A method, device and system for eliminating network storms

Abstract

The present disclosure relates to the technical field of network fault processing, in particular to a method, device and system for eliminating network storm, the method comprising: a first node adding corresponding storm labels to a plurality of service packets to be sent respectively, obtaining a plurality of corresponding storm packets, and sending the plurality of storm packets; a second node performing network storm elimination according to the type of the received storm packet and a pre-set storm elimination rule when judging that the storm packet is received; the storm elimination rule comprising: performing network storm elimination according to a strict storm elimination mode when the received storm packet is a strict time sequence type packet, and performing network storm elimination according to a relaxed storm elimination mode when the received storm packet is a non-strict time sequence type packet. The present disclosure can accurately eliminate repeated packets in network storm and quickly recover service faults caused by network storm.

Description

Technical Field

[0001] This disclosure relates to the field of network fault handling technology, specifically to a method, apparatus, and system for eliminating network storms. Background Technology

[0002] A network storm is characterized by a large number of duplicate packets appearing in the network. Network storms can be caused by several factors, including: 1. Inappropriate network loops; 2. Network equipment failure; and 3. Network attacks. These duplicate packets not only consume available network bandwidth but also increase the load on receiving device processors, leading to decreased network performance, network paralysis, loss of critical service frames, and in severe cases, network equipment malfunction. Because the causes of network storms are complex and difficult to completely eliminate, it is crucial to address how to mitigate a network storm after it occurs.

[0003] Traditional storm control involves pre-configuring the maximum bandwidth for broadcast, multicast, and unknown unicast traffic on the switch interface and comparing the current traffic speed with a pre-configured threshold. When the packet traffic speed reaches the upper limit threshold, the excess portion will be dropped until the traffic speed falls below the threshold, at which point normal operation will resume.

[0004] Traditional storm control methods have significant shortcomings. They merely address storms through bandwidth limiting, failing to fundamentally eliminate network storm problems. More seriously, this control method can lead to frame drops or out-of-order delivery in normal service traffic, negatively impacting not only normal service packets but also potentially disrupting other services. Furthermore, this mechanism places high demands on the switch's caching capabilities. Summary of the Invention

[0005] To address the problems in related technologies, embodiments of this disclosure provide a method, apparatus, and system for eliminating network storms.

[0006] In a first aspect, this disclosure provides a method for eliminating network storms, wherein the network includes multiple network nodes, and the network node in the network that first identifies storm traffic characteristics is designated as a first node, and network nodes subsequent to the first node are designated as second nodes; the method includes: The first node adds corresponding storm tags to the multiple service packets to be sent, obtains the corresponding multiple storm packets, and sends the multiple storm packets. The storm tag includes a flow identifier field and a sequence number field. Service packets with the same flow feature information have the same flow identifier field, and multiple service packets with the same flow identifier field have different sequence number fields. When the second node determines that a storm message has been received, it performs network storm elimination based on the message type of the received storm message and the pre-set storm elimination rules. The storm elimination rules include: when the received storm message is a strictly timed message, network storm elimination is performed according to the strict storm elimination mode; when the received storm message is a non-strictly timed message, network storm elimination is performed according to the lenient storm elimination mode. The strict storm elimination mode includes: parsing the currently received strict time-series message, determining whether the storm label carried by the currently received strict time-series message is consistent with the storm labels carried by all strict time-series messages received in the past; if so, discarding the currently received strict time-series message; otherwise, continuing to forward the currently received strict time-series message. The relaxed storm elimination mode includes: parsing the currently received non-strictly ordered packets, determining whether the storm label of the currently received non-strictly ordered packets is consistent with the storm label of the latest non-strictly ordered packets received in the historical time; if so, discarding the currently received non-strictly ordered packets; otherwise, continuing to forward the currently received non-strictly ordered packets.

[0007] According to embodiments of this disclosure: The network also includes a storm feature table, which includes multiple storm flow features; The network node identifies storm traffic characteristics and thus serves as the first node: When a network node determines that the packet traffic characteristics of a received service message match any of the storm traffic characteristics included in the storm characteristic table, it identifies the storm traffic characteristics.

[0008] According to embodiments of this disclosure, the storm label further includes a storm type field, wherein the storm type field is the same for multiple service packets located in a network.

[0009] According to an embodiment of this disclosure, the second node determines whether a storm message has been received by parsing whether the received service message carries a storm type field; If the received business message contains a storm type field, confirm that the storm message has been received; If the received business message does not carry a storm type field, it is confirmed that no storm message has been received.

[0010] According to embodiments of this disclosure, when the second node confirms that it has not received a storm message, it determines whether a network storm has formed at this node by identifying the message traffic within a set time window; When the packet traffic within the set time window exceeds the set traffic threshold, it is determined that a network storm has formed; If the packet traffic within the set time window is less than or equal to the set traffic threshold, it is determined that no network storm has formed.

[0011] According to an embodiment of this disclosure, when the second node confirms that it has not received a storm message and a network storm has formed, the second node discards service messages that exceed the set traffic threshold. Once the second node confirms that it has not received a storm message and that no network storm has formed, the second node continues to forward the received service messages.

[0012] According to embodiments of this disclosure, the method further includes: not performing the network storm elimination for multiple storm packets with different flow identifier fields in the storm labels they carry.

[0013] According to embodiments of this disclosure: The strictly timed message satisfies the following conditions: the message arrival order is the message sending order, and the message transmission delay is less than a set delay threshold. The non-strictly timed message refers to any service message other than the strictly timed message.

[0014] According to an embodiment of this disclosure, when the first node adds corresponding storm tags to multiple service messages to be sent, the storm tags are added between the virtual LAN tag field and the type length field of the corresponding service data frame, wherein the service data frame is obtained by encapsulating the service message.

[0015] According to embodiments of this disclosure, the second node includes a historical feature table, which includes multiple historical storm tags, wherein the historical storm tags are storm tags carried by storm messages received by the second node at historical times; the method further includes: After the second node determines that a storm message has been received, it determines whether the storm label carried by the received storm message is consistent with any of the multiple historical storm labels. If they match, the historical feature table remains unchanged; if they do not match, the storm tag carried by the received storm message is added to the historical feature table to update the historical feature table.

[0016] According to embodiments of this disclosure, the network further includes a monitoring server; the method further includes: The monitoring server counts the number of second nodes in the network that receive storm messages. When the number of second nodes receiving storm messages exceeds a set node number threshold, the network enters a strict network mode, which includes: the second nodes discarding service messages that exceed the set traffic threshold.

[0017] Secondly, embodiments of this disclosure provide a method for eliminating network storms, wherein the network includes multiple network nodes, and the network node in the network that first identifies storm traffic characteristics is designated as a first node, and network nodes subsequent to the first node are designated as second nodes; the method includes: The first node adds corresponding storm tags to multiple service packets to be sent, obtains multiple storm packets, and sends the multiple storm packets, thereby enabling the second node to perform network storm elimination based on the packet type of the storm packets received from the first node and the pre-set storm elimination rules; wherein, the storm tag includes a flow identifier field and a sequence number field, service packets with the same flow characteristic information have the same flow identifier field, and multiple service packets with the same flow identifier field have different sequence number fields; The storm elimination rules include: when the received storm message is a strictly timed message, network storm elimination is performed according to the strict storm elimination mode; when the received storm message is a non-strictly timed message, network storm elimination is performed according to the lenient storm elimination mode. The strict storm elimination mode includes: parsing the currently received strict time-series message, determining whether the storm label carried by the currently received strict time-series message is consistent with the storm labels carried by all strict time-series messages received in the past; if so, discarding the currently received strict time-series message; otherwise, continuing to forward the currently received strict time-series message. The relaxed storm elimination mode includes: parsing the currently received non-strictly ordered packets, determining whether the storm label of the currently received non-strictly ordered packets is consistent with the storm label of the latest non-strictly ordered packets received in the historical time; if so, discarding the currently received non-strictly ordered packets; otherwise, continuing to forward the currently received non-strictly ordered packets.

[0018] According to embodiments of this disclosure, the network further includes a storm feature table, which includes multiple storm flow features; the method further includes: When the first node determines that the message traffic characteristics of the received service message are consistent with any of the storm traffic characteristics included in the storm characteristic table, it determines that the storm traffic characteristics have been identified.

[0019] Thirdly, embodiments of this disclosure provide a method for eliminating network storms, wherein the network includes multiple network nodes, and the network node in the network that first identifies storm traffic characteristics is designated as a first node, and network nodes subsequent to the first node are designated as second nodes; the method includes: When the second node determines that a storm message has been received, it performs network storm elimination based on the message type of the received storm message and the pre-set storm elimination rules. The storm message is obtained by the first node by adding corresponding storm tags to multiple service messages to be sent. The storm tag includes a flow identifier field and a sequence number field. Service messages with the same flow characteristic information have the same flow identifier field, and multiple service messages with the same flow identifier field have different sequence number fields. The storm elimination rules include: when the received storm message is a strictly timed message, network storm elimination is performed according to the strict storm elimination mode; when the received storm message is a non-strictly timed message, network storm elimination is performed according to the lenient storm elimination mode. The strict storm elimination mode includes: parsing the currently received strict time-series message, determining whether the storm label carried by the currently received strict time-series message is consistent with the storm labels carried by all strict time-series messages received in the past; if so, discarding the currently received strict time-series message; otherwise, continuing to forward the currently received strict time-series message. The relaxed storm elimination mode includes: parsing the currently received non-strictly ordered packets, determining whether the storm label of the currently received non-strictly ordered packets is consistent with the storm label of the latest non-strictly ordered packets received in the historical time; if so, discarding the currently received non-strictly ordered packets; otherwise, continuing to forward the currently received non-strictly ordered packets.

[0020] According to an embodiment of this disclosure, the method further includes: when the second node confirms that no storm message has been received, it determines whether a network storm has formed by identifying the message traffic within a set time window; when the message traffic within the set time window exceeds a set traffic threshold, it determines that a network storm has formed; when the message traffic within the set time window is less than or equal to the set traffic threshold, it determines that a network storm has not formed.

[0021] Fourthly, this disclosure provides an apparatus for eliminating network storms, wherein the network includes multiple network nodes, and the network node in the network that first identifies storm traffic characteristics is designated as a first node, and the network nodes after the first node are designated as second nodes; the apparatus is disposed at the first node, and the apparatus includes: The tagging module is configured to add corresponding storm tags to multiple service packets to be sent, obtain multiple storm packets, and send the multiple storm packets, so that the second node can perform network storm elimination according to the packet type of the storm packets received from the first node and the pre-set storm elimination rules; wherein, the storm tag includes a flow identifier field and a sequence number field, service packets with the same flow characteristic information have the same flow identifier field, and multiple service packets with the same flow identifier field have different sequence number fields; The storm elimination rules include: when the received storm message is a strictly timed message, network storm elimination is performed according to the strict storm elimination mode; when the received storm message is a non-strictly timed message, network storm elimination is performed according to the lenient storm elimination mode. The strict storm elimination mode includes: parsing the currently received strict time-series message, determining whether the storm label carried by the currently received strict time-series message is consistent with the storm labels carried by all strict time-series messages received in the past; if so, discarding the currently received strict time-series message; otherwise, continuing to forward the currently received strict time-series message. The relaxed storm elimination mode includes: parsing the currently received non-strictly ordered packets, determining whether the storm label of the currently received non-strictly ordered packets is consistent with the storm label of the latest non-strictly ordered packets received in the historical time; if so, discarding the currently received non-strictly ordered packets; otherwise, continuing to forward the currently received non-strictly ordered packets.

[0022] According to embodiments of this disclosure, the network further includes a storm feature table, which includes multiple storm flow features; the device further includes a first identification module; The first identification module is configured to determine that a storm traffic feature is identified when the message traffic feature of the received service message is consistent with any storm traffic feature included in the storm feature table.

[0023] Fifthly, embodiments of this disclosure provide an apparatus for eliminating network storms, wherein the network includes multiple network nodes, and the network node in the network that first identifies storm traffic characteristics is designated as a first node, and the network nodes after the first node are designated as second nodes; the apparatus is disposed at the second node, and the apparatus includes: The network storm elimination module is configured to perform network storm elimination based on the message type of the received storm message and pre-set storm elimination rules when a storm message is received. The storm message is obtained by the first node by adding corresponding storm tags to multiple service messages to be sent. The storm tag includes a flow identifier field and a sequence number field. Service messages with the same flow characteristic information have the same flow identifier field, and multiple service messages with the same flow identifier field have different sequence number fields. The storm elimination rules include: when the received storm message is a strictly timed message, network storm elimination is performed according to the strict storm elimination mode; when the received storm message is a non-strictly timed message, network storm elimination is performed according to the lenient storm elimination mode. The strict storm elimination mode includes: parsing the currently received strict time-series message, determining whether the storm label carried by the currently received strict time-series message is consistent with the storm labels carried by all strict time-series messages received in the past; if so, discarding the currently received strict time-series message; otherwise, continuing to forward the currently received strict time-series message. The relaxed storm elimination mode includes: parsing the currently received non-strictly ordered packets, determining whether the storm label of the currently received non-strictly ordered packets is consistent with the storm label of the latest non-strictly ordered packets received in the historical time; if so, discarding the currently received non-strictly ordered packets; otherwise, continuing to forward the currently received non-strictly ordered packets.

[0024] According to embodiments of this disclosure, the apparatus further includes: a historical feature table storage module and a historical feature table maintenance module; The historical feature table storage module is configured to store a historical feature table, which includes multiple historical storm tags. The historical storm tags are storm tags carried by storm messages received by the second node at historical moments. The historical feature table maintenance module is configured to, after receiving a storm message, determine whether the storm tag carried by the received storm message is consistent with any of the multiple historical storm tags; if consistent, the historical feature table remains unchanged; if inconsistent, the storm tag carried by the received storm message is added to the historical feature table to update the historical feature table.

[0025] According to embodiments of this disclosure, the storm tag further includes a storm type field, wherein the storm type field of multiple service packets located in a network is the same, and the device further includes: a parsing and judgment module, configured to determine whether a storm packet has been received by parsing whether the received service packet carries a storm type field; wherein, if the received service packet carries a storm type field, it is confirmed that a storm packet has been received; if the received service packet does not carry a storm type field, it is confirmed that a storm packet has not been received.

[0026] According to embodiments of this disclosure, the device further includes: a second identification module; The second identification module is configured to determine whether a network storm has formed by identifying the packet traffic within a set time window when it is confirmed that no storm message has been received; to determine that a network storm has formed when the packet traffic within the set time window exceeds a set traffic threshold; and to determine that a network storm has not formed when the packet traffic within the set time window is less than or equal to the set traffic threshold.

[0027] In a sixth aspect, embodiments of this disclosure provide a network storm elimination system, the system including apparatus for eliminating network storms as described in any of the second aspects and apparatus for eliminating network storms as described in any of the third aspects.

[0028] In a seventh aspect, embodiments of this disclosure provide a computer-readable storage medium having computer instructions stored thereon that, when executed by a processor, implement the method as described in any of the first aspects.

[0029] Eighthly, embodiments of this disclosure provide a computer program product including computer instructions that, when executed by a processor, implement the method as described in any of the first aspects.

[0030] According to the technical solution provided in this disclosure, the network node that first identifies storm traffic characteristics in the network is designated as the first node. The first node adds corresponding storm tags to multiple service packets to be sent, and then sends the resulting multiple storm packets. The storm tag includes a flow identifier field and a sequence number field. When the second node determines that a storm packet has been received, it performs network storm elimination based on the packet type of the received storm packet and pre-set storm elimination rules. The storm elimination rules include: when the received storm packet is a strictly time-series packet, network storm elimination is performed according to a strict storm elimination mode; when the received storm packet is a non-strictly time-series packet, network storm elimination is performed according to a relaxed storm elimination mode.

[0031] This disclosure selects the network node that first identifies storm traffic characteristics as the first node, and has the first node tag the packets. This allows for the marking of service packets before a network storm actually forms, enabling the second node to accurately eliminate duplicate packets based on the identified different types of service packets. This reduces the probability of a network storm occurring before it forms, and allows for rapid recovery from service failures caused by a network storm without affecting the transmission of normal packets. This solves the problem of existing technologies that rely solely on traffic for service control, which can lead to frame drops or out-of-order delivery even for normal services. Furthermore, this disclosure allows for flexible adjustment of control strategies based on actual network operation and service requirements, achieving more refined security management.

[0032] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0033] Other features, objects, and advantages of this disclosure will become more apparent from the following detailed description of non-limiting embodiments, taken in conjunction with the accompanying drawings. In the drawings: Figure 1 A logic block diagram of a method for eliminating network storms according to an embodiment of the present disclosure is shown; Figure 2 A schematic diagram illustrating a network structure targeted by the method for eliminating network storms according to an embodiment of the present disclosure is shown. Figure 3 A schematic diagram illustrating another network structure targeted by the method for eliminating network storms according to embodiments of this disclosure; Figure 4 This diagram illustrates the addition of storm tags to service packets in a method for eliminating network storms according to an embodiment of the present disclosure; Figure 5 This diagram illustrates the composition of storm labels in a method for eliminating network storms according to an embodiment of the present disclosure; Figure 6 A complete flowchart of a method for eliminating network storms according to an embodiment of the present disclosure is shown; Figure 7 A logic block diagram is shown for another method of eliminating network storms according to an embodiment of the present disclosure; Figure 8 A logic block diagram is shown for yet another method of eliminating network storms according to an embodiment of the present disclosure; Figure 9 A schematic diagram of the structure of an apparatus for eliminating network storms according to an embodiment of the present disclosure is shown; Figure 10 A schematic diagram of the structure of another apparatus for eliminating network storms according to an embodiment of the present disclosure is shown. Detailed Implementation

[0034] In the following, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings to enable those skilled in the art to readily implement them. Furthermore, for clarity, portions unrelated to the description of exemplary embodiments have been omitted from the drawings.

[0035] In this disclosure, it should be understood that terms such as “comprising” or “having” are intended to indicate the presence of features, figures, steps, behaviors, components, parts or combinations thereof disclosed in this specification, and are not intended to exclude the possibility of the presence or addition of one or more other features, figures, steps, behaviors, components, parts or combinations thereof.

[0036] It should also be noted that, unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other. This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0037] In this disclosure, any operation involving the acquisition of user information or user data, or the display of user information or user data to others, is an operation authorized or confirmed by the user, or actively selected by the user.

[0038] The inventors noted that traditional methods of dealing with network storms solely through bandwidth limiting cannot fundamentally eliminate the problem. More seriously, this control method can lead to frame drops or out-of-order delivery of normal business traffic, negatively impacting not only normal business packets but also potentially disrupting other services. Furthermore, this mechanism places high demands on the switch's caching capabilities.

[0039] This disclosure provides a method for eliminating network storms, wherein the network includes multiple network nodes, and the network node in the network that first identifies storm traffic characteristics is designated as a first node, and network nodes after the first node are designated as second nodes; the method includes: The first node adds corresponding storm tags to the multiple service packets to be sent, obtains the corresponding multiple storm packets, and sends the multiple storm packets. The storm tag includes a flow identifier field and a sequence number field. Service packets with the same flow feature information have the same flow identifier field, and multiple service packets with the same flow identifier field have different sequence number fields. When the second node determines that a storm message has been received, it performs network storm elimination based on the message type of the received storm message and the pre-set storm elimination rules. The storm elimination rules include: when the received storm message is a strictly timed message, network storm elimination is performed according to the strict storm elimination mode; when the received storm message is a non-strictly timed message, network storm elimination is performed according to the lenient storm elimination mode. The strict storm elimination mode includes: parsing the currently received strict time-series message and determining whether the storm label carried by the currently received strict time-series message is consistent with the storm labels carried by all strict time-series messages received in the past; if so, discarding the currently received strict time-series message; otherwise, continuing to forward the currently received strict time-series message. The lenient storm elimination mode includes: parsing the currently received non-strict time-series message and determining whether the storm label of the currently received non-strict time-series message is consistent with the storm label of the latest non-strict time-series message received in the past; if so, discarding the currently received non-strict time-series message; otherwise, continuing to forward the currently received non-strict time-series message.

[0040] This disclosure enables the marking of service packets before a network storm actually forms. It can also accurately eliminate duplicate packets based on the identified different types of service packets, reducing the probability of a network storm occurring before one does. Furthermore, it can quickly recover from service failures caused by a network storm without affecting the transmission of normal packets. This disclosure also allows for flexible adjustment of control strategies based on actual network operation and service requirements, achieving more refined security management.

[0041] Figure 1 A logical block diagram of a method for eliminating network storms according to an embodiment of this disclosure is shown. Figure 1 As shown, the method includes the following steps S101~S102.

[0042] In this disclosure, the network can be any communication network, such as a wide area network, a local area network, a wireless communication network, a time-sensitive network, etc.

[0043] According to embodiments of this disclosure, the network includes multiple network nodes, wherein the network node that first identifies storm flow characteristics is designated as a first node, and network nodes subsequent to the first node are designated as second nodes. Therefore, the network includes one first node and at least one second node.

[0044] Specifically, the network nodes following the first node are the downstream nodes of the first node, determined according to the communication direction or data flow direction, and these downstream nodes communicate directly or indirectly with the first node.

[0045] Figure 2 This diagram illustrates a network structure targeted by the method for eliminating network storms according to an embodiment of this disclosure. Figure 2 As shown, the network contains a total of 8 network nodes. In this network, the first network node is the one that first identifies the storm flow characteristics, so this first network node is designated as the first node, and the downstream nodes of the first network node are designated as the second nodes. That is, the remaining 7 network nodes in the network, excluding the first node, are all second nodes.

[0046] Figure 3 A schematic diagram illustrating another network structure targeted by the method for eliminating network storms according to embodiments of this disclosure is shown. Similarly, as Figure 3 As shown, the network contains a total of 6 network nodes. In this network, the second network node is the first network node to identify the storm flow characteristics, so this second network node is regarded as the first node. After this second network node, there are 3 downstream nodes, which are regarded as the second nodes. Therefore, the network contains 3 second nodes.

[0047] Those skilled in the art should understand that the network structure can be arbitrary, and the network structure is not intended to limit the scope of protection of this disclosure.

[0048] According to embodiments of this disclosure, the network further includes a storm feature table, which includes multiple storm traffic features. These storm traffic features can be set according to actual needs, for example, they can be specified packet fields (fields of interest to the user) or specified IP addresses.

[0049] According to an embodiment of this disclosure, the network node identifies storm traffic characteristics and thus serves as the first node in the following manner: when the network node determines that the message traffic characteristics of the received service message are consistent with any storm traffic characteristics included in the storm characteristic table, it determines that a storm traffic characteristic has been identified.

[0050] In step S101, the first node adds corresponding storm tags to the multiple service packets to be sent, obtains the corresponding multiple storm packets, and sends the multiple storm packets. The storm tag includes a flow identifier field and a sequence number field. Service packets with the same flow feature information have the same flow identifier field, and multiple service packets with the same flow identifier field have different sequence number fields.

[0051] The service message can be of any type, such as video surveillance, video communication, remote surgery, file transfer, email, software update, etc. The flow characteristic information of the service message can be message field information, message quintuple information, etc.

[0052] Specifically, the first node adds corresponding storm tags to each of the multiple service packets queued for transmission in its sending queue. The storm tag includes a flow identifier field and a sequence number field. When adding storm tags to multiple service packets with the same flow characteristics, the flow identifier field of these multiple service packets with the same flow characteristics is identical. However, the sequence number fields of these multiple service packets with the same flow identifier field are different; that is, among the multiple service packets with the same flow characteristics, the sequence number field of each service packet is different.

[0053] After adding the corresponding storm tags, multiple storm messages can be obtained. The first node sends out these multiple storm messages, and subsequent second nodes will receive the storm messages through direct or indirect communication with the first node. (See reference...) Figure 2 or Figure 3 .

[0054] In step S102, when the second node determines that a storm message has been received, it performs network storm elimination based on the message type of the received storm message and the pre-set storm elimination rules.

[0055] In this disclosure, storm messages include two message types: strictly timed messages and non-strictly timed messages. Specifically, strictly timed messages meet the following conditions: the message arrival order is the same as the message sending order, and the message transmission delay is less than a set delay threshold. That is, for strictly timed messages, the message arrival order is the same as the message sending order, and the message transmission time is also shorter, less than the set delay threshold, which can be set as needed. Non-strictly timed messages are service messages other than strictly timed messages.

[0056] According to embodiments of this disclosure, the storm elimination rules include: when the received storm message is a strictly timed message, performing network storm elimination according to a strict storm elimination mode; and when the received storm message is a non-strictly timed message, performing network storm elimination according to a lenient storm elimination mode.

[0057] The strict storm elimination mode includes: parsing the currently received strict time-series message, determining whether the storm label carried by the currently received strict time-series message is consistent with the storm labels carried by all strict time-series messages received in the past; if so, discarding the currently received strict time-series message; otherwise, continuing to forward the currently received strict time-series message.

[0058] The relaxed storm elimination mode includes: parsing the currently received non-strictly ordered packets, determining whether the storm label of the currently received non-strictly ordered packets is consistent with the storm label of the latest non-strictly ordered packets received in the historical time; if so, discarding the currently received non-strictly ordered packets; otherwise, continuing to forward the currently received non-strictly ordered packets.

[0059] In detail, different storm elimination modes are adopted for different types of service messages. For strictly time-sequential messages, since they have high requirements for device hardware and buffering, such as notification service messages, a strict storm elimination mode is required for storm elimination. For non-strictly time-sequential messages, since the receiver is less sensitive to the sequence number or number of messages, a relaxed storm elimination mode can reduce bandwidth pressure and reduce the consumption of computing resources.

[0060] According to embodiments of this disclosure, the storm label further includes a storm type field, wherein the storm type field is the same for multiple service packets located in a network.

[0061] The second node determines whether a storm message has been received by parsing whether the received service message carries a storm type field. If the received service message carries a storm type field, it confirms that a storm message has been received; if the received service message does not carry a storm type field, it confirms that a storm message has not been received.

[0062] That is, after the second node receives the service message, it parses the service message and determines whether the message is a storm message by checking whether the message carries a storm type field.

[0063] Since the second node may connect to other network nodes in addition to the first node, it may also receive storm messages as well as messages sent by other network nodes. Therefore, after receiving a service message, the second node needs to determine whether the received service message is a storm message, and this can be done by parsing whether the service message carries a storm type field.

[0064] This disclosure enables the marking of service packets before a network storm actually forms, facilitating the accurate elimination of duplicate packets based on different packet types. This reduces the probability of a network storm occurring before it does and allows for rapid recovery from service failures caused by a storm, without affecting normal packet transmission. It solves the problem of existing technologies relying solely on traffic flow for service control, which can lead to frame drops or out-of-order delivery even for normal services.

[0065] Figure 4 This diagram illustrates the addition of storm tags to service packets in a method for eliminating network storms according to an embodiment of the present disclosure.

[0066] like Figure 4 As shown, when the first node adds corresponding storm tags to multiple service packets to be sent, the storm tag is added between the virtual LAN tag field and the type length field of the corresponding service data frame. The service data frame is obtained by encapsulating the service packet. In a specific embodiment, a service packet originally includes the following fields: destination MAC address field (6 bytes), source MAC address field (6 bytes), virtual LAN tag field (4 bytes), type length field (2 bytes), payload data, and frame check field (4 bytes). After adding the corresponding storm tag to the service packet, a corresponding storm tag (STORM TAG, 6 bytes) is added between the virtual LAN tag field and the type length field.

[0067] Figure 5 This diagram illustrates the composition of storm labels in a method for eliminating network storms according to an embodiment of the present disclosure.

[0068] exist Figure 5 In the specific embodiment shown, the storm label includes three fields: a storm type field (Type), a flow identifier field (Flow ID), and a sequence number field (Sequence Number). In one specific embodiment, the size of each of the three fields included in the storm label is 2 bytes.

[0069] The storm type field has a default value of 88FF, indicating that the message supports the storm label. This value can be modified, but the storm type field of each device within the same network should remain consistent.

[0070] For the flow identifier field, the flow identifier field of service messages with the same flow characteristic information is consistent.

[0071] For the sequence number field, even service packets with the same flow identifier field will have different sequence number fields. Furthermore, if a second node receives two storm packets with the same flow identifier field and the same sequence number field, it indicates that the node received duplicate storm packets. For multiple storm packets with different flow identifier fields in their storm labels, no network storm cancellation is performed.

[0072] Furthermore, when the second node confirms that no storm message has been received, it determines whether a network storm has formed by identifying the message traffic within a set time window; when the message traffic within the set time window exceeds a set traffic threshold, it is determined that a network storm has formed; when the message traffic within the set time window is less than or equal to the set traffic threshold, it is determined that a network storm has not formed.

[0073] Furthermore, when the second node confirms that it has not received a storm message and a network storm has formed, the second node discards service messages that exceed the set traffic threshold; when the second node confirms that it has not received a storm message and a network storm has not formed, the second node continues to forward the received service messages.

[0074] To further improve the effectiveness of network storm elimination, when the second node does not receive a storm message, it can be determined whether a network storm has formed on the second node by setting a time window and a traffic threshold, and further processing can be carried out based on whether a network storm has formed.

[0075] The packet traffic within the set time window refers to the number of packets transmitted by the second node within that time window. The set time window is configured based on the node's device performance and processing capabilities. For example, for low-performance devices with limited computing power, the set time window should not be too short (e.g., ≥1 second), while for high-performance devices, millisecond-level windows are supported.

[0076] According to an embodiment of this disclosure, the second node includes a historical feature table, which includes multiple historical storm tags, wherein the historical storm tags are storm tags carried by storm messages received by the second node at historical times.

[0077] In this disclosure, each of the plurality of second nodes maintains a historical feature table to record the storm tag information carried in storm messages received by that node at historical moments.

[0078] According to an embodiment of this disclosure, after the second node determines that it has received a storm message, it determines whether the storm tag carried by the received storm message is consistent with any of the multiple historical storm tags; if consistent, the historical feature table remains unchanged; if inconsistent, the storm tag carried by the received storm message is added to the historical feature table to update the historical feature table.

[0079] According to an embodiment of this disclosure, the network also includes a monitoring server. The monitoring server counts the number of second nodes in the network that receive storm packets; when the number of second nodes receiving storm packets exceeds a set node number threshold, the network enters a strict network mode, which includes: the second nodes discarding service packets that exceed the set traffic threshold.

[0080] By monitoring the number of second-level nodes receiving storm packets in a network using a monitoring server, if the number exceeds a set threshold, it indicates that the network storm has reached a significant scale, potentially indicating malicious attacks or virus propagation. In this case, the network needs to enter strict network mode, where all second-level nodes must drop service packets exceeding the set traffic threshold.

[0081] Therefore, this disclosure not only solves the problem that the existing technology relies solely on traffic for service control, which may lead to frame loss or out-of-order delivery even for normal services, but also allows for flexible adjustment of control strategies based on the actual network operation and service requirements, thereby achieving more refined security management.

[0082] The method for eliminating cyber storms disclosed herein will be described below with a specific embodiment.

[0083] Figure 6 A complete flowchart of a method for eliminating network storms according to an embodiment of the present disclosure is shown.

[0084] like Figure 6 As shown, the first node adds corresponding storm tags to the multiple service messages to be sent, thereby obtaining multiple storm messages, and then sends the multiple storm messages.

[0085] After receiving a service message, the second node determines whether it has received a storm message by parsing whether the received service message carries a storm type field.

[0086] When the second node determines that no storm message has been received, it determines whether a network storm has formed by identifying the message traffic within a set time window. If the message traffic within the set time window exceeds a set traffic threshold, a network storm is determined to have formed, and messages exceeding the set traffic threshold are discarded. If the message traffic within the set time window is less than or equal to the set traffic threshold, a network storm is determined not to have formed, and forwarding is then performed.

[0087] After the second node confirms that a storm message has been received, it determines the corresponding storm elimination rule based on the message type of the storm message received from the first node. Specifically, when the received storm message is a strictly timed message, network storm elimination is performed according to the strict storm elimination mode; when the received storm message is a non-strictly timed message, network storm elimination is performed according to the lenient storm elimination mode.

[0088] The strict storm elimination mode includes: parsing the currently received strict time-series message, determining whether the storm label carried by the currently received strict time-series message is consistent with the storm label carried by a strict time-series message received at a historical time; if so, discarding the currently received strict time-series message; otherwise, continuing to forward the currently received strict time-series message. The relaxed storm elimination mode includes: parsing the currently received non-strictly ordered packets and determining whether the storm label of the currently received non-strictly ordered packets is consistent with the storm label of the previously received non-strictly ordered packets; if so, discarding the currently received non-strictly ordered packets; otherwise, continuing to forward the currently received non-strictly ordered packets.

[0089] Figure 7 A logic block diagram of another method for eliminating network storms according to an embodiment of the present disclosure is shown. The method includes step S701.

[0090] In step S701, the first node adds corresponding storm tags to the multiple service packets to be sent, obtains the corresponding multiple storm packets, and sends the multiple storm packets, so that the second node can perform network storm elimination according to the packet type of the storm packets received from the first node and the pre-set storm elimination rules; wherein, the storm tag includes a flow identifier field and a sequence number field, service packets with the same flow characteristic information have the same flow identifier field, and multiple service packets with the same flow identifier field have different sequence number fields.

[0091] The storm elimination rules include: when the received storm message is a strictly timed message, network storm elimination is performed according to the strict storm elimination mode; when the received storm message is a non-strictly timed message, network storm elimination is performed according to the lenient storm elimination mode. The strict storm elimination mode includes: parsing the currently received strict time-series message, determining whether the storm label carried by the currently received strict time-series message is consistent with the storm labels carried by all strict time-series messages received in the past; if so, discarding the currently received strict time-series message; otherwise, continuing to forward the currently received strict time-series message. The relaxed storm elimination mode includes: parsing the currently received non-strictly ordered packets, determining whether the storm label of the currently received non-strictly ordered packets is consistent with the storm label of the latest non-strictly ordered packets received in the historical time; if so, discarding the currently received non-strictly ordered packets; otherwise, continuing to forward the currently received non-strictly ordered packets.

[0092] According to an embodiment of this disclosure, the network further includes a storm feature table, which includes multiple storm traffic features; the method further includes: when the first node determines that the message traffic feature of the received service message is consistent with any storm traffic feature included in the storm feature table, it determines that a storm traffic feature has been identified.

[0093] Figure 8 A logic block diagram of another method for eliminating network storms according to an embodiment of the present disclosure is shown. The method includes step S801.

[0094] In step S801, when the second node determines that a storm message has been received, it performs network storm elimination according to the message type of the received storm message and the pre-set storm elimination rules. The storm message is obtained by the first node by adding corresponding storm tags to multiple service messages to be sent. The storm tag includes a flow identifier field and a sequence number field. Service messages with the same flow characteristic information have the same flow identifier field, and multiple service messages with the same flow identifier field have different sequence number fields.

[0095] The storm elimination rules include: when the received storm message is a strictly timed message, network storm elimination is performed according to the strict storm elimination mode; when the received storm message is a non-strictly timed message, network storm elimination is performed according to the lenient storm elimination mode. The strict storm elimination mode includes: parsing the currently received strict time-series message, determining whether the storm label carried by the currently received strict time-series message is consistent with the storm labels carried by all strict time-series messages received in the past; if so, discarding the currently received strict time-series message; otherwise, continuing to forward the currently received strict time-series message. The relaxed storm elimination mode includes: parsing the currently received non-strictly ordered packets, determining whether the storm label of the currently received non-strictly ordered packets is consistent with the storm label of the latest non-strictly ordered packets received in the historical time; if so, discarding the currently received non-strictly ordered packets; otherwise, continuing to forward the currently received non-strictly ordered packets.

[0096] Figure 9 This diagram illustrates a structural schematic of an apparatus for eliminating network storms according to an embodiment of the present disclosure. The apparatus can be implemented as part or all of an electronic device through software, hardware, or a combination of both. Figure 9 As shown, the device 900 includes a marking module 910 and a first identification module 920.

[0097] In this disclosure, the network includes multiple network nodes, with the network node that first identifies storm flow characteristics in the network designated as the first node, and the network nodes after the first node designated as the second nodes, and the device disposed at the first node; the network also includes a storm characteristic table, which includes multiple storm flow characteristics.

[0098] The tagging module 910 is configured to add corresponding storm tags to multiple service packets to be sent, obtain multiple corresponding storm packets, and send the multiple storm packets, so that the second node can perform network storm elimination according to the packet type of the storm packets received from the first node and the pre-set storm elimination rules; wherein, the storm tag includes a flow identifier field and a sequence number field, service packets with the same flow characteristic information have the same flow identifier field, and multiple service packets with the same flow identifier field have different sequence number fields.

[0099] According to embodiments of this disclosure, the storm elimination rules include: when the received storm message is a strictly timed message, performing network storm elimination according to a strict storm elimination mode; and when the received storm message is a non-strictly timed message, performing network storm elimination according to a lenient storm elimination mode.

[0100] The strict storm elimination mode includes: parsing the currently received strict time-series message, determining whether the storm label carried by the currently received strict time-series message is consistent with the storm labels carried by all strict time-series messages received in the past; if so, discarding the currently received strict time-series message; otherwise, continuing to forward the currently received strict time-series message. The relaxed storm elimination mode includes: parsing the currently received non-strictly ordered packets, determining whether the storm label of the currently received non-strictly ordered packets is consistent with the storm label of the latest non-strictly ordered packets received in the historical time; if so, discarding the currently received non-strictly ordered packets; otherwise, continuing to forward the currently received non-strictly ordered packets.

[0101] The first identification module 920 is configured to determine that a storm flow feature is identified when the message flow feature of the received service message is consistent with any storm flow feature included in the storm feature table.

[0102] This disclosure enables the differentiation of different business messages and the precise filtering of duplicate messages by tagging business messages.

[0103] Figure 10 A schematic diagram of another apparatus for eliminating network storms according to an embodiment of this disclosure is shown. This apparatus can be implemented as part or all of an electronic device through software, hardware, or a combination of both. Figure 10 As shown, the device 1000 includes a network storm elimination module 1010, a historical feature table storage module 1020, a historical feature table maintenance module 1030, a parsing and judgment module 1040, and a second identification module 1050.

[0104] In this disclosure, the network includes multiple network nodes, wherein the network node that first identifies storm flow characteristics in the network is designated as the first node, and the network nodes that communicate with the first node after the first node are designated as the second nodes.

[0105] The network storm elimination module 1010 is configured to perform network storm elimination based on the message type of the received storm message and pre-set storm elimination rules when it is determined that a storm message has been received. The storm message is obtained by the first node by adding corresponding storm tags to multiple service messages to be sent. The storm tag includes a flow identifier field and a sequence number field. Service messages with the same flow characteristic information have the same flow identifier field, and multiple service messages with the same flow identifier field have different sequence number fields.

[0106] The storm elimination rules include: when the received storm message is a strictly timed message, network storm elimination is performed according to the strict storm elimination mode; when the received storm message is a non-strictly timed message, network storm elimination is performed according to the lenient storm elimination mode. The strict storm elimination mode includes: parsing the currently received strict time-series message, determining whether the storm label carried by the currently received strict time-series message is consistent with the storm labels carried by all strict time-series messages received in the past; if so, discarding the currently received strict time-series message; otherwise, continuing to forward the currently received strict time-series message. The relaxed storm elimination mode includes: parsing the currently received non-strictly ordered packets, determining whether the storm label of the currently received non-strictly ordered packets is consistent with the storm label of the latest non-strictly ordered packets received in the historical time; if so, discarding the currently received non-strictly ordered packets; otherwise, continuing to forward the currently received non-strictly ordered packets.

[0107] The historical feature table storage module 1020 is configured to store a historical feature table, which includes multiple historical storm tags. The historical storm tags are storm tags carried by storm messages received by the second node at historical moments.

[0108] The historical feature table maintenance module 1030 is configured to, after determining that a storm message has been received, determine whether the storm tag carried by the received storm message is consistent with any of the multiple historical storm tags; if consistent, then the historical feature table remains unchanged; if not, then the storm tag carried by the received storm message is added to the historical feature table to update the historical feature table.

[0109] According to embodiments of this disclosure, the storm label further includes a storm type field, wherein the storm type field is the same for multiple service packets located in a network.

[0110] The parsing and judgment module 1040 is configured to determine whether a storm message has been received by parsing whether the received service message carries a storm type field; wherein, if the received service message carries a storm type field, it is confirmed that a storm message has been received; if the received service message does not carry a storm type field, it is confirmed that a storm message has not been received.

[0111] The second identification module 1050 is configured to determine whether a network storm has formed by identifying the packet traffic within a set time window when it is confirmed that no storm message has been received; to determine that a network storm has formed when the packet traffic within the set time window exceeds a set traffic threshold; and to determine that no network storm has formed when the packet traffic within the set time window is less than or equal to the set traffic threshold.

[0112] This disclosure not only allows for the selection of appropriate storm suppression methods for different types of messages, but also enables flexible adjustment of control strategies based on the actual network operation and business needs.

[0113] This disclosure also discloses a network storm elimination system, the system including apparatus for eliminating network storms as described in any of the preceding embodiments.

[0114] In particular, according to embodiments of this disclosure, the methods described above can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program containing program code for performing the methods described above. In such embodiments, the computer program can be downloaded and installed from a network via a communication component, and / or installed from a removable medium.

[0115] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0116] The units or modules described in the embodiments of this disclosure can be implemented in software or programmable hardware. The described units or modules can also be located in a processor, and the names of these units or modules do not necessarily constitute a limitation on the unit or module itself.

[0117] In another aspect, this disclosure also provides a computer-readable storage medium, which may be a computer-readable storage medium included in the electronic device or computer system described above; or it may be a standalone computer-readable storage medium not assembled into a device. The computer-readable storage medium stores one or more programs, which are used by one or more processors to perform the methods described in this disclosure.

[0118] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

Claims

1. A method for eliminating cyber storms, characterized in that, The network includes multiple network nodes, wherein the network node that first identifies storm flow characteristics is designated as the first node, and network nodes subsequent to the first node are designated as second nodes; the method includes: The first node adds corresponding storm tags to the multiple service packets to be sent, obtains the corresponding multiple storm packets, and sends the multiple storm packets. The storm tag includes a flow identifier field and a sequence number field. Service packets with the same flow feature information have the same flow identifier field, and multiple service packets with the same flow identifier field have different sequence number fields. When the second node determines that a storm message has been received, it performs network storm elimination based on the message type of the received storm message and the pre-set storm elimination rules. The storm elimination rules include: when the received storm message is a strictly timed message, network storm elimination is performed according to the strict storm elimination mode; when the received storm message is a non-strictly timed message, network storm elimination is performed according to the lenient storm elimination mode. The strict storm elimination mode includes: parsing the currently received strict time-series message, determining whether the storm label carried by the currently received strict time-series message is consistent with the storm labels carried by all strict time-series messages received in the past; if so, discarding the currently received strict time-series message; otherwise, continuing to forward the currently received strict time-series message. The relaxed storm elimination mode includes: parsing the currently received non-strictly ordered packets, determining whether the storm label of the currently received non-strictly ordered packets is consistent with the storm label of the latest non-strictly ordered packets received in the historical time; if so, discarding the currently received non-strictly ordered packets; otherwise, continuing to forward the currently received non-strictly ordered packets.

2. The method according to claim 1, characterized in that: The network also includes a storm feature table, which includes multiple storm flow features; The network node identifies storm traffic characteristics and thus serves as the first node: When a network node determines that the packet traffic characteristics of a received service message match any of the storm traffic characteristics included in the storm characteristic table, it identifies the storm traffic characteristics.

3. The method according to claim 1, characterized in that, The storm label also includes a storm type field, wherein the storm type field is the same for multiple service packets located in a network.

4. The method according to claim 3, characterized in that, The second node determines whether a storm message has been received by parsing whether the received service message carries a storm type field; If the received business message contains a storm type field, confirm that the storm message has been received; If the received business message does not carry a storm type field, it is confirmed that no storm message has been received.

5. The method according to claim 4, characterized in that, When the second node confirms that it has not received a storm message, it determines whether a network storm has formed at this node by identifying the message traffic within a set time window. When the packet traffic within the set time window exceeds the set traffic threshold, it is determined that a network storm has formed; If the packet traffic within the set time window is less than or equal to the set traffic threshold, it is determined that no network storm has formed.

6. The method according to claim 5, characterized in that: When the second node confirms that it has not received a storm message and a network storm has formed, the second node discards service messages that exceed the set traffic threshold. Once the second node confirms that it has not received a storm message and that no network storm has formed, the second node continues to forward the received service messages.

7. The method according to claim 1, characterized in that, The method further includes: for multiple storm packets with different flow identifier fields in the storm labels they carry, the network storm elimination is not performed.

8. The method according to claim 1, characterized in that: The strictly timed message satisfies the following conditions: the message arrival order is the message sending order, and the message transmission delay is less than a set delay threshold. The non-strictly timed message refers to any service message other than the strictly timed message.

9. The method according to claim 1, characterized in that, When the first node adds corresponding storm tags to multiple service messages to be sent, the storm tags are added between the virtual LAN tag field and the type length field of the corresponding service data frame, wherein the service data frame is obtained by encapsulating the service message.

10. The method according to claim 1, characterized in that, The second node includes a historical feature table, which includes multiple historical storm tags, wherein the historical storm tags are storm tags carried by storm messages received by the second node at historical times; the method further includes: After the second node determines that a storm message has been received, it determines whether the storm label carried by the received storm message is consistent with any of the multiple historical storm labels. If they match, the historical feature table remains unchanged; if they do not match, the storm tag carried by the received storm message is added to the historical feature table to update the historical feature table.

11. The method according to claim 1, characterized in that, The network also includes a monitoring server; the method further includes: The monitoring server counts the number of second nodes in the network that receive storm messages. When the number of second nodes receiving storm messages exceeds a set node number threshold, the network enters a strict network mode, which includes: the second nodes discarding service messages that exceed a set traffic threshold.

12. A method for eliminating cyber storms, characterized in that, The network includes multiple network nodes, wherein the network node that first identifies storm flow characteristics is designated as the first node, and network nodes subsequent to the first node are designated as second nodes; the method includes: The first node adds corresponding storm tags to multiple service packets to be sent, obtains multiple storm packets, and sends the multiple storm packets, thereby enabling the second node to perform network storm elimination based on the packet type of the storm packets received from the first node and the pre-set storm elimination rules; wherein, the storm tag includes a flow identifier field and a sequence number field, service packets with the same flow characteristic information have the same flow identifier field, and multiple service packets with the same flow identifier field have different sequence number fields; The storm elimination rules include: when the received storm message is a strictly timed message, network storm elimination is performed according to the strict storm elimination mode; when the received storm message is a non-strictly timed message, network storm elimination is performed according to the lenient storm elimination mode. The strict storm elimination mode includes: parsing the currently received strict time-series message, determining whether the storm label carried by the currently received strict time-series message is consistent with the storm labels carried by all strict time-series messages received in the past; if so, discarding the currently received strict time-series message; otherwise, continuing to forward the currently received strict time-series message. The relaxed storm elimination mode includes: parsing the currently received non-strictly ordered packets, determining whether the storm label of the currently received non-strictly ordered packets is consistent with the storm label of the latest non-strictly ordered packets received in the historical time; if so, discarding the currently received non-strictly ordered packets; otherwise, continuing to forward the currently received non-strictly ordered packets.

13. The method according to claim 12, characterized in that, The network also includes a storm feature table, which includes multiple storm flow features; the method further includes: When the first node determines that the message traffic characteristics of the received service message are consistent with any of the storm traffic characteristics included in the storm characteristic table, it determines that the storm traffic characteristics have been identified.

14. A method for eliminating cyber storms, characterized in that, The network includes multiple network nodes, wherein the network node that first identifies storm flow characteristics is designated as the first node, and network nodes subsequent to the first node are designated as second nodes; the method includes: When the second node determines that a storm message has been received, it performs network storm elimination based on the message type of the received storm message and the pre-set storm elimination rules. The storm message is obtained by the first node by adding corresponding storm tags to multiple service messages to be sent. The storm tag includes a flow identifier field and a sequence number field. Service messages with the same flow characteristic information have the same flow identifier field, and multiple service messages with the same flow identifier field have different sequence number fields. The storm elimination rules include: when the received storm message is a strictly timed message, network storm elimination is performed according to the strict storm elimination mode; when the received storm message is a non-strictly timed message, network storm elimination is performed according to the lenient storm elimination mode. The strict storm elimination mode includes: parsing the currently received strict time-series message, determining whether the storm label carried by the currently received strict time-series message is consistent with the storm labels carried by all strict time-series messages received in the past; if so, discarding the currently received strict time-series message; otherwise, continuing to forward the currently received strict time-series message. The relaxed storm elimination mode includes: parsing the currently received non-strictly ordered packets, determining whether the storm label of the currently received non-strictly ordered packets is consistent with the storm label of the latest non-strictly ordered packets received in the historical time; if so, discarding the currently received non-strictly ordered packets; otherwise, continuing to forward the currently received non-strictly ordered packets.

15. The method according to claim 14, characterized in that, The method further includes: when the second node confirms that no storm message has been received, it determines whether a network storm has formed by identifying the message traffic within a set time window; when the message traffic within the set time window exceeds a set traffic threshold, it determines that a network storm has formed; when the message traffic within the set time window is less than or equal to the set traffic threshold, it determines that a network storm has not formed.

16. A device for eliminating network storms, characterized in that, The network includes multiple network nodes, wherein the network node that first identifies storm flow characteristics is designated as the first node, and network nodes subsequent to the first node are designated as second nodes; the device is disposed at the first node, and the device includes: The tagging module is configured to add corresponding storm tags to multiple service packets to be sent, obtain multiple storm packets, and send the multiple storm packets, so that the second node can perform network storm elimination according to the packet type of the storm packets received from the first node and the pre-set storm elimination rules; wherein, the storm tag includes a flow identifier field and a sequence number field, service packets with the same flow characteristic information have the same flow identifier field, and multiple service packets with the same flow identifier field have different sequence number fields; The storm elimination rules include: when the received storm message is a strictly timed message, network storm elimination is performed according to the strict storm elimination mode; when the received storm message is a non-strictly timed message, network storm elimination is performed according to the lenient storm elimination mode. The strict storm elimination mode includes: parsing the currently received strict time-series message, determining whether the storm label carried by the currently received strict time-series message is consistent with the storm labels carried by all strict time-series messages received in the past; if so, discarding the currently received strict time-series message; otherwise, continuing to forward the currently received strict time-series message. The relaxed storm elimination mode includes: parsing the currently received non-strictly ordered packets, determining whether the storm label of the currently received non-strictly ordered packets is consistent with the storm label of the latest non-strictly ordered packets received in the historical time; if so, discarding the currently received non-strictly ordered packets; otherwise, continuing to forward the currently received non-strictly ordered packets.

17. The apparatus according to claim 16, characterized in that, The network also includes a storm feature table, which includes multiple storm flow features; the device also includes a first identification module. The first identification module is configured to determine that a storm traffic feature is identified when the message traffic feature of the received service message is consistent with any storm traffic feature included in the storm feature table.

18. A device for eliminating network storms, characterized in that, The network includes multiple network nodes, wherein the network node that first identifies storm flow characteristics is designated as the first node, and network nodes subsequent to the first node are designated as second nodes; the device is disposed at the second node, and the device includes: The network storm elimination module is configured to perform network storm elimination based on the message type of the received storm message and pre-set storm elimination rules when a storm message is received. The storm message is obtained by the first node by adding corresponding storm tags to multiple service messages to be sent. The storm tag includes a flow identifier field and a sequence number field. Service messages with the same flow characteristic information have the same flow identifier field, and multiple service messages with the same flow identifier field have different sequence number fields. The storm elimination rules include: when the received storm message is a strictly timed message, network storm elimination is performed according to the strict storm elimination mode; when the received storm message is a non-strictly timed message, network storm elimination is performed according to the lenient storm elimination mode. The strict storm elimination mode includes: parsing the currently received strict time-series message, determining whether the storm label carried by the currently received strict time-series message is consistent with the storm labels carried by all strict time-series messages received in the past; if so, discarding the currently received strict time-series message; otherwise, continuing to forward the currently received strict time-series message. The relaxed storm elimination mode includes: parsing the currently received non-strictly ordered packets, determining whether the storm label of the currently received non-strictly ordered packets is consistent with the storm label of the latest non-strictly ordered packets received in the historical time; if so, discarding the currently received non-strictly ordered packets; otherwise, continuing to forward the currently received non-strictly ordered packets.

19. The apparatus according to claim 18, characterized in that, The device further includes: a historical feature table storage module and a historical feature table maintenance module; The historical feature table storage module is configured to store a historical feature table, which includes multiple historical storm tags. The historical storm tags are storm tags carried by storm messages received by the second node at historical moments. The historical feature table maintenance module is configured to, after receiving a storm message, determine whether the storm tag carried by the received storm message is consistent with any of the multiple historical storm tags; if consistent, the historical feature table remains unchanged; if inconsistent, the storm tag carried by the received storm message is added to the historical feature table to update the historical feature table.

20. The apparatus according to claim 18, characterized in that, The storm label also includes a storm type field, wherein multiple service packets located in a network have the same storm type field. The device further includes a parsing and judgment module, configured to determine whether a storm packet has been received by parsing whether the received service packet carries a storm type field; wherein, if the received service packet carries a storm type field, it is confirmed that a storm packet has been received; if the received service packet does not carry a storm type field, it is confirmed that a storm packet has not been received.

21. The apparatus according to claim 18, characterized in that, The device further includes: a second identification module; The second identification module is configured to determine whether a network storm has formed by identifying the packet traffic within a set time window when it is confirmed that no storm message has been received; to determine that a network storm has formed when the packet traffic within the set time window exceeds a set traffic threshold; and to determine that a network storm has not formed when the packet traffic within the set time window is less than or equal to the set traffic threshold.

22. A network storm elimination system, characterized in that, The system includes the apparatus for eliminating network storms as described in any one of claims 16-17 and the apparatus for eliminating network storms as described in any one of claims 18-21.

23. A computer-readable storage medium storing computer instructions thereon, characterized in that, When executed by a processor, the computer instructions implement the method described in any one of claims 1 to 15.

24. A computer program product comprising computer instructions, characterized in that, When executed by a processor, the computer instructions implement the method described in any one of claims 1 to 15.

Images