Traffic protection method and device, equipment and storage medium

Abstract

The embodiment of the invention relates to the technical field of data processing, in particular to a traffic protection method and device, equipment and a storage medium, and aims to improve the traffic attack protection efficiency of a server. The method comprises the following steps: generating a corresponding real-time traffic model according to real-time traffic data in a server; obtaining index data corresponding to at least one protection module from the real-time flow model; according to the index data, a protection strategy corresponding to at least one protection module is adjusted, and corresponding protection measures are executed; generating a historical traffic model on the basis of the real-time traffic model according to historical traffic data in the server; in the forwarding process of the real-time traffic data, obtaining a corresponding traffic analysis result according to the historical traffic model; and according to the flow analysis result, adjusting a protection strategy corresponding to the at least one protection module, and executing a corresponding protection measure.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network technology, and more specifically, to a traffic protection method, apparatus, device, and storage medium. Background Art

[0002] When a server is attacked by traffic, it is easy to crash, affecting the normal operation of the server. In the prior art, multiple protection modules are pre-set in the server. When the server is attacked by traffic, the traffic log is directly analyzed and a protection strategy is issued.

[0003] In the existing technology, only the protection strategy of a single node is considered, and it is impossible to conduct a comprehensive analysis from the overall situation of the node. In addition, the analysis time is slow, which leads to delayed protection decisions and reduced protection efficiency. Summary of the invention

[0004] The embodiments of the present application provide a traffic protection method, apparatus, device and storage medium, aiming to improve the traffic attack protection efficiency of a server.

[0005] A first aspect of an embodiment of the present application provides a traffic protection method, the method comprising: Generate a corresponding real-time traffic model according to the real-time traffic data in the server; Obtaining indicator data corresponding to at least one protection module from the real-time traffic model; Adjusting the protection strategy corresponding to at least one of the protection modules according to the indicator data, and executing corresponding protection measures; Generating a historical traffic model based on the real-time traffic model according to the historical traffic data in the server; In the process of forwarding the real-time traffic data, a corresponding traffic analysis result is obtained according to the historical traffic model; According to the traffic analysis result, a protection strategy corresponding to at least one of the protection modules is adjusted, and corresponding protection measures are executed.

[0006] Optionally, before generating a corresponding real-time traffic model according to the real-time traffic data in the server, the method further includes: Obtaining traffic data from the traffic log and attack log of the server; Classifying the flow data according to corresponding attributes to obtain the classified flow data; The classified traffic data is stored in the memory of the server according to the corresponding data indicators, and is asynchronously pushed to the database.

[0007] Optionally, generating a corresponding real-time traffic model according to the real-time traffic data in the server includes: Extracting traffic data within a preset time period from the memory of the server according to preset data indicators, wherein the preset time period is a time period with a granularity of seconds including the current time; The flow data is processed according to preset data acquisition rules to obtain the real-time flow model.

[0008] Optionally, adjusting the protection strategy corresponding to at least one of the protection modules according to the indicator data includes: determining the protection module corresponding to the indicator data; Sending the indicator data to the protection module; The protection threshold corresponding to the protection module is adjusted according to the indicator data, and the protection rule of the protection module is adjusted.

[0009] Optionally, generating a historical traffic model based on the real-time traffic model according to the historical traffic data in the server includes: Extracting traffic data from the database of the server at an hourly granularity according to preset data indicators; Processing the flow data according to preset data acquisition rules to obtain processing result data; The real-time traffic model is supplemented by the processing result data to obtain the historical traffic model.

[0010] Optionally, in the process of forwarding the real-time traffic data, obtaining a corresponding traffic analysis result according to the historical traffic model includes: Determine a time period corresponding to the real-time traffic data; Acquire historical traffic data of the same time period in the historical time in the historical traffic model; The historical traffic data and the real-time traffic data are analyzed to obtain the traffic analysis result.

[0011] Optionally, adjusting a protection strategy corresponding to at least one of the protection modules according to the traffic analysis result includes: Put the traffic analysis result into the subscription message queue; Sending the traffic analysis result from the subscription message queue to the corresponding protection module; The module threshold of the protection module is adjusted according to the traffic analysis result, and the protection rule of the protection module is adjusted.

[0012] A second aspect of an embodiment of the present application provides a flow protection device, the device comprising: A first traffic model generating module, used to generate a corresponding real-time traffic model according to the real-time traffic data in the server; An indicator data acquisition module, used to obtain indicator data corresponding to at least one protection module from the real-time traffic model; A first protection module, configured to adjust a protection strategy corresponding to at least one of the protection modules according to the indicator data, and execute corresponding protection measures; A second traffic model generating module, configured to generate a historical traffic model based on the real-time traffic model according to the historical traffic data in the server; A traffic analysis module, used to obtain corresponding traffic analysis results according to the historical traffic model during the forwarding process of the real-time traffic data; The second protection module is used to adjust the protection strategy corresponding to at least one of the protection modules according to the traffic analysis result, and execute corresponding protection measures.

[0013] Optionally, the device further comprises: A flow data acquisition module, used to acquire flow data from the flow log and attack log of the server; A flow data classification module, used for classifying the flow data according to corresponding attributes to obtain the classified flow data; The traffic data storage module is used to store the classified traffic data in the memory of the server according to the corresponding data indicators, and asynchronously push it to the database.

[0014] Optionally, the first traffic model generating module includes: A first data extraction submodule is used to extract the traffic data within a preset time period from the memory of the server according to a preset data indicator, wherein the preset time period is a time period with a granularity of seconds including the current time; The first data processing submodule is used to process the traffic data according to a preset data acquisition rule to obtain the real-time traffic model.

[0015] Optionally, the first protection module includes: a protection module determination submodule, used to determine the protection module corresponding to the indicator data; An indicator data sending submodule, used for sending the indicator data to the protection module; The first protection submodule is used to adjust the protection threshold corresponding to the protection module and the protection rule of the protection module according to the indicator data.

[0016] Optionally, the second traffic model generating module includes: A second data extraction submodule is used to extract traffic data from the database of the server based on preset data indicators with hourly granularity; The second data processing submodule is used to process the flow data according to a preset data acquisition rule to obtain processing result data; The second traffic model generating submodule is used to supplement the real-time traffic model with the processing result data to obtain the historical traffic model.

[0017] Optionally, the traffic analysis module includes: A time period determination submodule, used to determine the time period corresponding to the real-time traffic data; A historical traffic data acquisition submodule, used to acquire historical traffic data of the same time period in the historical time in the historical traffic model; The analysis result acquisition submodule is used to analyze the historical traffic data and the real-time traffic data to obtain the traffic analysis results.

[0018] Optionally, the second protection module includes: A result queue submodule, used to put the traffic analysis result into a subscription message queue; A result sending submodule, used for sending the traffic analysis result from the subscription message queue to the corresponding protection module; The second protection submodule is used to adjust the module threshold of the protection module and the protection rule of the protection module according to the traffic analysis result.

[0019] A third aspect of an embodiment of the present application provides a readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps in the method described in the first aspect of the present application are implemented.

[0020] A fourth aspect of an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the method described in the first aspect of the present application are implemented.

[0021] By adopting the traffic protection method provided by the present application, a corresponding real-time traffic model is generated according to the real-time traffic data in the server; indicator data corresponding to at least one protection module is obtained from the real-time traffic model; the protection strategy corresponding to at least one of the protection modules is adjusted according to the indicator data, and corresponding protection measures are executed; according to the historical traffic data in the server, a historical traffic model is generated on the basis of the real-time traffic model; in the process of forwarding the real-time traffic data, a corresponding traffic analysis result is obtained according to the historical traffic model; according to the traffic analysis result, the protection strategy corresponding to at least one of the protection modules is adjusted, and corresponding protection measures are executed.

[0022] In this method, real-time traffic data is analyzed to generate a real-time traffic model, and corresponding indicator data is determined according to the real-time traffic model. The protection module adjusts the protection strategy according to the indicator data and executes corresponding protection measures to achieve real-time traffic protection. At the same time, a historical traffic model is generated according to historical traffic data. Based on the analysis of historical traffic, the protection strategy of the protection module is further adjusted to better execute corresponding protection measures, thereby achieving real-time and precise protection against traffic attacks. In addition, the protection strategy can be continuously learned and adjusted, thereby improving the protection effect against traffic attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0024] Figure 1 is a flow chart of a flow protection method proposed in an embodiment of the present application; Figure 2 This is a schematic diagram of the overall protection process of the flow model linkage proposed in an embodiment of the present application; Figure 3 This is a flowchart of dynamic node protection adjustment proposed in an embodiment of the present application; Figure 4 is a schematic diagram of a flow protection device proposed in an embodiment of the present application; Figure 5 It is a schematic diagram of an electronic device proposed in an embodiment of the present application. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0026] refer to Figure 1 , Figure 1 Flow chart of the flow protection method proposed in one embodiment of the present application. Figure 1 As shown, the method comprises the following steps: S11: Generate a corresponding real-time traffic model according to the real-time traffic data in the server.

[0027] In this embodiment, the real-time traffic data is the traffic data in a period of time close to the current time. The real-time traffic model is a model generated by extracting data from the real-time traffic data through a data extraction rule, and the data extraction rule can be set by oneself, such as mean, peak value, normal distribution, 95 rule, etc.

[0028] In this embodiment, in order to prevent DDoS (Distributed Denial of Service) attacks, a network attack method that paralyzes the server by sending a large number of requests to the target server, making it unable to process or denying further services. The traffic data is analyzed by generating a real-time traffic model, and then the corresponding protection module is used for protection, and the protection strategy is adjusted.

[0029] In this embodiment, during the normal operation of the server, real-time traffic data is first obtained from the database of the server, and then data is extracted from the real-time traffic data according to preset data extraction rules to generate a real-time traffic model.

[0030] In this embodiment, the specific steps of generating a corresponding real-time traffic model according to the real-time traffic data in the server include: S11-1: Extracting the traffic data within a preset time period from the memory of the server according to preset data indicators, wherein the preset time period is a time period with a granularity of seconds including the current time.

[0031] In this embodiment, the data indicator is an attribute type in the traffic data, and the preset time period is a time period with a granularity of seconds including the current time.

[0032] In this embodiment, the flow data within a preset time period is extracted from the memory of the server according to the preset data index. The data in the server is classified and stored according to the attributes in advance. When extracting, the location of the data storage of the corresponding attribute is found to directly obtain the latest stored data in seconds. The data of the most recent few seconds can also be extracted.

[0033] In this embodiment, the data indicators include attack types and peak attributes such as host IP, VIP, machine group, PPS packet rate, bps bandwidth, SYNCFLOOD, IP FLOOD, etc. Host IP refers to the network address of the host, VIP refers to the virtual address, machine group refers to the relevant machine components of the server, PPS is the commonly used unit of network throughput (i.e., how many packets are sent per second), and the performance of the network is usually measured by the throughput indicator. ‌bps is the abbreviation of bits per second, which means the number of bits transmitted per second. ‌In computer science and network communications, bps is often used to describe the data transmission rate. The unit of bps is "bit per second" (bit / s or bps), where "bit" is the basic unit of binary numbers, and "per second" represents the unit of time. The higher the bps value, the faster the data transmission speed. ‌SYN Flood attack‌ is a common denial of service attack (DoS) method. By sending a large number of forged TCP connection requests (SYN packets), the semi-connection queue of the victim server is quickly filled up, making it unable to process legitimate connection requests. This attack takes advantage of the three-way handshake process in the TCP / IP protocol. The attacker sends a large number of SYN packets but does not respond to the server's SYN-ACK packets, causing the server to maintain a large number of half-open connections and eventually exhaust resources. IP FLOOD is a network attack method, commonly used in DDoS attacks (distributed denial of service attacks). IP FLOOD attacks send a large number of IP packets to the target server, causing the server resources to be exhausted and unable to process normal network requests, thereby affecting the availability of services.

[0034] ‌S11-2: Process the traffic data according to preset data acquisition rules to obtain the real-time traffic model.

[0035] In this embodiment, the flow data is processed by the preset data extraction rules, the corresponding index data is obtained from the flow data, and then the index data is statistically analyzed to obtain a real-time flow model. After the data extraction rules are determined, the data extraction rules are applied to the flow data to extract the required data, and the corresponding real-time flow model is generated according to the required data. The real-time flow model reflects the characteristics of the flow data in the current time period.

[0036] In this embodiment, different data are retrieved using different data retrieval rules, and multiple data retrieval rules can be used to process the data at the same time. For example, using the 95 rule, the first 5% of the data in the current traffic data is removed, and the largest value of the remaining 95% of the data is taken as the target value. This method is suitable for scenarios with large amounts of data.

[0037] In this embodiment, data is directly extracted from the memory of the server without having to be extracted from the database, which ensures the timeliness of real-time traffic data analysis and is conducive to rapid response to traffic attacks.

[0038] In another embodiment of the present application, before generating a corresponding real-time traffic model according to the real-time traffic data in the server, the method further includes: S21: Obtaining traffic data from the traffic log and attack log of the server.

[0039] In this embodiment, traffic log refers to the information related to data traffic in the network, including the source, destination, transmission protocol, port number, etc. of the data. By analyzing the traffic log, the network administrator can understand the data flow in the network, so as to conduct network monitoring, performance optimization and user behavior analysis. Attack log refers to the record left by the attacker when performing various attack behaviors during the network security attack process. These records usually include the attacker's IP address, attack time, attack method, attack target and other information. Attack logs are crucial for network security analysis, tracing and defense.

[0040] In this embodiment, traffic data is obtained from the traffic log of the server. The traffic log contains attributes such as host IP, VIP, machine group, PPS packet rate, BPS bandwidth, etc. The attack log contains attributes such as SYNC FLOOD, IP FLOOD, attack type and peak value. The traffic data is obtained from the traffic log and the attack log. These traffic data include the basic data recorded in the traffic log and the attack data recorded in the attack log.

[0041] S22: Classify the traffic data according to corresponding attributes to obtain the classified traffic data.

[0042] In this embodiment, the flow data is classified according to the corresponding attributes to obtain the classified flow data. The original flow log and the flow data after multi-machine aggregation are collected, and according to configurable rules, such as extracting data from the flow log and attack log at regular intervals, data indicators of the server node as a whole, single machine, single VIP, single protection group, attack type classification and other dimensions are dynamically generated.

[0043] S23: The classified traffic data is stored in the memory of the server according to corresponding data indicators, and is asynchronously pushed to the database.

[0044] In this embodiment, the classified traffic data is stored in the memory of the server according to the corresponding data indicators, and is asynchronously pushed to the database.

[0045] S12: Obtain indicator data corresponding to at least one protection module from the real-time traffic model.

[0046] In this embodiment, the indicator data is the value of the data indicator in the traffic model. The protection module is a module that encapsulates the program for taking protection measures against traffic attacks.

[0047] In this embodiment, through the corresponding algorithm, indicator data corresponding to at least one protection module is obtained from the real-time traffic model. The algorithm can determine whether the value of each data indicator in the real-time traffic model is in a normal state. When the value of the data indicator is in an abnormal state, the indicator data is extracted from the traffic model and the protection module corresponding to the indicator data is determined.

[0048] For example, if the bps bandwidth value is too high, the indicator data is sent to the protection module corresponding to the network bandwidth.

[0049] S13: adjusting the protection strategy corresponding to at least one of the protection modules according to the indicator data, and executing corresponding protection measures.

[0050] In this embodiment, after the indicator data is obtained, the corresponding protection measures are executed according to the indicator by the corresponding protection module, and the protection strategy is adjusted according to the indicator, the threshold set by the adjustment module, or the protection rule of the adjustment module is adjusted.

[0051] In this embodiment, the specific steps of adjusting the protection strategy corresponding to at least one of the protection modules according to the indicator data include: S13-1: Determine the protection module corresponding to the indicator data.

[0052] In this embodiment, each protection module corresponds to a different attack type and requires different indicator data. The corresponding protection module is determined according to the type of the indicator data.

[0053] For example, an indicator data is the current value of the bps bandwidth, the corresponding type is the bandwidth type, and the corresponding protection module is the protection module for bandwidth attacks.

[0054] S13-2: Send the indicator data to the protection module.

[0055] In this embodiment, after the type of the indicator data is determined, the indicator data is sent to the corresponding protection module.

[0056] S13-4: adjusting the protection threshold corresponding to the protection module and the protection rule of the protection module according to the indicator data.

[0057] In this embodiment, the protection threshold is a critical value. When the value of a data indicator of a certain data exceeds or falls below the critical value, the corresponding protection measure is triggered. The protection rule is a rule for the protection module to execute the protection measure.

[0058] In this embodiment, after the indicator data is obtained from the real-time traffic model, the corresponding protection engine (a program deployed on the host to detect DDoS attacks and provide protection functions such as cleaning. The corresponding security configuration of the SOC needs to be sent to the engine machine and then hot-loaded to take effect. The engine will generate different logs based on different modules.), such as SYNC, IP and other protection modules. After the corresponding module obtains the indicator data, it adjusts the corresponding protection threshold and the protection rules of the protection module according to the obtained indicator data.

[0059] For example, when the obtained indicator is within the range specified by the protection threshold, but still appears in the attack log, it is necessary to appropriately reduce the direction specified by the protection threshold. For protection rules, new rules can be added based on existing protection rules to address the problems that arise.

[0060] S14: Generate a historical traffic model based on the real-time traffic model according to the historical traffic data in the server.

[0061] In this embodiment, the historical traffic data is the traffic data generated by the server in the past long period of time. The historical traffic model is a model generated by supplementing the real-time traffic model based on the historical traffic data.

[0062] In this embodiment, historical traffic data is stored in the database of the server. According to preset indicators, traffic data is extracted with hourly granularity, that is, data from the past several hours is extracted. Data can also be extracted with daily granularity, that is, data from the past several days. The granularity can be set by itself. The extracted data is analyzed according to the corresponding data acquisition rules to obtain analysis results. Through the analysis results, the real-time traffic model is supplemented to obtain a historical traffic model.

[0063] In this embodiment, according to the historical traffic data in the server, the specific steps of generating the historical traffic model based on the real-time traffic model include: S14-1: Extracting traffic data from the database of the server based on preset data indicators at an hourly granularity.

[0064] In this embodiment, traffic data is extracted from the server's historical database based on preset data indicators, such as the node as a whole, a single machine, a single VIP, a single protection group and other data indicators, with hourly granularity, and then traffic data for the past multiple hours is extracted.

[0065] S14-2: Process the traffic data according to preset data acquisition rules to obtain processing result data.

[0066] In this embodiment, the flow data is processed by the preset data acquisition rules to obtain the processing result data. The processing result data is the values ​​of multiple data indicators obtained by processing the flow data in the past few hours by the data acquisition rules.

[0067] S14-3: Supplement the real-time traffic model with the processing result data to obtain the historical traffic model.

[0068] In this embodiment, the real-time traffic model is supplemented by processing result data, and then a historical traffic model of the node for a long period of time is generated based on the real-time traffic model at a granularity such as hours or days.

[0069] In this embodiment, the historical traffic model can be continuously improved as the data in the database is supplemented.

[0070] S15: During the forwarding process of the real-time traffic data, a corresponding traffic analysis result is obtained according to the historical traffic model.

[0071] In this embodiment, the traffic analysis result indicates whether the performance of each preset indicator in the real-time traffic data during the period is consistent with the value during the historical period.

[0072] In this embodiment, during the forwarding process of real-time traffic data, it is possible to determine whether the value corresponding to each data indicator remains at a normal level and whether the change trend conforms to historical rules based on the historical traffic model, thereby obtaining corresponding traffic analysis results.

[0073] In this embodiment, during the forwarding process of the real-time traffic data, the specific steps of obtaining the corresponding traffic analysis result according to the historical traffic model include: S15-1: Determine the time period corresponding to the real-time traffic data.

[0074] In this embodiment, the time period corresponding to the real-time traffic data currently being forwarded is first determined, that is, the current time period is determined.

[0075] S15-2: Obtain historical traffic data of the same time period in the historical time in the historical traffic model.

[0076] In this embodiment, after the current time period is determined, historical traffic data of the same time period in the historical time is obtained in the historical traffic model.

[0077] S15-3: Analyze the historical traffic data and the real-time traffic data to obtain the traffic analysis result.

[0078] In this embodiment, the historical traffic data and real-time traffic data are analyzed to determine the changes in the values ​​of the data indicators in the real-time traffic data compared with the values ​​in the historical traffic data, and whether the changing trends conform to the law of traffic changes, so as to obtain the values ​​of the data indicators that do not meet the preset thresholds as the traffic analysis results.

[0079] In this embodiment, it supports generating a long-term node traffic history model based on the real-time traffic model according to the granularity of hours and days according to dynamic configuration, and continuously self-learning and improving the traffic model over time. In combination with resource data such as node bandwidth, in the real-time traffic forwarding process, more detailed and accurate analysis results are further generated according to the configuration rules such as the usual same period and single VIP peak value for decision-making in subsequent processes.

[0080] S16: According to the traffic analysis result, the protection strategy corresponding to at least one of the protection modules is adjusted, and corresponding protection measures are executed.

[0081] In this embodiment, the traffic analysis results are sent to the corresponding protection modules. Each protection module executes corresponding protection measures according to the traffic analysis results and adjusts the protection strategy. The specific steps include: S16-1: Put the traffic analysis result into a subscription message queue.

[0082] In this embodiment, the subscription message queue is used to provide corresponding messages to each protection module. When a protection module subscribes to a message, the message subscribed by the protection module is sent to the protection module.

[0083] In this embodiment, the traffic analysis result is put into a subscription message queue to send the corresponding traffic analysis result to the protection module that subscribes to the message.

[0084] S16-2: Send the traffic analysis result from the subscription message queue to the corresponding protection module.

[0085] In this embodiment, the traffic analysis result includes values ​​of various data indicators, a protection module corresponding to each data indicator is determined, and the corresponding data indicator is sent to the protection module.

[0086] S16-3: adjusting the module threshold of the protection module and the protection rule of the protection module according to the traffic analysis result.

[0087] In this embodiment, after receiving the traffic analysis results, the protection module adjusts the module threshold of the protection module and the protection rules of the protection module. The threshold and rules of the protection module are adjusted based on the traffic analysis results generated by the historical traffic model, so that the protection threshold and protection strategy of the protection module can be more in line with the traffic change law, thereby improving the protection effect and efficiency.

[0088] In this embodiment, the analysis results are written into the corresponding sping event message, and the protection module that subscribes to the message performs corresponding processing according to the configuration rules. The subscriber mainly includes the engine's self-adjustment of the threshold of each attack type protection module, the rule self-creation logic, the node local engine diversion or black hole logic, the backbone network front-end traffic suppression logic, and the remote center SOC (Security Operations Center: a management platform mainly used to manage security configuration, monitor and analyze various network attacks, and collect aggregated security data reports) data reporting and decision linkage. It supports plug-in message subscription, and each logic subscription module supports the configuration of data indicator filtering rules. Only when the rules are met will the logic implementation be triggered, so as to achieve smarter decision-making and more accurate protection.

[0089] In this embodiment, it supports packaging the spring boot project into an executable jar; writing Dockerfile for docker image packaging; supporting docker compose or k8s cluster horizontal expansion deployment to deploy the traffic protection program as a whole in the server node.

[0090] refer to Figure 2 , Figure 2 : is a flow chart of the overall protection process of the flow model linkage proposed in an embodiment of the present application, such as Figure 2As shown, the anti-D machine is a plurality of devices for preventing traffic attacks. In the server, the traffic log and the attack log are reported to the SOC. The data are analyzed and aggregated according to various dimensions, such as machine IP, VIP, attack type, strategy group, etc., to obtain atomic data at the second level, and then a real-time traffic model is established to make strategy decisions. The data indicators are sent to the corresponding protection module, and the node local engine protection linkage is implemented. The measures implemented include analyzing the node VIP traffic model, intelligent threshold adjustment and alarm protection, analyzing the attack type and attack trend of the learning node, automatically adjusting the corresponding type of protection, analyzing the node learning single machine model, and adjusting the single machine protection strategy of other machines in the node in linkage. Then, a node long-term end traffic model (historical traffic model) is created for risk assessment, alarm and intelligent adjustment of protection strategy. The node traffic model and protection strategy are reported to the remote SOC for analysis. The attack traffic model of multiple nodes is linked to analyze data and evaluate, and the decision-making generates a global protection strategy and sends it to each node, and links the backbone network to perform pre-protection such as IP blocking to prevent traffic attacks.

[0091] refer to Figure 3 , Figure 3 This is a flowchart of the dynamic adjustment of node protection proposed in an embodiment of the present application, such as Figure 3 As shown in the figure, when the real-time traffic model is created, the attack type and peak trend of the attack traffic are analyzed, and the atomic data indicators are extracted and generated according to the rules. The data indicators are processed, and the real-time traffic model is generated according to the rules of mean, normal distribution, 95 distribution, etc., and then combined with the long-term historical traffic model for analysis and data processing to form the analysis results. According to the analysis results, the subscription message (spring event) is pushed to make intelligent decisions and take protective measures, including: automatically adjusting the threshold of the attack type shadow strategy, and automatically creating a protection strategy for traffic cleaning (a network security service, mainly used to protect government and enterprise customers of IDC (Internet Data Center) services from DDoS attacks. The traffic cleaning service ensures the security of the customer's network environment by monitoring, alerting and protecting against these attacks.). Risk assessment reports are made, node linkage protection is carried out, the backbone network and other front-end networks are linked to ban IP, and remote soc is reported for multi-node linkage protection.

[0092] In the above-mentioned embodiments of the present application, dynamic configuration and extraction of atomic data indicators are supported to form a rich data foundation, which has the advantages of fast configuration generation and flexible selection and use. On the one hand, storage in memory can achieve faster data acquisition, shorten the time to obtain analysis results, reduce delays and achieve more real-time analysis; on the other hand, asynchronous landing and storage in the database can be more convenient for historical models and node data to link remote center SOC. Dynamic configuration rules can be used to circle atomic data indicators, and multi-dimensional real-time traffic models can be obtained more quickly and flexibly. After obtaining data results from the real-time data model according to the corresponding algorithm, the linkage engine SYNC, IP and other attack type protection modules are used to self-adjust the protection strategy threshold and self-generate protection rules, realizing the first layer of intelligent adjustment and second-level protection. Support continuous learning and analysis according to the configured rules to form a long-term traffic history model with hourly granularity or daily granularity, and combine resource data such as node bandwidth to realize the corresponding data analysis algorithm, and generate more detailed and accurate analysis results according to the configuration rules of the same period, the same group, and the same vip when the traffic is forwarded in real time. After the analysis results are written into the Spring Event message, plug-in message subscription is supported. The logic processing module can be changed dynamically at any time, which is easier to expand. Each logic subscription module supports the configuration of data indicator filtering rules. Only when the rules are met will the logic implementation be triggered, so as to achieve smarter and more accurate protection. The processing logic focuses on the automatic adjustment of thresholds and automatic creation of protection rules after self-learning of local attack types of traffic on the node, which is more adaptive to the actual operation of the node. It can also adopt multi-node linkage, backbone network linkage pre-suppression and other functional extensions, continuously enrich protection decision-making measures and support flexible adjustment of rules for smarter decision-making. In addition, the spring boot project can be packaged as an executable jar; Dockerfile can be written for docker image packaging; dockercompose or k8s cluster horizontal expansion is supported to add protection programs to service nodes, which improves the flexibility of protection. This effectively improves the protection efficiency against Ddos traffic attacks and ensures the stable operation of the server.

[0093] Based on the same inventive concept, an embodiment of the present application provides a flow protection device. Figure 4 , Figure 4 FIG. 4 is a schematic diagram of a flow protection device 400 proposed in an embodiment of the present application. Figure 4 As shown, the device comprises: The first traffic model generating module 401 is used to generate a corresponding real-time traffic model according to the real-time traffic data in the server; An indicator data acquisition module 402, used to acquire indicator data corresponding to at least one protection module from the real-time traffic model; A first protection module 403, configured to adjust a protection strategy corresponding to at least one of the protection modules according to the indicator data, and execute corresponding protection measures; A second traffic model generating module 404, configured to generate a historical traffic model based on the real-time traffic model according to the historical traffic data in the server; A traffic analysis module 405, configured to obtain corresponding traffic analysis results according to the historical traffic model during the forwarding process of the real-time traffic data; The second protection module 406 is used to adjust the protection strategy corresponding to at least one of the protection modules according to the traffic analysis result, and execute corresponding protection measures.

[0094] Optionally, the device further comprises: A flow data acquisition module, used to acquire flow data from the flow log and attack log of the server; A flow data classification module, used for classifying the flow data according to corresponding attributes to obtain the classified flow data; The traffic data storage module is used to store the classified traffic data in the memory of the server according to the corresponding data indicators, and asynchronously push it to the database.

[0095] Optionally, the first traffic model generating module includes: A first data extraction submodule is used to extract the traffic data within a preset time period from the memory of the server according to a preset data indicator, wherein the preset time period is a time period with a granularity of seconds including the current time; The first data processing submodule is used to process the traffic data according to a preset data acquisition rule to obtain the real-time traffic model.

[0096] Optionally, the first protection module includes: a protection module determination submodule, used to determine the protection module corresponding to the indicator data; An indicator data sending submodule, used for sending the indicator data to the protection module; The first protection submodule is used to adjust the protection threshold corresponding to the protection module and the protection rule of the protection module according to the indicator data.

[0097] Optionally, the second traffic model generating module includes: A second data extraction submodule is used to extract traffic data from the database of the server based on preset data indicators with hourly granularity; The second data processing submodule is used to process the flow data according to a preset data acquisition rule to obtain processing result data; The second traffic model generating submodule is used to supplement the real-time traffic model with the processing result data to obtain the historical traffic model.

[0098] Optionally, the traffic analysis module includes: A time period determination submodule, used to determine the time period corresponding to the real-time traffic data; A historical traffic data acquisition submodule, used to acquire historical traffic data of the same time period in the historical time in the historical traffic model; The analysis result acquisition submodule is used to analyze the historical traffic data and the real-time traffic data to obtain the traffic analysis results.

[0099] Optionally, the second protection module includes: A result queue submodule, used to put the traffic analysis result into a subscription message queue; A result sending submodule, used for sending the traffic analysis result from the subscription message queue to the corresponding protection module; The second protection submodule is used to adjust the module threshold of the protection module and the protection rule of the protection module according to the traffic analysis result.

[0100] Based on the same inventive concept, another embodiment of the present application provides a readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the traffic protection method described in any of the above embodiments of the present application are implemented.

[0101] Based on the same inventive concept, another embodiment of the present application provides an electronic device, Figure 5 It is a schematic diagram of an electronic device 500 proposed in one embodiment of the present application, including a memory 501, a processor 502 and a computer program stored in the memory and executable on the processor, and the processor, when executed, implements the steps in the traffic protection method described in any of the above embodiments of the present application.

[0102] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0103] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0104] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the embodiments of the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0105] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0106] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0107] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0108] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0109] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0110] The above is a detailed introduction to the traffic protection method, device, equipment and storage medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A flow protection method, characterized in that: The method comprises: Generate a corresponding real-time traffic model according to the real-time traffic data in the server; Obtaining indicator data corresponding to at least one protection module from the real-time traffic model; Adjusting the protection strategy corresponding to at least one of the protection modules according to the indicator data, and executing corresponding protection measures; Generating a historical traffic model based on the real-time traffic model according to the historical traffic data in the server; In the process of forwarding the real-time traffic data, a corresponding traffic analysis result is obtained according to the historical traffic model; According to the traffic analysis result, a protection strategy corresponding to at least one of the protection modules is adjusted, and corresponding protection measures are executed.

2. The flow protection method according to claim 1, characterized in that: Before generating a corresponding real-time traffic model according to the real-time traffic data in the server, the method further includes: Obtaining traffic data from the traffic log and attack log of the server; Classifying the flow data according to corresponding attributes to obtain the classified flow data; The classified traffic data is stored in the memory of the server according to the corresponding data indicators, and is asynchronously pushed to the database.

3. The flow protection method according to claim 1, characterized in that: Generating a corresponding real-time traffic model according to the real-time traffic data in the server includes: Extracting traffic data within a preset time period from the memory of the server according to preset data indicators, wherein the preset time period is a time period with a granularity of seconds including the current time; The flow data is processed according to preset data acquisition rules to obtain the real-time flow model.

4. The flow protection method according to claim 1, characterized in that: The step of adjusting the protection strategy corresponding to at least one of the protection modules by using the indicator data includes: determining the protection module corresponding to the indicator data; Sending the indicator data to the protection module; The protection threshold corresponding to the protection module is adjusted according to the indicator data, and the protection rule of the protection module is adjusted.

5. The flow protection method according to claim 1, characterized in that: The generating of the historical traffic model based on the real-time traffic model according to the historical traffic data in the server includes: Extracting traffic data from the database of the server at an hourly granularity according to preset data indicators; Processing the flow data according to preset data acquisition rules to obtain processing result data; The real-time traffic model is supplemented by the processing result data to obtain the historical traffic model.

6. The flow protection method according to claim 1, characterized in that: In the process of forwarding the real-time traffic data, a corresponding traffic analysis result is obtained according to the historical traffic model, including: Determine a time period corresponding to the real-time traffic data; Acquire historical traffic data of the same time period in the historical time in the historical traffic model; The historical traffic data and the real-time traffic data are analyzed to obtain the traffic analysis result.

7. The flow protection method according to claim 1, characterized in that: The step of adjusting the protection strategy corresponding to at least one of the protection modules according to the traffic analysis result includes: Put the traffic analysis result into the subscription message queue; Sending the traffic analysis result from the subscription message queue to the corresponding protection module; The module threshold of the protection module is adjusted according to the traffic analysis result, and the protection rule of the protection module is adjusted.

8. A flow protection device, characterized in that: The device comprises: A first traffic model generating module, used to generate a corresponding real-time traffic model according to the real-time traffic data in the server; An indicator data acquisition module, used to obtain indicator data corresponding to at least one protection module from the real-time traffic model; A first protection module, configured to adjust a protection strategy corresponding to at least one of the protection modules according to the indicator data, and execute corresponding protection measures; A second traffic model generating module, configured to generate a historical traffic model based on the real-time traffic model according to the historical traffic data in the server; A traffic analysis module, used to obtain corresponding traffic analysis results according to the historical traffic model during the forwarding process of the real-time traffic data; The second protection module is used to adjust the protection strategy corresponding to at least one of the protection modules according to the traffic analysis result, and execute corresponding protection measures.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps in the method according to any one of claims 1 to 7 are implemented.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

Images