFlow traffic corresponding to the IP address, whether the start time and end time carried in the NetFlow traffic are within the same statistical period; if so, determine the statistical period as the statistical period occupied by the NetFlow traffic; if not, when the statistical periods in which the start time and end time are located are adjacent, determine the adjacent statistical periods as the statistical period occupied by the NetFlow traffic; if the statistical periods in which the start time and end time are located are not adjacent, determine the statistical period in which the start time and end time are located and the statistical period between the two statistical periods as the statistical period occupied by the NetFlow traffic.

4. The device according to claim 3, characterized in that Each traffic statistics CPU core is specifically used to, for any NetFlow traffic, if the NetFlow traffic occupies one statistical period, determine the number of messages and bytes corresponding to the NetFlow traffic as the target number of sub-messages and target number of sub-bytes within the statistical period; if the NetFlow traffic occupies multiple statistical periods, determine the time period occupied by the NetFlow traffic according to the start time and end time of the NetFlow traffic, and determine the target number of sub-messages and target number of sub-bytes of the NetFlow traffic in each statistical period according to the length of the time period in each statistical period and the number of messages and bytes of the NetFlow traffic.

5. The device according to claim 1, characterized in that Each of the analysis CPU cores is further used to count the number of NetFlow flows corresponding to the same source IP or the same destination IP according to the source IP and the destination IP in the quintuple of each NetFlow flow; For each source IP or destination IP, determine whether the number of NetFlow flows corresponding to the source IP or destination IP is greater than a preset number. If not, continue to execute the step of determining the target traffic statistics CPU core corresponding to the NetFlow flow based on the source IP and destination IP in the quintuple of the NetFlow flow and the IP address range processed by each saved traffic statistics CPU core.

6. The device according to claim 5, characterized in that The device also includes a main CPU core; Each analysis CPU core is further used for determining the NetFlow flow of the source IP or the destination IP as the top NetFlow flow if the amount of the NetFlow flow of the source IP or the destination IP is greater than a preset amount, and shunting each top NetFlow flow to each flow statistics CPU core; Each traffic statistics CPU core is further used to count the number of packets and bytes of each top NetFlow flow corresponding to the source IP or destination IP received by the traffic statistics CPU core, and send the number of packets and bytes of each top NetFlow flow in the traffic statistics CPU core and the corresponding IP address information to the main CPU core; The main CPU core is used to count the number of messages and bytes of each top NetFlow flow sent by each flow statistics CPU core and the corresponding IP address information, count the total number of messages and the total number of bytes of each top NetFlow flow corresponding to the IP address, and perform DDoS detection based on the total number of messages and the total number of bytes.

7. The device according to claim 6, characterized in that Each analysis CPU core is specifically used to obtain the number of top NetFlow flows that each traffic statistics CPU core can process; according to the number of top NetFlow flows that each traffic statistics CPU core can process, determine the proportion of top NetFlow flows diverted to each traffic statistics CPU core; Based on the top NetFlow flow ratio of each flow statistics CPU core, the top NetFlow flows are split.

8. An attack detection method, characterized in that: Applied to an attack detection device, the method comprises: Receive each data packet to be analyzed that encapsulates NetFlow traffic; Parse each received data packet to be analyzed to obtain encapsulated NetFlow traffic and the corresponding five-tuple, number of messages and number of bytes; for each NetFlow traffic, determine the target traffic statistics CPU core corresponding to the NetFlow traffic according to the source IP and destination IP in the five-tuple of the NetFlow traffic and the IP address range processed by each traffic statistics CPU core in the attack detection device, and send the NetFlow traffic to the target traffic statistics CPU core; make each traffic statistics CPU core count the number of messages and bytes of the NetFlow traffic of each IP address within the IP address range processed by the target traffic statistics CPU core, and perform distributed denial of service attack DDoS detection according to the number of messages and bytes of the NetFlow traffic of each IP address.

9. The method according to claim 8, characterized in that Before determining the target traffic statistics CPU core corresponding to the NetFlow traffic according to the source IP and destination IP in the quintuple of the NetFlow traffic and the stored IP address range processed by each traffic statistics CPU core in the attack detection device, the method further includes: According to the source IP and the destination IP in the quintuple of each NetFlow flow, the number of NetFlow flows corresponding to the same source IP or the same destination IP is counted; For each source IP or destination IP, determine whether the number of NetFlow flows corresponding to the source IP or destination IP is greater than a preset number. If not, continue to execute the step of determining the target traffic statistics CPU core corresponding to the NetFlow flow based on the source IP and destination IP in the quintuple of the NetFlow flow and the IP address range processed by each saved traffic statistics CPU core.

10. An attack detection device, characterized in that: The device comprises: A receiving module, used for receiving each data packet to be analyzed encapsulated with NetFlow traffic; The processing module is used to parse each received data packet to be analyzed, obtain the encapsulated NetFlow flow and the corresponding five-tuple, message number and byte number; for each NetFlow flow, according to the source IP and destination IP in the five-tuple of the NetFlow flow, and the IP address range processed by each flow statistics CPU core in the attack detection device, determine the target flow statistics CPU core corresponding to the NetFlow flow, and send the NetFlow flow to the target flow statistics CPU core; make each flow statistics CPU core count the message number and byte number of the NetFlow flow of each IP address within the IP address range processed by the target flow statistics CPU core, and perform distributed denial of service attack DDoS detection according to the message number and byte number of the NetFlow flow of each IP address.

Images