Message processing method, security protection system, device, medium and program product

Abstract

The invention provides a message processing method, a security protection system, equipment, a medium and a program product, and relates to a computer network technology, the method comprises the following steps: aiming at each request message received by a target protection node in a current synchronization period of the target protection node and a central control node, the target protection node calculates a first hash value of the request message; the target protection node counts the number of target first hash values in the plurality of first hash values in the current synchronization period, and sends the number to the central control node; the central control node calculates the number of the target first Hash values in the current synchronization period, the sum of the number of the target first Hash values in the current synchronization period and the sum of the first number of the target first Hash values in the current statistical period, and the second number of the target first Hash values in the current statistical period is obtained; and the central control node triggers the plurality of protection nodes to perform speed limiting processing on the to-be-speed-limited request message based on the second number of the target first hash values in the current statistical period. Therefore, the security of the network can be improved.

Description

Technical Field

[0001] Embodiments of the present application relate to computer network technology, and in particular, to a message processing method, a security protection system, a device, a medium, and a program product. Background Art

[0002] Distributed Denial of Service (DDoS) is an attack method that controls a large number of computers, IoT terminals or network zombies to send a large number of requests to the target website, thereby exhausting its server resources and making it impossible for normal users to access the service. Layer 7 DDoS refers to a distributed denial of service attack at the application layer.

[0003] Protection against layer 7 DDoS is extremely important and directly determines the security of the network. Figure 1 This is a schematic diagram of the basic protection principle, such as Figure 1 As shown, the basic principle of protection against Layer 7 DDoS is as follows: the Layer 7 Hypertext Transfer Protocol (HTTP) requests of normal users and attackers all pass through the forwarding system, where HTTP requests from normal users can be called normal Layer 7 traffic, and HTTP requests from attackers can be called attack traffic. The forwarding system forwards the HTTP request to the security protection system. The security protection system can detect whether the HTTP request is attack traffic. If it is attack traffic, the security protection system can clean the attack traffic, that is, notify the forwarding system that the HTTP request is attack traffic, based on which the forwarding system can block the HTTP request. If it is not attack traffic, the security protection system notifies the forwarding system that the HTTP request is normal traffic, based on which the forwarding system can return the HTTP request to the source station. Usually, a security protection system includes multiple protection nodes. In order to ensure that the load of the security protection system is as balanced as possible, the forwarding system usually loads the HTTP hash to the protection node based on the source Internet Protocol (IP) address and domain name of the HTTP request. Currently, the single-machine speed limit method is mainly used to limit the speed of attack traffic. If the attack field of the attack traffic happens to be consistent with the field involved in load balancing, such as the source IP address and domain name, then the attack traffic can be limited by the single-machine speed limit method.

[0004] However, in a Layer 7 DDoS attack scenario, the attack fields of the attack traffic may be inconsistent with the fields involved in load balancing. For example, the attack fields include specified fields in the cookie, specified fields in the HTTP header, and multiple items in the query, which are inconsistent with the IP address and domain name fields involved in load balancing. In this case, the single-machine speed limit method will cause a large amount of attack traffic to be transmitted through, resulting in low network security. Summary of the invention

[0005] The present application provides a message processing method, a security protection system, a device, a medium and a program product, thereby improving the security of the network.

[0006] In a first aspect, an embodiment of the present application provides a message processing method, which is applied to a security protection system, wherein the security protection system includes: a central control node and multiple protection nodes; the method includes: for each request message received by the target protection node in the current synchronization period between the target protection node among the multiple protection nodes and the central control node, the target protection node calculates a first hash value of the request message; the target protection node counts the number of target first hash values ​​among the multiple first hash values ​​in the current synchronization period, and sends first synchronization data to the central control node, wherein the first synchronization data includes: the number of target first hash values ​​in the current synchronization period; the central control node calculates the number of target first hash values ​​in the current synchronization period, and the sum of the first number of target first hash values ​​in the current statistical period, to obtain a second number of target first hash values ​​in the current statistical period; based on the second number of target first hash values ​​in the current statistical period, the central control node triggers multiple protection nodes to perform speed limit processing on the speed limit request message.

[0007] In the second aspect, an embodiment of the present application provides a message processing method, which is applied to a target protection node, and the method includes: for each request message received by the target protection node within the current synchronization period between the target protection node and the central control node, calculating the first hash value of the request message; counting the number of target first hash values ​​among multiple first hash values ​​within the current synchronization period, and sending first synchronization data to the central control node, wherein the first synchronization data includes: the number of target first hash values ​​within the current synchronization period.

[0008] In the third aspect, an embodiment of the present application provides a message processing method, which is applied to a central control node, and the method includes: receiving first synchronization data, wherein the first synchronization data includes: the number of target first hash values ​​in the current synchronization period; calculating the number of target first hash values ​​in the current synchronization period, and the sum of the first number of target first hash values ​​in the current statistical period, to obtain a second number of target first hash values ​​in the current statistical period; based on the second number of target first hash values ​​in the current statistical period, triggering multiple protection nodes to perform speed limit processing on the speed limit request message.

[0009] In a fourth aspect, an embodiment of the present application provides a message processing method, which is applied to other protection nodes, and the method includes: receiving a first speed limit indication; based on the first speed limit indication, treating a request message corresponding to a target first hash value as a request message to be speed limited, and performing speed limit processing on the request message to be speed limited.

[0010] In a fifth aspect, an embodiment of the present application provides a security protection system, comprising: a central control node and multiple protection nodes; a target protection node among the multiple protection nodes is used to: calculate a first hash value of the request message for each request message received by the target protection node within the current synchronization period between the target protection node and the central control node; count the number of target first hash values ​​among the multiple first hash values ​​within the current synchronization period, and send first synchronization data to the central control node, wherein the first synchronization data includes: the number of target first hash values ​​within the current synchronization period; the central control node is used to: calculate the number of target first hash values ​​within the current synchronization period, and the sum of the first number of target first hash values ​​within the current statistical period, to obtain a second number of target first hash values ​​within the current statistical period; based on the second number of the target first hash value within the current statistical period, trigger multiple protection nodes to perform speed limit processing on the speed limit request message.

[0011] In the sixth aspect, an embodiment of the present application provides a message processing device, which includes: a processing module, used to: calculate the first hash value of the request message for each request message received by the message processing device within the current synchronization period between the message processing device and the central control node; count the number of target first hash values ​​among multiple first hash values ​​within the current synchronization period, and send first synchronization data to the central control node, wherein the first synchronization data includes: the number of target first hash values ​​within the current synchronization period.

[0012] In the seventh aspect, an embodiment of the present application provides a message processing device, which includes: a transceiver module and a processing module, wherein the transceiver module is used to receive first synchronization data, wherein the first synchronization data includes: the number of target first hash values ​​in the current synchronization period; the processing module is used to: calculate the number of target first hash values ​​in the current synchronization period, and the sum of the first number of target first hash values ​​in the current statistical period, to obtain the second number of target first hash values ​​in the current statistical period; based on the second number of target first hash values ​​in the current statistical period, trigger multiple protection nodes to perform speed limit processing on the speed limit request message.

[0013] In an eighth aspect, an embodiment of the present application provides a message processing device, which includes: a transceiver module and a processing module, wherein the transceiver module is used to receive a first speed limit indication; the processing module is used to treat a request message corresponding to a target first hash value as a request message to be speed limited based on the first speed limit indication, and perform speed limit processing on the request message to be speed limited.

[0014] In the ninth aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory, and executing the methods in the second to fourth aspects or their respective implementations.

[0015] In a tenth aspect, an embodiment of the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program enables a computer to execute the methods in the second to fourth aspects or their respective implementations.

[0016] In an eleventh aspect, an embodiment of the present application provides a computer program product, comprising computer program instructions, which enable a computer to execute the methods in the second to fourth aspects or their respective implementations.

[0017] In a twelfth aspect, an embodiment of the present application provides a computer program, which enables a computer to execute the methods in the second to fourth aspects or their respective implementations.

[0018] Through the technical solution provided by the present application, each protection node in the security protection system can calculate the first hash value of the request message, and each protection node can regularly synchronize the number of the same first hash value in the local synchronization period (that is, the number of request messages corresponding to the same first hash value) to the central control node in the security protection system, so that the central control node can calculate the global statistical value of the same first hash value in the current statistical period, and trigger all protection nodes to perform speed limit processing through the global statistical value. Since the attack traffic can be accurately determined based on the global statistical value, and all prevention and control nodes can perform comprehensive speed limit processing on the attack traffic, the security of the network can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 It is a schematic diagram of the basic principle of protection;

[0021] Figure 2 A schematic diagram of a system architecture involved in an embodiment of the present application;

[0022] Figure 3 to Figure 4 A diagram of the configuration interface of the speed limit strategy provided in the embodiment of the present application;

[0023] Figure 5 A flowchart of a message processing method provided in an embodiment of the present application;

[0024] Figure 6 A schematic diagram of the structure of first synchronization data according to an embodiment of the present application;

[0025] Figure 7 A schematic diagram of the structure of second synchronization data according to an embodiment of the present application;

[0026] Figure 8 This is a schematic diagram of the structure of a second speed limit indication in an embodiment of the present application;

[0027] Fig. 9 This is a schematic diagram of the structure of a first speed limit indication in an embodiment of the present application;

[0028] Fig.10 A flowchart of another message processing method provided in an embodiment of the present application;

[0029] Fig.11 A flowchart of another message processing method provided in an embodiment of the present application;

[0030] Fig.12 A schematic diagram of a safety protection system 1200 provided in an embodiment of the present application;

[0031] Fig.13 A schematic diagram of a message processing device 1300 provided in an embodiment of the present application;

[0032] Fig.14 A schematic diagram of a message processing device 1400 provided in an embodiment of the present application;

[0033] Fig.15A schematic diagram of a message processing device 1500 provided in an embodiment of the present application;

[0034] Fig.16 It is a schematic block diagram of an electronic device 1600 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0035] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0036] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0037] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0038] Before introducing the technical solution of this application, the relevant knowledge of this application is first explained below:

[0039] 1. DDoS is an attack method that controls a large number of computers, IoT terminals or network zombies to send a large number of requests to the target website, thereby exhausting its server resources and making it impossible for normal users to access the service.

[0040] 2. Layer 7 DDoS refers to DDoS attacks targeting the seventh layer of the Open Systems Interconnection (OSI) model - the application layer.

[0041] 3. Single-machine speed limiting method refers to the speed limiting processing method of attack traffic through a protection node.

[0042] 4. Consistent Hashing is a special hashing algorithm that is mainly used to solve problems such as data storage, load balancing, and data sharding in distributed systems. The core idea is to map the entire hash value space into a virtual ring and map both storage nodes and data objects to this ring. The data object searches for the nearest storage node clockwise based on the hash value to complete data storage and access. This algorithm can change the mapping relationship between existing data objects and storage nodes as little as possible when adding or removing nodes, and has good fault tolerance and scalability.

[0043] 5. UA is a characteristic string that contains detailed information about the user agent software (usually a browser) that initiates the HTTP request, such as application type, operating system, software developer, and version number.

[0044] 6. Cookies are a small piece of data that the server sends to the browser and saves locally. They will be carried and sent to the server the next time the browser makes a request to the same server. Cookies are mainly used in the following aspects:

[0045] State management: The server can use Cookies to detect and manage the user's state, such as the user's login status, shopping cart contents, etc.

[0046] Personalization settings: Based on the information in the cookie, the server can provide users with personalized content and services, such as recommending products and displaying user preferences.

[0047] Session management: In web applications, cookies are often used for session management to ensure that users remain logged in between multiple pages or requests.

[0048] 7. Query is the parameter part of the Uniform Resource Locator (URL) of the HTTP request. Query is mainly used in the following aspects:

[0049] Passing information: Query is a way for the client to pass information to the server. For example, in a search engine, the keywords entered by the user are passed to the server through the query.

[0050] Implementing dynamic pages: Many websites use queries to implement dynamic page content. For example, a page that displays product details may dynamically generate content based on the product's identity (ID), which is passed through the query.

[0051] Detection and statistics: Websites can use queries to detect user sources, behaviors, and other information for data analysis.

[0052] 8. Origin site refers to a server that provides specific information, services or resources that can be referenced, linked or used by other websites or users.

[0053] The following is an explanation of the technical problems, inventive concepts and system architecture to be solved by the embodiments of the present application:

[0054] As mentioned above, the single-machine speed limit method is currently mainly used to limit the speed of attack traffic. If the attack field of the attack traffic happens to be consistent with the field involved in load balancing, such as the source IP address and domain name, then the attack traffic can be limited by the single-machine speed limit method. However, in the 7-layer DDoS attack scenario, the attack field of the attack traffic may be inconsistent with the field involved in load balancing. For example, the attack field includes the specified field of the cookie, the specified field of the HTTP header, and multiple items in the query, which are inconsistent with the fields IP address and domain name involved in load balancing. In this case, the single-machine speed limit method will cause a large amount of attack traffic to be transmitted through, resulting in low network security.

[0055] In order to solve the above technical problems, the present application proposes that each protection node in the security protection system can calculate the first hash value of the request message, and each protection node can regularly synchronize the number of the same first hash value in the local synchronization period (that is, the number of request messages corresponding to the same first hash value) to the central control node in the security protection system, so that the central control node can calculate the global statistical value of the same first hash value in the current statistical period, and trigger all protection nodes to perform speed limit processing through the global statistical value. Since the attack traffic can be accurately determined based on the global statistical value, and all prevention and control nodes can perform comprehensive speed limit processing on the attack traffic, the security of the network can be improved.

[0056] For example, Figure 2 This is a schematic diagram of a system architecture involved in an embodiment of the present application, including: a terminal device 210, a forwarding system 220, a security protection system 230 and a source station 240, wherein the security protection system 230 includes: multiple protection nodes 2301, a central control node 2302 and a management and control node 2303.

[0057] In some possible implementations, the forwarding system 220 may be directly or indirectly connected to the terminal device 210, the protection node 2301, and the source station 240 through wired or wireless communication, and this application does not impose any limitation thereto.

[0058] In some possible implementations, the protection node 2301 can be directly or indirectly connected to the central control node 2302 and the management and control node 2303 through wired or wireless communication, which is not limited in this application.

[0059] In some implementations, the terminal device 210 may be installed with a browser, and the user clicks on a website link on the browser or enters the URL of the website in the input bar of the browser to send a request message to the source station 240. It should be understood that the request message is a web page request, which may be an HTTP request or a request message based on other protocols, and the embodiments of the present application do not limit this.

[0060] It should be understood that a browser is a software application for accessing the Internet, which allows users to obtain and display information on web pages by entering a Uniform Resource Locator (URL) or clicking a link.

[0061] It should be understood that the terminal device 210 is often equipped with a display device to display web pages and the like.

[0062] It should be understood that a display device is also referred to as a display, a display screen, a touch screen, etc., and a touch screen is also referred to as a touch screen, a touch panel, etc.

[0063] In some implementations, the terminal device 210 may be a desktop computer, a laptop computer, a PDA, a tablet computer, a smart phone, a smart watch, virtual reality (VR), augmented reality (AR), etc., but is not limited thereto.

[0064] In some implementations, the forwarding system 220 can intercept the request message and use a load balancing method to send the request message to a protection node 2301. For each request message received by the protection node 2301 during the current synchronization period between the protection node 2301 and the central control node 2302, the protection node 2301 calculates the first hash value of the request message; and counts the number of target first hash values ​​in the multiple first hash values ​​during the current synchronization period, and sends the first synchronization data to the central control node 2302, wherein the first synchronization data includes: the number of target first hash values ​​during the current synchronization period; the central control node 2302 calculates Calculate the number of target first hash values ​​in the current synchronization period, and the sum of the first number of target first hash values ​​in the current statistical period, and obtain the second number of target first hash values ​​in the current statistical period; based on the second number of target first hash values ​​in the current statistical period, the central control node 2302 triggers multiple protection nodes 2301 to perform speed limit processing on the request message to be speed limited. For example, if a request message is a request message to be speed limited, that is, attack traffic, then the protection node 2301 notifies the forwarding system 220 that the request message is an attack traffic. Based on this, the forwarding system 220 can block the request message, that is, not send the request message to the source station 240. If a request message is not a request message to be speed limited, that is, attack traffic, then the protection node 2301 notifies the forwarding system 220 that the request message is normal traffic. Based on this, the forwarding system 220 can return the request message to the source station 240.

[0065] In some possible implementations, the control node 2303 may send a speed limit strategy to the protection node 2301, such as a speed limit threshold, a statistical period, a speed limit processing method, a speed limit processing period, and the conditions for the effectiveness of the speed limit strategy.

[0066] For example, Figure 3 to Figure 4 The configuration interface diagram of the speed limit strategy provided in the embodiment of the present application is as follows: Figure 3 As shown, the operation and maintenance platform can display Figure 3 In the interface shown, the operation and maintenance personnel can select "Rate Limit" on this interface to enter Figure 4 The configuration interface shown in the figure, in which the operation and maintenance personnel can configure the conditions for the speed limit policy to take effect, such as Figure 4 As shown in the figure, the currently configured effective condition is: UA equals curl. The operation and maintenance personnel can also configure the speed limit policy, such as Figure 4 As shown in , the current speed limit strategy includes: speed limit threshold 100 times / 10 seconds, statistical cycle 10 seconds, speed limit processing cycle, that is, processing duration 30 seconds, speed limit processing method, that is, processing method, where the processing methods include: interception, algorithm challenge, redirection, etc. In addition, Figure 4As shown, the attack fields involved in the speed limit strategy include: the specified field test1 in the cookie, the query in the URL query parameter, and the specified field test2 in the HTTP header. It is worth mentioning that the operation and maintenance personnel can also configure other attack fields, such as JA3 fingerprint. After the operation and maintenance personnel configure the speed limit strategy, the control node as the background can obtain the speed limit strategy, so that the speed limit strategy can be issued to the protection node 2301.

[0067] In some implementations, the forwarding system 220 may be deployed on one or more edge nodes, but is not limited thereto. The forwarding system 220 may also be referred to as a forwarding cluster, but is not limited thereto.

[0068] It should be understood that edge nodes are relative to cloud computing data centers and refer to network nodes with fewer intermediate links between them and the final access users. These nodes can be a computer room or a physical device, and they have common capabilities such as edge-side real-time data analysis, local data storage, and real-time network connection.

[0069] It is worth mentioning that the network attack involved in the embodiments of the present application may be a DDoS attack, but is not limited to this. For example, it may be a 7-layer DDoS attack, and of course it may be other types of network attacks.

[0070] It should be understood that if the network attack involved in the embodiment of the present application is a 7-layer DDoS attack, then the forwarding system 220 can also be referred to as a 7-layer forwarding system or a 7-layer forwarding cluster, etc., and the embodiment of the present application does not limit this. Similarly, if the network attack involved in the embodiment of the present application is a 7-layer DDoS attack, then the security protection system 230 can also be referred to as a 7-layer protection system, a 7-layer protection cluster, a 7-layer security protection system, a 7-layer security protection cluster, etc., and the embodiment of the present application does not limit this.

[0071] In some implementations, the protection node 2301 may be deployed on one or more edge nodes, but is not limited thereto. The protection node 2301 may also be referred to as a protection machine, a protection service, or a protection engine, but is not limited thereto.

[0072] It should be understood that the protection node 2301 is used to process the speed limit request message through the speed limit policy. For example, the protection node 2301 can notify the forwarding system that the speed limit request message is attack traffic, based on which the forwarding system can block the request message, that is, not send the request message to the source station.

[0073] In some implementations, the central control node 2302 may be deployed on one or more edge nodes, but is not limited thereto. The central control node 2302 may also be referred to as a central control service, but is not limited thereto.

[0074] It should be understood that the central control node 2302 serves as a control center for maintaining the global statistical value of each request message. For example, the central control node 2302 can receive the number of target first hash values ​​sent by the target protection node in the current synchronization period, and calculate the number of target first hash values ​​in the current synchronization period, and the sum of the first number of target first hash values ​​in the current statistical period, to obtain the second number of target first hash values ​​in the current statistical period. Further, the central control node 2302 can trigger multiple protection nodes to perform speed limit processing on the speed limit request message based on the second number of target first hash values ​​in the current statistical period. Among them, the second number of target first hash values ​​in the current statistical period can be understood as the global statistical value of the request message corresponding to the target first hash value.

[0075] In some implementations, the management and control node 2303 may be deployed on one or more edge nodes, but is not limited thereto. The management and control node 2303 may also be referred to as a management and control service, but is not limited thereto.

[0076] It should be understood that the control node 2303 is used to issue speed limit policies to the protection node 2301, such as speed limit thresholds, statistical cycles, speed limit processing methods, speed limit processing cycles, speed limit policy effectiveness conditions, etc.

[0077] In some possible implementations, the source station 240 can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), as well as big data and artificial intelligence platforms.

[0078] It should be noted that Figure 2 This is only a schematic diagram of a system architecture provided in the embodiment of the present application. The system architecture involved in the embodiment of the present application is not limited to Figure 2 The system architecture shown, for example, Figure 2 The system architecture shown includes only one terminal device 210 and two protection nodes 2301 . In practice, it may include multiple terminal devices 210 or other numbers of protection nodes 2301 .

[0079] The technical solution of this application will be described in detail below:

[0080] Figure 5 A flowchart of a message processing method provided in an embodiment of the present application, the method is applied to a security protection system, the security protection system comprising: a central control node and multiple protection nodes; Figure 5As shown, the method may include:

[0081] S510: For each request message received by the target protection node within the current synchronization period between the target protection node and the central control node, the target protection node calculates a first hash value of the request message;

[0082] It should be understood that the target protection node is any protection node among the multiple protection nodes.

[0083] It should be understood that the current synchronization period refers to the period during which the target protection node and the central control node currently perform data synchronization, which is also referred to as the current synchronization window.

[0084] In some implementations, for each request message received by the target protection node in the current synchronization period, the request message may be an HTTP request or a request message based on other protocols, which is not limited in this embodiment of the present application.

[0085] It should be understood that, for each request message received by the target protection node in the current synchronization period, the first hash value of the request message is used to determine whether the request message is a request message to be rate-limited, that is, to determine whether the request message is attack traffic.

[0086] In some implementations, for each request message received by the target protection node in the current synchronization period, the target protection node may perform a hash calculation on at least one attack field of the request message to obtain a first hash value of the request message.

[0087] It should be understood that, for each request message received by the target protection node in the current synchronization cycle, the attack field of the request message refers to the field used by the attacker when conducting a network attack.

[0088] In some implementations, for each request message received by the target protection node in the current synchronization period, the attack field of the request message includes at least one of the following, but is not limited to: a specified field of a cookie, a specified field of an HTTP header, and a query. For example, the specified field of a cookie may be test1 in the cookie, and the specified field of an HTTP header may be test2.

[0089] In some implementations, for each request message received by the target protection node in the current synchronization cycle, the target protection node calculates a first hash value of the request message, including: for each request message received by the target protection node in the current synchronization cycle, the target protection node directly calculates the first hash value of the request message.

[0090] In some possible implementations, for each request message received by the target protection node in the current synchronization cycle, the target protection node calculates a first hash value of the request message, including: for each request message received by the target protection node in the current synchronization cycle, the target protection node matches the request message with an effective condition of the speed limit policy; if the request message matches the effective condition, the target protection node calculates the first hash value of the request message.

[0091] It should be understood that the difference between this implementable method and the previous implementable method is that in this implementable method, the target protection node needs to first match the request message with the effective conditions of the rate limit policy, and only calculate the first hash value of the request message when the match is successful. This implementable method can better adapt to attack scenarios. For example, in a 7-layer DDoS attack scenario, in addition to the above-mentioned attack fields, the attack traffic also has the following characteristics: the User Agent (UA) field is equal to curl.

[0092] In some implementations, the speed limit policy may include one or more effectiveness conditions, which is not limited in the embodiments of the present application.

[0093] In some implementations, the security protection node includes a central control node.

[0094] In some possible implementations, the security protection system includes multiple central control nodes; accordingly, for each request message received by the target protection node in the current synchronization period, before the target protection node calculates the first hash value of the request message, it also includes: the target protection node selects a central control node from the multiple central control nodes using a consistent hashing algorithm. Based on this, the central control node involved in the subsequent embodiments of the present application refers to the central control node selected by the target protection node.

[0095] It should be understood that the embodiment of the present application can solve the problem of uneven distribution of synchronization data (i.e., the first synchronization data below) through the consistent hashing algorithm, thereby achieving the purpose of load balancing. In addition, the central control node can be dynamically expanded or reduced according to actual conditions, thereby improving the scalability and availability of the entire security protection system. For example, when a central control node goes down, it can be replaced by another central control node, or, when the request message increases dramatically, the central control node can be dynamically expanded to meet the demand.

[0096] In some implementations, for each request message received by the target protection node in the current synchronization period, the first hash value of the request message may also be used to determine the request message.

[0097] It should be understood that, considering that different request messages may have the same first hash value, based on this, an embodiment of the present application proposes to calculate the second hash value of the request message, and determine a unique request message by combining the first hash value and the second hash value of the request message.

[0098] In some implementations, for each request message received by the target protection node in the current synchronization period, the target protection node may perform a hash calculation on at least one non-attack field of the request message to obtain a second hash value of the request message.

[0099] It should be understood that, for each request message received by the target protection node in the current synchronization period, the non-attack field of the request message refers to any other field in the request message except the attack field.

[0100] In some implementations, for each request message received by the target protection node during the current synchronization cycle, the non-attack field of the request message includes at least one of the following, but is not limited to: source IP address, destination IP address, source port number, destination port number, domain name.

[0101] S520: The target protection node counts the number of target first hash values ​​in the current synchronization period, and sends first synchronization data to the central control node, wherein the first synchronization data includes: the number of target first hash values ​​in the current synchronization period;

[0102] It should be understood that for each request message received by the target protection node in the current synchronization period, the request message has a first hash value, and therefore the target protection node can obtain multiple first hash values.

[0103] It should be understood that the target first hash value is any first hash value among the above-mentioned multiple first hash values.

[0104] It should be understood that the number of target first hash values ​​in the current synchronization cycle is equal to the number of request messages corresponding to the target first hash value received by the target protection node in the current synchronization cycle. Among them, if the second hash value of the request message is not considered, the request message corresponding to the target first hash value refers to the request message whose first hash value is equal to the target first hash value. If the second hash value of the request message is considered, the request message corresponding to the target first hash value refers to the request message whose first hash value is equal to the target first hash value and corresponds to the same second hash value. Similarly, if the second hash value of the request message is considered, the number of target first hash values ​​in the current synchronization cycle refers to the number of target first hash values ​​corresponding to the same second hash value in the current synchronization cycle. Similarly, if the second hash value of the request message is considered, the number of target first hash values ​​in the current statistical period refers to the number of target first hash values ​​corresponding to the same second hash value in the current synchronization cycle.

[0105] In some possible implementations, the first synchronization data also includes at least one of the following: a statistical period and a speed limit threshold; the message processing method also includes: if the central control node determines that the speed limit policy has changed based on at least one of the statistical period and the speed limit threshold, the central control node clears the number counter of the target first hash value in the current statistical period.

[0106] It should be understood that the statistical period refers to a statistical period of a global number of target first hash values.

[0107] It should be understood that the current statistical period refers to the current statistical period of the global number of target first hash values, and the current statistical period may also be referred to as a current statistical window.

[0108] It should be understood that the target first hash value quantity counter in the current statistical period is used to count the quantity of the target first hash values ​​in the current statistical period.

[0109] It should be understood that each protection node can synchronize at least one of the statistical cycle and the speed limit threshold to the central control node each time it synchronizes data with the central control node. The central control node stores at least one of the statistical cycle and the speed limit threshold received each time. Based on this, when the central control node receives at least one of the statistical cycle and the speed limit threshold currently synchronized by the target protection node, it can compare at least one of the currently synchronized statistical cycle and the speed limit threshold with at least one of the statistical cycle and the speed limit threshold it has stored most recently. If at least one of the statistical cycle and the speed limit threshold changes, it indicates that the speed limit policy has changed. Based on this, the central control node can clear the number counter of the target first hash value in the current statistical cycle. By automatically clearing the timer, incorrect statistics of request messages can be avoided, and attack traffic can be accurately determined, thereby improving network security.

[0110] For example, assuming that the latest statistical period stored in the central control node is 10s, and the statistical period it receives from the target protection node is 15s, then the central control node determines that the speed limit policy has changed. Based on this, the central control node can clear the number counter of the target first hash value in the current statistical period.

[0111] For example, assuming that the latest speed limit threshold stored by the central control node is 100 times / 10s, and the speed limit threshold received from the target protection node is 100 times / 15s, then the central control node determines that the speed limit policy has changed. Based on this, the central control node can clear the number counter of the target first hash value in the current statistical period.

[0112] For example, assuming that the latest statistical period stored by the central control node is 10s and the speed limit threshold is 100 times / 10s, and the statistical period received from the target protection node is 15s and the speed limit threshold is 100 times / 15s, then the central control node determines that the speed limit policy has changed. Based on this, the central control node can clear the number counter of the target first hash value in the current statistical period.

[0113] In some implementations, the first synchronization data also includes: the start time of the current statistical cycle; accordingly, the message processing method also includes: if the central control node determines that the current synchronization cycle exceeds the range of the current statistical cycle based on the start time of the current statistical cycle, the central control node clears the number counter of the target first hash value in the current statistical cycle. By automatically clearing the timer, incorrect statistics of request messages can be avoided, and attack traffic can be accurately determined, thereby improving network security.

[0114] For example, assuming that the start time of the current statistical period is t0, the statistical period is 10s, and the current synchronization period is [t0+600ms, t0+610ms]. Since the current synchronization period exceeds the current statistical period [t0, t0+600ms], the central control node can clear the quantity counter of the target first hash value in the current statistical period.

[0115] In some implementations, the first synchronization data further includes: a target first hash value, so that the central control node can learn the hash value of the global quantity to be counted, and can determine the request message based on the target first hash value.

[0116] In some implementations, the first synchronization data further includes: a second hash value of the request message corresponding to the target first hash value, so that the central control node can better determine the request message by using the target first hash value and the second hash value.

[0117] In some implementations, the first synchronization data further includes: a public header.

[0118] In some implementations, the public header may include at least one of the following, but is not limited to: a timestamp, a data length of the first synchronization data, and a protocol version number. The central control node may determine whether the first synchronization data is dirty data by the timestamp, and if the first synchronization data is dirty data, the data may be discarded. The protocol version number is the transmission protocol used by the target protection node and the central control node, and the transmission protocol may be the HTTP protocol or other custom protocols, which are not limited in the embodiments of the present application.

[0119] In some implementations, the first synchronization data also includes: a data type of the data, that is, a synchronization type.

[0120] In some implementations, for the target protection node, each time after synchronizing the number of the target first hash value in the current synchronization cycle to the central control node, the central control node can return the number of the target first hash value in the current statistical cycle, that is, the global number, wherein the target protection node can count the number of the target first hash value in the current statistical cycle through the local target first hash value in the current statistical cycle The number counter. Based on this, the target protection node can calculate the number of the target first hash value in the current synchronization cycle, and the sum of the third number of the target first hash value in the current statistical cycle, and obtain the fourth number of the target first hash value in the current statistical cycle. Among them, the third number of the target first hash value in the current statistical cycle refers to the count value of the local number counter of the target protection node before the number of the target first hash value in the current synchronization cycle is accumulated. The fourth number of the target first hash value in the current statistical cycle refers to the count value of the local number counter of the target protection node after the number of the target first hash value in the current synchronization cycle is accumulated. In other words, the target protection node can also calculate the number of the target first hash value in the current statistical cycle.

[0121] It should be understood that the initial count value of the local quantity counter of the target protection node is zero.

[0122] In some implementations, the first synchronization data further includes: a fourth number of the target first hash value in the current statistical period.

[0123] Figure 6 This is a schematic diagram of the structure of a first synchronization data in an embodiment of the present application, such as Figure 6 As shown, the first synchronization data includes: a common header, a synchronization type, a target first hash value, a second hash value, the number of target first hash values ​​in the current synchronization period, the fourth number of target first hash values ​​in the current statistical period, a speed limit threshold, the start time of the current statistical period, and the statistical period.

[0124] S530: The central control node calculates the number of target first hash values ​​in the current synchronization period and the sum of the first number of target first hash values ​​in the current statistical period to obtain a second number of target first hash values ​​in the current statistical period;

[0125] In some implementations, the central control node can count the number of target first hash values ​​in the current statistical period through a local target first hash value in the current statistical period counter. The first number of target first hash values ​​in the current statistical period refers to the count value of the local number counter of the central control node before the number of target first hash values ​​in the current synchronization period is accumulated. The second number of target first hash values ​​in the current statistical period refers to the count value of the local number counter of the central control node after the number of target first hash values ​​in the current synchronization period is accumulated.

[0126] It should be understood that the initial count value of the quantity counter in the central control node is zero.

[0127] S540: The central control node triggers multiple protection nodes to perform speed limit processing on the speed limit request message based on the second number of the target first hash value in the current statistical period.

[0128] In the embodiment of the present application, S540 may be implemented in any of the following implementable ways, but is not limited thereto:

[0129] In a first implementation mode, S540 may include:

[0130] S540-1A: The central control node sends second synchronization data to the target protection node, where the second synchronization data includes: a second number of the target first hash value in the current statistical period;

[0131] In some implementations, the second synchronization data further includes: a public header.

[0132] In some implementations, the public header may include at least one of the following, but is not limited to: a timestamp, the data length of the second synchronization data, and a protocol version number. The target protection node may determine whether the second synchronization data is dirty data by the timestamp. If the second synchronization data is dirty data, the data may be discarded. The protocol version number is the transmission protocol used by the target protection node and the central control node. The transmission protocol may be the HTTP protocol or other custom protocols, which are not limited in the embodiments of the present application.

[0133] In some implementations, the second synchronization data also includes: a data type of the data, that is, a synchronization type.

[0134] In some implementations, the second synchronization data further includes: a target first hash value, so that the target protection node can learn the hash value of the global quantity to be counted, and can determine the request message based on the target first hash value.

[0135] In some implementations, the second synchronization data further includes: a second hash value, so that the target protection node can better determine the request message by using the target first hash value and the second hash value.

[0136] In some implementations, the second synchronization data further includes: a start time of a current statistical period.

[0137] Figure 7 This is a schematic diagram of the structure of a second synchronization data in an embodiment of the present application, such as Figure 7 As shown, the second synchronization data includes: a common header, a synchronization type, a target first Hash value, a second Hash value, a second number of the target first Hash value in the current statistical period, and a start time of the current statistical period.

[0138] S540-2A: If the second number of the target first hash value in the current statistical period is greater than the speed limit threshold, the target protection node uses the request message corresponding to the target first hash value as a request message to be speed limited, and performs speed limit processing on the request message to be speed limited;

[0139] In some possible implementations, the target protection node uses the request message corresponding to the target first hash value as the request message to be speed limited, including: the target protection node uses the request message corresponding to the target first hash value received by the target protection node during the current statistical period and the current speed limit processing period as the request message to be speed limited.

[0140] It should be understood that the current speed limit processing cycle refers to the cycle in which the speed limit processing is currently being performed, which is also referred to as the current processing cycle, but is not limited thereto.

[0141] In some implementations, the start time of the current speed limit processing cycle may be the time when the target protection node determines that the second number is greater than the speed limit threshold, but is not limited thereto. Therefore, there may be an intersection between the current processing cycle and the current statistical cycle, for example, the current statistical cycle is [t0, t0+600ms], and the current processing cycle is [t0+400ms, t0+800ms].

[0142] In some implementations, the target protection node uses the request message corresponding to the target first hash value as the request message to be speed limited, including: the target protection node uses the request message corresponding to the target first hash value received by the target protection node in the current statistical period as the request message to be speed limited.

[0143] In some possible implementations, the target protection node uses the request message corresponding to the target first hash value as the request message to be speed limited, including: the target protection node uses the request message corresponding to the target first hash value received by the target protection node during the current speed limit processing cycle as the request message to be speed limited.

[0144] In some achievable embodiments, the target protection node performs speed limiting processing on the request message to be limited, including: the target protection node intercepts the request message to be limited, performs algorithm challenge, redirects, etc. Taking the interception of the request message to be limited as an example, the target protection node can notify the forwarding system that the request message to be limited is attack traffic, based on which the forwarding system can block the request message, that is, not send the request message to the source station.

[0145] S540-3A: The target protection node sends a first speed limit instruction to other protection nodes through the central control node;

[0146] It should be understood that the first speed limit indication is used to perform speed limit processing on the speed limit request message.

[0147] In some possible implementations, the target protection node sends a first speed limit indication to other protection nodes through the central control node, including: the target protection node sends a second speed limit indication to the central control node; the central control node generates a first speed limit indication based on the second speed limit indication; the central control node sends the first speed limit indication to other protection nodes.

[0148] It should be understood that the second speed limit indication is used to instruct to perform speed limit processing on the speed limit request message.

[0149] In some implementations, the second rate limit indication includes: a target first hash value, so that the central control node determines the request message through the target first hash value.

[0150] In some implementations, the second speed limit indication further includes: a second hash value, so that the central control node can use the target first hash value and the second hash value to better determine the request message.

[0151] In some implementations, the second speed limit indication further includes: a data type of the second speed limit indication, that is, a synchronization type.

[0152] In some implementations, the second speed limit indication further includes: a common header.

[0153] In some implementations, the public header may include at least one of the following, but is not limited thereto: a timestamp, the data length of the second speed limit indication, and a protocol version number. The central control node may determine whether the second speed limit indication is dirty data by the timestamp, and if the second speed limit indication is dirty data, the data may be discarded. The protocol version number is the transmission protocol used by the target protection node and the central control node, and the transmission protocol may be the HTTP protocol or other custom protocols, which are not limited in the embodiments of the present application.

[0154] In some possible implementations, the second speed limit indication also includes: the start time of the current speed limit processing cycle, so that the central control node can know the start time of the current speed limit processing cycle, and then notify other protection nodes of the start time, so that all protection nodes can perform speed limit processing on the speed limit request message in the current speed limit processing cycle.

[0155] In some possible implementations, the second speed limit indication also includes: a speed limit processing period, so that the central control node can be informed of the speed limit processing period, and can compare the most recently stored speed limit processing period with the speed limit processing period carried by the second speed limit indication. If they are different, it is determined that the speed limit policy has changed, and the central control node clears the number counter of the target first hash value in the current statistical period.

[0156] Figure 8 Schematic diagram of the structure of a second speed limit indication in an embodiment of the present application, such as Figure 8 As shown, the second speed limit indication includes: a common header, a data type of the second speed limit indication, ie, a synchronization type, a target first hash value, a second hash value, a start time of a current speed limit processing cycle, and a speed limit processing cycle.

[0157] In some possible implementations, the first speed limit indication and the second speed limit indication may be the same or different, and the embodiment of the present application does not limit this.

[0158] For example, Fig. 9 This is a schematic diagram of the structure of a first speed limit indication in an embodiment of the present application, such as Fig. 9 As shown, the first speed limit indication includes: a common header, a data type of the second speed limit indication, that is, a synchronization type, a target first hash value, a second hash value, and the start time of the current speed limit processing cycle. Fig. 9 The first speed limit indicator shown is Figure 8 The second speed limit indication shown is different.

[0159] S540-4A: The other protection nodes use the request message corresponding to the target first hash value as a request message to be speed limited based on the first speed limit indication, and perform speed limit processing on the request message to be speed limited.

[0160] In some possible implementations, other protection nodes use the request message corresponding to the target first hash value as the request message to be limited in speed, including: other protection nodes use the request message corresponding to the target first hash value received by other protection nodes during the current statistical period and the current speed limit processing period as the request message to be limited in speed.

[0161] In some implementations, other protection nodes use the request message corresponding to the target first hash value as the request message to be limited, including: other protection nodes use the request message corresponding to the target first hash value received by other protection nodes in the current statistical period as the request message to be limited.

[0162] In some implementations, other protection nodes use the request message corresponding to the target first hash value as the request message to be speed limited, including: other protection nodes use the request message corresponding to the target first hash value received by other protection nodes during the current speed limit processing cycle as the request message to be speed limited.

[0163] In some implementable manners, other protection nodes perform speed limiting processing on the speed limit request message, including: other protection nodes intercept, algorithmically challenge, redirect, etc. the speed limit request message. Taking intercepting the speed limit request message as an example, other protection nodes can notify the forwarding system that the speed limit request message is attack traffic, based on which the forwarding system can block the request message, that is, not send the request message to the source station.

[0164] In a second implementation mode, S540 may include:

[0165] S540-1B: If the second number of the target first hash value in the current statistical period is greater than the speed limit threshold, the central control node sends a fourth speed limit indication to each protection node;

[0166] It should be understood that the fourth speed limit indication is used to perform speed limit processing on the speed limit request message.

[0167] It should be understood that the format of the fourth speed limit indication can be the same as that of the first speed limit indication, and therefore, the explanation of the fourth speed limit indication can refer to the explanation of the first speed limit indication above. It is worth mentioning that the reason why the speed limit indication in this implementable method is called the fourth speed limit indication is that the time when the second number determined by the central control node is greater than the speed limit threshold and the time when the second number determined by the target protection node is greater than the speed limit threshold can be different. In other words, the start time of the current speed limit processing cycle determined by the central control node and the start time of the current speed limit processing cycle determined by the target prevention and control node can be different.

[0168] S540-2B: Each protection node uses the request message corresponding to the target first hash value as a request message to be speed limited based on the fourth speed limit indication, and performs speed limit processing on the request message to be speed limited.

[0169] In some achievable embodiments, for each protection node, the protection node uses the request message corresponding to the target first hash value as the request message to be subject to speed limit based on the fourth speed limit indication, including: the protection node uses the request message corresponding to the target first hash value received by the protection node during the current statistical period and the current speed limit processing period as the request message to be subject to speed limit. The current speed limit processing period can be determined based on the fourth speed limit indication, for example, the fourth speed limit indication can indicate the start time of the current speed limit processing period, and the protection node has been configured with a speed limit processing period, based on which the protection node can determine the current speed limit processing period based on the start time and the speed limit processing period.

[0170] In some possible implementations, for each protection node, the protection node uses the request message corresponding to the target first hash value as the request message to be limited in speed based on the fourth speed limit indication, including: the protection node responds to the fourth speed limit indication and uses the request message corresponding to the target first hash value received by the protection node during the current statistical period as the request message to be limited in speed.

[0171] In some achievable embodiments, for each protection node, the protection node uses the request message corresponding to the target first hash value as the request message to be subject to speed limit based on the fourth speed limit indication, including: the protection node uses the request message corresponding to the target first hash value received by the protection node within the current speed limit processing cycle as the request message to be subject to speed limit. The current speed limit processing cycle can be determined based on the fourth speed limit indication, for example, the fourth speed limit indication can indicate the start time of the current speed limit processing cycle, and the protection node has been configured with a speed limit processing cycle, based on which the protection node can determine the current speed limit processing cycle based on the start time and the speed limit processing cycle.

[0172] In some achievable embodiments, for each protection node, the protection node performs speed limiting processing on the request message to be limited, including: the protection node intercepts the request message to be limited, performs algorithm challenge, redirects, etc. Taking the interception of the request message to be limited as an example, the protection node can notify the forwarding system that the request message to be limited is attack traffic, based on which the forwarding system can block the request message, that is, not send the request message to the source station.

[0173] In a third implementation mode, S540 may include:

[0174] S540-1C: The central control node sends second synchronization data to each protection node, wherein the second synchronization data includes: a second number of the target first hash value in the current statistical period;

[0175] It should be understood that the explanation of the second synchronization data can be referred to above, and the embodiments of the present application will not go into details therein.

[0176] S540-2C: For each protection node, if the second number of the target first hash value in the current statistical period is greater than the speed limit threshold, the protection node will treat the request message corresponding to the target first hash value as a request message to be speed limited, and perform speed limit processing on the request message to be speed limited.

[0177] In some possible implementations, for each protection node, the protection node uses the request message corresponding to the target first hash value as the request message to be limited in speed, including: the protection node uses the request message corresponding to the target first hash value received by the protection node during the current statistical period and the current speed limit processing period as the request message to be limited in speed.

[0178] In some possible implementations, for each protection node, the protection node uses the request message corresponding to the target first hash value as the request message to be limited, including: the protection node uses the request message corresponding to the target first hash value received by the protection node during the current statistical period as the request message to be limited.

[0179] In some possible implementations, for each protection node, the protection node uses the request message corresponding to the target first hash value as the request message to be speed limited, including: the protection node uses the request message corresponding to the target first hash value received by the protection node during the current speed limit processing cycle as the request message to be speed limited.

[0180] In some achievable embodiments, for each protection node, the protection node performs speed limiting processing on the request message to be limited, including: the protection node intercepts the request message to be limited, performs algorithm challenge, redirects, etc. Taking the interception of the request message to be limited as an example, the protection node can notify the forwarding system that the request message to be limited is attack traffic, based on which the forwarding system can block the request message, that is, not send the request message to the source station.

[0181] In some possible implementations, if the target protection node determines that the number of target first hash values ​​in the current statistical period and the next statistical period is greater than the speed limit threshold, the target protection node extends the speed limit processing period for the request message corresponding to the target first hash value, thereby improving the protection effect.

[0182] For example, the speed limit processing cycle originally configured by the operation and maintenance personnel is 10s, but the number of target first hash values ​​in the current statistical period is greater than the speed limit threshold, and the number in the next statistical period is still greater than the speed limit threshold. Based on this, the target protection node can extend the originally configured speed limit processing cycle to 15s for the request message corresponding to the target first hash value.

[0183] The following is an example of an exemplary description of the message processing method provided in the embodiment of the present application:

[0184] Fig.10 A flowchart of another message processing method provided in an embodiment of the present application, assuming that M represents the number of a first hash value in a synchronization period, P represents the number of the first hash value in a statistical period, the synchronization period is 10ms, the statistical period is 35ms, the speed limit processing period is 10ms, and the speed limit threshold is 100 times / 35ms. Fig.10As shown, the data synchronized by the protection node 1 to the central control node for the first time includes: M=1, that is, the number of the first hash value synchronized by the protection node 1 to the central control node in the current synchronization period is 1, and then because in the current statistical period, the central control node receives the number of the first hash value in the synchronization period for the first time, therefore, the central control node can calculate the sum of the number 1 of the first hash value in the synchronization period and the number 0 of the first hash value in the current statistical period, and obtain that the number of the first hash value in the current statistical period is 1, and it can synchronize data to the protection node 1: P=1, the protection node 1 determines that the number of the first hash value in the current statistical period is not greater than the speed limit threshold, and it does not perform any processing. Furthermore, the data synchronized by the protection node 2 to the central control node for the first time includes: M=10, that is, the number of the first hash values ​​synchronized by the protection node 2 to the central control node in the current synchronization cycle is 10, and then the central control node can calculate the sum of the number of the first hash values ​​in the synchronization cycle 10 and the number of the first hash values ​​in the current statistical cycle 1, and obtain the number of the first hash values ​​in the current statistical cycle is 11, and it can synchronize data to the protection node 2: P=11, the protection node 2 determines that the number of the first hash values ​​in the current statistical cycle is not greater than the speed limit threshold, and it does not perform any processing. Furthermore, the data synchronized by the protection node 1 to the central control node for the second time includes: M=20, that is, the number of the first hash values ​​synchronized by the protection node 1 to the central control node in the current synchronization cycle is 20, and then the central control node can calculate the sum of the number of the first hash values ​​in the synchronization cycle 20 and the number of the first hash values ​​in the current statistical cycle 11, and obtain the number of the first hash values ​​in the current statistical cycle is 31. It can synchronize data to the protection node 1: P=31, and the protection node 1 determines that the number of the first hash values ​​in the current statistical cycle is not greater than the speed limit threshold, and it does not perform any processing. Furthermore, the data synchronized by the protection node 2 to the central control node for the second time includes: M=20, that is, the number of the first hash values ​​synchronized by the protection node 2 to the central control node in the current synchronization cycle is 20, and then the central control node can calculate the sum of the number of the first hash values ​​in the synchronization cycle 20 and the number of the first hash values ​​in the current statistical cycle 31, and obtain the number of the first hash values ​​in the current statistical cycle is 51. It can synchronize data to the protection node 2: P=51, and the protection node 2 determines that the number of the first hash values ​​in the current statistical cycle is not greater than the speed limit threshold, and it does not perform any processing.Furthermore, the data synchronized by the protection node 1 to the central control node for the third time includes: M=50, that is, the number of the first hash values ​​synchronized by the protection node 1 to the central control node in the current synchronization cycle is 50, and then the central control node can calculate the sum of the number 50 of the first hash values ​​in the synchronization cycle and the number 51 of the first hash values ​​in the current statistical cycle, and obtain that the number of the first hash values ​​in the current statistical cycle is 101, and it can synchronize data to the protection node 1: P=101, the protection node 1 determines that the number of the first hash values ​​in the current statistical cycle is greater than the speed limit threshold. In this case, the protection node 1 can regard the request message corresponding to the first hash value as the request message to be speed limited, and perform speed limit processing on the request message to be speed limited, and send a second speed limit indication to the central control node; the central control node sends the first speed limit indication to other protection nodes, and the other protection nodes regard the request message corresponding to the first hash value as the request message to be speed limited based on the first speed limit indication, and perform speed limit processing on the request message to be speed limited.

[0185] The embodiment of the present application provides a message processing method, which is applied to a security protection system, and the security protection system includes: a central control node and multiple protection nodes; the method includes: for each request message received by the target protection node in the current synchronization period between the target protection node in the multiple protection nodes and the central control node, the target protection node calculates the first hash value of the request message; the target protection node counts the number of target first hash values ​​in the current synchronization period among the multiple first hash values, and sends the first synchronization data to the central control node, wherein the first synchronization data includes: the number of target first hash values ​​in the current synchronization period; the central control node calculates the number of target first hash values ​​in the current synchronization period, and the sum of the first number of target first hash values ​​in the current statistical period, and obtains the second number of target first hash values ​​in the current statistical period; the central control node triggers multiple protection nodes to perform speed limit processing on the speed limit request message based on the second number of target first hash values ​​in the current statistical period. Thus, each protection node can regularly synchronize the number of the same first hash value in the local synchronization period to the central control node, so that the central control node can calculate the global statistical value of the same first hash value in the current statistical period, and trigger all protection nodes to perform speed limit processing through the global statistical value. Since the attack traffic can be accurately determined based on the global statistical value, and all control nodes can perform comprehensive speed limit processing on the attack traffic, the security of the network can be improved. In addition, the message processing method provided in the embodiment of the present application is suitable for extreme scenarios, such as scenarios with a large number of request messages and / or a large number of attack fields. For such scenarios, the protection accuracy can reach 80%.

[0186] In some implementations, before the central control node calculates the number of target first hash values ​​in the current synchronization period and the first number of target first hash values ​​in the current statistical period to obtain the second number of target first hash values ​​in the current statistical period, the message processing method also includes: the target protection node calculates the number of target first hash values ​​in the current synchronization period and the third number of target first hash values ​​in the current statistical period to obtain the fourth number of target first hash values ​​in the current statistical period, wherein the first synchronization data also includes: the fourth number of target first hash values ​​in the current statistical period; accordingly, the central control node calculates the number of target first hash values ​​in the current synchronization period and the first number of target first hash values ​​in the current statistical period to obtain the second number of target first hash values ​​in the current statistical period, including: if the fourth number of target first hash values ​​in the current statistical period is less than or equal to the speed limit threshold, the central control node calculates the number of target first hash values ​​in the current synchronization period and the first number of target first hash values ​​in the current statistical period to obtain the second number of target first hash values ​​in the current statistical period.

[0187] It should be understood that the explanation of the third number and the fourth number of the target first hash value in the current statistical period can be referred to above, and the embodiments of the present application will not be repeated here.

[0188] It should be understood that in this implementable method, for the current synchronization period, before receiving the second number of the target first hash value in the current statistical period, the target protection node first calculates the global number of the target first hash value in the current statistical period, that is, the fourth number, and synchronizes the fourth number to the central control node. The central control node can compare the fourth number with the speed limit threshold. Only when the fourth number is less than or equal to the speed limit threshold, the central control node calculates the global number of the target first hash value in the current statistical period, that is, the second number, and based on the second number of the target first hash value in the current statistical period, triggers multiple protection nodes to perform speed limit processing on the speed limit request message.

[0189] In some possible implementations, if the fourth number of the target first hash value in the current statistical period is greater than the speed limit threshold, the target protection node will treat the request message corresponding to the target first hash value as the request message to be speed limited, and perform speed limit processing on the request message to be speed limited; the target protection node sends a third speed limit indication to other protection nodes through the central control node; the other protection nodes will treat the request message corresponding to the target first hash value as the request message to be speed limited based on the third speed limit indication, and perform speed limit processing on the request message to be speed limited.

[0190] It should be understood that in this implementable method, if the fourth number is greater than the speed limit threshold, the target protection node can directly perform speed limit processing without waiting for the central control node to return the second number of the target first hash value within the current statistical period, and then compare the second number with the speed limit threshold, thereby improving the protection efficiency.

[0191] In some possible implementations, the method for determining the request message to be speed limited and the method for speed limit processing can be referred to above, and the embodiments of the present application will not be described in detail.

[0192] It should be understood that the format of the third speed limit indication can be the same as that of the first speed limit indication, and therefore, the explanation of the third speed limit indication can refer to the explanation of the first speed limit indication above. It is worth mentioning that the speed limit indication in this implementable manner is called the third speed limit indication because the start time of the current speed limit processing cycle determined by the target protection node can be different in the two implementable manners.

[0193] In some possible implementations, if the fourth number of the target first hash value in the current statistical period is greater than the speed limit threshold, the central control node sends third synchronization data to other protection nodes, wherein the third synchronization data includes: the fourth number of the target first hash value in the current statistical period; if the fourth number of the target first hash value in the current statistical period is greater than the speed limit threshold, the other protection nodes stop synchronizing data to the central control node.

[0194] In some implementations, the third synchronization data may have the same format as the second synchronization data. Therefore, the explanation of the third synchronization data may refer to the explanation of the second synchronization data above.

[0195] It should be understood that for other protection nodes, after receiving the fourth number, they can compare the fourth number with the speed limit threshold, so that when the fourth number is greater than the speed limit threshold, other protection nodes can stop synchronizing data to the central control node, thereby reducing the network resource overhead between other protection nodes and the central control node.

[0196] The following is an example of an exemplary description of the message processing method provided in the embodiment of the present application:

[0197] Fig.11 A flowchart of another message processing method provided in an embodiment of the present application, assuming that M represents the number of a first hash value in a synchronization period, N represents the number of the first hash value calculated by the protection node in a statistical period, P represents the number of the first hash value calculated by the central control node in a statistical period, the synchronization period is 10ms, the statistical period is 35ms, the speed limit processing period is 10ms, and the speed limit threshold is 80 times / 35ms. Fig.11As shown, the data synchronized by the protection node 1 to the central control node for the first time includes: M=1, N=1, that is, the number of the first hash value synchronized by the protection node 1 to the central control node in the current synchronization period is 1, and the number of the first hash value synchronized in the current statistical period is 1, then the central control node can compare N and the speed limit threshold, because N is less than the speed limit threshold, and in the current statistical period, the central control node receives the number of the first hash value in the synchronization period for the first time, therefore, the central control node can calculate the sum of the number 1 of the first hash value in the synchronization period and the number 0 of the first hash value in the current statistical period, and obtain the number of the first hash value in the current statistical period is 1, it can synchronize data to the protection node 1: P=1, the protection node 1 determines that the number of the first hash value in the current statistical period is not greater than the speed limit threshold, and it does not perform any processing. Furthermore, the data synchronized by the protection node 2 to the central control node for the first time includes: M=10, N=10, that is, the protection node 2 synchronizes to the central control node that the number of the first hash values ​​in the current synchronization cycle is 10, and synchronizes that the number of the first hash values ​​in the current statistical cycle is 10. Then the central control node can compare N and the speed limit threshold. Since N is less than the speed limit threshold, the central control node can then calculate the sum of the number of the first hash values ​​in the synchronization cycle (10) and the number of the first hash values ​​in the current statistical cycle (1), and obtain the number of the first hash values ​​in the current statistical cycle is 11. It can synchronize data to the protection node 2: P=11. The protection node 2 determines that the number of the first hash values ​​in the current statistical cycle is not greater than the speed limit threshold, and it does not perform any processing. Furthermore, the data synchronized by the protection node 1 to the central control node for the second time includes: M=20, N=21, that is, the protection node 1 synchronizes to the central control node that the number of the first hash values ​​in the current synchronization cycle is 20, and synchronizes that the number of the first hash values ​​in the current statistical cycle is 21. Then the central control node can compare N with the speed limit threshold. Since N is less than the speed limit threshold, the central control node can then calculate the sum of the number of the first hash values ​​in the synchronization cycle, 20, and the number of the first hash values ​​in the current statistical cycle, 11, and obtain that the number of the first hash values ​​in the current statistical cycle is 31. It can synchronize data to the protection node 1: P=31. The protection node 1 determines that the number of the first hash values ​​in the current statistical cycle is not greater than the speed limit threshold, and it does not perform any processing.Furthermore, the data synchronized by the protection node 2 to the central control node for the second time includes: M=20, N=31, that is, the protection node 2 synchronizes to the central control node that the number of the first hash values ​​in the current synchronization cycle is 20, and synchronizes that the number of the first hash values ​​in the current statistical cycle is 31. Then the central control node can compare N and the speed limit threshold. Since N is less than the speed limit threshold, the central control node can then calculate the sum of the number of the first hash values ​​in the synchronization cycle, 20, and the number of the first hash values ​​in the current statistical cycle, 31, and obtain that the number of the first hash values ​​in the current statistical cycle is 51. It can synchronize data to the protection node 2: P=51. The protection node 2 determines that the number of the first hash values ​​in the current statistical cycle is not greater than the speed limit threshold, and it does not perform any processing. Furthermore, the data synchronized by the protection node 1 to the central control node for the third time includes: M=50, N=81, that is, the number of the first hash values ​​synchronized by the protection node 1 to the central control node in the current synchronization cycle is 50, and the protection node 1 compares N and the speed limit threshold. Since N is greater than the speed limit threshold, the protection node 1 can use the request message corresponding to the first hash value as a request message to be speed-limited, and perform speed limit processing on the request message to be speed-limited, and send a second speed limit indication to the central control node; the central control node sends the first speed limit indication to other protection nodes, and other protection nodes use the request message corresponding to the first hash value as a request message to be speed-limited based on the first speed limit indication, and perform speed limit processing on the request message to be speed-limited. And the central control node determines that N is greater than the speed limit threshold, so it no longer accumulates the number of the first hash values ​​in the current statistical cycle, and no longer returns the number of the first hash values ​​in the current statistical cycle to the protection node 1.

[0198] In an embodiment of the present application, for the current synchronization period, the target protection node can first calculate the global number of the target first hash value in the current statistical period, and compare the global number with the speed limit threshold. If the speed limit threshold is greater than the speed limit threshold, the target protection node can directly perform speed limit processing without waiting for the central control node to return the second number of the target first hash value in the current statistical period, and then compare the second number with the speed limit threshold, thereby improving the protection efficiency.

[0199] The preferred embodiments of the present application are described in detail above in conjunction with the accompanying drawings. However, the present application is not limited to the specific details in the above embodiments. Within the technical concept of the present application, the technical solution of the present application can be subjected to a variety of simple modifications, and these simple modifications all belong to the protection scope of the present application. For example, the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present application will not further explain various possible combinations. For another example, the various different embodiments of the present application can also be arbitrarily combined, as long as they do not violate the ideas of the present application, they should also be regarded as the contents disclosed in the present application.

[0200] It should also be understood that in the various method embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0201] The above describes the method provided in the embodiment of the present application. The following describes the message processing system and device provided in the embodiment of the present application.

[0202] Fig.12 A schematic diagram of a safety protection system 1200 provided in an embodiment of the present application is shown as follows: Fig.12 As shown, it includes: a central control node 1210 and multiple protection nodes 1220.

[0203] The target protection node among the multiple protection nodes 1220 is used for:

[0204] For each request message received by the target protection node during a current synchronization period between the target protection node and the central control node, calculate a first hash value of the request message;

[0205] Counting the number of target first hash values ​​in the current synchronization cycle among the multiple first hash values, and sending first synchronization data to the central control node, wherein the first synchronization data includes: the number of target first hash values ​​in the current synchronization cycle;

[0206] The central control node 1210 is used for:

[0207] Calculate the number of target first hash values ​​in the current synchronization period and the sum of the first number of target first hash values ​​in the current statistical period to obtain a second number of target first hash values ​​in the current statistical period;

[0208] Based on a second number of the target first hash values ​​in the current statistical period, multiple protection nodes are triggered to perform speed limit processing on the speed limit request message.

[0209] In some possible implementations, the central control node 1210 is used to send second synchronization data to the target protection node, wherein the second synchronization data includes: a second number of the target first hash value in the current statistical period; if the second number of the target first hash value in the current statistical period is greater than the speed limit threshold, the target protection node is used to treat the request message corresponding to the target first hash value as a request message to be speed limited, and perform speed limit processing on the request message to be speed limited; the target protection node is used to send a first speed limit indication to other protection nodes through the central control node 1210; the other protection nodes are used to treat the request message corresponding to the target first hash value as a request message to be speed limited based on the first speed limit indication, and perform speed limit processing on the request message to be speed limited.

[0210] In some possible implementations, the target protection node is specifically configured to use the request message corresponding to the target first hash value received by the target protection node in the current statistical period and the current speed limit processing period as the request message to be speed limited.

[0211] In some possible implementations, the other protection nodes are specifically configured to use the request messages corresponding to the target first hash value received by the other protection nodes in the current statistical period and the current speed limit processing period as the request messages to be speed limited.

[0212] In some implementations, the target protection node is used to send a second speed limit indication to the central control node 1210; the central control node 1210 is used to generate a first speed limit indication based on the second speed limit indication; the central control node 1210 is used to send the first speed limit indication to other protection nodes.

[0213] In some possible implementations, before the central control node 1210 calculates the number of target first hash values ​​in the current synchronization period, and the sum of the first number of target first hash values ​​in the current statistical period, to obtain the second number of target first hash values ​​in the current statistical period, the target protection node is also used to calculate the number of target first hash values ​​in the current synchronization period, and the sum of the third number of target first hash values ​​in the current statistical period, to obtain the fourth number of target first hash values ​​in the current statistical period, wherein the first synchronization data also includes: the fourth number of target first hash values ​​in the current statistical period; accordingly, the central control node 1210 is specifically used to: if the fourth number of target first hash values ​​in the current statistical period is less than or equal to the speed limit threshold, then calculate the number of target first hash values ​​in the current synchronization period, and the sum of the first number of target first hash values ​​in the current statistical period, to obtain the second number of target first hash values ​​in the current statistical period.

[0214] In some possible implementations, if the fourth number of the target first hash value in the current statistical period is greater than the speed limit threshold, the target protection node is also used to treat the request message corresponding to the target first hash value as a request message to be speed limited, and perform speed limit processing on the request message to be speed limited; the target protection node is also used to send a third speed limit indication to other protection nodes through the central control node 1210; the other protection nodes are also used to treat the request message corresponding to the target first hash value as a request message to be speed limited based on the third speed limit indication, and perform speed limit processing on the request message to be speed limited.

[0215] In some possible implementations, if the fourth number of the target first hash value in the current statistical period is greater than the speed limit threshold, the central control node 1210 is also used to send third synchronization data to other protection nodes, wherein the third synchronization data includes: the fourth number of the target first hash value in the current statistical period; if the fourth number of the target first hash value in the current statistical period is greater than the speed limit threshold, the other protection nodes are also used to stop synchronizing data to the central control node 1210.

[0216] In some possible implementations, if the target protection node determines that the number of target first hash values ​​in the current statistical period and the next statistical period is greater than the speed limit threshold, the target protection node is also used to extend the speed limit processing period for the request message corresponding to the target first hash value.

[0217] In some possible implementations, the first synchronization data also includes at least one of the following: a statistical period and a speed limit threshold; the central control node 1210 is also used to: if the central control node 1210 determines that the speed limit policy has changed based on at least one of the statistical period and the speed limit threshold, then the number counter of the target first hash value in the current statistical period is cleared.

[0218] In some possible implementations, the first synchronization data also includes: the start time of the current statistical period; the central control node 1210 is also used to: if the central control node 1210 determines that the current synchronization period exceeds the range of the current statistical period based on the start time of the current statistical period, then the quantity counter of the target first hash value in the current statistical period is cleared.

[0219] In some implementations, the first synchronization data further includes: a second hash value of the request message corresponding to the target first hash value.

[0220] In some possible implementations, the security protection system includes multiple central control nodes 1210; for each request message received by the target protection node within the current synchronization period between the target protection node and the central control node 1210 among the multiple protection nodes, before the target protection node calculates the first hash value of the request message, the target protection node is also used to select a central control node 1210 from the multiple central control nodes 1210 using a consistent hashing algorithm.

[0221] In some implementations, the target protection node is specifically used to: for each request message received by the target protection node in the current synchronization period, match the request message with the effectiveness condition of the speed limit policy; if the request message matches the effectiveness condition, calculate the first hash value of the request message.

[0222] It should be understood that the system embodiment and the method embodiment may correspond to each other, and similar descriptions may refer to the method embodiment. To avoid repetition, they will not be described here.

[0223] Fig.13 A schematic diagram of a message processing device 1300 provided in an embodiment of the present application is shown as follows: Fig.13 As shown, the device 1300 includes: a processing module 1310, which is used to:

[0224] For each request message received by the message processing device in a current synchronization period between the message processing device and the central control node, calculate a first hash value of the request message;

[0225] The number of target first hash values ​​in the multiple first hash values ​​in the current synchronization cycle is counted, and first synchronization data is sent to the central control node, wherein the first synchronization data includes: the number of target first hash values ​​in the current synchronization cycle.

[0226] In some possible implementations, the message processing device 1300 also includes: a transceiver module 1320, which is used to receive second synchronization data sent by the central control node, wherein the second synchronization data includes: a second number of target first hash values ​​in the current statistical period; the processing module 1310 is also used to: if the second number of target first hash values ​​in the current statistical period is greater than the speed limit threshold, then the request message corresponding to the target first hash value is used as a request message to be speed limited, and the speed limit processing is performed on the request message to be speed limited; the transceiver module 1320 is also used to send a first speed limit indication to other protection nodes through the central control node; so that other protection nodes treat the request message corresponding to the target first hash value as a request message to be speed limited based on the first speed limit indication, and perform speed limit processing on the request message to be speed limited.

[0227] In some implementations, the processing module 1310 is specifically used to: use the request message corresponding to the target first hash value received by the message processing device in the current statistical period and the current speed limit processing period as the request message to be speed limited.

[0228] In some possible implementations, the transceiver module 1320 is specifically used to: send a second speed limit indication to the central control node; so that the central control node generates a first speed limit indication based on the second speed limit indication; and send the first speed limit indication to other protection nodes.

[0229] In some implementations, the processing module 1310 is also used to: calculate the number of target first hash values ​​in the current synchronization period, and the sum of the third number of target first hash values ​​in the current statistical period, to obtain the fourth number of target first hash values ​​in the current statistical period, wherein the first synchronization data also includes: the fourth number of target first hash values ​​in the current statistical period.

[0230] In some possible implementations, the processing module 1310 is also used to: if the fourth number of the target first hash value in the current statistical period is greater than the speed limit threshold, then the request message corresponding to the target first hash value is used as the request message to be speed limited, and the speed limit processing is performed on the request message to be speed limited; send a third speed limit indication to other protection nodes through the central control node, so that the other protection nodes regard the request message corresponding to the target first hash value as the request message to be speed limited based on the third speed limit indication, and perform speed limit processing on the request message to be speed limited.

[0231] In some implementations, the processing module 1310 is further used to: if it is determined that the number of target first hash values ​​in the current statistical period and the next statistical period is greater than the speed limit threshold, then extend the speed limit processing period for the request message corresponding to the target first hash value.

[0232] In some implementations, the first synchronization data further includes: a second hash value of the request message corresponding to the target first hash value.

[0233] In some implementations, the security protection system includes multiple central control nodes; the processing module 1310 is also used to: use a consistent hashing algorithm to select a central control node from the multiple central control nodes.

[0234] In some implementations, the processing module 1310 is specifically used to: for each request message received by the message processing device in the current synchronization cycle, match the request message with the effectiveness condition of the speed limit policy; if the request message matches the effectiveness condition, calculate the first hash value of the request message.

[0235] It should be understood that the device embodiment and the method embodiment may correspond to each other, and similar descriptions may refer to the method embodiment. To avoid repetition, they will not be described here. Specifically, Fig.13 The device 1300 shown can execute a method embodiment corresponding to the target protection node, and the aforementioned and other operations and / or functions of each module in the device 1300 are respectively for implementing the corresponding processes in each method corresponding to the target protection node. For the sake of brevity, they will not be repeated here.

[0236] The above describes the device 1300 of the embodiment of the present application from the perspective of the functional module in conjunction with the accompanying drawings. It should be understood that the functional module can be implemented in hardware form, can be implemented by instructions in software form, and can also be implemented by a combination of hardware and software modules. Specifically, the steps of the method embodiment in the embodiment of the present application can be completed by the hardware integrated logic circuit and / or software form instructions in the processor, and the steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or a combination of hardware and software modules in the decoding processor to perform. Optionally, the software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory, and completes the steps in the above method embodiment in conjunction with its hardware.

[0237] Fig.14 A schematic diagram of a message processing device 1400 provided in an embodiment of the present application is shown as follows: Fig.14 As shown, the device 1400 includes:

[0238] The transceiver module 1410 is configured to receive first synchronization data, wherein the first synchronization data includes: the number of target first hash values ​​in a current synchronization period;

[0239] The processing module 1420 is used to:

[0240] Calculate the number of target first hash values ​​in the current synchronization period and the sum of the first number of target first hash values ​​in the current statistical period to obtain a second number of target first hash values ​​in the current statistical period;

[0241] Based on a second number of the target first hash value in the current statistical period, multiple protection nodes are triggered to perform speed limit processing on the speed limit request message.

[0242] In some implementations, the transceiver module 1410 is used to send second synchronization data to the target protection node, wherein the second synchronization data includes: a second number of the target first hash value in the current statistical period.

[0243] In some implementations, the transceiver module 1410 is used to receive a second speed limit indication; the processing module 1420 is used to: generate a first speed limit indication based on the second speed limit indication; the transceiver module 1410 is used to send the first speed limit indication to other protection nodes.

[0244] In some possible implementations, the first synchronization data also includes: a fourth number of target first hash values ​​in the current statistical period; the processing module 1420 is specifically used to: if the fourth number of target first hash values ​​in the current statistical period is less than or equal to the speed limit threshold, then calculate the number of target first hash values ​​in the current synchronization period, and the sum of the first number of target first hash values ​​in the current statistical period, to obtain the second number of target first hash values ​​in the current statistical period.

[0245] In some implementations, the transceiver module 1410 is also used to send third synchronization data to other protection nodes if the fourth number of the target first hash value in the current statistical period is greater than the speed limit threshold, wherein the third synchronization data includes: the fourth number of the target first hash value in the current statistical period.

[0246] In some implementations, the first synchronization data also includes at least one of the following: a statistical period and a speed limit threshold; the processing module 1420 is also used to: if it is determined that the speed limit policy has changed based on at least one of the statistical period and the speed limit threshold, then the number counter of the target first hash value in the current statistical period is cleared.

[0247] In some implementations, the first synchronization data also includes: the start time of the current statistical period; the processing module 1420 is also used to: if it is determined based on the start time of the current statistical period that the current synchronization period exceeds the range of the current statistical period, then the number counter of the target first hash value in the current statistical period is cleared.

[0248] In some implementations, the first synchronization data further includes: a second hash value of the request message corresponding to the target first hash value.

[0249] It should be understood that the device embodiment and the method embodiment may correspond to each other, and similar descriptions may refer to the method embodiment. To avoid repetition, they will not be described here. Specifically, Fig.14 The device 1400 shown can execute the method embodiment corresponding to the central control node, and the aforementioned and other operations and / or functions of each module in the device 1400 are respectively for implementing the corresponding processes in each method corresponding to the central control node. For the sake of brevity, they will not be repeated here.

[0250] The above describes the device 1400 of the embodiment of the present application from the perspective of the functional module in conjunction with the accompanying drawings. It should be understood that the functional module can be implemented in hardware form, can be implemented by instructions in software form, and can also be implemented by a combination of hardware and software modules. Specifically, the steps of the method embodiment in the embodiment of the present application can be completed by the hardware integrated logic circuit and / or software form instructions in the processor, and the steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or a combination of hardware and software modules in the decoding processor to perform. Optionally, the software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory, and completes the steps in the above method embodiment in conjunction with its hardware.

[0251] Fig.15 A schematic diagram of a message processing device 1500 provided in an embodiment of the present application is shown as follows: Fig.15 As shown, the device 1500 includes:

[0252] The transceiver module 1510 is configured to receive a first speed limit indication;

[0253] The processing module 1520 is configured to use the request message corresponding to the target first hash value as a request message to be speed limited based on the first speed limit indication, and perform speed limit processing on the request message to be speed limited.

[0254] In some implementations, the processing module 1520 is specifically configured to: use the request message corresponding to the target first hash value received by other protection nodes in the current statistical period and the current speed limit processing period as the request message to be speed limited.

[0255] In some implementations, the transceiver module 1510 is further used to receive a third speed limit indication; the processing module 1520 is further used to treat the request message corresponding to the target first hash value as a request message to be speed limited based on the third speed limit indication, and perform speed limit processing on the request message to be speed limited.

[0256] In some possible implementations, the transceiver module 1510 is also used to receive third synchronization data, wherein the third synchronization data includes: the fourth number of the target first hash value in the current statistical period; the transceiver module 1510 is also used to: if the fourth number of the target first hash value in the current statistical period is greater than the speed limit threshold, stop synchronizing data to the central control node.

[0257] It should be understood that the device embodiment and the method embodiment may correspond to each other, and similar descriptions may refer to the method embodiment. To avoid repetition, they will not be described here. Specifically, Fig.15The device 1500 shown can execute method embodiments corresponding to other protection nodes, and the aforementioned and other operations and / or functions of each module in the device 1500 are respectively for implementing the corresponding processes in each method corresponding to other protection nodes. For the sake of brevity, they will not be repeated here.

[0258] The above describes the device 1500 of the embodiment of the present application from the perspective of the functional module in conjunction with the accompanying drawings. It should be understood that the functional module can be implemented in hardware form, can be implemented by instructions in software form, and can also be implemented by a combination of hardware and software modules. Specifically, the steps of the method embodiment in the embodiment of the present application can be completed by the hardware integrated logic circuit and / or software form instructions in the processor, and the steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or a combination of hardware and software modules in the decoding processor to perform. Optionally, the software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory, and completes the steps in the above method embodiment in conjunction with its hardware.

[0259] Fig.16 1 is a schematic block diagram of an electronic device 1600 provided in an embodiment of the present application. The electronic device 1600 may be the target protection node, central control node or other protection node, but is not limited thereto. Fig.16 As shown, the electronic device 1600 may include:

[0260] The memory 1610 and the processor 1620, the memory 1610 is used to store the computer program 1630 and transmit the computer program 1630 to the processor 1620. In other words, the processor 1620 can call and run the computer program 1630 from the memory 1610 to implement the method in the embodiment of the present application.

[0261] For example, the processor 1620 may be configured to execute the steps in the above method according to the instructions in the computer program 1630 .

[0262] In some embodiments of the present application, the processor 1620 may include but is not limited to:

[0263] General-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc.

[0264] In some embodiments of the present application, the memory 1610 includes but is not limited to:

[0265] Volatile memory and / or non-volatile memory. Among them, the non-volatile memory can be read-only memory (ROM), programmable ROM (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM) or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus random access memory (DR RAM).

[0266] In some embodiments of the present application, the computer program 1630 may be divided into one or more modules, which are stored in the memory 1610 and executed by the processor 1620 to complete the method provided by the present application. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program 1630 in the electronic device.

[0267] like Fig.16 As shown, the electronic device 1600 may further include:

[0268] The transceiver 1640 may be connected to the processor 1620 or the memory 1610 .

[0269] The processor 1620 may control the transceiver 1640 to communicate with other devices, specifically, to send information or data to other devices, or to receive information or data sent by other devices. The transceiver 1640 may include a transmitter and a receiver. The transceiver 1640 may further include an antenna, and the number of antennas may be one or more.

[0270] It should be understood that the various components in the electronic device 1600 are connected via a bus system, wherein the bus system includes not only a data bus but also a power bus, a control bus and a status signal bus.

[0271] According to one aspect of the present application, a computer storage medium is provided, on which a computer program is stored, and when the computer program is executed by a computer, the computer can perform the method of the above method embodiment. In other words, the present application embodiment also provides a computer program product containing instructions, and when the instructions are executed by a computer, the computer can perform the method of the above method embodiment.

[0272] According to another aspect of the present application, a computer program product or computer program is provided, the computer program product or computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method of the above method embodiment.

[0273] In other words, when implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a server, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server, or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disc (digital video disc, DVD)), or a semiconductor medium (e.g., a solid state drive (solid state disk, SSD)), etc.

[0274] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0275] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the module is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0276] The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to implement the scheme of this embodiment. For example, each functional module in each embodiment of the present application may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0277] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A message processing method, characterized in that: The method is applied to a security protection system, which includes: a central control node and multiple protection nodes; the method includes: For each request message received by the target protection node in a current synchronization period between the target protection node among the multiple protection nodes and the central control node, the target protection node calculates a first hash value of the request message; The target protection node counts the number of target first hash values ​​in the multiple first hash values ​​within the current synchronization period, and sends first synchronization data to the central control node, wherein the first synchronization data includes: the number of the target first hash values ​​within the current synchronization period; The central control node calculates the number of the target first hash value in the current synchronization period, and the sum of the first number of the target first hash value in the current statistical period, to obtain the second number of the target first hash value in the current statistical period; The central control node triggers the multiple protection nodes to perform speed limit processing on the speed limit request message based on the second number of the target first hash value in the current statistical period.

2. The method according to claim 1, characterized in that The central control node triggers the plurality of protection nodes to perform speed limiting processing on the speed limit request message based on a second number of the target first hash value in the current statistical period, including: The central control node sends second synchronization data to the target protection node, wherein the second synchronization data includes: a second number of the target first hash value in a current statistical period; If the second number of the target first hash value in the current statistical period is greater than the speed limit threshold, the target protection node uses the request message corresponding to the target first hash value as a request message to be speed limited, and performs speed limit processing on the request message to be speed limited; The target protection node sends a first speed limit instruction to other protection nodes through the central control node; The other protection nodes use the request message corresponding to the target first hash value as a request message to be speed limited based on the first speed limit indication, and perform speed limit processing on the request message to be speed limited.

3. The method according to claim 2, characterized in that The target protection node uses the request message corresponding to the target first hash value as a request message to be speed-limited, including: The target protection node uses the request message corresponding to the target first hash value received by the target protection node during the current statistical period and the current speed limit processing period as a request message to be speed limited.

4. The method according to claim 2, characterized in that: The other protection node uses the request message corresponding to the target first hash value as a request message to be limited in speed based on the first speed limit indication, including: The other protection nodes use the request messages corresponding to the target first hash value received by the other protection nodes in the current statistical period and the current speed limit processing period as request messages to be speed limited.

5. The method according to claim 2, characterized in that: The target protection node sends a first speed limit instruction to other protection nodes through the central control node, including: The target protection node sends a second speed limit instruction to the central control node; The central control node generates the first speed limit indication based on the second speed limit indication; The central control node sends the first speed limit instruction to the other protection nodes.

6. The method according to any one of claims 1 to 5, characterized in that: The central control node calculates the number of the target first hash values ​​in the current synchronization period and the sum of the first number of the target first hash values ​​in the current statistical period to obtain the second number of the target first hash values ​​in the current statistical period, and also includes: The target protection node calculates the number of the target first Hash value in the current synchronization period, and the sum of the third number of the target first Hash value in the current statistical period, to obtain the fourth number of the target first Hash value in the current statistical period, wherein the first synchronization data also includes: the fourth number of the target first Hash value in the current statistical period; The central control node calculates the number of the target first hash value in the current synchronization period and the sum of the first number of the target first hash value in the current statistical period to obtain the second number of the target first hash value in the current statistical period, including: If the fourth number of the target first hash value in the current statistical period is less than or equal to the speed limit threshold, the central control node calculates the number of the target first hash value in the current synchronization period, and the sum of the first number of the target first hash value in the current statistical period, to obtain the second number of the target first hash value in the current statistical period.

7. The method according to claim 6, characterized in that Also includes: If the fourth number of the target first hash value in the current statistical period is greater than the speed limit threshold, the target protection node uses the request message corresponding to the target first hash value as a request message to be speed limited, and performs speed limit processing on the request message to be speed limited; The target protection node sends a third speed limit instruction to other protection nodes through the central control node; The other protection nodes use the request message corresponding to the target first hash value as a request message to be speed limited based on the third speed limit indication, and perform speed limit processing on the request message to be speed limited.

8. The method according to claim 7, characterized in that Also includes: If the fourth number of the target first hash value in the current statistical period is greater than the speed limit threshold, the central control node sends third synchronization data to the other protection nodes, wherein the third synchronization data includes: the fourth number of the target first hash value in the current statistical period; If the fourth number of the target first hash value in the current statistical period is greater than the speed limit threshold, the other protection nodes stop synchronizing data to the central control node.

9. The method according to any one of claims 1 to 5, characterized in that: Also includes: If the target protection node determines that the number of the target first hash values ​​in the current statistical period and the next statistical period is greater than the speed limit threshold, the target protection node extends the speed limit processing period for the request message corresponding to the target first hash value.

10. The method according to any one of claims 1 to 5, characterized in that: The first synchronization data further includes at least one of the following: a statistical period and a speed limit threshold; the method further includes: If the central control node determines that the speed limit policy has changed based on at least one of the statistical period and the speed limit threshold, the central control node clears the number counter of the target first hash value in the current statistical period.

11. The method according to claim 10, characterized in that The first synchronization data also includes: the start time of the current statistical period; the method also includes: If the central control node determines that the current synchronization period exceeds the range of the current statistical period based on the start time of the current statistical period, the central control node clears the number counter of the target first hash value in the current statistical period.

12. The method according to any one of claims 1 to 5, characterized in that: The first synchronization data also includes: a second hash value of the request message corresponding to the target first hash value.

13. The method according to any one of claims 1 to 5, characterized in that: The security protection system includes a plurality of central control nodes; for each request message received by the target protection node in the current synchronization period between the target protection node and the central control node among the plurality of protection nodes, before the target protection node calculates the first hash value of the request message, the system further includes: The target protection node selects a central control node from the multiple central control nodes using a consistent hashing algorithm.

14. The method according to any one of claims 1 to 5, characterized in that: The target protection node calculates a first hash value of each request message received by the target protection node in a current synchronization period between the target protection node and the central control node among the multiple protection nodes, including: For each request message received by the target protection node in the current synchronization period, the target protection node matches the request message with the validity condition of the rate limit policy; If the request message matches the validation condition, the target protection node calculates a first hash value of the request message.

15. A message processing method, characterized in that: The method is applied to a target protection node, and the method comprises: For each request message received by the target protection node in a current synchronization period between the target protection node and the central control node, calculate a first hash value of the request message; Counting the number of target first hash values ​​in the multiple first hash values ​​within the current synchronization cycle, and sending first synchronization data to the central control node, wherein the first synchronization data includes: the number of the target first hash values ​​within the current synchronization cycle.

16. A message processing method, characterized in that: The method is applied to a central control node, and the method includes: Receive first synchronization data, wherein the first synchronization data includes: the number of target first hash values ​​in a current synchronization cycle; Calculate the number of the target first Hash value in the current synchronization period and the sum of the first number of the target first Hash value in the current statistical period to obtain the second number of the target first Hash value in the current statistical period; Based on a second number of the target first hash values ​​in the current statistical period, multiple protection nodes are triggered to perform speed limit processing on the speed limit request message.

17. A safety protection system, characterized in that: include: Central control node and multiple protection nodes; The target protection node among the multiple protection nodes is used for: For each request message received by the target protection node during a current synchronization period between the target protection node and the central control node, calculating a first hash value of the request message; Counting the number of target first hash values ​​in the current synchronization period among the multiple first hash values, and sending first synchronization data to the central control node, wherein the first synchronization data includes: the number of the target first hash values ​​in the current synchronization period; The central control node is used for: Calculate the number of the target first Hash value in the current synchronization period and the sum of the first number of the target first Hash value in the current statistical period to obtain the second number of the target first Hash value in the current statistical period; Based on a second number of the target first hash values ​​in the current statistical period, the multiple protection nodes are triggered to perform speed limit processing on the speed limit request message.

18. An electronic device, characterized in that: include: A processor and a memory, the memory being used to store a computer program, and the processor being used to call and run the computer program stored in the memory to execute the method of claim 15 or 16.

19. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein the computer program causes a computer to execute the method according to claim 15 or 16.

20. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method according to claim 15 or 16 is implemented.

Images