Traffic processing method, device, electronic device and storage medium

Abstract

The present application provides a traffic processing method, device, electronic device and storage medium. The traffic processing method includes: receiving a business traffic packet, determining a processing method for the business traffic packet based on a preset traffic processing rule; if it is determined that the processing method for the business traffic packet is diversion forwarding, determining a target distributed node from multiple distributed nodes based on the addresses corresponding to multiple distributed nodes in a cloud distributed system and the addresses of security devices; sending a business traffic packet to the target distributed node, so that when the target distributed node confirms that the business traffic packet is legal, the target distributed node sends the business traffic packet to the target device pointed to by the destination address in the address information of the business traffic packet; or, when the business traffic packet is confirmed to be illegal, processing the business traffic packet according to the preset security rules. By adopting the method provided by the present application, the processing efficiency of the business traffic packet can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a flow processing method, device, electronic device and storage medium. Background Art

[0002] At present, some of the network security threats to customers are caused by unsafe access to web pages; in the related art, in order to detect such unsafe access, it is usually necessary to set up a data center, which is used to realize a complete set of integrated IT application environments for centralized processing, storage, transmission, exchange, and management of data information in a physical space. At the same time, in the current data center network, value-added service equipment is usually deployed, such as firewalls, intrusion prevention systems, etc., to detect business traffic packets. However, in the related art, when using a data center to detect business traffic packets, due to the huge amount of data stored in the data center and the slow data update, the business traffic packet detection efficiency and accuracy are low when performing business traffic packet detection. Summary of the invention

[0003] In view of the above problems, the present application provides a traffic processing method, device, electronic device and storage medium, which can have.

[0004] The embodiment of the present application is implemented by adopting the following technical solutions:

[0005] In the first aspect, an embodiment of the present application provides a traffic processing method, which is applied to a security device, and the method includes: receiving a business traffic packet, which carries address information; determining a processing method for the business traffic packet based on a preset traffic processing rule; if it is determined that the processing method for the business traffic packet is diversion forwarding, based on the addresses corresponding to multiple distributed nodes in the cloud distributed system and the address of the security device, determining an available target distributed node from the multiple distributed nodes; sending the business traffic packet to the target distributed node, so that when the target distributed node confirms that the business traffic packet is legal, the target distributed node sends the business traffic packet to the target device pointed to by the destination address in the address information of the business traffic packet; or, when it is confirmed that the business traffic packet is illegal, processing the business traffic packet according to the preset security rules.

[0006] In the second aspect, an embodiment of the present application provides a traffic processing method, which is applied to a target distributed node in a distributed system, and the method includes: receiving a business traffic packet forwarded by a security device, the business traffic packet being forwarded to the target distributed node by the security device when the security device determines that the processing method for the business traffic packet is diversion forwarding based on a preset traffic processing rule, and the target distributed node is determined from multiple distributed nodes based on the addresses corresponding to multiple distributed nodes of the cloud distributed system and the address of the security device; sending the business traffic packet to the target device pointed to by the destination address in the business traffic packet.

[0007] In the third aspect, an embodiment of the present application provides a traffic processing device, which includes: a traffic packet receiving module, used to receive a business traffic packet, wherein the business traffic packet carries address information; a processing method determination module, used to determine the processing method for the business traffic packet based on preset traffic processing rules; a distributed node determination module, used to determine an available target distributed node from the multiple distributed nodes based on the addresses corresponding to the multiple distributed nodes in the cloud distributed system and the address of the security device when determining that the processing method for the business traffic packet is diversion forwarding; a traffic packet sending module, used to send the business traffic packet to the target distributed node, so that the target distributed node sends the business traffic packet to the target device pointed to by the destination address in the address information of the business traffic packet when confirming that the business traffic packet is legal; or, when confirming that the business traffic packet is illegal, the business traffic packet is processed according to preset security rules.

[0008] In some embodiments, the processing method determination module is also used to match the preset traffic processing rules with the address information of the business traffic packet to obtain a matching result, and the preset traffic processing rules include multiple diversion rules; if the matching result indicates that there is a target diversion rule that matches the business traffic packet, it is determined that the processing method for the business traffic packet is diversion forwarding.

[0009] In some embodiments, the preset traffic processing rules also include multiple drainage rules and drainage methods corresponding to each drainage rule; the processing method determination module is also used to determine the drainage method corresponding to the target drainage rule in the preset traffic processing rule library as the processing method for the business traffic packet if the matching result indicates that there is a target drainage rule that matches the address information of the business traffic packet; the device also includes: a drainage processing module, which is used to process the business traffic packet according to the drainage method corresponding to the target drainage rule.

[0010] In some embodiments, the device also includes: a traffic forwarding module, which is used to forward the business traffic packet based on the address information of the business traffic packet if the matching result indicates that there is no preset traffic processing rule that matches the address information of the business traffic packet.

[0011] In some implementations, the address information of the service traffic packet includes a DNS domain name, an IP address, or a URL address; the preset traffic processing rule includes one or more of a preset domain name, a preset IP address segment, and a preset URL domain name.

[0012] In some embodiments, the distributed node determination module is also used to match the source address in the address information of the business traffic packet with the addresses corresponding to multiple distributed nodes in the cloud distributed system to obtain matching results corresponding to each distributed node; if there is a matching result corresponding to a distributed node indicating that the source address matches the address corresponding to the distributed node, the distributed node is determined to be the target distributed node.

[0013] In a fourth aspect, an embodiment of the present application also provides a traffic processing device, which is applied to a target distributed node in a distributed system, and the device includes: a traffic packet receiving module, which is used to receive a business traffic packet forwarded by a security device, and the business traffic packet is forwarded to the target distributed node by the security device when the security device determines that the processing method for the business traffic packet is diversion forwarding based on a preset traffic processing rule, and the target distributed node is determined from multiple distributed nodes based on the addresses corresponding to multiple distributed nodes of the cloud distributed system and the address of the security device; a traffic packet forwarding module, which is used to send the business traffic packet to the target device pointed to by the destination address in the business traffic packet.

[0014] In some embodiments, the device also includes a legitimacy determination module for determining the legitimacy of the business traffic packet; a traffic packet processing module for processing the business traffic packet according to preset security rules when it is determined that the business traffic packet is illegal; and the traffic packet forwarding module is also used to send the business traffic packet to a target device pointed to by the destination address in the business traffic packet when it is determined that the business traffic packet is legal.

[0015] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the above-mentioned traffic processing method.

[0016] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a program code, and the program code can be called by a processor to execute the above-mentioned traffic processing method.

[0017] The traffic processing method, device, electronic device and storage medium provided in the embodiments of the present application include: if a business traffic packet is obtained, determining the processing method of the business traffic packet based on the preset traffic processing rules; if it is determined that the processing method of the business traffic packet is diversion forwarding, determining the target distributed node from multiple distributed nodes based on the addresses corresponding to the multiple distributed nodes in the cloud distributed system and the addresses of the security devices; sending the business traffic packet to the target distributed node, so that when the target distributed node confirms that the business traffic packet is legal, it sends the business traffic packet to the target device pointed to by the destination address in the address information of the business traffic packet; or, when it is confirmed that the business traffic packet is illegal, the business traffic packet is processed according to the preset security rules. By adopting the method provided by the present application, by matching the distributed node address with the address information of the business traffic packet, it is possible to guide the traffic to the target distributed node that is closer to the initiator of the business traffic packet, thereby reducing the network transmission distance and delay, and improving the user experience; in addition, when a distributed node detects illegal traffic, it can be processed immediately according to the preset security rules, thereby improving the security response speed and accuracy.

[0018] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 It is a flow chart of a flow processing method provided in an embodiment of the present application.

[0021] Figure 2 This is an application scenario diagram of a traffic processing method provided in an embodiment of the present application.

[0022] Figure 3 This is another application scenario diagram of a traffic processing method provided in an embodiment of the present application.

[0023] Figure 4 It is another process meaning diagram of a traffic processing provided in an embodiment of the present application.

[0024] Figure 5It is a connection block diagram of a flow processing device provided in an embodiment of the present application.

[0025] Figure 6 This is another connection block diagram of a traffic processing device provided in an embodiment of the present application.

[0026] Figure 7 It is a schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limiting the present application.

[0028] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0029] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0030] like Figure 1 , Figure 1 A flow chart of a flow processing method provided in an embodiment of the present application, which can be applied to Figure 2 The security device in the traffic processing system shown in the figure may be a firewall, an integrated security machine, a security router, etc. The traffic processing system also includes a distributed system, which includes multiple distributed nodes ( Figure 2 Only a schematic diagram of a traffic processing system including three distributed nodes is shown), the method includes:

[0031] Step S110: receiving a service traffic packet.

[0032] The above-mentioned service traffic packet can be any data packet transmitted between two devices in different local area networks. For example, one of the two devices is a first device and the other is a second device; at this time, when the first device and the second device communicate with each other, the data packet sent by the first device to the second device, or the data packet sent by the second device to the first device can be called a service traffic packet.

[0033] Exemplarily, when the first device is a terminal device, if the terminal device needs to request access to a certain page, the service traffic packet is a request packet, and the second device is a server.

[0034] The security device can be deployed between the first device and the second device, for example, in a gateway manner. Whether it is a business traffic packet sent from the first device to the second device or a business traffic packet sent from the second device to the first device, it will pass through the security device, so the security device can intercept the business traffic packet passing through the security device.

[0035] In some other embodiments, the security device can also be deployed at the first device in a bypass deployment manner. For example, a plug-in can be installed on the first device, and the plug-in is used to obtain the business traffic packet of the mirror of the business traffic packet communicated between the first device and the second device, and send the mirrored business traffic packet to the security device. Of course, a probe device can also be installed at the exit of the first device, and the probe device is used to obtain the business traffic packet of the mirror of the business traffic packet communicated between the first device and the second device, and send the mirrored business traffic packet to the security device.

[0036] The service traffic packet carries address information, wherein the address information includes a DNS address (DNS, Domain Name System), an IP address (IP, Internet Protocol) or a URL address (URL, Uniform Resource Locator); wherein the DNS address is a human-readable, easy-to-remember name for a host or service on the Internet. For example, www.example.com is a domain name address. An IP address is a digital label used to uniquely identify a device in a computer network, and is used to locate and address a specific host or network device on the Internet. For example, an IPv4 address is usually a 32-bit string of numbers, represented by four decimal numbers between 0 and 255, separated by ".", such as 192.0.2.1. A URL address fully describes the location of a resource on the Internet and how to access this resource. A URL includes a protocol type (such as http: / / , https: / / ), a domain name (or an IP address), a port number (displayed when necessary, such as: 8080), a path (such as / path / to / resource), and query parameters (such as? param1=value1¶m2=value2). For example, a complete URL address can be: https: / / www.example.com / path / to / page?query=term.

[0037] Step S120: Determine a processing method for the service traffic packet based on preset traffic processing rules.

[0038] When determining the processing method for the business traffic packet based on the preset traffic processing rules, the characteristic information of the business traffic packet can be extracted, and then the extracted traffic characteristics can be matched with the preset traffic processing rules. For example, the traffic characteristics can be the attack behavior detection results and / or preset access resources in the business traffic packet. Of course, in some other embodiments, the traffic characteristics can also include traffic types, IP addresses, domain names or URL addresses in business traffic packets, etc., which are not limited here. The above-mentioned traffic types are used to describe the types of business traffic packets. There can be multiple classification standards for traffic types. For example, traffic types can be divided according to five-tuples (five-tuples include source IP address, source port, destination IP address, destination port, protocol type) or business types (such as communication services, data retrieval services, etc.).

[0039] In one possible implementation, the preset traffic processing rule includes one or more of a preset domain name, a preset IP address segment, and a preset URL domain name. The feature information extracted from the service traffic packet includes the DNS domain name, IP address, or URL address of the service traffic packet.

[0040] In one possible implementation, the above step S110 can be to determine the processing method for the business traffic packet based on the preset traffic processing rule and the address information of the business traffic packet, and match the preset traffic processing rule with the address information of the business traffic packet to obtain a matching result, and the preset traffic processing rule includes a plurality of preset diversion rules; if the matching result indicates that there is a target diversion rule that matches the business traffic packet, determine that the processing method for the business traffic packet is diversion forwarding. It should be understood that the above matching result includes the matching result between each preset diversion rule and the business traffic packet.

[0041] Among them, in this embodiment, diversion forwarding refers to the redirection of business traffic packets that originally directly reach the target device (for example, sent from the first device to the second device or from the second device to the first device) through an additional intermediary layer or channel. For example, through the cloud platform's load balancer, reverse proxy server, CDN (Content Delivery Network) and other technical means, the business traffic packets are guided to the target distributed node in multiple distributed nodes in a pre-set cloud distributed system, and the target distributed node forwards the business traffic packets.

[0042] Among them, if the address information of the service traffic packet is IP address information, and the preset diversion rules include multiple preset address segments, the IP address information can be matched with the multiple preset address segments. If the IP address information correspondence table is within a preset address segment, it can be determined that the preset address segment matches the service traffic packet. Exemplarily, if the preset address segment is 192.0.XXX.XXX, if the address information of the service traffic packet is IP address information, and specifically 192.0.2.1, it can be determined that the address information of the service traffic packet corresponds to the preset address segment. At this time, the preset address segment matches the address information of the service traffic packet, and the service traffic packet needs to be diverted.

[0043] If the address information of the service traffic package is a URL address or a domain name, the URL address and domain name can be resolved to obtain an IP address, and the above-mentioned matching method can be executed; alternatively, the preset diversion rules can also include multiple preset URL address information and multiple preset domain name information, and the URL address of the service traffic package can be matched with multiple preset URL address information, or the domain name of the service traffic package can be matched with multiple preset domain names.

[0044] Exemplarily, multiple preset URL address information may specifically include: " / images / *", "api / v2 / *" and ".html and www.example1.com". When the preset URL address information is " / images / *", it means that the business traffic package including the " / images / *" path will be diverted, when the preset URL address information is "api / v2 / *", it means that the business traffic package including "api / v2 / *" will be diverted, and the preset URL address information is ".html and www.example1.com", which means that the business traffic package ending with .html and belonging to www.example1.com will be diverted. Multiple preset domain names may include: "video.example2.com", "static.example3.com", ".eu", etc.

[0045] At this time, if there is a business traffic package, whose URL address is https: / / www.example1.com / images / product1.jpg, according to the aforementioned preset traffic rules, the URL address of the business traffic package contains the preset URL address information / images / *, so the business traffic package needs to be diverted. If there is another business traffic package, whose target URL is https: / / api.example4.com / api / v2 / user / profile, because the URL contains api / v2 / *, this business traffic package also needs to be diverted.

[0046] Step S130: If it is determined that the processing method for the business traffic packet is diversion forwarding, based on the addresses corresponding to the multiple distributed nodes in the cloud distributed system and the address of the security device, an available target distributed node is determined from the multiple distributed nodes.

[0047] Among them, distributed nodes specifically refer to computing units deployed in the network architecture that have processing capabilities and can work together. These distributed nodes can be embodied in the form of virtual servers, container services, microservices, etc. in the cloud computing environment, or they can be physical devices such as independent server clusters, network devices (such as load balancers, firewalls), different servers or edge computing nodes within the data center, etc. Distributed node availability means that the distributed node is currently in operation and can process business traffic packets. The addresses corresponding to multiple distributed nodes in the cloud distributed system and the addresses of security devices can be address segments or geographic locations.

[0048] When the address corresponding to the distributed node is a geographical location, and the address of the security device is also a geographical location, the geographical location may refer to the geographical location where the device (distributed node or security device) is installed. For example, the geographical location where distributed node A is installed may be province a; the geographical location corresponding to distributed node B may be province b; and the geographical location corresponding to distributed node C may be province c. The above step S120 may be, according to the geographical location of the security device, selecting a target distributed node that is closest to the geographical location of the security device from a plurality of distributed nodes according to the geographical location and the geographical locations corresponding to each distributed node, or selecting the first N candidate distributed nodes (N is a positive integer) that are closest. Subsequently, the target distributed node may be selected from each candidate distributed node according to the load, function, etc. of each candidate distributed node.

[0049] When the addresses corresponding to multiple distributed nodes in a cloud distributed system are address segments, the same distributed node may correspond to multiple address segments, and multiple distributed nodes may have the same address segment. The above step S120 may be: selecting a candidate distributed node from the multiple distributed nodes, wherein the address segment corresponding to the security device is included in the address segment of the candidate distributed node.

[0050] In the above two methods, if there is one candidate distributed node, the candidate distributed node is used as the target distributed node; if there are multiple candidate distributed nodes, the candidate distributed node that is closest to the device sending the service traffic packet is selected as the target distributed node based on the geographical locations corresponding to the multiple candidate distributed nodes. The target distributed node with the lowest load can also be selected from the loads corresponding to the multiple candidate distributed nodes. It should be understood that the above-mentioned target distributed node method is only illustrative, and there can be more selection methods.

[0051] Considering that different distributed nodes may also have different functions, for example, there may be some distributed nodes that specialize in processing API request-type business traffic packets (API, Application Programming Interface), there may also be some distributed nodes used for caching and distributing static content; there may also be some nodes used for deep packet detection. Therefore, the target distributed node can also be determined from multiple distributed nodes based on the characteristic information used to characterize the processing method of the business traffic packet in the address information carried in the business traffic packet and the functions of each distributed node, wherein the function of the target distributed node corresponds to the processing method of the business traffic packet. Exemplarily, multiple preset traffic processing rules include Rule 1, indicating that HTTP(S) business traffic packets with an IP address segment of 192.168.0.0 / 16 are all directed to distributed nodes with deep packet detection functions to ensure the legitimacy and security of business traffic packets; Rule 2, indicating that business traffic packets with a URL address containing / api / v1 / * and a target domain name of api.example.com are directed to distributed nodes that specialize in processing API requests and have high-performance computing capabilities. Rule 3 directs the business traffic packets with the domain name cdn.example.net (the business traffic packets are static file requests such as .jpg, .css, .js, etc.) to distributed nodes deployed around the world that are dedicated to caching and distributing static content. If a business traffic packet is received, its source IP address is 192.168.1.2, the URL address is https: / / api.example.com / api / v1 / user / login, and the domain name is api.example.com. According to Rule 1, although the business traffic packet originates from the specified IP address segment, since the request is an API request rather than ordinary HTTP traffic, according to Rule 2, since the target URL and domain name of the business traffic packet meet the preset URL address information and domain name information, a distributed node that can process API requests will be selected as the target distributed node, and the business traffic packet will be sent to the target distributed node.

[0052] Step S140: Send the service traffic packet to the target distributed node, so that when the target distributed node confirms that the service traffic packet is legal, it sends the service traffic packet to the target device pointed to by the destination address in the address information of the service traffic packet; or, when it is confirmed that the service traffic packet is illegal, it processes the service traffic packet according to preset security rules.

[0053] Among them, when the target distributed node confirms whether the business traffic packet is legal, there may be specific methods such as identity authentication, access control, content verification, protocol compliance verification, signature verification, and traffic filtering. Among them, when the legitimacy of the business traffic packet is determined through identity authentication, the authentication information in the business traffic packet can be checked, such as the token, data block or basic identity authentication information in the HTTP (Hypertext Transfer Protocol) header, to ensure that the initiator of the business traffic packet has passed the identity authentication and is an authorized user or service. When the legitimacy of the business traffic packet is determined through access control, if the business traffic packet is a request packet, the preset access control list or role permission model is used to determine whether the business traffic packet has the right to access specific resources or perform specific operations. If so, it is legal, and if not, it is illegal. Content verification refers to the format verification of submitted data for business traffic packets with data payloads such as POST (POST Request, POST request packet, used to submit data to a specified resource and request the server to process it (such as storing data or triggering a new action) and PUT (PUT Request, PUT request, used to upload the latest content to a specified resource location, often used to update existing resources.) to ensure that the content structure meets expectations. Security check refers to the detection of common security threats such as SQL injection, cross-site scripting attacks, and cross-site request forgery in business traffic packets. At the same time, malware scanning is performed on business traffic packets, especially when uploading files, to check whether the business traffic packets carry viruses or other malicious codes. Protocol compliance check refers to whether the business traffic packets comply with relevant protocol standards, such as checking whether the HTTP method is correct, URI specifications, header fields, etc. are complete and correct. Signature verification refers to the need to verify the digital signature for encrypted transmission of business traffic packets to ensure message integrity, and to verify the source of the message through certificate chain verification. Traffic filtering refers to the use of firewall rules to determine whether traffic should be allowed to pass.

[0054] Wherein, when it is confirmed that the business traffic packet is illegal, the way to process the business traffic packet according to the preset security rules can be, according to the illegal type of the business traffic packet, select at least one preset security rule, and use the selected at least one preset security rule to process the business traffic packet. Wherein, there can be multiple preset security rules, such as denial of service, access control denial, redirection, content filtering and cleaning, logging and alarm, black hole strategy, etc. Wherein, denial of service means that if the business traffic packet is abnormally high frequency or obviously intends to consume system resources, the target distributed node may start the denial of service protection rule, such as temporarily blocking or limiting the traffic from a specific IP address. Access control denial means that when the business traffic packet attempts to access unauthorized resources or perform unauthorized operations, the target distributed node will reject the request in the business traffic packet according to the access control list and record the violation event. Redirection means that if the business traffic packet attempts to access a service that has been migrated or abandoned, the distributed node can redirect it to a new service address. Content filtering and cleaning means that if a business traffic packet contains malicious content (such as SQL injection (SQL, Structured Query Language, Structured Query Language), XSS attack (XSS, Cross-Site Scripting, cross-site scripting attack), etc.), the target distributed node can remove the malicious part and forward the purified business traffic packet, or directly discard it. Logging and alarming means that no matter what type of illegal traffic packet the business traffic packet is, it will trigger logging, and may also trigger an alarm notification to the security operation and maintenance personnel, recording important information including business traffic packet details, occurrence time, source IP, etc. The black hole strategy refers to business traffic packets that are continuously malicious or seriously illegal. Such business traffic packets can be completely discarded and no longer occupy any system resources.

[0055] For example, if the target distributed node detects that the service traffic contains an obvious SQL injection attack string, after detecting the attack string, the distributed node will perform content cleaning on the traffic packet according to the preset security rules (content filtering and cleaning), remove harmful character sequences, and forward it after repair, while recording the attack event and related information. If the target distributed node continuously detects that the same initiator initiates a large number of invalid or attack-like request service traffic packets (there are multiple service traffic packets with the same source IP address within a preset time, and multiple service traffic packets are invalid or have attack-like nature), the target distributed node will trigger the preset security rule of denial of service and limit the speed of the IP address or temporarily block it.

[0056] It should be understood that when faced with multiple illegal situations, the target distributed node can select appropriate countermeasures based on the priority of the security policy corresponding to each illegal situation and the severity of the illegal situation. For example, the security policy of denial of service may have a higher priority than the security policy corresponding to the access control error and will be processed first. In addition, different types of illegal situations may have different security rules and response times to ensure that the system can both effectively and timely prevent potential risks and ensure that normal services are not affected.

[0057] It should be noted that after the business traffic packet is processed according to the preset security rules, such as after limiting, cleaning or redirecting the business traffic packet, if it is determined that the processed business traffic packet can be sent, the business traffic packet can be sent to the target device pointed to by the destination address according to the destination address in the address information of the processed business traffic packet.

[0058] Among them, the process of sending the business traffic packet to the target device pointed to by the destination address in the address information of the business traffic packet can specifically be that the target distributed node selects the corresponding network protocol (such as TCP / IP (Transmission Control Protocol / Internet Protocol) or UDP protocol (User Datagram Protocol)) to encapsulate the business traffic packet, and accurately sends the business traffic packet to the target device pointed to by the destination address through the underlying network interface. This process may also involve network transmission mechanisms such as routing selection and congestion control.

[0059] In one possible implementation, if the matching result indicates that there is no preset traffic processing rule that matches the address information of the service traffic packet, the service traffic packet is forwarded based on the address information of the service traffic packet.

[0060] Among them, when the security device forwards the service traffic packet based on the address information of the service traffic packet, the security device may adopt a basic forwarding strategy by default, such as direct forwarding or forwarding based on a routing table. When forwarding based on a routing table, the security device can check the destination address information of the service traffic packet, use an internal or external routing table to determine the best path, and then send the service traffic packet along the path. During the forwarding process, the service traffic packet is transmitted along the network infrastructure until it reaches the server pointed to by the destination address.

[0061] By adopting the traffic processing method of the present application, by setting up a distributed system in the cloud, the business traffic packets can be allocated to different distributed nodes for processing, achieving the dispersion and load balancing of the business traffic packets, thereby improving the processing capacity and response speed of the business traffic packets under high concurrency. Further, by matching the distributed node address with the address information of the business traffic packet, it is possible to guide the traffic to the target distributed node closer to the initiator of the business traffic packet, thereby reducing the network transmission distance and delay, and improving the user experience; in addition, when a distributed node detects illegal traffic, it can be processed immediately according to the preset security rules, thereby improving the security response speed and accuracy. In addition, the present application sets a variety of preset traffic processing rules, such as the preset traffic processing rules set include one or more of the preset domain name, the preset IP address segment, and the preset URL domain name, so that when the address information of the business traffic packet includes the DNS domain name, IP address or URL address, it can be detected, thereby achieving a more comprehensive detection of the business traffic packet, and effectively improving the accuracy of the detection results of the business traffic packet.

[0062] Please refer to Figure 3 In one possible implementation, the preset traffic processing rule further includes a plurality of drainage rules and a drainage method corresponding to each drainage rule, and the above step S110 includes:

[0063] If the matching result indicates that there is a target drainage rule that matches the address information of the business traffic packet, the drainage method corresponding to the target drainage rule in the preset traffic processing rule library is determined as the processing method for the business traffic packet.

[0064] Among them, the drainage methods include rate limiting drainage, priority queue drainage and burst control drainage. Among them. Rate limiting drainage refers to setting a rate threshold for business traffic packets. Business traffic packets that exceed the rate threshold will be discarded or cached; priority queue drainage refers to assigning different priorities to business traffic packets according to the importance of different services or applications in the business traffic packets to ensure that key business traffic packets are not affected by low-priority traffic; burst control drainage refers to allowing a small degree of overspeed (such as within a preset range of 5% or 10%) within a certain period of time, but adjusting after exceeding the threshold.

[0065] The method further includes: processing the service traffic packet according to a drainage mode corresponding to the target drainage rule.

[0066] For example, if the service traffic packet is file download traffic, the corresponding traffic flow rule is a traffic shaping rule, and the security device can limit the transmission speed of the service traffic packet according to the preset speed limit, giving more bandwidth to other more important service traffic packets. If the service traffic packet matches the rule of prohibiting or restricting access, the security device can directly discard the traffic, or mark it with a special mark for further processing by the subsequent firewall or other security components.

[0067] It should be noted that for speed-limited traffic, after limiting the transmission speed of the business traffic packet, it is necessary to forward the business traffic packet based on the address information of the business traffic packet. The specific forwarding process can refer to the aforementioned forwarding process, which will not be repeated here.

[0068] See also Figure 4 The embodiment of the present application provides a traffic processing method, which is applied to a target distributed node in a distributed system, and the method includes:

[0069] Step S210: Receive a business traffic packet forwarded by a security device, where the business traffic packet is forwarded to a target distributed node by the security device when the security device determines based on a preset traffic processing rule that the processing method for the business traffic packet is diversion forwarding, and the target distributed node is determined from multiple distributed nodes based on addresses corresponding to multiple distributed nodes of the cloud distributed system and the address of the security device.

[0070] Step S220: Send the service traffic packet to the target device pointed to by the destination address in the service traffic packet.

[0071] In one possible implementation, before executing step S220, the method further includes: determining the legality of the business traffic packet; if the business traffic packet is illegal, processing the business traffic packet according to preset security rules; if the business traffic packet is legal, executing step S220.

[0072] For the detailed description of S210 - S220 , please refer to the detailed description of steps S110 - S130 in the aforementioned embodiment, which will not be repeated here.

[0073] like Figure 5 , Figure 5A traffic processing device 300 is provided in an embodiment of the present application, and the device 300 includes: a traffic packet receiving module 310, used to receive a business traffic packet; a processing method determination module 320, used to determine the processing method for the business traffic packet based on a preset traffic processing rule; a distributed node determination module 330, used to determine an available target distributed node from the multiple distributed nodes based on the addresses corresponding to the multiple distributed nodes in the cloud distributed system and the address of the security device when determining that the processing method for the business traffic packet is diversion forwarding; a traffic packet sending module 340, used to send the business traffic packet to the target distributed node, so that the target distributed node sends the business traffic packet to the target device pointed to by the destination address in the address information of the business traffic packet when confirming that the business traffic packet is legal; or, when confirming that the business traffic packet is illegal, the business traffic packet is processed according to the preset security rules.

[0074] In some embodiments, the processing method determination module 320 is also used to match the preset traffic processing rules with the address information of the business traffic packet to obtain a matching result, and the preset traffic processing rules include multiple diversion rules; if the matching result indicates that there is a target diversion rule that matches the business traffic packet, it is determined that the processing method for the business traffic packet is diversion forwarding.

[0075] In some embodiments, the preset traffic processing rules also include multiple drainage rules and drainage methods corresponding to each drainage rule; the processing method determination module 320 is also used to determine the drainage method corresponding to the target drainage rule in the preset traffic processing rule library as the processing method for the business traffic packet if the matching result indicates that there is a target drainage rule that matches the address information of the business traffic packet; the device also includes: a drainage processing module, which is used to process the business traffic packet according to the drainage method corresponding to the target drainage rule.

[0076] In some embodiments, the device 300 also includes: a traffic forwarding module, which is used to forward the business traffic packet based on the address information of the business traffic packet if the matching result indicates that there is no preset traffic processing rule that matches the address information of the business traffic packet.

[0077] In some implementations, the address information of the service traffic packet includes a DNS domain name, an IP address, or a URL address; the preset traffic processing rule includes one or more of a preset domain name, a preset IP address segment, and a preset URL domain name.

[0078] In some embodiments, the distributed node determination module 330 is also used to match the source address in the address information of the business traffic packet with the addresses corresponding to multiple distributed nodes in the cloud distributed system to obtain matching results corresponding to each distributed node; if there is a matching result corresponding to a distributed node indicating that the source address matches the address corresponding to the distributed node, the distributed node is determined to be a target distributed node.

[0079] See also Figure 6 The embodiment of the present application also provides a traffic processing device 400, which is applied to a target distributed node in a distributed system. The device 400 includes: a traffic packet receiving module 410, which is used to receive a business traffic packet forwarded by a security device. The business traffic packet is forwarded to the target distributed node by the security device when the security device determines that the processing method for the business traffic packet is diversion forwarding based on a preset traffic processing rule. The target distributed node is determined from multiple distributed nodes based on the addresses corresponding to multiple distributed nodes of the cloud distributed system and the address of the security device; a traffic packet forwarding module 420, which is used to send the business traffic packet to the target device pointed to by the destination address in the business traffic packet.

[0080] In some embodiments, the device 400 also includes a legitimacy determination module for determining the legitimacy of the business traffic packet; a traffic packet processing module for processing the business traffic packet according to preset security rules when it is determined that the business traffic packet is illegal; and the traffic packet forwarding module 420 is also used to send the business traffic packet to the target device pointed to by the destination address in the business traffic packet when it is determined that the business traffic packet is legal.

[0081] Correspondingly, such as Figure 7 The embodiment of the present application further provides an electronic device 500, which may be an electronic device capable of running applications, such as a smart phone, a tablet computer, or a server. The electronic device 500 may include one or more processors 510, a memory 520, and one or more applications, wherein the one or more applications are stored in the memory 520 and configured to be executed by the one or more processors 510, and the one or more applications are configured to execute the above-mentioned traffic processing method.

[0082] It can be understood that the processor 510 and the memory 520 are connected via a communication bus to complete mutual communication, and the processor 510 can call the logic instructions in the memory 520 to execute the speech template generation method in any of the aforementioned embodiments. Exemplarily, the processor 510 can be implemented in the form of a general-purpose CPU, a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit.ASIC), or one or more integrated circuits, etc., for executing related programs to implement the technical solution provided in this application. The memory can include ROM (Read0nly Memory, read-only memory), RAM (Random Access Memory, random access memory) static storage devices, dynamic storage devices, etc.

[0083] Correspondingly, an embodiment of the present application further provides a computer-readable storage medium, in which a program code is stored, and the program code can be called by a processor to execute the above-mentioned traffic processing method.

[0084] It can be understood that the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.

[0085] Part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for enabling a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0086] The above are only preferred embodiments of the present application, and are not intended to limit the present application in any form. Although the present application has been disclosed as above with preferred embodiments, it is not intended to limit the present application. Any technical personnel in the field can make some changes or modify the technical contents disclosed above into equivalent embodiments without departing from the scope of the technical solution of the present application. However, any brief modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present application without departing from the content of the technical solution of the present application are still within the scope of the technical solution of the present application.

Claims

1. A traffic processing method, applied to a security device, characterized in that: The method comprises: Receiving business traffic packets; Determine a processing method for the service traffic packet based on a preset traffic processing rule; If it is determined that the processing method for the service traffic packet is diversion forwarding, based on the addresses corresponding to the multiple distributed nodes in the cloud distributed system and the address of the security device, an available target distributed node is determined from the multiple distributed nodes; Send the service traffic packet to the target distributed node, so that when the target distributed node confirms that the service traffic packet is legal, the target distributed node sends the service traffic packet to the target device pointed to by the destination address in the address information of the service traffic packet; or, when it is confirmed that the service traffic packet is illegal, the service traffic packet is processed according to preset security rules.

2. The method according to claim 1, characterized in that: Determining a processing method for the service traffic packet based on a preset traffic processing rule includes: Matching the preset traffic processing rule with the address information of the service traffic packet to obtain a matching result, wherein the preset traffic processing rule includes a plurality of traffic diversion rules; If the matching result indicates that there is a target diversion rule that matches the business traffic packet, it is determined that the processing method for the business traffic packet is diversion forwarding.

3. The method according to claim 2, characterized in that The preset flow processing rules also include a plurality of flow discharging rules and a flow discharging method corresponding to each flow discharging rule; Determining a processing method for the service traffic packet based on a preset traffic processing rule also includes: If the matching result indicates that there is a target flow discharge rule that matches the address information of the service traffic packet, the flow discharge method corresponding to the target flow discharge rule in the preset traffic processing rule library is determined as the processing method for the service traffic packet; The method further comprises: The service traffic packet is processed according to a discharge method corresponding to the target discharge rule.

4. The method according to claim 3, characterized in that The method further comprises: If the matching result indicates that there is no preset traffic processing rule that matches the address information of the service traffic packet, the service traffic packet is forwarded based on the address information of the service traffic packet.

5. The method according to claim 2, characterized in that: The address information of the business traffic packet includes a DNS domain name, an IP address or a URL address; the preset traffic processing rule includes one or more of a preset domain name, a preset IP address segment and a preset URL domain name.

6. A traffic processing method, applied to a target distributed node in a distributed system, characterized in that: The method comprises: Receive a service traffic packet forwarded by a security device, the service traffic packet being forwarded to a target distributed node by the security device when the security device determines based on a preset traffic processing rule that the processing mode of the service traffic packet is diversion forwarding, the target distributed node being determined from multiple distributed nodes based on addresses corresponding to multiple distributed nodes of a cloud distributed system and an address of the security device; The service traffic packet is sent to the target device pointed to by the destination address in the service traffic packet.

7. The method according to claim 6, characterized in that Before sending the service traffic packet to the target device pointed to by the destination address in the service traffic packet, the method further includes: Determining the legitimacy of the service traffic package; If the service traffic packet is illegal, the service traffic packet is processed according to preset security rules; If the service traffic packet is legal, execute the step of sending the service traffic packet to the target device pointed to by the destination address in the service traffic packet.

8. A flow processing device, applied to a security device, characterized in that: The device comprises: A traffic packet receiving module, used to receive a service traffic packet, wherein the service traffic packet carries address information; A processing method determination module, used to determine a processing method for the service traffic packet based on a preset traffic processing rule; A distributed node determination module, for determining an available target distributed node from a plurality of distributed nodes based on addresses corresponding to the plurality of distributed nodes in the cloud distributed system and the address of the security device when determining that the processing mode for the service traffic packet is diversion forwarding; A traffic packet sending module is used to send the business traffic packet to the target distributed node, so that when the target distributed node confirms that the business traffic packet is legal, it sends the business traffic packet to the target device pointed to by the destination address in the address information of the business traffic packet; or, when it is confirmed that the business traffic packet is illegal, it processes the business traffic packet according to preset security rules.

9. A traffic processing device, applied to a target distributed node in a distributed system, characterized in that: The device comprises: A traffic packet receiving module, used to receive a service traffic packet forwarded by a security device, wherein the service traffic packet is forwarded to a target distributed node by the security device when the security device determines that the processing mode of the service traffic packet is diversion forwarding based on a preset traffic processing rule, and the target distributed node is determined from multiple distributed nodes based on addresses corresponding to multiple distributed nodes of a cloud distributed system and an address of the security device; The traffic packet forwarding module is used to send the service traffic packet to the target device pointed to by the destination address in the service traffic packet.

10. An electronic device, characterized in that: include: one or more processors; Memory; One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the method as described in any one of claims 1-5 or 6-7.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program code, and the program code can be called by a processor to execute the method as claimed in any one of claims 1-5 or 6-7.

Images