A method and system for determining service forwarding sources

Abstract

The application discloses a method and system for determining the source of service forwarding, which comprises the following steps: grabbing a plurality of first data packets from a first network link; grabbing a plurality of second data packets from a second network link; finding at least one first data packet and at least one second data packet with the same destination port of access; performing time matching on the at least one first data packet and the at least one second data packet; and determining that the second data packet is a first server forwarding an access request to a second server after receiving the access request from a client, if the time relationship between the at least one second data packet and the at least one first data packet has a sequence and meets a predetermined condition. The application solves the problem that a network security device cannot determine the source of an access request when a server forwards the access request to another server in the prior art, thereby determining the source of service forwarding and providing a basis for taking security measures.

Description

Technical Field

[0001] The present application relates to the field of networks, and in particular to a method and system for determining a service forwarding source. Background Art

[0002] In network technology, ports include two types: logical ports and physical ports. A physical port is an interface used to connect physical devices, such as an ADSL modem, hub, switch, or router, which is used to connect to other network devices, such as an RJ-45 port or SC port. A logical port is a port used to logically distinguish services, such as port 80 for web browsing services and port 21 for FTP services. For example, the service port in the TCP / IP protocol uses different logical ports to distinguish different services. The ports of an IP address are numbered using 16 bits, and there can be up to 65,536 ports. Ports are marked by port numbers, which are integers ranging from 0 to 65,535.

[0003] The primary function of a port number is to identify the service provided by a specific process on a computer. Computers on a network are identified by their IP addresses, which uniquely identify a specific computer. However, a single computer can simultaneously provide many services, such as database services, FTP services, and Web services. Port numbers are used to distinguish these different services provided by the same computer. For example, the common port number 21 represents FTP services, port 23 represents Telnet services, and port 25 represents SMTP services. Port numbers are generally 4-digit integers and cannot be repeated on the same computer; otherwise, port number conflicts will occur.

[0004] The port address in both TCP and UDP segment structures is 16 bits, and can have a port number in the range of 0 to 65535. The following rules apply to the use of these 65536 port numbers:

[0005] (1) Port numbers less than 256 are defined as common ports, and servers are generally identified by common port numbers. Any service provided by a TCP / IP implementation uses port numbers between 1 and 1023, which are managed by ICANN. Port numbers from 1024 to 49151 are registered ports, also known as "user ports," and are designated by IANA for use by special services.

[0006] (2) The client only needs to ensure that the port number is unique on the local machine. The client port number is also called a temporary port number because it exists for a very short time.

[0007] (3) Most TCP / IP implementations assign temporary port numbers between 1024 and 5000. Port numbers greater than 5000 are reserved for other servers.

[0008] Figure 1 It is a schematic diagram of providing network services based on devices in related technologies, such as Figure 1 As shown in the figure, the device provides service A through port (PORT) 80, service B through port 443, and service C through ports 81 and 521. This device can also be called a server (first server). Clients can obtain different services by accessing different ports. It should be noted that the computing resources of a device are limited. When the number of clients accessing services A, B or C is too large, the device may not be able to provide the corresponding services. In this case, the device will divert the access. The second server can also provide service A. Figure 1 In the example, service AA is shown, and the third server can provide server B. Figure 1 It is displayed as service BB. Figure 1 In the example, the first server diverts the access, so the first server records which accesses are diverted to the second server and the third server.

[0009] To improve network security, network security devices can monitor network traffic. For a network link from a client to a first server, data packets can be captured to determine which clients accessed which servers within the first server. These records can be used to implement security measures. However, if the first server forwards client requests to a second or third server, the network security device monitoring the traffic will only indicate that these requests were from the first server to the second or third server, without being able to determine the source of these requests, hindering the implementation of network measures. Summary of the Invention

[0010] The embodiments of the present application provide a method and system for determining the source of service forwarding, so as to at least solve the problem in the related art that a network security device cannot determine the source of an access request when a server forwards an access request to another server.

[0011] According to one aspect of the present application, a method for determining the source of service forwarding is provided, comprising: capturing multiple first data packets from a first network link, wherein the first network link is a link between a client and a first server; capturing multiple second data packets from a second network link, wherein the second network link is a link between the first server and at least one second server, the second server provides the same service as the first server, and the second server is used to provide load balancing for the first server; matching the multiple first data packets with the multiple second data packets, and searching for at least one first data packet and at least one second data packet with the same access destination port; time matching the at least one first data packet and the at least one second data packet; and determining that the second data packet is the first server forwarding the access request from the client to the second server, when the time relationship between the at least one second data packet and the at least one first data packet is a chronological relationship and meets predetermined conditions.

[0012] According to another aspect of the present application, a system for determining the source of service forwarding is also provided, including: a first capture module for capturing multiple first data packets from a first network link, wherein the first network link is a link between a client and a first server; a second capture module for capturing multiple second data packets from a second network link, wherein the second network link is a link between the first server and at least one second server, the second server provides the same service as the first server, and the second server is used to provide load balancing for the first server; a first matching module for matching the multiple first data packets and the multiple second data packets, and finding at least one first data packet and at least one second data packet with the same access destination port; a second matching module for time matching the at least one first data packet and the at least one second data packet; a processing module for determining that the second data packet is the first server forwarding the access request from the client to the second server after receiving the access request.

[0013] In an embodiment of the present application, a plurality of first data packets are captured from a first network link, wherein the first network link is a link between a client and a first server; a plurality of second data packets are captured from a second network link, wherein the second network link is a link between the first server and at least one second server, the second server provides the same service as the first server, and the second server is used to provide load balancing for the first server; the plurality of first data packets and the plurality of second data packets are matched, and at least one first data packet and at least one second data packet with the same access destination port are found; the at least one first data packet and the at least one second data packet are time matched; when the time relationship between the at least one second data packet and the at least one first data packet exists in a sequential relationship and meets a predetermined condition, it is determined that the second data packet is the first server after receiving the access request from the client, and forwarding the access request to the second server. This application solves the problem in the related art that the network security device cannot determine the source of the access request when a server forwards the access request to another server, thereby being able to determine the source of the service forwarding, providing a basis for the adoption of security measures. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0015] Figure 1 It is a schematic diagram of providing network services according to a device in the related art;

[0016] Figure 2 This is a flowchart of a method for determining a service forwarding source according to an embodiment of the present application. DETAILED DESCRIPTION

[0017] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0018] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0019] exist Figure 1In the network structure shown, the network security device captures the data packets accessing the second server. From the IP address of the source of the data packets, it can distinguish whether these data packets come directly from the client or from the first server. For the data packets from the first server, the network security device has no way to determine the true source client. Although the first server saves the corresponding forwarding records, the network security device cannot obtain these forwarding records. To solve this problem, a method for determining the source of service forwarding is provided in this embodiment. Figure 2 is a flow chart of a method for determining a service forwarding source according to an embodiment of the present application. Figure 2 As shown below, Figure 2 The steps involved in the method are described.

[0020] Step S202: Capture a plurality of first data packets from a first network link, wherein the first network link is a link between a client and a first server.

[0021] Step S204, capturing multiple second data packets from a second network link, wherein the second network link is a link between the first server and at least one second server, the second server provides the same service as the first server, and the second server is used to provide load balancing for the first server.

[0022] Step S206: Match the multiple first data packets and the multiple second data packets to find at least one first data packet and at least one second data packet that have the same access destination port.

[0023] Step S208: Time-matching the at least one first data packet and the at least one second data packet.

[0024] Step S210, when there is a time relationship between the at least one second data packet and the at least one first data packet and meets a predetermined condition, it is determined that the second data packet is the first server forwarding the access request to the second server after receiving the access request from the client.

[0025] As an example, after determining that the first server forwards the access request to the second server, all forwarding behaviors of the first server within a predetermined time period are counted. If the number of forwarding times within the predetermined time period exceeds a threshold, it is determined that the load of the first server exceeds expectations, and a message is sent to the management device, wherein the message is used to indicate the expansion of the computing resources provided by the first server.

[0026] As another example, it is also determined in step S210 that the second network link is established by the first server in order to forward the request from the client and receive the response data packet in response to the request, and an association relationship is established between the second network link and the first network link, wherein the association relationship is used to indicate that the requests received by the second server through the second network link are all from the client that established the first network connection.

[0027] As another example, after establishing the association relationship, network security rules are obtained and matched with the association relationship, wherein the IP address and port number of the client in the association relationship are used as source information, and the IP address and port number of the second server in the association relationship are used as destination information, and the source information and the destination information are matched with the network security rules; if the match is successful, the complete network rule is executed.

[0028] There are many ways to enforce network security rules. For example, the complete network rules can be sent to a firewall device to which the first and second servers are connected, and the firewall device enforces the network security rules. Alternatively, the network security rules can be sent directly to the first or second server, and the first or second server enforces the rules.

[0029] The above-mentioned network security rules can be generated in a variety of ways. For example, (a1) based on deep packet parsing, the data packet information transmitted in the network is collected through a data collector and stored in a data storage component so that the learning engine can query the data; (a2) the security rule learning engine analyzes the packet information and generates security rules. In step (a1), deep packet parsing refers to extracting key information from the original data packet through analysis. This packet information includes the source address, destination address, network protocol name, port number, and data details of the data packet. In step (a1), the data collection methods include collecting data through security protection devices in the network, monitoring network switches, and utilizing the user device's own log information. In step (a2), during the security rule learning process, the user can manually or automatically classify the devices, and the learning engine learns security rules based on the device categories to control the number of security rule items and shorten the security rule learning time. In step (a2), during the security rule learning process, the user can define network behavior modules according to their own needs, or automatically classify different network behaviors into certain behavior modules through machine learning methods. In step (a3), for data packets that do not comply with all security rules, the learning engine defines default response measures. These response measures can be for all devices and network protocols, or for certain devices or network protocols. When the protection device does not find any matching rules, the data packet is processed according to the default response measures.

[0030] It should be noted that, unless otherwise specified, the examples in this embodiment can be used in combination.

[0031] There are many methods for determining the time relationship. For example, determining that the time relationship between the at least one second data packet and the at least one first data packet is sequential and meets a predetermined condition includes:

[0032] Determine the service type accessed by the at least one first data packet and the at least one second data packet based on the destination port numbers of the at least one first data packet and the at least one second data packet; determine a timeout period for providing the service based on the service type, wherein the timeout period is the longest response time of the service of the service type after receiving a request; if the difference between the time when the at least one second data packet is sent from the first server and the time when the at least one first data packet is received by the first server is within the timeout period, determine that the time relationship between the at least one second data packet and the at least one first data packet is a chronological relationship and meets a predetermined condition.

[0033] The at least one first data packet is a data packet sent by the client to the first server, the at least one second data packet is a data packet sent by the first server to the second server, and the at least one first data packet and the at least one second data packet are both request data packets for requesting services.

[0034] For another example, determining that the time relationship between the at least one second data packet and the at least one first data packet is sequential and meets a predetermined condition includes:

[0035] Determine the service type accessed by the at least one first data packet and the at least one second data packet based on the destination port numbers of the at least one first data packet and the at least one second data packet; determine the forwarding time of the service based on the service type, wherein the forwarding time is the maximum time for the service of the service type to be forwarded to the requesting party after receiving the response data packet; if the difference between the time when the at least one second data packet is received by the first server and the time when the first server sends the at least one first data packet to the client is within the forwarding time, it is determined that the time relationship between the at least one second data packet and the at least one first data packet is in a chronological relationship and meets the predetermined conditions.

[0036] The at least one second data packet is a data packet sent by the second server to the first server, the at least one first data packet is a data packet sent by the first server to the client, and the at least one first data packet and the at least one second data packet are both response data packets in response to the request data packet.

[0037] The above steps solve the problem in the related art that when a server forwards an access request to another server, the network security device cannot determine the source of the access request, thereby being able to determine the source of the service forwarding, providing a basis for taking security measures.

[0038] The steps in the above embodiment can be performed by a network security device, which can be of various types. For example, the network security device can be an IP hardware firewall. The IP hardware firewall can implement the following security processing strategies. Of course, these security processing strategies are examples, and different security processing strategies can also be used.

[0039] For example, step one is to deploy a no-IP hardware firewall: connect the no-IP hardware firewall directly in series in front of the protected device so that all data packets sent to the protected device pass through the no-IP hardware firewall; step two, the no-IP hardware firewall obtains all network data packets transmitted through it, parses each obtained network data packet, and obtains the source IP address, source port, destination port, destination IP address, transmission protocol type and data payload of each network data packet; step three, realize the rapid networking and security rule configuration of the no-IP hardware firewall: step four, the current no-IP hardware firewall matches the protocol header and payload of each parsed network data packet according to the preset rules to determine whether each network data packet is a malicious data packet; step five, if the network data packet is determined to be a malicious data packet, execute step six, otherwise execute step seven, and determine the next processing action based on the matching result; step six, the current no-IP hardware firewall blocks the network data packet, prevents it from entering and exiting the network, and then jumps to execute step eight; step seven, allows the network data packet to pass, and releases the data packets determined to be normal to enter and exit; step eight, continuously monitors the network data packet and repeats the logical process of steps four to seven.

[0040] The rapid networking and security rule configuration of the non-IP hardware firewall also includes: if the current non-IP hardware firewall can identify and process the detection data packet to form a normal network, it will feedback the networking information to the security control perception cloud platform, feedback success, and mark the networking successful; if the current non-IP hardware firewall cannot receive the networking data packet, the current non-IP hardware firewall broadcasts the networking request data packet on the network. When other IP hardware firewalls intercept the networking request data packet, they send a special networking data packet to the device connected in series with the current non-IP hardware firewall. The current non-IP hardware firewall intercepts the special networking data packet for analysis and processing to form a normal network. At this time, it sends a temporary rule request data packet to the other non-IP hardware firewalls. When the other IP hardware firewalls intercept the temporary rule request data packet, they send a temporary security rule configuration data packet to the device connected in series with the current non-IP hardware firewall. The current non-IP hardware firewall intercepts the temporary security rule configuration data packet for analysis and processing to obtain temporary security rules, and when the security control perception cloud platform is back online, it sends a detection data packet. The current IP hardware firewall feedbacks, marking the networking successful, and the security control perception cloud platform re-issues the security rule configuration data to implement the current IP hardware firewall configuration.

[0041] The current non-IP hardware firewall matches the protocol header and payload of each parsed network packet according to preset rules. Determining whether each network packet is a malicious packet also includes: determining whether the protocol header and payload of each parsed network packet comply with the preset rules. If so, the network packet is determined to be non-malicious. If not, the network packet is blocked. If it does not comply with the preset rules, after blocking the network packet, the current non-IP hardware firewall also includes: simultaneously enabling a virtualized environment, identifying attack behavior characteristics based on a preset attack behavior feature library, uploading the packet to the security management and perception cloud platform for cloud threat analysis when an attack is identified, and issuing a security update policy based on the analysis results. Step 5: If the network packet is determined to be a malicious packet, execute step 6; otherwise, execute step 7. The subsequent processing action determined based on the matching results also includes: if the network packet is not determined to be a malicious packet, perform authentication simultaneously. If authentication succeeds, execute step 7; if authentication fails, execute step 6.

[0042] Authentication includes at least location-based authentication. In response to a service request message sent by a first IoT device, a second non-IP hardware firewall connected in series with a second IoT device intercepts first location feature information in the service request message. The non-IP hardware firewall requests a list of reliable IoT devices from the security management and control perception cloud platform. In response to the non-IP hardware firewall sending a security request message to an IoT device in the reliable IoT device list, the non-IP hardware firewall identifies a third IoT device and receives at least second location feature information sent by the third IoT device via the corresponding third non-IP firewall. The first location feature information and the second location feature information are compared, and if they meet a judgment rule, the first IoT device is securely authenticated. The location feature information includes at least location parameter information, which is obtained by a positioning chip mounted on the non-IP hardware firewall or the IoT device. The location parameter information includes at least code pseudorange, carrier phase value, satellite number, Doppler, signal strength, signal-to-noise ratio, and observation time.

[0043] The judgment rules specifically include: step 1; obtaining the positioning observation information in the first position feature information; step 2; establishing an exclusionary condition. If the positioning observation information in the first position feature information includes an exclusionary element, it does not comply with the judgment rule. If it does not include it, execute the following steps; step 3: establishing a first multidimensional matrix and a second multidimensional matrix respectively according to the positioning observation information in the first position feature information and the positioning observation information in the second position feature information, and determining the cosine similarity between the two. When it is greater than the threshold, it is considered to comply with the judgment rule; establishing the exclusionary condition specifically includes: the positioning observation information in the first position feature information is abnormal, the positioning observation information in the first position feature information conflicts with the positioning observation information in the second position feature information, and the positioning observation information in the first position feature information does not comply with at least one of the constraints formed by the positioning observation information in the second position feature information combined with the built-in digital surface model of the no-IP firewall.

[0044] In this embodiment, an electronic device is provided, including a memory and a processor. The memory stores a computer program, and the processor is configured to run the computer program to execute the method in the above embodiment.

[0045] The above program can be executed in a processor or stored in a memory (or computer-readable medium). Computer-readable media includes both permanent and non-permanent, removable and non-removable media, and can be implemented using any method or technology for information storage. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0046] These computer programs can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps of the functions specified in one or more blocks can be implemented by different modules corresponding to different steps.

[0047] In this embodiment, such a device or system is provided. The system is called a system for determining the source of service forwarding, comprising: a first capture module for capturing multiple first data packets from a first network link, wherein the first network link is a link between a client and a first server; a second capture module for capturing multiple second data packets from a second network link, wherein the second network link is a link between the first server and at least one second server, the second server providing the same service as the first server, and the second server providing load balancing for the first server; a first matching module for matching the multiple first data packets with the multiple second data packets, and finding at least one first data packet and at least one second data packet with the same access destination port; a second matching module for time matching the at least one first data packet with the at least one second data packet; a processing module for determining that the second data packet is the first server forwarding the access request from the client to the second server after receiving the access request.

[0048] The system or device is used to implement the functions of the method in the above-mentioned embodiment. Each module in the system or device corresponds to each step in the method, which has been explained in the method and will not be repeated here.

[0049] Optionally, the processing module is used to: determine the service type accessed by the at least one first data packet and the at least one second data packet based on the destination port numbers of the at least one first data packet and the at least one second data packet; determine a timeout period for providing the service based on the service type, wherein the timeout period is the longest response time of the service of the service type after receiving a request; if the difference between the time when the at least one second data packet is sent from the first server and the time when the at least one first data packet is received by the first server is within the timeout period, it is determined that the time relationship between the at least one second data packet and the at least one first data packet is in a chronological relationship and meets a predetermined condition.

[0050] Optionally, the processing module is used to: determine the service type accessed by the at least one first data packet and the at least one second data packet based on the destination port numbers of the at least one first data packet and the at least one second data packet; determine the forwarding time of the service based on the service type, wherein the forwarding time is the maximum time for the service of the service type to be forwarded to the requesting party after receiving the response data packet; if the difference between the time when the at least one second data packet is received by the first server and the time when the first server sends the at least one first data packet to the client is within the forwarding time, it is determined that the time relationship between the at least one second data packet and the at least one first data packet has a chronological relationship and meets the predetermined conditions.

[0051] The above implementation solves the problem in related technologies that when a server forwards an access request to another server, the network security device cannot determine the source of the access request, thereby being able to determine the source of the service forwarding, providing a basis for taking security measures.

[0052] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A method for determining a service forwarding source, characterized in that: include: Capturing a plurality of first data packets from a first network link, wherein the first network link is a link between a client and a first server; capturing a plurality of second data packets from a second network link, wherein the second network link is a link between the first server and at least one second server, the second server provides the same service as the first server, and the second server is used to provide load balancing for the first server; Match the multiple first data packets and the multiple second data packets, and search for at least one first data packet and at least one second data packet having the same access destination port; performing time matching on the at least one first data packet and the at least one second data packet; When there is a temporal relationship between the at least one second data packet and the at least one first data packet and meets predetermined conditions, it is determined that the second data packet is the first server forwarding the access request to the second server after receiving the access request from the client.

2. The method according to claim 1, characterized in that Determining that a temporal relationship between the at least one second data packet and the at least one first data packet exists in a sequential relationship and meets a predetermined condition includes: Determining the service type accessed by the first data packet and the second data packet according to the destination port numbers of the at least one first data packet and the at least one second data packet; Determine a timeout period for providing a service according to the service type, wherein the timeout period is the longest response time of the service of the service type after receiving a request; If the time difference between the time when the at least one second data packet is sent from the first server and the time when the at least one first data packet is received by the first server is within the timeout period, it is determined that the time relationship between the at least one second data packet and the at least one first data packet is a chronological relationship and meets the predetermined conditions.

3. The method according to claim 2, characterized in that The at least one first data packet is a data packet sent by the client to the first server, the at least one second data packet is a data packet sent by the first server to the second server, and the at least one first data packet and the at least one second data packet are both request data packets for requesting services.

4. The method according to claim 1, wherein Determining that a temporal relationship between the at least one second data packet and the at least one first data packet exists in a sequential relationship and meets a predetermined condition includes: Determining the service type accessed by the first data packet and the second data packet according to the destination port numbers of the at least one first data packet and the at least one second data packet; Determine a forwarding time of a service according to the service type, wherein the forwarding time is the maximum time for a service of the service type to forward a response data packet to the requester after receiving the response data packet; If the difference between the time when the at least one second data packet is received by the first server and the time when the first server sends the at least one first data packet to the client is within the forwarding time, it is determined that the time relationship between the at least one second data packet and the at least one first data packet is a chronological relationship and meets the predetermined conditions.

5. The method according to claim 4, characterized in that The at least one second data packet is a data packet sent by the second server to the first server, the at least one first data packet is a data packet sent by the first server to the client, and the at least one first data packet and the at least one second data packet are both response data packets in response to the request data packet.

6. A system for determining the source of service forwarding, characterized in that: include: A first capture module is configured to capture a plurality of first data packets from a first network link, wherein the first network link is a link between a client and a first server; a second capture module, configured to capture a plurality of second data packets from a second network link, wherein the second network link is a link between the first server and at least one second server, the second server providing the same service as the first server, and the second server providing load balancing for the first server; a first matching module, configured to match the plurality of first data packets and the plurality of second data packets, and search for at least one first data packet and at least one second data packet having the same access destination port; A second matching module, configured to perform time matching on the at least one first data packet and the at least one second data packet; The processing module is used to determine that the second data packet is the first server forwarding the access request from the client to the second server after receiving the access request from the client, when the time relationship between the at least one second data packet and the at least one first data packet is a chronological relationship and meets predetermined conditions.

7. The system according to claim 6, characterized in that The processing module is used for: Determining the service type accessed by the first data packet and the second data packet according to the destination port numbers of the at least one first data packet and the at least one second data packet; Determine a timeout period for providing a service according to the service type, wherein the timeout period is the longest response time of the service of the service type after receiving a request; If the time difference between the time when the at least one second data packet is sent from the first server and the time when the at least one first data packet is received by the first server is within the timeout period, it is determined that the time relationship between the at least one second data packet and the at least one first data packet is a chronological relationship and meets the predetermined conditions.

8. The system according to claim 7, characterized in that The at least one first data packet is a data packet sent by the client to the first server, the at least one second data packet is a data packet sent by the first server to the second server, and the at least one first data packet and the at least one second data packet are both request data packets for requesting services.

9. The system according to claim 6, wherein: The processing module is used for: Determining the service type accessed by the first data packet and the second data packet according to the destination port numbers of the at least one first data packet and the at least one second data packet; Determine a forwarding time of a service according to the service type, wherein the forwarding time is the maximum time for a service of the service type to forward a response data packet to the requester after receiving the response data packet; If the difference between the time when the at least one second data packet is received by the first server and the time when the first server sends the at least one first data packet to the client is within the forwarding time, it is determined that the time relationship between the at least one second data packet and the at least one first data packet is a chronological relationship and meets the predetermined conditions.

10. The system according to claim 9, characterized in that The at least one second data packet is a data packet sent by the second server to the first server, the at least one first data packet is a data packet sent by the first server to the client, and the at least one first data packet and the at least one second data packet are both response data packets in response to the request data packet.

Images