Network defense method and device, equipment, storage medium and computer program product

Abstract

The invention relates to the technical field of network security, and discloses a network defense method, device and equipment, a storage medium and a computer program product.The method comprises the steps that whether malicious oscillation exists or not is judged according to at least one of route change information of a border gateway protocol, a time window threshold value and a route updating frequency threshold value; and analyzing the current traffic characteristics through an attack detection model, judging whether an attack behavior of distributed denial of service exists, limiting the speed of the current network traffic according to the malicious oscillation characteristics, and guiding the attack traffic of the attack behavior to a black hole address based on the extracted attack characteristics. According to the application, malicious oscillation and attack behaviors are monitored and identified in real time, when malicious oscillation is detected, the speed of the current network flow is limited according to the characteristics of the malicious oscillation, for the attack behaviors, the attack flow is guided to the black hole address based on the extracted attack characteristics, the attack source is quickly blocked, and a dual detection and response mechanism is adopted. And the timeliness and effectiveness of network defense are improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular, to a network defense method, apparatus, device, storage medium, and computer program product. Background Art

[0002] In the current field of switch network security technology, especially in the aspect of defending against Border Gateway Protocol (BGP) oscillations and Distributed Denial of Service (DDoS) attacks, the defense technologies adopted usually rely on manual configuration or static rules, and the response speed is slow when encountering network attacks, which cannot meet the real-time requirements. Summary of the Invention

[0003] The main purpose of this application is to provide a network defense method, aiming to solve the technical problem of untimely defense response in the prior art.

[0004] To achieve the above object, this application proposes a network defense method, and the method includes:

[0005] Judging whether there is malicious oscillation in the routing network according to at least one of the routing change information of the Border Gateway Protocol, the time window threshold, and the routing update frequency threshold;

[0006] Analyzing the current traffic characteristics through an attack detection model to judge whether there is a Distributed Denial of Service attack behavior in the routing network;

[0007] In response to the malicious oscillation, rate-limit the current network traffic according to the malicious oscillation characteristics;

[0008] And / or, in response to the attack behavior, direct the attack traffic of the attack behavior to a black hole address based on the extracted attack characteristics.

[0009] In an embodiment, the step of rate-limiting the current network traffic according to the malicious oscillation characteristics in response to the malicious oscillation includes:

[0010] In response to the malicious oscillation, determine a rate-limiting event according to the malicious oscillation characteristics of the malicious oscillation, and initialize a protocol family and a callback function based on the rate-limiting event;

[0011] Construct a secure communication channel between the user space and the kernel space through a lock-free queue algorithm;

[0012] Based on the protocol family and the secure communication channel, create a memory mapping shared area by sharing the rate-limiting event between the user space and the kernel space;

[0013] In the memory - mapped shared area, generate a corresponding traffic - limiting instruction according to the malicious oscillation feature;

[0014] When limiting the current network traffic according to the traffic - limiting instruction, adjust the traffic - limiting instruction by triggering the callback function until the routing network state returns to normal.

[0015] In one embodiment, the step of constructing a secure communication channel between the user space and the kernel space through the lock - free queue algorithm includes:

[0016] According to the communication requirements of the protocol family, initialize the communication interface between the user space and the kernel space through the lock - free queue algorithm to obtain a lock - free communication framework;

[0017] Based on the lock - free communication framework, manage the transmission process of the traffic - limiting event by using atomic operation instructions and a double - buffer switching strategy to obtain a secure communication channel between the user space and the kernel space, where the atomic operation instructions synchronously update the read - write pointers of the traffic - limiting event, and the double - buffer switching strategy switches the data storage area when detecting buffer overflow.

[0018] In one embodiment, the step of guiding the attack traffic of the attack behavior to a black - hole address based on the extracted attack features in response to the attack behavior includes:

[0019] In response to the attack behavior, determine the black - hole routing parameters according to the extracted attack features, and encapsulate the black - hole routing parameters into a black - hole routing policy;

[0020] Based on the black - hole routing policy, form a traffic - discarding rule by registering a black - hole routing entry of the target address in the routing table;

[0021] According to the traffic - discarding rule, establish a mapping relationship table between the attack features and the black - hole address in the memory - mapped shared area to generate a real - time traffic filtering policy;

[0022] Guide the attack traffic of the attack behavior to the black - hole address through the real - time traffic filtering policy.

[0023] In one embodiment, the step of determining whether there is malicious oscillation in the routing network according to at least one of the routing change information of the Border Gateway Protocol, the time - window threshold, and the routing update frequency threshold includes:

[0024] Collect the routing change information of the Border Gateway Protocol in real - time;

[0025] Statistically count the cumulative number of routing updates within the time window in the routing change information. When the cumulative number of updates exceeds the time - window threshold, determine that there is malicious oscillation in the routing network;

[0026] Determine the actual frequency of routing updates within a unit time. When the actual frequency continuously exceeds the frequency threshold, it is determined that there is malicious oscillation in the routing network;

[0027] Analyze the distribution law of the Internet protocol address segments of routing changes. When periodic out-of-range routing changes are detected through the distribution law, it is determined that there is malicious oscillation in the routing network.

[0028] In one embodiment, the step of analyzing the current traffic characteristics through an attack detection model to determine whether there is a distributed denial-of-service attack behavior in the routing network includes:

[0029] Obtain network traffic in real time, and extract the current traffic characteristics from the network traffic, where the current traffic characteristics include at least one of the synchronous sequence number request frequency, source address distribution entropy value, and traffic peak deviation degree;

[0030] Map the current traffic characteristics to a quantum state through a quantum encoding circuit to obtain quantum entanglement characteristics;

[0031] Concatenate the quantum entanglement characteristics with the current traffic characteristics to generate a hybrid characteristic;

[0032] Input the hybrid characteristic into an attack detection model pre-trained based on a neural ordinary differential equation network, and output an attack probability score by solving the neural ordinary differential equation within a preset time window;

[0033] When the attack probability score exceeds the score threshold, it is determined that there is a distributed denial-of-service attack behavior in the routing network, where the score threshold is updated according to the Hurst exponent of the network traffic.

[0034] In addition, to achieve the above object, the present application also proposes a network defense device, and the network defense device includes:

[0035] An oscillation detection module, configured to determine whether there is malicious oscillation in the routing network according to at least one of the routing change information of the Border Gateway Protocol, the time window threshold, and the routing update frequency threshold;

[0036] An attack detection module, configured to analyze the current traffic characteristics through an attack detection model to determine whether there is a distributed denial-of-service attack behavior in the routing network;

[0037] A traffic speed limiting module, configured to respond to the malicious oscillation and limit the current network traffic according to the malicious oscillation characteristics;

[0038] And / or, a black hole routing module, configured to respond to the attack behavior and direct the attack traffic of the attack behavior to a black hole address based on the extracted attack characteristics.

[0039] In addition, to achieve the above object, the present application further provides a network defense device, which includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the network defense method as described above.

[0040] In addition, to achieve the above object, the present application further provides a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium, and when the computer program is executed by a processor, it implements the steps of the network defense method as described above.

[0041] In addition, to achieve the above object, the present application further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the network defense method as described above.

[0042] The technical solution proposed by the present application determines whether there is malicious oscillation in the routing network according to at least one of the routing change information of the Border Gateway Protocol, the time window threshold, and the routing update frequency threshold, analyzes the current traffic characteristics through an attack detection model to determine whether there is a distributed denial of service attack behavior in the routing network, in response to malicious oscillation, limits the speed of the current network traffic according to the malicious oscillation characteristics, and / or, in response to the attack behavior, guides the attack traffic of the attack behavior to a black hole address based on the extracted attack characteristics. The present application identifies malicious oscillation and attack behavior through real-time monitoring. When malicious oscillation is detected, it limits the speed of the current network traffic according to its characteristics. For attack behavior, it guides the attack traffic to a black hole address based on the extracted attack characteristics, quickly blocks the attack source, and the dual detection and response mechanism improves the timeliness and effectiveness of network defense. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The drawings here are incorporated into the specification and form a part of the specification, showing embodiments consistent with the present application, and are used together with the specification to explain the principles of the present application.

[0044] To more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, for those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0045] Figure 1 It is a schematic flowchart provided for Embodiment 1 of the network defense method of the present application;

[0046] Figure 2Schematic flowchart provided for the second embodiment of the network defense method of this application;

[0047] Figure 3 Schematic flowchart provided for the third embodiment of the network defense method of this application;

[0048] Figure 4 Schematic diagram of the module structure of the network defense method of this application;

[0049] Figure 5 Schematic diagram of the module structure of the network defense device for the embodiment of this application;

[0050] Figure 6 Schematic diagram of the device structure of the hardware operating environment involved in the network defense method for the embodiment of this application.

[0051] The realization of the purpose, functional features and advantages of this application will be further described with reference to the embodiments and the accompanying drawings. Detailed implementation manners

[0052] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of this application and are not used to limit this application.

[0053] To better understand the technical solutions of this application, the following will be described in detail in conjunction with the drawings of the specification and specific implementation manners.

[0054] In the current field of switch network security technology, especially in terms of BGP oscillation and DDoS attacks, the defense technologies adopted usually rely on manual configuration or static rules, and the response speed is slow when encountering network attacks, unable to meet the real-time requirements.

[0055] Therefore, to overcome the above defects, this application provides a solution. By real-time monitoring and identifying malicious oscillation and attack behaviors, when malicious oscillation is detected, the current network traffic is rate-limited according to its characteristics. For attack behaviors, the attack traffic is guided to the black hole address based on the extracted attack characteristics, quickly blocking the attack source. The dual detection and response mechanism improves the timeliness and effectiveness of network defense.

[0056] It should be noted that the execution subject of each embodiment of this application can be a computing service system with data processing, network communication, and program running functions, such as an electronic system or a network defense system that can implement the above functions. The following takes the network defense system as an example (hereinafter referred to as "system") to illustrate the following embodiments.

[0057] Based on this, the embodiments of this application provide a network defense method, referring to Figure 1 , Figure 1 Schematic flowchart of the first embodiment of the network defense method of this application.

[0058] In this embodiment, the network defense method includes steps S10 to S40:

[0059] Step S10: Determine whether there is malicious oscillation in the routing network according to at least one of the routing change information of the Border Gateway Protocol, the time window threshold, and the routing update frequency threshold.

[0060] In the current field of Linux (operating system kernel) switch network security, especially in defending against BGP oscillation and DDoS attacks, the defense technologies adopted mainly rely on traditional routing protocols and traffic control means. These methods usually rely on manual configuration or static rules, and have a slow response speed when encountering network attacks, unable to meet the real-time requirements. In addition, when defending against BGP oscillation in the prior art, manual intervention is often required, and a fast and automated response cannot be achieved. The protection against DDoS attacks generally also relies on traffic monitoring and rule protection, but for dynamic and asynchronous attack traffic, the response speed is often slow, resulting in the attack behavior not being curbed in time.

[0061] This application realizes the function of self-repair by extending the Linux kernel network module based on the Generic Netlink protocol. When the network defense system of the switch platform detects the characteristics of BGP oscillation or DDoS attack, it can quickly trigger the kernel to quickly issue a black hole route or a rate limit policy, thereby forming an efficient, automated, and real-time defense closed-loop. Asynchronous communication between network devices is achieved through the Generic Netlink protocol, ensuring that the attack response time does not exceed 100 ms, thus greatly improving the real-time performance and accuracy of network defense.

[0062] First of all, it should be understood that it is possible to determine whether there is malicious oscillation in the routing network by monitoring at least one of the routing change information of BGP, the set time window threshold, and the routing update frequency threshold. Specifically, the system collects the update information of the BGP route in real time, records the time and content of each route update, and within the set time window, counts the number of route updates. If the update frequency exceeds the preset threshold, or the amplitude of the route change is too large in a short time, it is determined as malicious oscillation.

[0063] As an implementation manner, in this embodiment, the above step S10 may include: collecting the routing change information of the Border Gateway Protocol (BGP) in real time; counting the cumulative number of route updates within a time window in the routing change information, and determining that there is malicious oscillation in the routing network when the cumulative number of updates exceeds the time window threshold; determining the actual frequency of route updates per unit time, and determining that there is malicious oscillation in the routing network when the actual frequency continuously exceeds the frequency threshold; analyzing the distribution law of the Internet Protocol (IP) address segments of route changes, and determining that there is malicious oscillation in the routing network when periodic out-of-range route changes are detected through the distribution law.

[0064] In specific implementation, by continuously monitoring the update situation of BGP routes, the system can timely obtain the routing change information in the network. Within a set time window, count the number of route updates. If the update frequency exceeds the preset threshold, it is determined as malicious oscillation; by calculating the actual frequency of route updates per unit time, if this frequency continuously exceeds the preset frequency threshold, it is determined as malicious oscillation; by analyzing the distribution law of the Internet Protocol (IP) address segments of route changes, if periodic out-of-range route changes are detected, it is determined as malicious oscillation.

[0065] Step S20, analyze the current traffic characteristics through an attack detection model to determine whether there is a Distributed Denial of Service (DDoS) attack behavior in the routing network.

[0066] It should be understood that the current traffic characteristics are analyzed through an attack detection model to determine whether there is a DDoS attack behavior in the routing network. The attack detection model obtains the network traffic in real time and extracts the current traffic characteristics from it. These characteristics include the request frequency of the synchronization sequence number, the entropy value of the source address distribution, and the deviation degree of the traffic peak, etc. Through the comprehensive analysis of these characteristics, the model can identify abnormal traffic that is significantly different from the normal network traffic pattern, so as to determine whether there is a DDoS attack.

[0067] Step S30, in response to the malicious oscillation, limit the speed of the current network traffic according to the malicious oscillation characteristics.

[0068] After detecting the malicious oscillation, the system determines reasonable speed limit parameters, such as the speed limit value and the duration, according to the specific characteristics of the oscillation, such as the size of the attack traffic and the source IP distribution, etc., and generates a speed limit event accordingly.

[0069] Step S40, and / or, in response to the attack behavior, direct the attack traffic of the attack behavior to a black hole address based on the extracted attack characteristics.

[0070] After detecting a DDoS attack, the system determines the black hole routing parameters according to the attack characteristics, encapsulates these parameters into a black hole routing policy, and forms a traffic discard rule by registering a black hole routing entry for the target address in the routing table, so as to direct the attack traffic to an invalid path and block the network access of the attack source address segment. This process utilizes the flexibility of the network routing mechanism, can quickly isolate the attack traffic, and protect network resources from being affected by the attack.

[0071] In this embodiment, malicious oscillations and attack behaviors are identified through real-time monitoring. When a malicious oscillation is detected, the current network traffic is rate-limited according to its characteristics. For attack behaviors, the attack traffic is directed to a black hole address based on the extracted attack characteristics, quickly blocking the attack source. The dual detection and response mechanism improves the timeliness and effectiveness of network defense. Moreover, the multi-dimensional detection method can accurately identify malicious oscillations, avoiding misjudgment and missed judgment.

[0072] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar content as in the above-mentioned embodiment one can be referred to the above introduction and will not be repeated hereinafter. On this basis, referring to Figure 2 , step S30 may include steps S301 to S305:

[0073] Step S301, in response to the malicious oscillation, determine a rate-limiting event according to the malicious oscillation characteristics of the malicious oscillation, and initialize a protocol family and callback functions based on the rate-limiting event.

[0074] In specific implementation, the system determines the detailed parameters of the rate-limiting event, including the rate-limiting value, duration, etc., according to the specific characteristics of the malicious oscillation, such as the size of the attack traffic, the source IP distribution, etc. Based on these parameters, a new protocol family is initialized and a unique identifier is generated for it to ensure its uniqueness in the system. At the same time, a series of private callback functions are registered. The role of these callback functions is to dynamically adjust the rate-limiting instructions according to the changes in the network state in subsequent steps.

[0075] Step S302, construct a secure communication channel between the user mode and the kernel mode through a lock-free queue algorithm.

[0076] It should be noted that the lock-free queue algorithm is an efficient concurrent processing technology, which can ensure the thread safety of data access in a multi-core environment and avoid the performance bottleneck brought by the traditional lock mechanism. Through this algorithm, the system can establish a secure and efficient communication channel between the user mode and the kernel mode to ensure the rapid transmission of rate-limiting event data.

[0077] As an implementation, in this embodiment, step S302 may include: initializing the communication interface between the user space and the kernel space according to the communication requirements of the protocol family through a lock-free queue algorithm to obtain a lock-free communication framework; based on the lock-free communication framework, managing the transmission process of the speed limit event by using atomic operation instructions and a double-buffer switching strategy to obtain a secure communication channel between the user space and the kernel space, wherein the atomic operation instructions synchronously update the read and write pointers of the speed limit event, and the double-buffer switching strategy switches the data storage area when detecting a buffer overflow.

[0078] It should be understood that, according to the communication requirements of the protocol family, initializing the communication interface between the user space and the kernel space through a lock-free queue algorithm, the lock-free queue algorithm ensures thread safety of data access in a multi-core environment through a spin lock or a read-write update mechanism, avoiding the performance bottleneck brought by the traditional lock mechanism. This process involves the innovative application of concurrent processing technology and can significantly improve the performance and response speed of the system.

[0079] Furthermore, based on the lock-free communication framework, the atomic operation instructions synchronously update the read and write pointers of the speed limit event, avoiding data competition and race conditions, while the double-buffer switching strategy effectively prevents data loss caused by buffer overflow, further enhancing the stability and reliability of the system.

[0080] Step S303, based on the protocol family and the secure communication channel, create a memory-mapped shared area by sharing the speed limit event between the user space and the kernel space.

[0081] It should be noted that the memory-mapped shared area is an efficient memory management technology that allows the user space and the kernel space to directly access the same memory space, thus avoiding the overhead of data copying between the two and improving the efficiency of data transmission. Through this technology, the system can store the speed limit event data in the shared area to ensure that it can be correctly processed by the protocol family.

[0082] Step S304, in the memory-mapped shared area, generate corresponding speed limit instructions according to the malicious oscillation characteristics.

[0083] In the memory-mapped shared area, specific speed limit instructions are generated according to the specific characteristics of malicious oscillation. These speed limit instructions define in detail how to limit the current network traffic to mitigate the impact of malicious oscillation on the network.

[0084] Step S305, when limiting the current network traffic according to the speed limit instructions, adjust the speed limit instructions by triggering the callback function until the routing network state returns to normal.

[0085] When throttling the current network traffic according to the throttling instruction, the throttling instruction is adjusted by triggering a callback function until the routing network status returns to normal. The system monitors the network status in real time. If the network status changes, the callback function is triggered to dynamically adjust the throttling instruction to ensure the stability and security of the network.

[0086] In this embodiment, a secure communication channel between the user space and the kernel space is constructed through a lock-free queue algorithm, avoiding the thread safety problem in the traditional communication method. Based on the protocol family and the secure communication channel, a memory-mapped shared area is created to achieve the secure transmission and processing of throttling events. By dynamically adjusting the throttling instruction through a callback function, the throttling policy can be optimized in real time according to the network status until the network returns to normal, effectively improving the adaptive ability and stability of the network and reducing the impact of malicious oscillations on network performance. Moreover, the communication efficiency is improved through the lock-free queue algorithm, and the system resource consumption is reduced. The transmission process of throttling events is managed by using atomic operation instructions and a double-buffer switching strategy to ensure the consistency and reliability of data transmission.

[0087] As an implementation manner, the step S40 may include: in response to the attack behavior, determining black hole routing parameters according to the extracted attack features, and encapsulating the black hole routing parameters into a black hole routing policy; based on the black hole routing policy, forming a traffic discard rule by registering a black hole routing entry of the target address in the routing table; according to the traffic discard rule, establishing a mapping relationship table between the attack feature and the black hole address in the memory-mapped shared area to generate a real-time traffic filtering policy; and guiding the attack traffic of the attack behavior to the black hole address through the real-time traffic filtering policy.

[0088] It should be understood that in response to the attack behavior, the black hole routing parameters are determined according to the extracted attack features, and the black hole routing parameters are encapsulated into a black hole routing policy. Specifically, the system determines the specific parameters of the black hole routing according to the attack features, such as the attack source IP, the attack target IP, etc., including the target address, the black hole address, etc., and encapsulates these parameters into a black hole routing policy.

[0089] Then, based on the black hole routing policy, a traffic discard rule is formed by registering a black hole routing entry of the target address in the routing table. The system writes the parameters in the black hole routing policy into the kernel routing table and adds a routing entry pointing to the black hole address to ensure that the attack traffic is guided to an invalid path. In the memory-mapped shared area, the system establishes a mapping relationship table between the attack feature and the black hole address according to the traffic discard rule to generate a real-time traffic filtering policy, and then guides the attack traffic to the black hole address to ensure that the attack traffic is isolated and the normal network traffic is not affected.

[0090] When responding to an attack behavior in this embodiment, black hole routing parameters are determined according to the extracted attack features and encapsulated into a black hole routing policy. By registering a black hole routing entry for the target address in the routing table, a traffic discard rule is formed, and a mapping relationship table between the attack feature and the black hole address is established in the memory mapping shared area to generate a real-time traffic filtering policy. According to this policy, the attack traffic is guided to the black hole address, which can not only quickly block the network access of the attack source address segment and reduce the impact of the attack on the network, but also ensure that normal traffic is not affected, effectively maintaining the stable operation of the network.

[0091] Based on the first embodiment of the present application, in the third embodiment of the present application, the same or similar content as that in the above-mentioned first embodiment can be referred to the above introduction and will not be repeated hereinafter. On this basis, please refer to Figure 3 , the step S20 may include steps S201 to S205:

[0092] Step S201, obtain network traffic in real time, and extract the current traffic features from the network traffic, where the current traffic features include at least one of the synchronization sequence number request frequency, the source address distribution entropy value, and the traffic peak deviation degree.

[0093] It should be understood that the current traffic features of network traffic include but are not limited to the synchronization sequence number request frequency, the source address distribution entropy value, and the traffic peak deviation degree, etc. Specifically, the system continuously captures data packets in the network through a network traffic monitoring module and analyzes these data packets to extract key traffic features. For example, the synchronization sequence number request frequency reflects the sending frequency of SYN packets in the network, the source address distribution entropy value measures the diversity of source IP addresses, and the traffic peak deviation degree represents the deviation of the current traffic from the normal traffic peak.

[0094] Step S202, map the current traffic features to a quantum state through a quantum encoding circuit to obtain quantum entanglement features.

[0095] It should be noted that the quantum encoding circuit uses the superposition and entanglement characteristics of quantum bits to transform traditional traffic features into quantum state representations. It can not only retain the information of the original features, but also introduce new dimensions through quantum entanglement to enhance the expression ability of the features. Quantum entanglement features can more comprehensively reflect the complexity and dynamics of network traffic.

[0096] Step S203, splice the quantum entanglement features and the current traffic features to generate a hybrid feature.

[0097] It should be understood that the quantum entanglement feature and the traditional traffic feature are fused in the data structure to form a hybrid feature vector containing quantum and classical information. This hybrid feature vector combines the high-dimensional characteristics of the quantum state and the intuitiveness of the traditional features, and can more comprehensively describe the anomalies of network traffic. Through this hybrid feature, the attack detection model can more accurately identify complex attack patterns and improve the accuracy and robustness of detection.

[0098] Step S204: Input the hybrid feature into the attack detection model pre-trained based on the neural ordinary differential equation network, and output the attack probability score by solving the neural ordinary differential equation within a preset time window.

[0099] It should be understood that the attack detection model pre-trained based on the neural ordinary differential equation network outputs the attack probability score by solving the neural ordinary differential equation within a preset time window. Among them, the neural ordinary differential equation network is a new type of deep learning architecture that can efficiently model and analyze time series data. By solving the neural ordinary differential equation within a preset time window, the model can capture the dynamic changes of network traffic and output an attack probability score, indicating the possibility of an attack behavior in the current traffic.

[0100] Step S205: When the attack probability score exceeds the score threshold, it is determined that there is a distributed denial-of-service attack behavior in the routing network, where the score threshold is updated according to the Hurst exponent of the network traffic.

[0101] Specifically, the system sets a score threshold. When the attack probability score exceeds this threshold, it is determined that there is a DDoS attack behavior in the network. To improve the adaptability and accuracy of detection, the score threshold is dynamically updated according to the Hurst exponent of the network traffic. The Hurst exponent is a statistical indicator that measures the long-term dependence of time series and can reflect the self-similarity and long-term memory of network traffic. By dynamically adjusting the score threshold according to the Hurst exponent, the system can better adapt to the attack detection requirements in different network environments.

[0102] It should be noted that in the network defense method of this application, a quantum convolutional layer is added in front of the neural ordinary differential equation network to perform multi-scale feature extraction on the quantum entanglement feature by using quantum parallelism; the fusion weight of the quantum entanglement feature and the traditional current traffic feature is also dynamically adjusted through the attention mechanism, for example, using the trace distance of the quantum state density matrix as the basis for the attention score; controllable phase noise is also injected in the quantum coding stage to simulate the interference of the attacker on the quantum feature, and the robustness of the model to quantum noise is trained. An auxiliary discriminator network is also added to measure the authenticity of the quantum feature distribution through the Wasserstein distance, and jointly optimize the attack detection loss and the adversarial loss.

[0103] In this embodiment, a quantum encoding circuit is used to map the current traffic characteristics to a quantum state, obtain quantum entanglement characteristics, and splice them with the current traffic characteristics to generate hybrid characteristics, which can more comprehensively reflect the abnormal situation of network traffic. The attack detection method based on quantum characteristics and a neural ordinary differential equation network can effectively identify complex DDoS attack behaviors and enhance the network's resistance to attacks.

[0104] For ease of understanding, reference is made to Figure 4 ( Figure 4 (which is a schematic diagram of the module structure of the network defense method of this application) for illustration, but it does not limit the network defense method of this application. The network defense method of this application consists of the following core modules:

[0105] (1) BGP oscillation detection module: This module monitors the changes in BGP routes to identify whether there is a BGP oscillation phenomenon in the network. When abnormal route fluctuations are detected, subsequent protection operations are automatically triggered. Set traffic speed limits through the kernel network layer (such as the tc command), and dynamically adjust the speed limit policy according to traffic characteristics (such as the source IP of attack traffic, packet size, etc.) to reduce the network burden.

[0106] Specifically, it also includes: defining a fixed time window (such as 30 seconds), counting the number of route updates within this time, and if the update frequency exceeds the time window threshold (such as more than 5 times per second), it is judged as an oscillation; setting a frequency threshold, if the amplitude of route changes is too large within a short period of time (such as the previous and subsequent changes of the route exceed a certain IP segment range), it can be judged as an oscillation; evaluating through the IP address changes between two consecutive route changes, and if periodic and large-scale changes are found, it is judged as a malicious attack.

[0107] (2) DDoS attack detection module: This module analyzes the characteristics of network traffic (such as traffic peak values, source IP distribution, etc.) to identify whether there is a DDoS attack. Based on traffic characteristic analysis (using data collection modules such as the existing telemetry (network telemetry module) of the switch), automatically judge the attack type and source, and further analyze whether it is necessary to trigger a protection strategy. Configure a virtual "black hole" route to direct attack traffic to an invalid path to avoid affecting normal traffic, usually by adding a route entry pointing to the "black hole" in the routing table.

[0108] Specifically, it also includes: determining whether it is a SYN Flood attack by monitoring a large number of Synchronize Sequence Numbers (SYN) packets within a short period of time (such as more than 1000 per second); DDoS attacks often come from a large number of different source IPs. Calculate the entropy value of the source IP. If the entropy value is high (such as greater than 0.9), it may be a characteristic of a DDoS attack; use existing traffic data to train an application network model, such as the size of network traffic, source IP distribution, type of data packets, etc. Use the trained attack detection model (or combined with algorithms such as K-Nearest Neighbor (KNN) classification algorithm, Support Vector Machine (SVM), etc.) to identify whether it is a DDoS attack, which can further improve the detection accuracy. After training with historical data, it can flexibly identify according to the characteristics of different types of attacks.

[0109] (3) Generic Netlink protocol communication module: Based on the Generic Netlink protocol (a protocol for defining new policy distribution, mainly establishing communication with the sw.ko (kernel module). Since it is all at the kernel level, data is transmitted using skbuff without replication, accelerating the data plane transmission), construct an efficient asynchronous communication mechanism. Network devices communicate in real time through the Generic Netlink protocol to ensure that the attack detection results can be quickly transmitted to the network devices and trigger corresponding defense strategies. This module has efficient event triggering capabilities and can complete policy distribution within 100 ms.

[0110] Exemplarily, the kernel module development structure for the key technology implementation of the Generic Netlink module is as follows:

[0111]

[0112] The detailed implementation of the Generic Netlink protocol communication module may include:

[0113] 1) Dynamic protocol family registration

[0114] Generic Netlink_ID_GENERATE is a tool for dynamically generating a protocol family ID when using the Generic Netlink protocol to avoid manual conflicts. When registering a protocol family, the system will use this macro to generate a unique protocol family ID.

[0115] In the specific implementation, when initializing the kernel module, Generic Netlink_register_family() is called to register the protocol family. The system automatically generates an identity document (ID) using Generic Netlink_ID_GENERATE to ensure that each protocol family in the system has a unique identifier. If a protocol family conflict occurs (i.e., the same ID has been used), the registration return value can be judged and an error prompt can be given, or an attempt can be made to generate a new ID.

[0116] In addition, a fault tolerance mechanism is introduced. That is, if the protocol family registration fails, a retry mechanism can be added, or an alternative protocol ID can be set for registration; callback registration is introduced. That is, some private callback functions are registered on this Generic Netlink protocol. Here, mainly the user needs to use operations such as black hole routing and rate limiting. When the user sends this message, the callback function will let the kernel further complete these operations.

[0117] 2) Zero-copy communication

[0118] To avoid data copying between the kernel and user space, sk_buff (socket buffer) is a structure used for efficient data transmission, which carries the buffer for network data. Through the zero-copy mechanism, no memory copying is performed during the data transmission process: memory mapping (mmap) is used to directly share memory between the user state and the kernel state to avoid the overhead of data replication. The transfer of sk_buff uses the kernel's sk_buff data structure to avoid data copying from the kernel space to the user space. To further optimize performance, techniques such as SO_REUSEPORT (i.e., allowing multiple processes or threads to bind to the same IP and port) or multiplexing can be used to improve the concurrent processing ability.

[0119] The transfer of sk_buff mainly uses the pointer of this structure in the kernel for transfer. For security, techniques including but not limited to RCU locks and mutex locks can be used.

[0120] 3) Support for parallel operations

[0121] To process concurrent messages in a multi-core environment, the network defense method of this application uses lockless queues (such as spinlock or rcu) to ensure thread safety during concurrent data access. Independent message queues are allocated on multiple processing cores to reduce competition between different threads. For atomic operations, data consistency is guaranteed to avoid race conditions due to multi-threaded concurrency. In addition, the tasklet or workqueue mechanism can be combined to schedule the processing of messages at an appropriate time.

[0122] (4) Black Hole Routing and Rate Limiting Policy Module: After an attack is detected, it automatically issues black hole routing or traffic rate limiting policies at the kernel level through Generic Netlink communication to suppress attack traffic. The black hole routing guides the attack traffic to a "black hole" to ensure that the attack traffic does not affect normal business traffic; the rate limiting policy limits the traffic rate, effectively controlling the attack traffic and reducing the network load.

[0123] (5) Policy Adjustment and Feedback Mechanism: After the protection policy takes effect, the system continuously monitors the network status and dynamically adjusts the protection policy according to the changes in attack traffic. If the attack ends, the system will revoke the black hole routing or rate limiting policy and restore the normal traffic state of the network.

[0124] The advantages of the network defense method of this application are as follows:

[0125] (1) Real-time Response: Through the asynchronous communication mechanism based on the Generic Netlink protocol, the defense policy can be quickly triggered within 200 ms, greatly shortening the defense response time.

[0126] (2) Automatic Repair: It can automatically identify the characteristics of network attacks and automatically issue black hole routing or rate limiting policies, avoiding manual intervention and improving the intelligence and automation of the system.

[0127] (3) Efficient Network Repair: Through rapid routing adjustment at the kernel level, the losses caused by network attacks are reduced, and the continuity and stability of network services can be ensured.

[0128] (4) Scalability: It is extended based on the existing Generic Netlink protocol, with good compatibility and flexibility, facilitating docking with switch platforms of different manufacturers and being applicable to various switch chip environments.

[0129] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the network defense method of this application. Based on this technical concept, more forms of simple transformations are within the protection scope of this application.

[0130] This application also provides a network defense device. Please refer to Figure 5 , and the network defense device includes:

[0131] The Oscillation Detection Module 10 is used to judge whether there is malicious oscillation in the routing network according to at least one of the routing change information of the Border Gateway Protocol, the time window threshold, and the routing update frequency threshold;

[0132] The Attack Detection Module 20 is used to analyze the current traffic characteristics through an attack detection model to judge whether there is a distributed denial-of-service attack behavior in the routing network;

[0133] The traffic rate limiting module 30 is configured to respond to the malicious oscillation and limit the current network traffic according to the malicious oscillation characteristics.

[0134] And / or, the black hole routing module 40 is configured to respond to the attack behavior and direct the attack traffic of the attack behavior to the black hole address based on the extracted attack characteristics.

[0135] The network defense device provided by the present application adopts the network defense method in the above embodiment, and can solve the technical problem of untimely defense response in the prior art. Compared with the prior art, the beneficial effects of the network defense device provided by the present application are the same as those of the network defense method provided by the above embodiment, and other technical features in the network defense device are the same as those disclosed in the method of the above embodiment, and will not be elaborated here.

[0136] The present application provides a network defense device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein, the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the network defense method in the first embodiment above.

[0137] Next, refer to Figure 6 , which shows a schematic structural diagram of a network defense device suitable for implementing the embodiments of the present application. The network defense device in the embodiments of the present application may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Desctions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The network defense device shown is only an example and should not impose any limitations on the functions and usage scopes of the embodiments of the present application.

[0138] As Figure 6As shown, the network defense device may include a processing device 1001 (such as a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in the read-only memory 1002 or a program loaded from the storage device 1003 into the random access memory 1004. In the random access memory 1004, various programs and data required for the operation of the network defense device are also stored. The processing device 1001, the read-only memory 1002, and the random access memory 1004 are connected to each other through a bus 1005. The input / output interface 1006 is also connected to the bus. Generally, the following systems can be connected to the input / output interface 1006: an input device 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the network defense device to communicate with other devices wirelessly or wiredly to exchange data. Although the figure shows a network defense device with various systems, it should be understood that it is not required to implement or have all the shown systems. Instead, more or fewer systems can be implemented or had.

[0139] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program codes for executing the methods shown in the flowcharts. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device, or installed from the storage device 1003, or installed from the read-only memory 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the methods of the embodiments disclosed in the present application are executed.

[0140] The network defense device provided by the present application adopts the network defense method in the above-mentioned embodiment, and can solve the technical problem of untimely defense response in the prior art. Compared with the prior art, the beneficial effects of the network defense device provided by the present application are the same as those of the network defense method provided by the above-mentioned embodiment, and other technical features in the network defense device are the same as those disclosed in the method of the previous embodiment, and will not be elaborated here.

[0141] It should be understood that each part disclosed in the present application can be implemented by hardware, software, firmware, or a combination of them. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in a suitable manner in any one or more embodiments or examples.

[0142] As described above, it is only the specific implementation manner of the present application. However, the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present application can easily think of changes or substitutions, which should all be covered within the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

[0143] The present application provides a computer-readable storage medium having computer-readable program instructions (i.e., computer programs) stored thereon, and the computer-readable program instructions are used to execute the network defense method in the above embodiments.

[0144] The computer-readable storage medium provided by the present application can be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM) or flash memory, optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In this embodiment, the computer-readable storage medium can be any tangible medium that contains or stores a program, and the program can be used by or in combination with an instruction execution system or device. The program code contained on the computer-readable storage medium can be transmitted by any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0145] The above computer-readable storage medium can be included in a network defense device; or it can exist alone without being assembled into the network defense device.

[0146] The above computer-readable storage medium carries one or more programs, which, when executed by a network defense device, cause the network defense device to: determine whether there is malicious oscillation in the routing network according to at least one of the routing change information of the Border Gateway Protocol, the time window threshold, and the routing update frequency threshold, analyze the current traffic characteristics through an attack detection model to determine whether there is a distributed denial-of-service attack behavior in the routing network, in response to the malicious oscillation, limit the speed of the current network traffic according to the malicious oscillation characteristics, and / or, in response to the attack behavior, direct the attack traffic of the attack behavior to a black hole address based on the extracted attack characteristics.

[0147] Computer program code for performing the operations of the present application may be written in one or more programming languages or combinations thereof. The programming languages include object-oriented programming languages such as Java, Smalltalk, C++, and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, executed as a stand-alone software package, partially on the user's computer and partially on a remote computer, executed entirely on a remote computer or server, or executed on an ARM (Advanced RISC Machines) development board. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (for example, by connecting through an Internet service provider using the Internet).

[0148] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code that contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than marked in the accompanying drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, may be implemented by a dedicated hardware-based system for performing the specified functions or operations, or may be implemented by a combination of dedicated hardware and computer instructions.

[0149] The modules involved in the embodiments of the present application can be implemented in software or in hardware. In some cases, the name of the module does not constitute a limitation on the unit itself.

[0150] The readable storage medium provided by the present application is a computer-readable storage medium. The computer-readable storage medium stores computer-readable program instructions (i.e., computer programs) for executing the above network defense method, which can solve the technical problem of untimely defense response in the prior art. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as those of the network defense method provided by the above embodiments, and will not be elaborated here.

[0151] The present application also provides a computer program product, including a computer program, and the steps of the network defense method as described above are implemented when the computer program is executed by a processor.

[0152] The computer program product provided by the present application can solve the technical problem of untimely defense response in the prior art. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as those of the network defense method provided by the above embodiments, and will not be elaborated here.

[0153] The above are only some embodiments of the present application, and do not limit the patent scope of the present application. Any equivalent structural transformation made by using the description and drawings of the present application under the technical concept of the present application, or direct / indirect application in other related technical fields, is included in the patent protection scope of the present application.

Claims

1. A network defense method, characterized in that, The method includes the following steps: Judging whether there is malicious oscillation in the routing network according to at least one of the routing change information of the Border Gateway Protocol, the time window threshold, and the routing update frequency threshold; Analyzing the current traffic characteristics through an attack detection model to judge whether there is a distributed denial of service attack behavior in the routing network; In response to the malicious oscillation, rate-limiting the current network traffic according to the malicious oscillation characteristics; And / or, in response to the attack behavior, guiding the attack traffic of the attack behavior to a black hole address based on the extracted attack characteristics.

2. The network defense method according to claim 1, characterized in that, The step of, in response to the malicious oscillation, rate-limiting the current network traffic according to the malicious oscillation characteristics includes: In response to the malicious oscillation, determining a rate-limiting event according to the malicious oscillation characteristics of the malicious oscillation, and initializing a protocol family and a callback function based on the rate-limiting event; Constructing a secure communication channel between the user mode and the kernel mode through a lock-free queue algorithm; Based on the protocol family and the secure communication channel, creating a memory mapping shared area by sharing the rate-limiting event between the user mode and the kernel mode; In the memory mapping shared area, generating a corresponding rate-limiting instruction according to the malicious oscillation characteristics; When rate-limiting the current network traffic according to the rate-limiting instruction, adjusting the rate-limiting instruction by triggering the callback function until the routing network state returns to normal.

3. The network defense method according to claim 2, wherein The step of constructing a secure communication channel between the user mode and the kernel mode through a lock-free queue algorithm includes: Initializing the communication interface between the user mode and the kernel mode through a lock-free queue algorithm according to the communication requirements of the protocol family to obtain a lock-free communication framework; Based on the lock-free communication framework, managing the transmission process of the rate-limiting event by using atomic operation instructions and a double-buffer switching strategy to obtain a secure communication channel between the user mode and the kernel mode, wherein the atomic operation instructions synchronously update the read and write pointers of the rate-limiting event, and the double-buffer switching strategy switches the data storage area when detecting buffer overflow.

4. The network defense method according to any one of claims 1 to 3, characterized in that, The step of, in response to the attack behavior, guiding the attack traffic of the attack behavior to a black hole address based on the extracted attack characteristics includes: In response to the attack behavior, determining black hole routing parameters according to the extracted attack characteristics, and encapsulating the black hole routing parameters into a black hole routing policy; Based on the black hole routing policy, forming a traffic discard rule by registering a black hole routing entry of the target address in the routing table; According to the traffic discard rule, establishing a mapping relationship table between the attack characteristics and the black hole address in the memory mapping shared area to generate a real-time traffic filtering policy; Guiding the attack traffic of the attack behavior to a black hole address through the real-time traffic filtering policy.

5. The network defense method according to any one of claims 1 to 3, characterized in that The step of judging whether there is malicious oscillation in the routing network according to at least one of the routing change information of the Border Gateway Protocol, the time window threshold, and the routing update frequency threshold includes: Real-time collecting the routing change information of the Border Gateway Protocol; Counting the cumulative number of routing updates within the time window in the routing change information, and determining that there is malicious oscillation in the routing network when the cumulative number of updates exceeds the time window threshold; Determine the actual frequency of routing updates within a unit of time. When the actual frequency continuously exceeds the frequency threshold, it is determined that there is malicious oscillation in the routing network; Analyze the distribution law of the Internet protocol address segments of routing changes. When periodic out-of-range routing changes are detected through the distribution law, it is determined that there is malicious oscillation in the routing network.

6. The network defense method according to any one of claims 1 to 3, characterized in that The step of analyzing the current traffic characteristics through an attack detection model to determine whether there is a distributed denial-of-service attack behavior in the routing network includes: Obtain network traffic in real time, and extract the current traffic characteristics from the network traffic, where the current traffic characteristics include at least one of the synchronous sequence number request frequency, source address distribution entropy value, and traffic peak deviation degree; Map the current traffic characteristics to a quantum state through a quantum encoding circuit to obtain quantum entanglement characteristics; Concatenate the quantum entanglement characteristics with the current traffic characteristics to generate a hybrid feature; Input the hybrid feature into an attack detection model pre-trained based on a neural ordinary differential equation network, and output an attack probability score by solving the neural ordinary differential equation within a preset time window; When the attack probability score exceeds the score threshold, it is determined that there is a distributed denial-of-service attack behavior in the routing network, where the score threshold is updated according to the Hurst exponent of the network traffic.

7. A network defense device, characterized in that, The network defense device includes: An oscillation detection module for determining whether there is malicious oscillation in the routing network according to at least one of the routing change information of the border gateway protocol, the time window threshold, and the routing update frequency threshold; An attack detection module for analyzing the current traffic characteristics through an attack detection model to determine whether there is a distributed denial-of-service attack behavior in the routing network; A traffic rate limiting module for, in response to the malicious oscillation, limiting the current network traffic according to the malicious oscillation characteristics; And / or, a black hole routing module for, in response to the attack behavior, guiding the attack traffic of the attack behavior to a black hole address based on the extracted attack characteristics.

8. A network defense device, characterized in that, The network defense device includes: a memory, a processor, and a network defense program stored on the memory and executable on the processor. When the network defense program is executed by the processor, it implements the network defense method according to any one of claims 1 to 6.

9. A storage medium, characterized in that, A network defense program is stored on the storage medium. When the network defense program is executed by a processor, it implements the network defense method according to any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program. When the computer program is executed by a processor, it implements the steps of the network defense method according to any one of claims 1 to 6.

Images